diff --git a/en_US.ISO8859-1/books/handbook/mail/chapter.sgml b/en_US.ISO8859-1/books/handbook/mail/chapter.sgml index 343e15fec4..0f5255d7aa 100644 --- a/en_US.ISO8859-1/books/handbook/mail/chapter.sgml +++ b/en_US.ISO8859-1/books/handbook/mail/chapter.sgml @@ -1,817 +1,819 @@ Bill Lloyd Original work by Jim Mock Rewritten by Electronic Mail Synopsis email electronic mail Electronic Mail, better known as email, is one of the most widely used forms of communication today. Millions of people use email every day, and chances are if you are reading this online, you fall into that category and probably even have more than one email address. Electronic Mail configuration is the subject of many System Administration books. If you plan on doing anything beyond setting up one mailhost for your network, you need industrial strength help. DNS Some parts of email configuration are controlled in the Domain Name System (DNS). If you are going to run your own DNS server, be sure to read through the files in /etc/namedb and man -k named. Using Electronic Mail POP IMAP There are five major parts involved in an email exchange. They are: the user program, the server daemon, DNS, a pop or IMAP daemon, and of course, the mailhost itself. The User Program This includes command line programs such as mutt, pine, elm, and mail, and GUI programs such as balsa, xfmail to name a few, and something more sophisticated like a WWW browser. These programs simply pass off the email transactions to the local mailhost, either by calling one of the server daemons available or delivering it over TCP. Mailhost Server Daemon mail server daemons sendmail mail server daemons postfix mail server daemons qmail mail server daemons exim This is usually sendmail (by default with FreeBSD) or one of the other mail server daemons such as qmail, postfix, or exim. There are others, but those are the most widely used. The server daemon usually has two functions—it looks after receiving incoming mail and delivers outgoing mail. It does not allow you to connect to it via POP or IMAP to read your mail. You need an additional daemon for that. Be aware that some older versions of sendmail have some serious security problems, however as long as you run a current version of it you should not have any problems. As always, it is a good idea to stay up-to-date with any software you run. Email and DNS The Domain Name System (DNS) and its daemon named play a large role in the delivery of email. In order to deliver mail from your site to another, the server daemon will look up the site in the DNS to determine the host that will receive mail for the destination. It works the same way when you have mail sent to you. The DNS contains the database mapping hostname to an IP address, and a hostname to mailhost. The IP address is specified in an A record. The MX (Mail eXchanger) record specifies the mailhost that will receive mail for you. If you do not have an MX record for your hostname, the mail will be delivered directly to your host. Receiving Mail email receiving Receiving mail for your domain is done by the mail host. It will collect mail sent to you and store it for reading or pickup. In order to pick the stored mail up, you will need to connect to the mail host. This is done by either using POP or IMAP. If you want to read mail directly on the mail host, then a POP or IMAP server is not needed. POP IMAP If you want to run a POP or IMAP server, there are two things you need to do: Get a POP or IMAP daemon from the ports collection and install it on your system. Modify /etc/inetd.conf to load the POP or IMAP server. The Mail Host mail host The mail host is the name given to a server that is responsible for delivering and receiving mail for your host, and possibly your network. Christopher Shumway Contributed by <application>sendmail</application> Configuration sendmail &man.sendmail.8; is the default Mail Transfer Agent (MTA) in FreeBSD. sendmail's job is to accept mail from Mail User Agents (MUA) and deliver it to the appropriate mailer as defined by its configuration file. sendmail can also accept network connections and deliver mail to local mailboxes or deliver it to another program. sendmail uses the following configuration files: /etc/mail/access /etc/mail/aliases /etc/mail/local-host-names /etc/mail/mailer.conf /etc/mail/mailertable /etc/mail/sendmail.cf /etc/mail/virtusertable Filename Function /etc/mail/access sendmail access database file /etc/mail/aliases Mailbox aliases /etc/mail/local-host-names Lists of hosts sendmail accepts mail for + /etc/mail/mailer.conf Mailer program configuration /etc/mail/mailertable Mailer delivery table /etc/mail/sendmail.cf sendmail master configuration file /etc/mail/virtusertable Virtual users and domain tables <filename>/etc/mail/access</filename> The access database defines what host(s) or IP addresses have access to the local mail server and what kind of access they have. Hosts can be listed as , , or simply passed to sendmail's error handling routine with a given mailer error. Hosts that are listed as , which is the default, are allowed to send mail to this host as long as the mail's final destination is the local machine. Hosts that are listed as are rejected for all mail connections. Hosts that have the option for their hostname are allowed to send mail for any destination through this mail server. Configuring the <application>sendmail</application> Access Database cyberspammer.com 550 We don't accept mail from spammers FREE.STEALTH.MAILER@ 550 We don't accept mail from spammers another.source.of.spam REJECT okay.cyberspammer.com OK 128.32 RELAY In this example we have five entries. Mail senders that match the left hand side of the table are affected by the action on the right side of the table. The first two examples give an error code to sendmail's error handling routine. The message is printed to the remote host when a mail matches the left hand side of the table. The next entry rejects mail from a specific host on the Internet, another.source.of.spam. The next entry accepts mail connections from a host okay.cyberspammer.com, which is more exact than the cyberspamer.com line above. More specific matches override less exact matches. The last entry allows relaying of electronic mail from hosts with an IP address that begins with 128.32. These hosts would be able to send mail through this mail server that are destined for other mail servers. When this file is updated, you need to run make in /etc/mail/ to update the database. <filename>/etc/mail/aliases</filename> The aliases database contains a list of virtual mailboxes that are expanded to other user(s), files, programs or other aliases. Here is a few examples that can be used in /etc/mail/aliases: Mail Aliases root: localuser ftp-bugs: joe,eric,paul bit.bucket: /dev/null procmail: "|/usr/local/bin/procmail" The aliases update matches the mailbox name on the left of the colon, and will expand it to the target(s) on the right. The first example simply expands the mailbox root to the mailbox localuser , which is then looked up again in the aliases database. If no match is found, then the message is delivered to the local user localuser. The next example shows a mail list. Mail to the mailbox ftp-bugs is expanded to the three local mailboxes joe, eric, and paul. Note that a remote mailbox could be specified as user@domain.com. The next example shows writing mail to a file, in this case /dev/null. The last example shows sending mail to a program, in this case the mail message is written to the standard input of /usr/local/bin/procmail through a Unix pipe. When this file is updated, you need to run make in /etc/mail/ to update the database. + <filename>/etc/mail/local-host-names</filename> This is a list of hostnames &man.sendmail.8; is to accept as the local host name. Place any domains or hosts that sendmail is to be receiving mail for. For example, if this mail server was to accept mail for the domain example.com and the host mail.example.com, its local-host-names might look something like this: example.com mail.example.com When this file is updated, &man.sendmail.8; needs to be restarted for it to read the changes. <filename>/etc/mail/mailer.conf</filename> The mailer.conf configuration file holds a table containing the real mailer that is used for the given action. Very old software programs would hard-code in the name and path to the mailer, /usr/sbin/sendmail, which meant they where incompatible with other mailers such as postfix. Today, /usr/sbin/sendmail is a wrapper that looks at /etc/mail/mailer.conf and executes the correct binary. When another mail transfer agent is installed on the system, mailer.conf should be updated to reflect the correct programs to execute. <filename>/etc/mail/sendmail.cf</filename> sendmail's master configuration file, sendmail.cf controls the overall behavior of sendmail. Everything from rewriting e-mail addresses to printing reject messages for remote mail servers. Naturally, with such a diverse role, this configuration file is quite complex and its details are a bit out of the scope of this chapter. Fortunately, this file rarely needs to be changed for standard mail servers. The master sendmail configuration file can be built from &man.m4.1; macros that define features and behavior of sendmail. Please see /usr/src/contrib/sendmail/cf/README for some of the details. When changes to this file are made, sendmail needs to be restarted for the changes to take effect. <filename>/etc/mail/virtusertable</filename> The virtualusertable maps mail for virtual domains and mailboxes to real mailboxes. These mail boxes can be local, remote, point to an alias defined in /etc/mail/aliases or to a file. Example Virtual Domain Mail Map root@example.com root postmaster@example.com postmaster@noc.example.net @example.com joe In the above example, we have a mapping for a domain example.com. This file is processed in a first match order down the file. The first item, maps root@example.com to the local mailbox root. The next entry maps postmaster@example.com to the mailbox postmaster on the host noc.example.net. Finally, if nothing from example.com has matched so far, it will match the last mapping, which matches every other mail message addressed to someone at example.com. This will be mapped to the local mail box joe. Troubleshooting email troubleshooting Why do I have to use the FQDN for hosts on my site? You will probably find that the host is actually in a different domain; for example, if you are in foo.bar.edu and you wish to reach a host called mumble in the bar.edu domain, you will have to refer to it by the fully-qualified domain name, mumble.bar.edu, instead of just mumble. BIND Traditionally, this was allowed by BSD BIND resolvers. However the current version of BIND that ships with FreeBSD no longer provides default abbreviations for non-fully qualified domain names other than the domain you are in. So an unqualified host mumble must either be found as mumble.foo.bar.edu, or it will be searched for in the root domain. This is different from the previous behavior, where the search continued across mumble.bar.edu, and mumble.edu. Have a look at RFC 1535 for why this was considered bad practice, or even a security hole. As a good workaround, you can place the line: search foo.bar.edu bar.edu instead of the previous: domain foo.bar.edu into your /etc/resolv.conf. However, make sure that the search order does not go beyond the boundary between local and public administration, as RFC 1535 calls it. sendmail says mail loops back to myself This is answered in the sendmail FAQ as follows: * I am getting Local configuration error messages, such as: 553 relay.domain.net config error: mail loops back to myself 554 <user@domain.net>... Local configuration error How can I solve this problem? You have asked mail to the domain (e.g., domain.net) to be forwarded to a specific host (in this case, relay.domain.net) by using an MX record, but the relay machine does not recognize itself as domain.net. Add domain.net to /etc/sendmail.cw (if you are using FEATURE(use_cw_file)) or add Cw domain.net to /etc/sendmail.cf. The sendmail FAQ is in /usr/src/usr.sbin/sendmail and is recommended reading if you want to do any tweaking of your mail setup. PPP How can I do email with a dial-up PPP host? You want to connect a FreeBSD box on a lan, to the Internet. The FreeBSD box will be a mail gateway for the lan. The PPP connection is non-dedicated. There are at least two ways to do this. UUCP The other is to use UUCP. The key is to get a Internet site to provide secondary MX service for your domain. For example: bigco.com. MX 10 bigco.com. MX 20 smalliap.com. Only one host should be specified as the final recipient (add Cw bigco.com in /etc/sendmail.cf on bigco.com). When the senders' sendmail is trying to deliver the mail it will try to connect to you over the modem link. It will most likely time out because you are not online. sendmail will automatically deliver it to the secondary MX site, i.e., your Internet provider. The secondary MX site will try every (sendmail_flags = -bd -q15m in /etc/rc.conf) 15 minutes to connect to your host to deliver the mail to the primary MX site. You might want to use something like this as a login script. #!/bin/sh # Put me in /usr/local/bin/pppbigco ( sleep 60 ; /usr/sbin/sendmail -q ) & /usr/sbin/ppp -direct pppbigco If you are going to create a separate login script for a user you could use sendmail -qRbigco.com instead in the script above. This will force all mail in your queue for bigco.com to be processed immediately. A further refinement of the situation is as follows. Message stolen from the &a.isp;. > we provide the secondary MX for a customer. The customer connects to > our services several times a day automatically to get the mails to > his primary MX (We do not call his site when a mail for his domains > arrived). Our sendmail sends the mailqueue every 30 minutes. At the > moment he has to stay 30 minutes online to be sure that all mail is > gone to the primary MX. > > Is there a command that would initiate sendmail to send all the mails > now? The user has not root-privileges on our machine of course. In the privacy flags section of sendmail.cf, there is a definition Opgoaway,restrictqrun Remove restrictqrun to allow non-root users to start the queue processing. You might also like to rearrange the MXs. We are the 1st MX for our customers like this, and we have defined: # If we are the best MX for a host, try directly instead of generating # local config error. OwTrue That way a remote site will deliver straight to you, without trying the customer connection. You then send to your customer. Only works for hosts, so you need to get your customer to name their mail machine customer.com as well as hostname.customer.com in the DNS. Just put an A record in the DNS for customer.com. Advanced Topics The following section covers more involved topics such as mail configuration and setting up mail for your entire domain. Basic Configuration email configuration Out of the box, you should be able to send email to external hosts as long as you have set up /etc/resolv.conf or are running your own name server. If you would like to have mail for your host delivered to that specific host, there are two methods: Run your own name server and have your own domain. For example, FreeBSD.org Get mail delivered directly to your host. This is done by delivering mail directly to the current DNS name for your machine. For example, example.FreeBSD.org. SMTP Regardless of which of the above you choose, in order to have mail delivered directly to your host, you must have a permanent (static) IP address (no dynamic PPP dial-up). If you are behind a firewall, it must pass SMTP traffic on to you. If you want to receive mail at your host itself, you need to be sure of one of two things: MX record Make sure that the MX record in your DNS points to your host's IP address. Make sure there is no MX entry in your DNS for your host. Either of the above will allow you to receive mail directly at your host. Try this: &prompt.root; hostname example.FreeBSD.org &prompt.root; host example.FreeBSD.org example.FreeBSD.org has address 204.216.27.XX If that is what you see, mail directly to yourlogin@example.FreeBSD.org should work without problems. If instead you see something like this: &prompt.root; host example.FreeBSD.org example.FreeBSD.org has address 204.216.27.XX example.FreeBSD.org mail is handled (pri=10) by hub.FreeBSD.org All mail sent to your host (example.FreeBSD.org) will end up being collected on hub under the same username instead of being sent directly to your host. The above information is handled by your DNS server. The DNS record that carries mail routing information is the Mail eXchange entry. If no MX record exists, mail will be delivered directly to the host by way of its IP address. The MX entry for freefall.FreeBSD.org at one time looked like this: freefall MX 30 mail.crl.net freefall MX 40 agora.rdrop.com freefall MX 10 freefall.FreeBSD.org freefall MX 20 who.cdrom.com As you can see, freefall had many MX entries. The lowest MX number is the host that ends up receiving the mail in the end while the others will queue mail temporarily if freefall is busy or down. Alternate MX sites should have separate Internet connections from your own in order to be the most useful. Your ISP or other friendly site should have no problem providing this service for you. Mail for Your Domain In order to set up a mailhost (a.k.a., mail server) you need to have any mail sent to various workstations directed to it. Basically, you want to hijack any mail for your domain (in this case *.FreeBSD.org) and divert it to your mail server so your users can check their mail via POP or directly on the server. DNS To make life easiest, a user account with the same username should exist on both machines. Use adduser to do this. The mailhost you will be using must be the designated mail exchange for each workstation on the network. This is done in your DNS configuration like so: example.FreeBSD.org A 204.216.27.XX ; Workstation MX 10 hub.FreeBSD.org ; Mailhost This will redirect mail for the workstation to the mailhost no matter where the A record points. The mail is sent to the MX host. You cannot do this yourself unless you are running a DNS server. If you are not, or cannot, run your own DNS server, talk to your ISP or whoever does your DNS for you. If you're doing virtual email hosting, the following information will come in handy. For the sake of an example, we will assume you have a customer with their own domain, in this case customer1.org and you want all the mail for customer1.org sent to your mailhost, which is named mail.myhost.com. The entry in your DNS should look like this: customer1.org MX 10 mail.myhost.com You do not need an A record if you only want to handle email for the domain. Be aware that this means pinging customer1.org will not work unless an A record exists for it. The last thing that you must do is tell sendmail on your mailhost what domains and/or hostnames it should be accepting mail for. There are a few different ways this can be done. Either of the following will work: Add the hosts to your /etc/sendmail.cw file if you are using the FEATURE(use_cw_file). If you are using sendmail 8.10 or higher, the file is /etc/mail/local-host-names. Add a Cwyour.host.com line to your /etc/sendmail.cf or /etc/mail/sendmail.cf if you are using sendmail 8.10 or higher. diff --git a/en_US.ISO8859-1/books/handbook/ppp-and-slip/chapter.sgml b/en_US.ISO8859-1/books/handbook/ppp-and-slip/chapter.sgml index 91a9085071..1f52f77c59 100644 --- a/en_US.ISO8859-1/books/handbook/ppp-and-slip/chapter.sgml +++ b/en_US.ISO8859-1/books/handbook/ppp-and-slip/chapter.sgml @@ -1,2984 +1,2984 @@ Jim Mock Restructured, reorganized, and updated by PPP and SLIP Synopsis PPP SLIP If you are connecting to the Internet via modem, or wish to provide dial-up connections to the Internet for others using FreeBSD, you have the option of using PPP or SLIP. PPP user PPP PPP kernel PPP PPP over Ethernet This chapter covers three varieties of PPP; user, kernel, and PPPoE (PPP over Ethernet). It also covers setting up a SLIP client and server. The first variety of PPP that will be covered is User PPP. User PPP was introduced into FreeBSD in 2.0.5-RELEASE as an addition to the already existing kernel implementation of PPP. You may be wondering what the main difference is between User PPP and kernel PPP. The answer is simple; user PPP processes the inbound and outbound data in userland rather than in the kernel. This is expensive in terms of copying the data between the kernel and userland, but allows a far more feature-rich ppp implementation. User PPP uses the tun device to communicate with the outside world whereas kernel-ppp uses the ppp device. From here on out in this chapter, user ppp will simply be referred to as ppp unless a distinction needs to be made between it and any other PPP software such as pppd. Unless otherwise stated, all of the commands explained in this section should be executed as root. Brian Somers Originally contributed by Nik Clayton With input from Dirk Frömberg Peter Childs Using User PPP User PPP Assumptions This document assumes you have the following: ISP PPP An account with an Internet Service Provider (ISP) which you connect to using PPP. Further, you have a modem or other device connected to your system and configured correctly, which allows you to connect to your ISP. The dial-up number(s) of your ISP. PAP CHAP Unix login name password Your login name and password. This can be either a regular Unix-style login and password pair, or a PAP or CHAP login and password pair. nameserver The IP address(es) of one or more name servers. Normally, you will be given two IP addresses by your ISP to use for this. If they have not given you at least one, then you can use the enable dns command in your ppp.conf file to tell ppp to set the name servers for you. This feature depends on your ISPs PPP implementation supporting DNS negotiation. The following information may be supplied by your ISP, but is not completely necessary: The IP address of your ISP's gateway. The gateway is the machine to which you will connect and will be set up as your default route. If you do not have this information, we can make one up and your ISP's PPP server will tell us the correct value when we connect. This IP number is referred to as HISADDR by ppp. The netmask you should use. If your ISP has not provided you with one, you can safely use 255.255.255.255. static IP address If your ISP provides you with a static IP address and hostname, you can enter it. Otherwise, we simply let the peer assign whatever IP address it sees fit. If you do not have any of the required information, contact your ISP and make sure they provide it to you. Preparing the Kernel As previously mentioned, ppp uses the tun device. If this device has not been compiled into your kernel, ppp will load it on demand as a module. The tunnel driver is dynamic, so any number of devices may be created (you are not limited by any kernel configuration values). It should be noted that the tunnel driver creates devices on demand, so ifconfig -a won't necessarily show up with any tun devices. Check the <devicename>tun</devicename> Device Under normal circumstances, most users will only use one tun device (/dev/tun0). References to tun0 below may be changed to tunN where N is any unit number. For FreeBSD installations that do not have DEVFS enabled, the existence of the tun0 device should be verified (this is not necessary if DEVFS is enabled as device - nodes will be created on demand). + nodes will be created on demand). The easiest way to make sure that the tun0 device is configured correctly, is to remake the device. To remake the device, do the following: &prompt.root; cd /dev &prompt.root; ./MAKEDEV tun0 If you need 16 tunnel devices in your kernel, you will need to create them. This can be done by executing the following commands: &prompt.root; cd /dev &prompt.root; ./MAKEDEV tun15 Name Resolution Configuration resolver hostname hosts The resolver is the part of the system that turns IP addresses into hostnames and vice versa. It can be configured to look for maps that describe IP to hostname mappings in one of two places. The first is a file called /etc/hosts. Read &man.hosts.5; for more information. The second is the Internet Domain Name Service (DNS), a distributed data base, the discussion of which is beyond the scope of this document. The resolver is a set of system calls that do the name mappings, but you have to tell it where to find the information. For versions of FreeBSD prior to 5.0, you do this by first editing the file /etc/host.conf. - FreeBSD 5.0 uses the /etc/nsswitch.conf file. + FreeBSD 5.0 uses the /etc/nsswitch.conf file. Edit <filename>/etc/host.conf</filename> For versions of FreeBSD prior to 5.0, this file should contain the following two lines (in this order): hosts bind This instructs the resolver to first look in the file /etc/hosts, and then to consult the DNS if the name was not found. Edit <filename>/etc/nsswitch.conf</filename> For FreeBSD version 5.0 or above, this file should - contain at least the following line: + contain at least the following line: hosts: files, dns This instructs the resolver to first look in the file /etc/hosts, and then to consult the DNS if the name was not found. Edit <filename>/etc/hosts</filename> This file may contain the IP addresses and names of machines on your network. At a bare minimum it should contain entries for the machine which will be running ppp. Assuming that your machine is called foo.bar.com with the IP address 10.0.0.1, /etc/hosts should contain: 127.0.0.1 localhost.bar.com localhost ::1 localhost.bar.com localhost 10.0.0.1 foo.bar.com foo The first two lines define the alias localhost as a synonym for the current machine. Regardless of your own IP address, the IP addresses for these lines should always be 127.0.0.1 and ::1. The last line maps the name foo.bar.com (and the shorthand foo) to the IP address 10.0.0.1. If your provider allocates you a static IP address and name, and you are not using that as your host name, add this - to the /etc/hosts too. + to the /etc/hosts too. Edit <filename>/etc/resolv.conf</filename> The /etc/resolv.conf file tells the resolver how to behave. Normally, you will need to enter the following line(s): domain bar.com nameserver x.x.x.x nameserver y.y.y.y The x.x.x.x and y.y.y.y addresses are those given to you by your ISP. Add as many nameserver lines as your ISP provides. The domain line is set to your hosts domain name. Refer to the &man.resolv.conf.5; manual page for details of other possible entries in this file. If you are running a local name server, replace the above nameserver lines with: nameserver 0.0.0.0 PPP ISP The enable dns command (entered in the /etc/ppp/ppp.conf file - see below) will tell PPP to request that your ISP confirms the nameserver values. If your ISP supplies different addresses (or if there are no nameserver lines in /etc/resolv.conf), PPP will rewrite the file with the ISP-supplied values. <application>PPP</application> Configuration PPPconfiguration Both ppp and pppd (the kernel level implementation of PPP) use the configuration files located in the /etc/ppp directory. Examples for user ppp can be found in - /usr/share/examples/ppp/. + /usr/share/examples/ppp/. Configuring ppp requires that you edit a number of files, depending on your requirements. What you put in them depends to some extent on whether your ISP allocates IP addresses statically (i.e., you get given one IP address, and always use that one) or dynamically (i.e., your IP address changes each time you connect to your ISP). PPP and Static IP Addresses PPPwith static IP addresses You will need to edit the /etc/ppp/ppp.conf configuration file. It should look similar to the example below. Lines that end in a : start in the first column, all other lines should be indented as shown using spaces or tabs. 1 default: 2 set log Phase Chat LCP IPCP CCP tun command 3 ident user-ppp VERSION (built COMPILATIONDATE) 4 set device /dev/cuaa0 5 set speed 115200 6 set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \ 7 \"\" AT OK-AT-OK ATE1Q0 OK \\dATDT\\TTIMEOUT 40 CONNECT" 8 set timeout 180 9 enable dns 10 11 provider: 12 set phone "(123) 456 7890" 13 set authname foo 14 set authkey bar 15 set login "TIMEOUT 10 \"\" \"\" gin:--gin: \\U word: \\P col: ppp" 16 set timeout 300 17 set ifaddr x.x.x.x y.y.y.y 255.255.255.255 0.0.0.0 18 add default HISADDR Do not include the line numbers, they are just for reference in this discussion. Line 1: Identifies the default entry. Commands in this entry are executed automatically when ppp is run. Line 2: Enables logging parameters. When the configuration is working satisfactorily, this line should be reduced to saying set log phase tun in order to avoid excessive log file sizes. Line 3: Tells PPP how to identify itself to the peer. PPP identifies itself to the peer if it has any trouble negotiating and setting up the link, providing information that the peers administrator may find useful when - investigating such problems. + investigating such problems. Line 4: Identifies the device to which the modem is connected. COM1 is /dev/cuaa0 and COM2 is /dev/cuaa1. Line 5: Sets the speed you want to connect at. If 115200 does not work (it should with any reasonably new modem), try 38400 instead. Line 6 & 7: PPPuser PPP The dial string. User PPP uses an expect-send syntax similar to the &man.chat.8; program. Refer to the manual page for information on the features of this language. Note that this command continues onto the next line for readability. Any command in ppp.conf may do this if the last character on the line is a ``\'' character. Line 8: Sets the idle timeout for the link. 180 seconds is the default, so this line is purely cosmetic. Line 9: Tells PPP to ask the peer to confirm the local resolver settings. If you run a local name server, this line should be commented out or removed. Line 10: A blank line for readability. Blank lines are ignored by PPP. Line 11: Identifies an entry for a provider called provider. Line 12: Sets the phone number for this provider. Multiple phone numbers may be specified using the colon (:) or pipe character (|)as a separator. The difference between the two separators is described in &man.ppp.8;. To summarize, if you want to rotate through the numbers, use a colon. If you want to always attempt to dial the first number first and only use the other numbers if the first number fails, use the pipe character. Always quote the entire set of phone numbers as shown. Line 13 & 14: Identifies the user name and password. When connecting using a unix-style login prompt, these values are referred to by the set login command using the \U and \P variables. When connecting using PAP or CHAP, these values are used at authentication time. Line 15: PAP CHAP If you are using PAP or CHAP, there will be no login at this point, and this line should be commented out or removed. See PAP and CHAP authentication for further details. The login string is of the same chat-like syntax as the dial string. In this example, the string works for a service whose login session looks like this: J. Random Provider login: foo password: bar protocol: ppp You will need to alter this script to suit your own needs. When you write this script for the first time, you should ensure that you have enabled chat logging so you can determine if the conversation is going as expected. Line 16: timeout Sets the default idle timeout (in seconds) for the connection. Here, the connection will be closed automatically after 300 seconds of inactivity. If you never want to timeout, set this value to zero or use the command line switch. Line 17: ISP Sets the interface addresses. The string x.x.x.x should be replaced by the IP address that your provider has allocated to you. The string y.y.y.y should be replaced by the IP address that your ISP indicated for their gateway (the machine to which you connect). If your ISP hasn't given you a gateway address, use 10.0.0.2/0. If you need to use a guessed address, make sure that you create an entry in /etc/ppp/ppp.linkup as per the instructions for PPP and Dynamic IP addresses. If this line is omitted, ppp cannot run in mode. Line 18: Adds a default route to your ISP's gateway. The special word HISADDR is replaced with the gateway address specified on line 9. It is important that this line appears after line 9, otherwise HISADDR will not yet be initialized. If you do not wish to run ppp in , this line should be moved to the - ppp.linkup file. + ppp.linkup file. It is not necessary to add an entry to ppp.linkup when you have a static IP address and are running ppp in mode as your routing table entries are already correct before you connect. You may however wish to create an entry to invoke programs after connection. This is explained later with the sendmail example. Example configuration files can be found in the /usr/share/examples/ppp/ directory. PPP and Dynamic IP Addresses PPPwith dynamic IP addresses IPCP If your service provider does not assign static IP addresses, ppp can be configured to negotiate the local and remote addresses. This is done by guessing an IP address and allowing ppp to set it up correctly using the IP Configuration Protocol (IPCP) after connecting. The ppp.conf configuration is the same as PPP and Static IP Addresses, with the following change: 17 set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.255 Again, do not include the line number, it is just for reference. Indentation of at least one space is required. Line 17: The number after the / character is the number of bits of the address that ppp will insist on. You may wish to use IP numbers more appropriate to your circumstances, but the above example will always work. The last argument (0.0.0.0) tells PPP to start negotiations using address 0.0.0.0 rather than 10.0.0.1 and is necessary for some ISPs. Do not use 0.0.0.0 as the first argument to set ifaddr as it prevents PPP from setting up an initial route in mode. If you are not running in mode, you will need to create an entry in /etc/ppp/ppp.linkup. ppp.linkup is used after a connection has been established. At this point, ppp will have assigned the interface addresses and it will now be possible to add the routing table entries: 1 provider: 2 add default HISADDR Line 1: On establishing a connection, ppp will look for an entry in ppp.linkup according to the following rules: First, try to match the same label as we used in ppp.conf. If that fails, look for an entry for the IP address of our gateway. This entry is a four-octet IP style label. If we still have not found an entry, look for the MYADDR entry. Line 2: This line tells ppp to add a default route that points to HISADDR. HISADDR will be replaced with the IP number of the gateway as negotiated by the IPCP. See the pmdemand entry in the files /usr/share/examples/ppp/ppp.conf.sample and /usr/share/examples/ppp/ppp.linkup.sample for a detailed example. Receiving Incoming Calls PPPreceiving incoming calls When you configure ppp to receive incoming calls on a machine connected to a LAN, you must decide if you wish to forward packets to the LAN. If you do, you should allocate the peer an IP number from your LAN's subnet, and use the command enable proxy in your /etc/ppp/ppp.conf file. You should also confirm that the /etc/rc.conf file contains the following: gateway="YES" Which getty? Configuring FreeBSD for Dial-up Services provides a good description on enabling dial-up services using &man.getty.8;. An alternative to getty is mgetty, a smarter version of getty designed with dial-up lines in mind. The advantages of using mgetty is that it actively talks to modems, meaning if port is turned off in /etc/ttys then your modem will not answer the phone. Later versions of mgetty (from 0.99beta onwards) also support the automatic detection of PPP streams, allowing your clients script-less access to your server. Refer to Mgetty and AutoPPP for more information on mgetty. <application>PPP</application> Permissions The ppp command must normally be run as user id 0. If however, you wish to allow ppp to run in server mode as a normal user by executing ppp as described below, that user must be given permission to run ppp by adding them to the network group in /etc/group. You will also need to give them access to one or more sections of the configuration file using the allow command: allow users fred mary If this command is used in the default section, it gives the specified users access to everything. PPP Shells for Dynamic-IP Users PPP shells Create a file called /etc/ppp/ppp-shell containing the following: #!/bin/sh IDENT=`echo $0 | sed -e 's/^.*-\(.*\)$/\1/'` CALLEDAS="$IDENT" TTY=`tty` if [ x$IDENT = xdialup ]; then IDENT=`basename $TTY` fi echo "PPP for $CALLEDAS on $TTY" echo "Starting PPP for $IDENT" exec /usr/sbin/ppp -direct $IDENT This script should be executable. Now make a symbolic link called ppp-dialup to this script using the following commands: &prompt.root; ln -s ppp-shell /etc/ppp/ppp-dialup You should use this script as the shell for all of your dialup users. This is an example from /etc/password for a dialup PPP user with username pchilds (remember don't directly edit the password file, use vipw). pchilds:*:1011:300:Peter Childs PPP:/home/ppp:/etc/ppp/ppp-dialup Create a /home/ppp directory that is world readable containing the following 0 byte files: -r--r--r-- 1 root wheel 0 May 27 02:23 .hushlogin -r--r--r-- 1 root wheel 0 May 27 02:22 .rhosts which prevents /etc/motd from being displayed. PPP Shells for Static-IP Users PPP shells Create the ppp-shell file as above and for each account with statically assigned IPs create a symbolic link to ppp-shell. For example, if you have three dialup customers fred, sam, and mary, that you route class C networks for, you would type the following: &prompt.root; ln -s /etc/ppp/ppp-shell /etc/ppp/ppp-fred &prompt.root; ln -s /etc/ppp/ppp-shell /etc/ppp/ppp-sam &prompt.root; ln -s /etc/ppp/ppp-shell /etc/ppp/ppp-mary Each of these users dialup accounts should have their shell set to the symbolic link created above (i.e., mary's shell should be /etc/ppp/ppp-mary). Setting up ppp.conf for Dynamic-IP Users The /etc/ppp/ppp.conf file should contain something along the lines of: default: set debug phase lcp chat set timeout 0 ttyd0: set ifaddr 203.14.100.1 203.14.100.20 255.255.255.255 enable proxy ttyd1: set ifaddr 203.14.100.1 203.14.100.21 255.255.255.255 enable proxy The indenting is important. The default: section is loaded for each session. For each dialup line enabled in /etc/ttys create an entry similar to the one for ttyd0: above. Each line should get a unique IP address from your pool of IP addresses for dynamic users. Setting up <filename>ppp.conf</filename> for Static-IP Users Along with the contents of the sample /usr/share/examples/ppp/ppp.conf above you should add a section for each of the statically assigned dialup users. We will continue with our fred, sam, and mary example. fred: set ifaddr 203.14.100.1 203.14.101.1 255.255.255.255 sam: set ifaddr 203.14.100.1 203.14.102.1 255.255.255.255 mary: set ifaddr 203.14.100.1 203.14.103.1 255.255.255.255 The file /etc/ppp/ppp.linkup should also contain routing information for each static IP user if required. The line below would add a route for the 203.14.101.0 class C via the client's ppp link. fred: add 203.14.101.0 netmask 255.255.255.0 HISADDR sam: add 203.14.102.0 netmask 255.255.255.0 HISADDR mary: add 203.14.103.0 netmask 255.255.255.0 HISADDR More on <command>mgetty</command>, AutoPPP, and MS Extensions <command>mgetty</command> and AutoPPP mgetty AutoPPP LCP Configuring and compiling mgetty with the AUTO_PPP option enabled allows mgetty to detect the LCP phase of PPP connections and automatically spawn off a ppp shell. However, since the default login/password sequence does not occur it is necessary to authenticate users using either PAP or CHAP. This section assumes the user has successfully configured, compiled, and installed a version of mgetty with the AUTO_PPP option (v0.99beta or later). Make sure your /usr/local/etc/mgetty+sendfax/login.config file has the following in it: /AutoPPP/ - - /etc/ppp/ppp-pap-dialup This will tell mgetty to run the ppp-pap-dialup script for detected PPP connections. Create a file called /etc/ppp/ppp-pap-dialup containing the following (the file should be executable): #!/bin/sh exec /usr/sbin/ppp -direct pap$IDENT For each dialup line enabled in /etc/ttys, create a corresponding entry in /etc/ppp/ppp.conf. This will happily co-exist with the definitions we created above. pap: enable pap set ifaddr 203.14.100.1 203.14.100.20-203.14.100.40 enable proxy Each user logging in with this method will need to have a username/password in /etc/ppp/ppp.secret file, or alternatively add the following option to authenticate users via PAP from /etc/password file. enable passwdauth If you wish to assign some users a static IP number, you can specify the number as the third argument in /etc/ppp/ppp.secret. See /usr/share/examples/ppp/ppp.secret.sample for examples. MS Extensions DNS NetBIOS PPPMicrosoft extensions It is possible to configure PPP to supply DNS and NetBIOS nameserver addresses on demand. To enable these extensions with PPP version 1.x, the following lines might be added to the relevant section of /etc/ppp/ppp.conf. enable msext set ns 203.14.100.1 203.14.100.2 set nbns 203.14.100.5 And for PPP version 2 and above: accept dns set dns 203.14.100.1 203.14.100.2 set nbns 203.14.100.5 This will tell the clients the primary and secondary name server addresses, and a netbios nameserver host. In version 2 and above, if the set dns line is omitted, PPP will use the values found in /etc/resolv.conf. PAP and CHAP Authentication PAP CHAP Some ISPs set their system up so that the authentication part of your connection is done using either of the PAP or CHAP authentication mechanisms. If this is the case, your ISP will not give a login: prompt when you connect, but will start talking PPP immediately. PAP is less secure than CHAP, but security is not normally an issue here as passwords, although being sent as plain text with PAP, are being transmitted down a serial line only. There's not much room for crackers to eavesdrop. Referring back to the PPP and Static IP addresses or PPP and Dynamic IP addresses sections, the following alterations must be made: 7 set login … 12 set authname MyUserName 13 set authkey MyPassword As always, do not include the line numbers, they are just for reference in this discussion. Indentation of at least one space is required. Line 7: Your ISP will not normally require that you log into the server if you're using PAP or CHAP. You must therefore disable your set login string. Line 12: This line specifies your PAP/CHAP user name. You will need to insert the correct value for MyUserName. Line 13: password This line specifies your PAP/CHAP password. You will need to insert the correct value for MyPassword. You may want to add an additional line, such as: 15 accept PAP or 15 accept CHAP to make it obvious that this is the intention, but PAP and CHAP are both accepted by default. Changing Your <command>ppp</command> Configuration on the Fly It is possible to talk to the ppp program while it is running in the background, but only if a suitable diagnostic port has been set up. To do this, add the following line to your configuration: set server /var/run/ppp-tun%d DiagnosticPassword 0177 This will tell PPP to listen to the specified unix-domain socket, asking clients for the specified password before allowing access. The %d in the name is replaced with the tun device number that is in use. Once a socket has been set up, the &man.pppctl.8; program may be used in scripts that wish to manipulate the running program. Final System Configuration PPPconfiguration You now have ppp configured, but there are a few more things to do before it is ready to work. They all involve editing the /etc/rc.conf file. Working from the top down in this file, make sure the hostname= line is set, e.g.: hostname="foo.bar.com" If your ISP has supplied you with a static IP address and name, it's probably best that you use this name as your host name. Look for the network_interfaces variable. If you want to configure your system to dial your ISP on demand, make sure the tun0 device is added to the list, otherwise remove it. network_interfaces="lo0 tun0" ifconfig_tun0= The ifconfig_tun0 variable should be empty, and a file called /etc/start_if.tun0 should be created. This file should contain the line: ppp -auto mysystem This script is executed at network configuration time, starting your ppp daemon in automatic mode. If you have a LAN for which this machine is a gateway, you may also wish to use the switch. Refer to the manual page for further details. Set the router program to NO with following line in your /etc/rc.conf: router_enable="NO" routed It is important that the routed daemon is not started (it is started by default), as it routed tends to delete the default routing table entries created by ppp. It is probably worth your while ensuring that the sendmail_flags line does not include the option, otherwise sendmail will attempt to do a network lookup every now and then, possibly causing your machine to dial out. You may try: sendmail_flags="-bd" sendmail The downside of this is that you must force sendmail to re-examine the mail queue whenever the ppp link is up by typing: &prompt.root; /usr/sbin/sendmail -q You may wish to use the !bg command in ppp.linkup to do this automatically: 1 provider: 2 delete ALL 3 add 0 0 HISADDR 4 !bg sendmail -bd -q30m SMTP If you don't like this, it is possible to set up a dfilter to block SMTP traffic. Refer to the sample files for further details. Now the only thing left to do is reboot the machine. All that is left is to reboot the machine. After rebooting, you can now either type: &prompt.root; ppp and then dial provider to start the PPP session, or, if you want ppp to establish sessions automatically when there is outbound traffic (and you have not created the start_if.tun0 script), type: &prompt.root; ppp -auto provider Summary To recap, the following steps are necessary when setting up ppp for the first time: Client side: Ensure that the tun device is built into your kernel. Ensure that the tunX device file is available in the /dev directory. Create an entry in /etc/ppp/ppp.conf. The pmdemand example should suffice for most ISPs. If you have a dynamic IP address, create an entry in /etc/ppp/ppp.linkup. Update your /etc/rc.conf file. Create a start_if.tun0 script if you require demand dialing. Server side: Ensure that the tun device is built into your kernel. Ensure that the tunX device file is available in the /dev directory. Create an entry in /etc/passwd (using the &man.vipw.8; program). Create a profile in this users home directory that runs ppp -direct direct-server or similar. Create an entry in /etc/ppp/ppp.conf. The direct-server example should suffice. Create an entry in /etc/ppp/ppp.linkup. Update your /etc/rc.conf file. Gennady B. Sorokopud Parts originally contributed by Robert Huff Using Kernel PPP Setting up Kernel PPP PPPkernel PPP Before you start setting up PPP on your machine make sure that pppd is located in /usr/sbin and the directory /etc/ppp exists. pppd can work in two modes: As a client, i.e., you want to connect your machine to the outside world via a PPP serial connection or modem line. PPPserver as a server, i.e. your machine is located on the network and used to connect other computers using PPP. In both cases you will need to set up an options file (/etc/ppp/options or ~/.ppprc if you have more than one user on your machine that uses PPP). You also will need some modem/serial software (preferably kermit) so you can dial and establish a connection with the remote host. Using <command>pppd</command> as a Client PPPclient Cisco The following /etc/ppp/options might be used to connect to a CISCO terminal server PPP line. crtscts # enable hardware flow control modem # modem control line noipdefault # remote PPP server must supply your IP address. # if the remote host doesn't send your IP during IPCP # negotiation , remove this option passive # wait for LCP packets domain ppp.foo.com # put your domain name here :<remote_ip> # put the IP of remote PPP host here # it will be used to route packets via PPP link # if you didn't specified the noipdefault option # change this line to <local_ip>:<remote_ip> defaultroute # put this if you want that PPP server will be your # default router To connect: kermit modem Dial to the remote host using kermit (or some other modem program), and enter your user name and password (or whatever is needed to enable PPP on the remote host). Exit kermit (without hanging up the line). Enter the following: &prompt.root; /usr/src/usr.sbin/pppd.new/pppd /dev/tty01 19200 Be sure to use the appropriate speed and device name. Now your computer is connected with PPP. If the connection fails, you can add the option to the /etc/ppp/options file and check messages on the console to track the problem. Following /etc/ppp/pppup script will make all 3 stages automatically: #!/bin/sh ps ax |grep pppd |grep -v grep pid=`ps ax |grep pppd |grep -v grep|awk '{print $1;}'` if [ "X${pid}" != "X" ] ; then echo 'killing pppd, PID=' ${pid} kill ${pid} fi ps ax |grep kermit |grep -v grep pid=`ps ax |grep kermit |grep -v grep|awk '{print $1;}'` if [ "X${pid}" != "X" ] ; then echo 'killing kermit, PID=' ${pid} kill -9 ${pid} fi ifconfig ppp0 down ifconfig ppp0 delete kermit -y /etc/ppp/kermit.dial pppd /dev/tty01 19200 kermit /etc/ppp/kermit.dial is a kermit script that dials and makes all necessary authorization on the remote host (an example of such a script is attached to the end of this document). Use the following /etc/ppp/pppdown script to disconnect the PPP line: #!/bin/sh pid=`ps ax |grep pppd |grep -v grep|awk '{print $1;}'` if [ X${pid} != "X" ] ; then echo 'killing pppd, PID=' ${pid} kill -TERM ${pid} fi ps ax |grep kermit |grep -v grep pid=`ps ax |grep kermit |grep -v grep|awk '{print $1;}'` if [ "X${pid}" != "X" ] ; then echo 'killing kermit, PID=' ${pid} kill -9 ${pid} fi /sbin/ifconfig ppp0 down /sbin/ifconfig ppp0 delete kermit -y /etc/ppp/kermit.hup /etc/ppp/ppptest Check to see if PPP is still running by executing /usr/etc/ppp/ppptest, which should look like this: #!/bin/sh pid=`ps ax| grep pppd |grep -v grep|awk '{print $1;}'` if [ X${pid} != "X" ] ; then echo 'pppd running: PID=' ${pid-NONE} else echo 'No pppd running.' fi set -x netstat -n -I ppp0 ifconfig ppp0 To hang up the modem, execute /etc/ppp/kermit.hup, which should contain: set line /dev/tty01 ; put your modem device here set speed 19200 set file type binary set file names literal set win 8 set rec pack 1024 set send pack 1024 set block 3 set term bytesize 8 set command bytesize 8 set flow none pau 1 out +++ inp 5 OK out ATH0\13 echo \13 exit Here is an alternate method using chat instead of kermit. The following two files are sufficient to accomplish a pppd connection. /etc/ppp/options: /dev/cuaa1 115200 crtscts # enable hardware flow control modem # modem control line connect "/usr/bin/chat -f /etc/ppp/login.chat.script" noipdefault # remote PPP serve must supply your IP address. # if the remote host doesn't send your IP during # IPCP negotiation, remove this option passive # wait for LCP packets domain <your.domain> # put your domain name here : # put the IP of remote PPP host here # it will be used to route packets via PPP link # if you didn't specified the noipdefault option # change this line to <local_ip>:<remote_ip> defaultroute # put this if you want that PPP server will be # your default router /etc/ppp/login.chat.script: The following should go on a single line. ABORT BUSY ABORT 'NO CARRIER' "" AT OK ATDT<phone.number> CONNECT "" TIMEOUT 10 ogin:-\\r-ogin: <login-id> TIMEOUT 5 sword: <password> Once these are installed and modified correctly, all you need to do is run pppd, like so: &prompt.root; pppd This sample is based primarily on information provided by: Trev Roydhouse <Trev.Roydhouse@f401.n711.z3.fidonet.org> and used with permission. Using <command>pppd</command> as a Server /etc/ppp/options should contain something similar to the following: crtscts # Hardware flow control netmask 255.255.255.0 # netmask ( not required ) 192.114.208.20:192.114.208.165 # ip's of local and remote hosts # local ip must be different from one # you assigned to the ethernet ( or other ) # interface on your machine. # remote IP is ip address that will be # assigned to the remote machine domain ppp.foo.com # your domain passive # wait for LCP modem # modem line The following /etc/ppp/pppserv script will enable tell pppd to behave as a server: #!/bin/sh ps ax |grep pppd |grep -v grep pid=`ps ax |grep pppd |grep -v grep|awk '{print $1;}'` if [ "X${pid}" != "X" ] ; then echo 'killing pppd, PID=' ${pid} kill ${pid} fi ps ax |grep kermit |grep -v grep pid=`ps ax |grep kermit |grep -v grep|awk '{print $1;}'` if [ "X${pid}" != "X" ] ; then echo 'killing kermit, PID=' ${pid} kill -9 ${pid} fi # reset ppp interface ifconfig ppp0 down ifconfig ppp0 delete # enable autoanswer mode kermit -y /etc/ppp/kermit.ans # run ppp pppd /dev/tty01 19200 Use this /etc/ppp/pppservdown script to stop the server: #!/bin/sh ps ax |grep pppd |grep -v grep pid=`ps ax |grep pppd |grep -v grep|awk '{print $1;}'` if [ "X${pid}" != "X" ] ; then echo 'killing pppd, PID=' ${pid} kill ${pid} fi ps ax |grep kermit |grep -v grep pid=`ps ax |grep kermit |grep -v grep|awk '{print $1;}'` if [ "X${pid}" != "X" ] ; then echo 'killing kermit, PID=' ${pid} kill -9 ${pid} fi ifconfig ppp0 down ifconfig ppp0 delete kermit -y /etc/ppp/kermit.noans The following kermit script (/etc/ppp/kermit.ans) will enable/disable autoanswer mode on your modem. It should look like this: set line /dev/tty01 set speed 19200 set file type binary set file names literal set win 8 set rec pack 1024 set send pack 1024 set block 3 set term bytesize 8 set command bytesize 8 set flow none pau 1 out +++ inp 5 OK out ATH0\13 inp 5 OK echo \13 out ATS0=1\13 ; change this to out ATS0=0\13 if you want to disable ; autoanswer mod inp 5 OK echo \13 exit A script named /etc/ppp/kermit.dial is used for dialing and authenticating on the remote host. You will need to customize it for your needs. Put your login and password in this script; you will also need to change the input statement depending on responses from your modem and remote host. ; ; put the com line attached to the modem here: ; set line /dev/tty01 ; ; put the modem speed here: ; set speed 19200 set file type binary ; full 8 bit file xfer set file names literal set win 8 set rec pack 1024 set send pack 1024 set block 3 set term bytesize 8 set command bytesize 8 set flow none set modem hayes set dial hangup off set carrier auto ; Then SET CARRIER if necessary, set dial display on ; Then SET DIAL if necessary, set input echo on set input timeout proceed set input case ignore def \%x 0 ; login prompt counter goto slhup :slcmd ; put the modem in command mode echo Put the modem in command mode. clear ; Clear unread characters from input buffer pause 1 output +++ ; hayes escape sequence input 1 OK\13\10 ; wait for OK if success goto slhup output \13 pause 1 output at\13 input 1 OK\13\10 if fail goto slcmd ; if modem doesn't answer OK, try again :slhup ; hang up the phone clear ; Clear unread characters from input buffer pause 1 echo Hanging up the phone. output ath0\13 ; hayes command for on hook input 2 OK\13\10 if fail goto slcmd ; if no OK answer, put modem in command mode :sldial ; dial the number pause 1 echo Dialing. output atdt9,550311\13\10 ; put phone number here assign \%x 0 ; zero the time counter :look clear ; Clear unread characters from input buffer increment \%x ; Count the seconds input 1 {CONNECT } if success goto sllogin reinput 1 {NO CARRIER\13\10} if success goto sldial reinput 1 {NO DIALTONE\13\10} if success goto slnodial reinput 1 {\255} if success goto slhup reinput 1 {\127} if success goto slhup if < \%x 60 goto look else goto slhup :sllogin ; login assign \%x 0 ; zero the time counter pause 1 echo Looking for login prompt. :slloop increment \%x ; Count the seconds clear ; Clear unread characters from input buffer output \13 ; ; put your expected login prompt here: ; input 1 {Username: } if success goto sluid reinput 1 {\255} if success goto slhup reinput 1 {\127} if success goto slhup if < \%x 10 goto slloop ; try 10 times to get a login prompt else goto slhup ; hang up and start again if 10 failures :sluid ; ; put your userid here: ; output ppp-login\13 input 1 {Password: } ; ; put your password here: ; output ppp-password\13 input 1 {Entering SLIP mode.} echo quit :slnodial echo \7No dialtone. Check the telephone line!\7 exit 1 ; local variables: ; mode: csh ; comment-start: "; " ; comment-start-skip: "; " ; end: Jim Mock Contributed (from http://node.to/freebsd/how-tos/how-to-freebsd-pppoe.html) by Using <application>PPP</application> over Ethernet (PPPoE) PPPover Ethernet PPPoE PPP, over Ethernet The following describes how to set up PPP over Ethernet, a.k.a, PPPoE. Prerequisites There are a few requirements that your system will need to meet in order for PPPoE to function properly. They are: Kernel source for FreeBSD 3.4 or later ppp from FreeBSD 3.4 or later Kernel Configuration kernelconfiguration You will need to set the following options in your kernel configuration file and then compile a new kernel. Optionally, you can add although if this functionality is not available at runtime, ppp will load the relevant modules on demand Setting up <filename>ppp.conf</filename> Here is an example of a working ppp.conf: default: # or name_of_service_provider set device PPPoE:xl1 # replace xl1 with your ethernet device set mru 1492 set mtu 1492 set authname YOURLOGINNAME set authkey YOURPASSWORD set log Phase tun command # you can add more detailed logging if you wish set dial set login set ifaddr 10.0.0.1/0 10.0.0.2/0 add default HISADDR nat enable yes # if you want to enable nat for your local net papchap: set authname YOURLOGINNAME set authkey YOURPASSWORD Care should be taken when running PPPoE with the option. Running <application>PPP</application> As root, you can run: &prompt.root; ppp -ddial name_of_service_provider Starting <application>PPP</application> at Boot Add the following to your /etc/rc.conf file: ppp_enable="YES" ppp_mode="ddial" ppp_nat="YES" ppp_profile="default" # or your provider Mário Sérgio Fujikawa Ferreira Contributed by PPPoE with a 3Com HomeConnect ADSL Modem Dual Link In short, it does not work. It should, but unfortunately, that is not the case. For whatever reason, this modem does not follow RFC 2516 (A Method for transmitting PPP over Ethernet (PPPoE), written by L. Mamakos, K. Lidl, J. Evarts, D. Carrel, D. Simone, and R. Wheeler). Since it does not follow the specification, FreeBSD's PPPoE implementation will not talk to it. It is very likely that it will not work under other Unix systems for that same reason. Complain to 3Com if you think it should comply with the PPPoE specification. ADSL If you absolutely want to use your ADSL connection with FreeBSD and are stuck with this modem, you can either: DSL Try replacing the modem with a different brand or model if your DSL provider permits you to do so. If you are not sure which brand(s) will work, the &a.questions; is a good place to ask. Try to get it working. Keep in mind that there is no guarantee it will work, your mileage may vary. If you want to try to make it work, you can do the following, but please keep in mind that you do this at your own risk! Just because it worked for me does not mean it will work for you. There are three steps to the process. They are: Make sure you already have ppp.conf set up. See the beginning of this chapter for more details on doing so. Since the modem does not speak the correct protocol, we need to learn how to speak its variant of the protocol. This information was obtained from a DSLreports forum message. The modem speaks 0x3c12 for DISCOVERY, and 0x3c13 for PAYLOAD identifiers instead of 0x8863 and 0x8864 respectively, as mandated by the PPPoE specification. Code RFC's Code Dual Link Modem's Code PAYLOAD 0x8863 0x3c12 PAYLOAD 0x8864 0x3c13 So, now what? You need to recompile the NETGRAPH_PPPOE code with the modem's codes. For this, you should have installed the full kernel sources. Find the /usr/src/sys/netgraph/ng_pppoe.h file. Be careful while editing this file. You have to modify both the little and the big endian entries. For big endian, find the line with 0x8863 in it, and replace the number with 0x3c12. Do the same with 0x8864, replacing it with 0x3c13. For little endian, find the line with 0x6388in it, and replace the number with 0x123c. Do the same with 0x6488, replacing it with 0x133c. Here is a diff of how the new file should look: &prompt.user; diff -u ng_pppoe.h.orig ng_pppoe.h --- ng_pppoe.h.orig Thu Apr 12 13:42:46 2001 +++ ng_pppoe.h Thu Apr 12 13:44:47 2001 @@ -148,8 +148,8 @@ #define PTT_SYS_ERR (0x0202) #define PTT_GEN_ERR (0x0203) -#define ETHERTYPE_PPPOE_DISC 0x8863 /* pppoe discovery packets */ -#define ETHERTYPE_PPPOE_SESS 0x8864 /* pppoe session packets */ +#define ETHERTYPE_PPPOE_DISC 0x3c12 /* pppoe discovery packets */ +#define ETHERTYPE_PPPOE_SESS 0x3c13 /* pppoe session packets */ #else #define PTT_EOL (0x0000) #define PTT_SRV_NAME (0x0101) @@ -162,8 +162,8 @@ #define PTT_SYS_ERR (0x0202) #define PTT_GEN_ERR (0x0302) -#define ETHERTYPE_PPPOE_DISC 0x6388 /* pppoe discovery packets */ -#define ETHERTYPE_PPPOE_SESS 0x6488 /* pppoe session packets */ +#define ETHERTYPE_PPPOE_DISC 0x123c /* pppoe discovery packets */ +#define ETHERTYPE_PPPOE_SESS 0x133c /* pppoe session packets */ #endif struct pppoe_tag { Then do the following as root: &prompt.root; cd /usr/src/sys/modules/netgraph/pppoe &prompt.root; make clean depend all install &prompt.root; make clean Now you can speak the modem's variant of the PPPoE specification. The third step is to figure out the name of the profile your ISP assigned to the modem. The information for this step was obtained from the Roaring Penguin PPPoE program which can be found in the ports collection. If you still are not able to find it, ask your ISP's tech support. If they do not know it either, and you are feeling bold (this may de-program your modem and render it useless, so think twice about doing it). Install the program shipped with the modem by your provider. Then, access the System menu from the program. The name of your profile should be listed there. It is usually ISP. The profile name will be used in the PPPoE configuration inside ppp.conf as the provider parameter. See the &man.ppp.8; manual page for more information. The PPPoE line in your ppp.conf should look like this: set device PPPoE:xl1:ISP Do not forget to change xl1 to the proper device for your Ethernet card. Do not forget to change ISP to the profile you have just found above. For additional information, you can try: Cheaper Broadband with FreeBSD on DSL by Renaud Waldura in Daemon News. Another PPPoE tutorial by Sympatico Users Group. Satoshi Asami Originally contributed by Guy Helmer With input from Piero Serini Using SLIP SLIP Setting up a SLIP Client SLIPclient The following is one way to set up a FreeBSD machine for SLIP on a static host network. For dynamic hostname assignments (i.e., your address changes each time you dial up), you probably need to do something much fancier. First, determine which serial port your modem is connected to. I have a symbolic link to /dev/modem from /dev/cuaa1, and only use the modem name in my configuration files. It can become quite cumbersome when you need to fix a bunch of files in /etc and .kermrc's all over the system! /dev/cuaa0 is COM1, cuaa1 is COM2, etc. Make sure you have the following in your kernel configuration file: pseudo-device sl 1 It is included in the GENERIC kernel, so this should not be a problem unless you have deleted it. Things You Have to Do Only Once Add your home machine, the gateway and nameservers to your /etc/hosts file. Mine looks like this: 127.0.0.1 localhost loghost 136.152.64.181 silvia.HIP.Berkeley.EDU silvia.HIP silvia 136.152.64.1 inr-3.Berkeley.EDU inr-3 slip-gateway 128.32.136.9 ns1.Berkeley.edu ns1 128.32.136.12 ns2.Berkeley.edu ns2 Make sure you have before in your /etc/host.conf. Otherwise, funny things may happen. Edit the /etc/rc.conf file. Set your hostname by editing the line that says: hostname=myname.my.domain You should give it your full Internet hostname. Add sl0 to the list of network interfaces by changing the line that says: network_interfaces="lo0" to: network_interfaces=lo0 sl0 Set the startup flags of sl0 by adding a line: ifconfig_sl0="inet ${hostname} slip-gateway netmask 0xffffff00 up" default route Designate the default router by changing the line: defaultrouter=NO to: defaultrouter=slip-gateway Make a file /etc/resolv.conf which contains: domain HIP.Berkeley.EDU nameserver 128.32.136.9 nameserver 128.32.136.12 nameserver domain name As you can see, these set up the nameserver hosts. Of course, the actual domain names and addresses depend on your environment. Set the password for root and toor (and any other accounts that do not have a password). Use passwd or &man.vipw.8;, do not edit the /etc/passwd or /etc/master.passwd files! Reboot your machine and make sure it comes up with the correct hostname. Making a SLIP Connection SLIPconnecting with Dial up, type slip at the prompt, enter your machine name and password. The things you need to enter depends on your environment. If you use kermit, you can try a script like this: # kermit setup set modem hayes set line /dev/modem set speed 115200 set parity none set flow rts/cts set terminal bytesize 8 set file type binary # The next macro will dial up and login define slip dial 643-9600, input 10 =>, if failure stop, - output slip\x0d, input 10 Username:, if failure stop, - output silvia\x0d, input 10 Password:, if failure stop, - output ***\x0d, echo \x0aCONNECTED\x0a Of course, you have to change the hostname and password to fit yours. After doing so, you can just type slip from the kermit prompt to get connected. Leaving your password in plain text anywhere in the filesystem is generally a BAD idea. Do it at your own risk. Leave the kermit there (you can suspend it by z) and as root, type: &prompt.root; slattach -h -c -s 115200 /dev/modem If you are able to ping hosts on the other side of the router, you are connected! If it does not work, you might want to try instead of as an argument to slattach. How to Shutdown the Connection Do the following: &prompt.root; kill -INT `cat /var/run/slattach.modem.pid` to kill slattach. Keep in mind you must be root to do the above. Then go back to kermit (fg if you suspended it) and exit from it (q). The slattach manual page says you have to use ifconfig sl0 down to mark the interface down, but this does not seem to make any difference for me. (ifconfig sl0 reports the same thing.) Some times, your modem might refuse to drop the carrier (mine often does). In that case, simply start kermit and quit it again. It usually goes out on the second try. Troubleshooting If it does not work, feel free to ask me. The things that people tripped over so far: Not using or in slattach (I have no idea why this can be fatal, but adding this flag solved the problem for at least one person). Using instead of (might be hard to see the difference on some fonts). Try ifconfig sl0 to see your interface status. For example, you might get: &prompt.root; ifconfig sl0 sl0: flags=10<POINTOPOINT> inet 136.152.64.181 --> 136.152.64.1 netmask ffffff00 Also, netstat -r will give the routing table, in case you get the no route to host messages from ping. Mine looks like: &prompt.root; netstat -r Routing tables Destination Gateway Flags Refs Use IfaceMTU Rtt Netmasks: (root node) (root node) Route Tree for Protocol Family inet: (root node) => default inr-3.Berkeley.EDU UG 8 224515 sl0 - - localhost.Berkel localhost.Berkeley UH 5 42127 lo0 - 0.438 inr-3.Berkeley.E silvia.HIP.Berkele UH 1 0 sl0 - - silvia.HIP.Berke localhost.Berkeley UGH 34 47641234 lo0 - 0.438 (root node) This is after transferring a bunch of files, your numbers should be smaller). Setting up a SLIP Server SLIPserver This document provides suggestions for setting up SLIP Server services on a FreeBSD system, which typically means configuring your system to automatically startup connections upon login for remote SLIP clients. The author has written this document based on his experience; however, as your system and needs may be different, this document may not answer all of your questions, and the author cannot be responsible if you damage your system or lose data due to attempting to follow the suggestions here. Prerequisites TCP/IP networking This document is very technical in nature, so background knowledge is required. It is assumed that you are familiar with the TCP/IP network protocol, and in particular, network and node addressing, network address masks, subnetting, routing, and routing protocols, such as RIP. Configuring SLIP services on a dial-up server requires a knowledge of these concepts, and if you are not familiar with them, please read a copy of either Craig Hunt's TCP/IP Network Administration published by O'Reilly & Associates, Inc. (ISBN Number 0-937175-82-X), or Douglas Comer's books on the TCP/IP protocol. modem It is further assumed that you have already setup your modem(s) and configured the appropriate system files to allow logins through your modems. If you have not prepared your system for this yet, please see the tutorial for configuring dialup services; if you have a World-Wide Web browser available, browse the list of tutorials at http://www.FreeBSD.org/. You may also want to check the manual pages for &man.sio.4; for information on the serial port device driver and &man.ttys.5;, &man.gettytab.5;, &man.getty.8;, & &man.init.8; for information relevant to configuring the system to accept logins on modems, and perhaps &man.stty.1; for information on setting serial port parameters (such as clocal for directly-connected serial interfaces). Quick Overview In its typical configuration, using FreeBSD as a SLIP server works as follows: a SLIP user dials up your FreeBSD SLIP Server system and logs in with a special SLIP login ID that uses /usr/sbin/sliplogin as the special user's shell. The sliplogin program browses the file /etc/sliphome/slip.hosts to find a matching line for the special user, and if it finds a match, connects the serial line to an available SLIP interface and then runs the shell script /etc/sliphome/slip.login to configure the SLIP interface. An Example of a SLIP Server Login For example, if a SLIP user ID were Shelmerg, Shelmerg's entry in /etc/master.passwd would look something like this (except it would be all on one line): Shelmerg:password:1964:89::0:0:Guy Helmer - SLIP:/usr/users/Shelmerg:/usr/sbin/sliplogin When Shelmerg logs in, sliplogin will search /etc/sliphome/slip.hosts for a line that had a matching user ID; for example, there may be a line in /etc/sliphome/slip.hosts that reads: Shelmerg dc-slip sl-helmer 0xfffffc00 autocomp sliplogin will find that matching line, hook the serial line into the next available SLIP interface, and then execute /etc/sliphome/slip.login like this: /etc/sliphome/slip.login 0 19200 Shelmerg dc-slip sl-helmer 0xfffffc00 autocomp If all goes well, /etc/sliphome/slip.login will issue an ifconfig for the SLIP interface to which sliplogin attached itself (slip interface 0,in the above example, which was the first parameter in the list given to slip.login) to set the local IP address (dc-slip), remote IP address (sl-helmer), network mask for the SLIP interface (0xfffffc00), and any additional flags (autocomp). If something goes wrong, sliplogin usually logs good informational messages via the daemon syslog facility, which usually goes into /var/log/messages (see the manual pages for &man.syslogd.8; and &man.syslog.conf.5; and perhaps check /etc/syslog.conf to see to which files syslogd is logging). OK, enough of the examples — let us dive into setting up the system. Kernel Configuration kernelconfiguration FreeBSD's default kernels usually come with two SLIP interfaces defined (sl0 and sl1); you can use netstat -i to see whether these interfaces are defined in your kernel. Sample output from netstat -i: Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll ed0 1500 <Link>0.0.c0.2c.5f.4a 291311 0 174209 0 133 ed0 1500 138.247.224 ivory 291311 0 174209 0 133 lo0 65535 <Link> 79 0 79 0 0 lo0 65535 loop localhost 79 0 79 0 0 sl0* 296 <Link> 0 0 0 0 0 sl1* 296 <Link> 0 0 0 0 0 The sl0 and sl1 interfaces shown in netstat -i's output indicate that there are two SLIP interfaces built into the kernel. (The asterisks after the sl0 and sl1 indicate that the interfaces are down.) However, FreeBSD's default kernels do not come configured to forward packets (ie, your FreeBSD machine will not act as a router) due to Internet RFC requirements for Internet hosts (see RFCs 1009 [Requirements for Internet Gateways], 1122 [Requirements for Internet Hosts — Communication Layers], and perhaps 1127 [A Perspective on the Host Requirements RFCs]), so if you want your FreeBSD SLIP Server to act as a router, you will have to edit the /etc/rc.conf file and change the setting of the gateway_enable variable to . You will then need to reboot for the new settings to take effect. You will notice that near the end of the default kernel configuration file (/sys/i386/conf/GENERIC) is a line that reads: pseudo-device sl 2 SLIP This is the line that defines the number of SLIP devices available in the kernel; the number at the end of the line is the maximum number of SLIP connections that may be operating simultaneously. Please refer to Configuring the FreeBSD Kernel for help in reconfiguring your kernel. Sliplogin Configuration As mentioned earlier, there are three files in the /etc/sliphome directory that are part of the configuration for /usr/sbin/sliplogin (see &man.sliplogin.8; for the actual manual page for sliplogin): slip.hosts, which defines the SLIP users & their associated IP addresses; slip.login, which usually just configures the SLIP interface; and (optionally) slip.logout, which undoes slip.login's effects when the serial connection is terminated. <filename>slip.hosts</filename> Configuration /etc/sliphome/slip.hosts contains lines which have at least four items, separated by whitespace: SLIP user's login ID Local address (local to the SLIP server) of the SLIP link Remote address of the SLIP link Network mask The local and remote addresses may be host names (resolved to IP addresses by /etc/hosts or by the domain name service, depending on your specifications in /etc/host.conf), and the network mask may be a name that can be resolved by a lookup into /etc/networks. On a sample system, /etc/sliphome/slip.hosts looks like this: # # login local-addr remote-addr mask opt1 opt2 # (normal,compress,noicmp) # Shelmerg dc-slip sl-helmerg 0xfffffc00 autocomp At the end of the line is one or more of the options. — no header compression — compress headers — compress headers if the remote end allows it — disable ICMP packets (so any ping packets will be dropped instead of using up your bandwidth) Note that sliplogin under early releases of FreeBSD 2 ignored the options that FreeBSD 1.x recognized, so the options , , , and had no effect until support was added in FreeBSD 2.2 (unless your slip.login script included code to make use of the flags). SLIP TCP/IP networking Your choice of local and remote addresses for your SLIP links depends on whether you are going to dedicate a TCP/IP subnet or if you are going to use proxy ARP on your SLIP server (it is not true proxy ARP, but that is the terminology used in this document to describe it). If you are not sure which method to select or how to assign IP addresses, please refer to the TCP/IP books referenced in the slips-prereqs section and/or consult your IP network manager. gated If you are going to use a separate subnet for your SLIP clients, you will need to allocate the subnet number out of your assigned IP network number and assign each of your SLIP client's IP numbers out of that subnet. Then, you will probably either need to configure a static route to the SLIP subnet via your SLIP server on your nearest IP router, or install gated on your FreeBSD SLIP server and configure it to talk the appropriate routing protocols to your other routers to inform them about your SLIP server's route to the SLIP subnet. Ethernet Otherwise, if you will use the proxy ARP method, you will need to assign your SLIP client's IP addresses out of your SLIP server's Ethernet subnet, and you will also need to adjust your /etc/sliphome/slip.login and /etc/sliphome/slip.logout scripts to use &man.arp.8; to manage the proxy-ARP entries in the SLIP server's ARP table. <filename>slip.login</filename> Configuration The typical /etc/sliphome/slip.login file looks like this: #!/bin/sh - # # @(#)slip.login 5.1 (Berkeley) 7/1/90 # # generic login file for a slip line. sliplogin invokes this with # the parameters: # 1 2 3 4 5 6 7-n # slipunit ttyspeed loginname local-addr remote-addr mask opt-args # /sbin/ifconfig sl$1 inet $4 $5 netmask $6 This slip.login file merely ifconfig's the appropriate SLIP interface with the local and remote addresses and network mask of the SLIP interface. If you have decided to use the proxy ARP method (instead of using a separate subnet for your SLIP clients), your /etc/sliphome/slip.login file will need to look something like this: #!/bin/sh - # # @(#)slip.login 5.1 (Berkeley) 7/1/90 # # generic login file for a slip line. sliplogin invokes this with # the parameters: # 1 2 3 4 5 6 7-n # slipunit ttyspeed loginname local-addr remote-addr mask opt-args # /sbin/ifconfig sl$1 inet $4 $5 netmask $6 # Answer ARP requests for the SLIP client with our Ethernet addr /usr/sbin/arp -s $5 00:11:22:33:44:55 pub The additional line in this slip.login, arp -s $5 00:11:22:33:44:55 pub, creates an ARP entry in the SLIP server's ARP table. This ARP entry causes the SLIP server to respond with the SLIP server's Ethernet MAC address whenever a another IP node on the Ethernet asks to speak to the SLIP client's IP address. EthernetMAC address When using the example above, be sure to replace the Ethernet MAC address (00:11:22:33:44:55) with the MAC address of your system's Ethernet card, or your proxy ARP will definitely not work! You can discover your SLIP server's Ethernet MAC address by looking at the results of running netstat -i; the second line of the output should look something like: ed0 1500 <Link>0.2.c1.28.5f.4a 191923 0 129457 0 116 This indicates that this particular system's Ethernet MAC address is 00:02:c1:28:5f:4a — the periods in the Ethernet MAC address given by netstat -i must be changed to colons and leading zeros should be added to each single-digit hexadecimal number to convert the address into the form that &man.arp.8; desires; see the manual page on &man.arp.8; for complete information on usage. When you create /etc/sliphome/slip.login and /etc/sliphome/slip.logout, the execute bit (ie, chmod 755 /etc/sliphome/slip.login /etc/sliphome/slip.logout) must be set, or sliplogin will be unable to execute it. <filename>slip.logout</filename> Configuration /etc/sliphome/slip.logout is not strictly needed (unless you are implementing proxy ARP), but if you decide to create it, this is an example of a basic slip.logout script: #!/bin/sh - # # slip.logout # # logout file for a slip line. sliplogin invokes this with # the parameters: # 1 2 3 4 5 6 7-n # slipunit ttyspeed loginname local-addr remote-addr mask opt-args # /sbin/ifconfig sl$1 down If you are using proxy ARP, you will want to have /etc/sliphome/slip.logout remove the ARP entry for the SLIP client: #!/bin/sh - # # @(#)slip.logout # # logout file for a slip line. sliplogin invokes this with # the parameters: # 1 2 3 4 5 6 7-n # slipunit ttyspeed loginname local-addr remote-addr mask opt-args # /sbin/ifconfig sl$1 down # Quit answering ARP requests for the SLIP client /usr/sbin/arp -d $5 The arp -d $5 removes the ARP entry that the proxy ARP slip.login added when the SLIP client logged in. It bears repeating: make sure /etc/sliphome/slip.logout has the execute bit set for after you create it (ie, chmod 755 /etc/sliphome/slip.logout). Routing Considerations SLIP routing If you are not using the proxy ARP method for routing packets between your SLIP clients and the rest of your network (and perhaps the Internet), you will probably either have to add static routes to your closest default router(s) to route your SLIP client subnet via your SLIP server, or you will probably need to install and configure gated on your FreeBSD SLIP server so that it will tell your routers via appropriate routing protocols about your SLIP subnet. Static Routes static routes Adding static routes to your nearest default routers can be troublesome (or impossible, if you do not have authority to do so...). If you have a multiple-router network in your organization, some routers, such as Cisco and Proteon, may not only need to be configured with the static route to the SLIP subnet, but also need to be told which static routes to tell other routers about, so some expertise and troubleshooting/tweaking may be necessary to get static-route-based routing to work. Running <command>gated</command> gated An alternative to the headaches of static routes is to install gated on your FreeBSD SLIP server and configure it to use the appropriate routing protocols (RIP/OSPF/BGP/EGP) to tell other routers about your SLIP subnet. You can use gated from the ports collection or retrieve and build it yourself from the GateD anonymous FTP site; the current version as of this writing is gated-R3_5Alpha_8.tar.Z, which includes support for FreeBSD out-of-the-box. Complete information and documentation on gated is available on the Web starting at the Merit GateD Consortium. Compile and install it, and then write a /etc/gated.conf file to configure your gated; here is a sample, similar to what the author used on a FreeBSD SLIP server: # # gated configuration file for dc.dsu.edu; for gated version 3.5alpha5 # Only broadcast RIP information for xxx.xxx.yy out the ed Ethernet interface # # # tracing options # traceoptions "/var/tmp/gated.output" replace size 100k files 2 general ; rip yes { interface sl noripout noripin ; interface ed ripin ripout version 1 ; traceoptions route ; } ; # # Turn on a bunch of tracing info for the interface to the kernel: kernel { traceoptions remnants request routes info interface ; } ; # # Propagate the route to xxx.xxx.yy out the Ethernet interface via RIP # export proto rip interface ed { proto direct { xxx.xxx.yy mask 255.255.252.0 metric 1; # SLIP connections } ; } ; # # Accept routes from RIP via ed Ethernet interfaces import proto rip interface ed { all ; } ; RIP The above sample gated.conf file broadcasts routing information regarding the SLIP subnet xxx.xxx.yy via RIP onto the Ethernet; if you are using a different Ethernet driver than the ed driver, you will need to change the references to the ed interface appropriately. This sample file also sets up tracing to /var/tmp/gated.output for debugging gated's activity; you can certainly turn off the tracing options if gated works OK for you. You will need to change the xxx.xxx.yy's into the network address of your own SLIP subnet (be sure to change the net mask in the proto direct clause as well). When you get gated built and installed and create a configuration file for it, you will need to run gated in place of routed on your FreeBSD system; change the routed/gated startup parameters in /etc/netstart as appropriate for your system. Please see the manual page for gated for information on gated's command-line parameters. diff --git a/en_US.ISO8859-1/books/handbook/x11/chapter.sgml b/en_US.ISO8859-1/books/handbook/x11/chapter.sgml index aba8438f75..8428cd7b6a 100644 --- a/en_US.ISO8859-1/books/handbook/x11/chapter.sgml +++ b/en_US.ISO8859-1/books/handbook/x11/chapter.sgml @@ -1,1394 +1,1394 @@ The X Window System Synopsis FreeBSD uses XFree86 to provide users with a powerful graphical user interface. XFree86 is a open-source implementation of the X Window System. The following chapter will cover installation and configuration of XFree86 on your FreeBSD system. For more information on X11 and to see whether your video card is supported, check the XFree86 web site. After reading this chapter you will know: How to install and configure XFree86. The various components of the X window system, and how they interoperate How to install and use different window managers How to use TrueType fonts in XFree86 How to setup your system for graphical logins (XDM). Before reading this chapter you should: Know how to install additional third-party software () Installing XFree86 XFree86 is available as a port and as a package, making it easy to install. You can also download the binaries directly from the XFree86 organization and install them by hand, following the instructions provided by the XFree86 group. Your only decision is which version of XFree86 to run. XFree86 3.X is the maintenance branch of XFree86 development. It's very stable, and it supports a huge number of graphics cards. However, no new development is happening there. XFree86 4.X is a redesign of XFree86. As well as introducing many new features (including much better support for fonts and anti-aliasing), XFree86 4.X supports slightly fewer graphics cards. If your card is supported we recommend you run 4.X. If it is not then run 3.X. The rest of this chapter will explain how to configure XFree86, and suggest various programs for X that you might want to try. Christopher Shumway Contributed by XFree86 Configuration Introduction This chapter will introduce the steps necessary to install and configure the XFree86 X Windows System under FreeBSD. Once the server is installed and configured properly. The user can read to setup their desktop environment. XFree86 4.X XFree86 Before You Start Before the user is to start configuration of XFree86-4, the the following information will need to be known about the target system: Monitor specifications Video Adapter chipset Video Adapter memory horizontal scan rate vertical scan rate The specifications for the target system's monitor are used by XFree86 to determine the resolution and refresh rate to run at. These specifications can usually be obtained from the documentation that came with the target system's monitor or from the manufacturer's website. There are two ranges of numbers that are needed, the horizontal scan rate and the vertical synchronization rate. The video adapter's chipset defines what driver module XFree86 uses to talk to the graphics hardware. With most chipsets, this can be automatically determined, but it is still useful to know in case the automatic detection doesn't work correctly. Video memory on the graphic adapter determines the resolution and color depth the target system can run at. This is important to know so the user knows the limitations of the target system. Installing XFree86 4.X Software XFree86 4 can be installed using the FreeBSD ports system or using &man.pkg.add.1;. If the user is building XFree86-4 from source and has USA_RESIDENT set in /etc/make.conf, the user may first have to fetch Wraphelp.c if XDM-AUTHORIZATION-1 support is desired. This file is to be placed in the port's files/ sub-directory before the port is built. Configuring XFree86 4.X Configuration of XFree86 4.X is a several step process. The first step is to build an initial configuration file with the configure option to XFree86. As the super user, simply run: &prompt.root; XFree86 -configure This will generate a skeleton XFree86 configuration file in the current working directory called XF86Config.new. The XFree86 program will attempt to probe the graphics hardware on the system and will write a configuration file to load the proper drivers for the detected hardware on the target system. The next step is to test the currently existing configuration to verify that XFree86 can work with the graphics hardware on the target system. To preform this task, the user needs to run: &prompt.root; XFree86 -xf86config XF86Config.new If the user is presented with a black and grey grid and an X mouse cursor, then the configuration was successful. To exit the test, just press ctrl, alt and backspace simultaneously. XFree86 4 Tuning Next, the user needs to tune the XF86Config.new configuration file to their personal taste. Open up the file in a text editor such as &man.emacs.1; or &man.ee.1;. The first thing the user will want to do is add the frequencies for the target system's monitor. These are usually expressed as a horizontal and vertical synchronization rate. These values are added to the XF86Config.new file under the "Monitor" section as such: Section "Monitor" Identifier "Monitor0" VendorName "Monitor Vendor" ModelName "Monitor Model" Horizsync 30-107 VertRefresh 48-120 EndSection The Horizsync and VertRefresh keywords may not exist in the user's configuration file. If they do not, they need to be added, with the correct horizontal synchronization rate placed after the Horizsync keyword and the vertical synchronization rate after the VertRefresh keyword. In the example above the target monitor's rates where entered. XF86Config While the XF86Config.new configuration file is still open in an editor, next the user needs to select what the default resolution and color depth is desired. This is defined in the Screen section. Section "Screen" Identifier "Screen0" Device "Card0" Monitor "Monitor0" DefaultColorDepth 24 SubSection "Display" Depth 24 Modes "1024x768" EndSubSection EndSection The DefaultColorDepth keyword describes the color depth the user wishes to run at by default. This can be overridden with the -bpp command line switch to XFree86 1. The Modes keyword describes the resolution the user wishes to run at for the given color depth. In the example above, the default color depth is twenty four bits per pixel. At this color depth, the accepted resolution is one thousand twenty four pixels by seven hundred and sixty eight pixels. If a user wants to run at a resolution of one thousand twenty four pixels by seven hundred sixty eight pixels at twenty four bits per pixel, then the user needs to add the DefaultColorDepth keyword with the value of twenty four, and add to the "Display" subsection with the desired Depth the Modes keyword with the resolution the user wishes to run at. Note that only VESA standard modes are supported as defined by the target system's graphics hardware. Finally, the user can write out the configuration file and test it using the test mode given above. If all is well, then the configuration file needs to be installed in a common location where XFree86 1 can source it in the future. This is typically /etc/X11/XF86Config or /usr/X11R6/etc/X11/XF86Config. &prompt.root; cp XF86Config.new /etc/X11/XF86Config Once the configuration file has been placed in a common location, XFree86 can then be used through &man.xdm.1;. In order to use startx 1 the user will have to install the X11/wrapper port. Advanced Configuration Topics Configuration with Intel i810 Graphics Chipsets Intel i810 graphic chipset Configuration with Intel i810 integrated chipsets requires the agpgart AGP programming interface for XFree86 to be able to drive the card. To enable the agpgart programming interface, the agp.ko kernel loadable module needs to be loaded into the kernel with &man.kldload.8;. This can be done automatically with the &man.loader.8;. Simply add this line to /boot/loader.conf to have the loader load agp.ko at boot time: agp_load="YES" Next, a device node needs to be created for the programming interface. To create the AGP device node, run &man.MAKEDEV.8; in the /dev directory as such: &prompt.root; cd /dev &prompt.root; sh MAKEDEV agpgart This will allow the user to configure the graphics hardware as any other graphics board. Understanding X If you are familiar with using windowing systems that ship with other operating systems, such as Microsoft Windows, or MacOS, then you may find your first introduction to X to be something of a culture shock. Today, as Unix desktop environments such as KDE and GNOME become more prevalent it is less necessary to understand all the behind-the-scenes interaction between the various X components, or what those components actually are. However, one of X's strengths is its underlying design, which lends a great deal of flexibility, and makes it possible to do things with X that are impossible with other, more rigid, systems. Why X? X is not the first window system written for Unix, but it is the most popular. X's original development team had worked on another window system before writing X. That system's name was W (for Window, obviously). X is just the next letter in the Roman alphabet. X can be referred to variously as X, X Window System, X11, and other terms. X Windows is to be avoided wherever possible; see &man.X.1; for more information. The X Client/Server Model X was designed from the beginning to be network-centric, and adopts a client-server model. In the X model, the X server runs on the computer that has the keyboard, monitor, and mouse attached. The server is responsible for managing the display, handling input from the keyboard and mouse, and so on. Each X application (such as XTerm, or Netscape) is a client. A client sends messages to the server such as Please draw a window at these coordinates, and the server sends back messages such as The user just clicked on your OK button. If you are using FreeBSD in a home or small office environment where you only have one computer then you will be running the X server and the X clients on the same computer. However, if you have many machines running FreeBSD it is perfectly possible to run the X server on the computer by your desk (which might be quite a low specification machine) and run your X applications (the clients) on the powerful expensive server that serves your office. In this scenario the communication between the X client and server takes place over the network. This confuses a lot of people, because the X terminology is exactly backward to what they expect. They expect the X server to be the big powerful machine down the hall, and the X client to be the machine on their desk. As long as you remember that the X server is the machine with the monitor and keyboard, and the X clients are the programs that display the windows you will not get confused. There is an interesting side-effect to this design. There is nothing in the forces the client and server machines to be running the same operating system, or even to be running on the same type of computer. It is perfectly feasible to run an X server on Microsoft Windows or Apple's MacOS, and there are various free and commercial applications available that do exactly that. The X server that ships with FreeBSD is called XFree86, and is available for free, under a license very similar to the FreeBSD license. Commercial X servers for FreeBSD are also available, should you want one. The Window Manager The X design philosophy is much like the Unix design philosophy, tools, not policy. By this we mean that X (and Unix) does not try to dictate to the end user how they should accomplish whatever task they are trying to solve. Instead, they aim to provide the user tools to do the job, and it is the user's responsibility to decide how to use those tools. This philosophy extends to X not dictating what windows should look like on screen, how you move them around with your mouse, what keystrokes you should use to move between windows (i.e., Alt Tab , if you are familiar with Windows), what the title bars on each window should look like, whether or not they have close buttons on them, and so on. Instead, X delegates this responsibility to an application called the Window Manager. There are dozens of window managers available for X; AfterStep, Enlightenment, ctwm, ftwm, sawfish, twm, WindowMaker and more. Each of these window managers provides a different look and feel; some of them support virtual desktops some of them allow you to completely customize the keystrokes you can use to manage your desktop; some have a Start button, or similar device; some are themeable, allowing you to completely change the look-and-feel of your desktop by applying a new theme. These window managers, and many more, are available in the x11-wm category of the Ports Collection. In addition, the KDE and GNOME desktop environments both have their own window managers which integrate tightly with the desktop, although both of them allow you to replace the default window manager with your own choice. Each window manager also has a different configuration mechanism; some expect you to write a configuration file by hand; others feature GUI tools for carrying most of the configuration tasks; at least one (sawfish) has a configuration file written in a dialect of the Lisp language, which is very powerful (if you are in to that sort of thing). As you can imagine, this flexibility comes with a price. It can be very difficult for documents such as this one to guide you through choosing and configuring a window manager because the available choice is so wide. Focus Policy Another feature the window manager is responsible for is the mouse focus policy. Each windowing system, be it X, Microsoft Windows, or some other has an abstraction called the focus, and at any one time only one window can have the focus. The window that has the focus is the window that will receive all your keypresses and mouse clicks. You are probably familiar with a focus policy commonly called click-to-focus. This means that you must click on the window you want to have the focus. The window may then come to the top of the stack, and all your keypresses will now be directed to this window, even if you move the mouse outside the window. To give the focus to another window you must first click in it. X does not support any particular focus policy. Instead, the window manager controls which window has the focus at any one time. Different window managers will support different focus methods. All of them support click to focus, and the majority of them support several others. The two other most popular focus policies are: focus-follows-mouse With this policy, the window that is under the mouse pointer is the window that has the focus. This may not necessarily be the window that is on top of all the other windows. You can change the focus by pointing at another window, there is no need to click in it as well. After getting used to this policy it can be very disorientating going back to another system that uses click-to-focus. sloppy-focus This policy is a small extension to focus-follows-mouse. With focus-follows-mouse, if you move the mouse over the background (or desktop, also called the root window) then no window has the focus, and your keypresses go nowhere. If you use sloppy-focus and move the mouse pointer on the root window then the last window that had the focus will keep it. Your window manager will almost certainly support other policies, and variations on these two, so make sure you read the documentation it is supplied with. Widgets The X approach of providing tools and not policy extends to the widgets that you see on screen in each application. Widget is a GUI term for all the items in the user interface that you can click on and manipulate in some way; buttons, checkboxes, radio buttons, icons, lists, and so on. Microsoft Windows Developer documentation calls these things controls. Microsoft Windows and Apple's MacOS both have a very rigid widget policy. Application developers are supposed to ensure that their applications share a common look and feel. X was designed long before either of these windowing systems, when research into GUI systems was in its infancy, and it was felt that it would not be sensible to mandate a particular graphical style, or set of widgets that have to be adhered to. If you examine the evolution of the Windows or MacOS GUI over the past ten years you will see many examples of how the interfaces have been altered over time to reflect new thinking in the art of Human/Computer Interaction. The upshot of this is that you can not expect X applications to have a common look and feel. There are several popular widget sets (and variations), including the original Athena widget set (developed at MIT), Motif (on which the widget set in Microsoft Windows was modeled, all bevelled edges and three shades of grey), OpenLook, and others. Most newer X applications today will use a modern-looking widget set, probably either Qt, used by KDE, or GTK, used by the GNOME project. In this respect we are beginning to see a convergence in look-and-feel on the Unix desktop, which certainly makes things easier for the novice user. However, the sudden rise in popularity of theming, where window managers make it possible to dramatically personally your desktop and alter the look and feel of the widgets risks confusing the issue once more. Murray - Stokely - Section on fonts by - + Stokely + Contributed by + Using Fonts in XFree86 Type1 Fonts The default fonts that ship with XFree86 are less than ideal for typical desktop publishing applications. Large presentation fonts show up jagged and unprofessional looking and small fonts in Netscape are almost completely unintelligible. However, there are several free, high quality Type1 (PostScript) fonts available which can be readily used with XFree86, either version 3.X or version 4.X. For instance, the URW font collection (x11-fonts/urwfonts) includes high quality versions of standard type1 fonts (Times Roman, Helvetica, Palatino and others). The Freefont collection (x11-fonts/freefont) includes many more fonts, but most of them are intended for use in graphics software such as the Gimp, and are not complete enough to serve as screen fonts. In addition, XFree86 can be configured to use TrueType fonts with a minimum of effort: see the section on TrueType fonts later. To install the above Type1 font collections from the ports collection you can run the following commands. &prompt.root; cd /usr/ports/x11-fonts/urwfonts &prompt.root; make install clean And likewise with the freefont or other collections. To tell the X server that these fonts exist, you can add an appropriate line to your XF86Config file (in /etc/ for XFree86 version 3, or in /etc/X11/ for version 4), which reads: FontPath "/usr/X11R6/lib/X11/fonts/URW/" Alternatively, at the command line in your X session you can write: &prompt.user; xset fp+ /usr/X11R6/lib/X11/fonts/URW &prompt.user; xset fp rehash This will work but will be lost when you log out from this session, unless you add it to your startup file (~/.xinitrc for a normal startx session, or ~/.xsession when logging in through a graphical login manager like XDM). A third way is to use the new XftConfig file: see the section on anti-aliasing, later. TrueType Fonts XFree86 4.0 has built in support for rendering TrueType fonts. There are two different modules that can enable this functionality. The "freetype" module is used in this example because it is more consistent with the other font rendering back-ends. To enable the freetype module just add the following line to the module section of your /etc/X11/XF86Config file. Load "freetype" For XFree86 3.3.X you will need to run a separate TrueType font server. Xfstt is commonly used for this purpose. To install x11-servers/Xfstt on your FreeBSD system simply install the port from /usr/ports/x11-servers/Xfstt You should now make a directory for your TrueType fonts (e.g. /usr/X11R6/lib/X11/fonts/TrueType) and copy all of your TrueType fonts into this directory. Keep in mind that you cannot take TrueType fonts directly from a Macintosh; they must be in Unix/DOS/Windows format for use by XFree86. Once you have copied the files into this directory you need to use ttmkfdir to create a fonts.dir file so that the X font renderer knows that you've installed these new files. There is a FreeBSD port for x11-fonts/ttmkfdir in /usr/ports/x11-fonts/ttmkfdir. &prompt.root; cd /usr/X11R6/lib/X11/fonts/TrueType &prompt.root; ttmkfdir > fonts.dir Now you need to add your TrueType directory to your fonts path. This is just the same as described above for Type1 fonts, that is, use &prompt.user; xset fp+ /usr/X11R6/lib/X11/fonts/TrueType &prompt.user; xset fp rehash or add a line to the XF86Config file. That's it. Now Netscape, Gimp, StarOffice, and all of your other X applications should now recognize your installed TrueType fonts. Extremely small fonts (as with text in a high resolution display on a web page) and extremely large fonts (within StarOffice) will look much better now. Anti-Aliasing Your Fonts Starting with version 4.0.2, XFree86 supports anti-aliased fonts. Currently, most software has not been updated to take advantage of this new functionality. However, Qt (the toolkit for the KDE desktop) does; so if you are running XFree86 4.0.2 (or higher), Qt 2.3 (or higher) and KDE, all your KDE/Qt applications can be made to use anti-aliased fonts. To configure anti-aliasing, you need to create (or edit, if it already exists) the file /usr/X11R6/lib/X11/XftConfig. Several advanced things can be done with this file; this section describes only the simplest possibilities. First, you need to tell the X server about the fonts which you want anti-aliased. To do that, for each font directory you have a line, which looks like this: dir "/usr/X11R6/lib/X11/Type1" And likewise for the other font directories (URW, truetype, etc) containing fonts you'd like anti-aliased. Anti-aliasing makes sense only for scalable fonts (basically, Type1 and TrueType) so don't include bitmap font directories here. The directories which you included here can now be commented out of your XF86Config file. Next, you may not want to anti-alias normal-sized text. (Antialiasing makes borders slightly fuzzy, which makes very small text more readable and removes "staircases" from large text, but can cause eyestrain if applied to normal text.) To exclude point sizes between 9 and 13 from anti-aliasing, include these lines: match any size > 8 any size < 14 edit antialias = false; You may also find that the spacing for some monospaced fonts gets messed up when you turn on anti-aliasing. This seems to be an issue with KDE, in particular. One possible fix for this is to force the spacing for such fonts to be 100: add the following lines: match any family == "fixed" edit family =+ "mono"; match any family == "console" edit family =+ "mono"; (this aliases the other common names for fixed fonts as "mono"), and then add: match any family == "mono" edit spacing = 100; Supposing you want to use the Lucidux fonts whenever monospaced fonts are required (these look nice, and don't seem to suffer from the spacing problem), you could replace that last line with these: match any family == "mono" edit family += "LuciduxMono"; match any family == "Lucidux Mono" edit family += "LuciduxMono"; match any family == "LuciduxMono" edit family =+ "Lucidux Mono"; (the last lines alias different equivalent family names). Finally, you want to allow users to add commands to this file, via their personal .xftconfig files. To do this, add a last line: includeif "~/.xftconfig" That's all; anti-aliasing should be enabled the next time you start the X server. However, note that your programs must know how to take advantage of it. At the present time, the toolkit Qt does, so the entire KDE environment can use anti-aliased fonts (see on KDE for details); there are patches for gtk+ to do the same, so if compiled against such a patched gtk+, the GNOME environment and Mozilla can also use anti-aliased fonts. Anti-aliasing is still new to FreeBSD and XFree86; configuring it should get easier with time, and it will soon be supported by many more applications. Seth Kingsley - Section on XDM by + Contributed by The X Display Manager Overview The X Display Manager (XDM) is an optional part of the X Window System that is used for login session management. This is useful for several types of situations, including minimal X Terminals (see ), desktops, and large network display servers. Since the X Window System is network and protocol independent, there are a wide variety of possible configurations for running X clients and servers on different machines connected by a network. XDM provides a graphical interface for choosing which display server to connect to, and entering authorization information such as a login and password combination. You may think of XDM as providing the same functionality to the user as the &man.getty.8; utility (see for details). That is, it performs system logins to the display being connected to and then runs a session manager on behalf of the user (usually an X window manager). XDM then waits for this program to exit, signaling that the user is done and should be logged out of the display. At this point, XDM can display the login and display chooser screens for the next user to login. Using XDM The XDM daemon program is located in /usr/X11R6/bin/xdm. You can run this program at any time as root and it will start managing the X display on the local machine. If you want XDM to run in the background every time the machine boots up, a convenient way to do this is by adding an entry to /etc/ttys. For more information about the format and usage of this file, see . There is a line in the default /etc/ttys file for running the XDM daemon on a virtual terminal: ttyv8 "/usr/X11R6/bin/xdm -nodaemon" xterm off secure By default this entry is disabled, and in order to enable it you will need to change field 5 from off to on and then restart &man.init.8; using the directions in . The first field, the name of the terminal this program will manage, is ttyv8. This means that XDM will start running on the 9th virtual terminal. Configuring XDM The XDM configuration directory is located in /usr/X11R6/lib/X11/xdm. In this directory you will see several files used to change the behavior and appearance of XDM. Typically you will find these files: File Description Xaccess Client authorization ruleset. Xresources Default X resource values. Xservers List of remote and local displays to manage. Xsession Default session script for logins. Xsetup_* xdm-config Global configuration for all displays running on this machine. xdm-errors Errors generated by the server program. xdm-pid The process ID of the currently running XDM. Also in this directory are a few scripts and programs used to setup the desktop when XDM is running. In the next few sections I will briefly describe the purpose of each of these files. The exact syntax and usage of all of these files is described in &man.xdm.1; The default configuration is a simple rectangular login window with the hostname of the machine displayed at the top in a large font and Login: and Password: prompts below. This is a good starting point if you are planning to design your own look and feel for the XDM screens. Xaccess The protocol for connecting to XDM controlled displays is called the X Display Manager Connection Protocol (XDMCP). This file is basically just a ruleset for controlling XDMCP connections from remote machines. By default, it allows any client to connect, but you will see this will not matter because the default xdm-config file does not listen for remote connections. Xresources This is an application-defaults file for the display chooser and the login screens. This is where you can customize the appearance of the login program. The format is identical to the app-defaults file described in the XFree86 documentation. Xservers This is a list of the remote displays the chooser should provide as choices. Xsession This is the default session script for XDM to run after a user has logged in. Normally each user will have a customized session script in ~/.xsessionrc that overrides this script. Xsetup_* These files contain scripts that will be run automatically before displaying the chooser or login interfaces. There is a script for each display being used, named Xsetup_followed by the local display number (for instance Xsetup_0). Typically these scripts will run one or two programs in the background such as xconsole. xdm-config This file contains settings in the form of app-defaults that are applicable to every display that this installation manages. xdm-errors This file contains the output of the X servers that XDM is trying to run. If a display that XDM is trying to start hangs for some reason, this is a good place to look for error messages. These messages are also written to the user's ~/.xsession-errors file on a per-session basis Running a Network Display Server In order for other clients to connect to your display server, you will need to edit the access control rules, and enable the connection listener. By default these are set to conservative values, which is a good decision security-wise. To get XDM to listen for connections first comment out a line in the xdm-config file: ! SECURITY: do not listen for XDMCP or Chooser requests ! Comment out this line if you want to manage X terminals with xdm DisplayManager.requestPort: 0 and then restart XDM. Remember that comments in app-defaults files begin with a ! character, not a #. After this, you may need to put more strict access controls in place. Look at the example entries in Xaccess file, and refer to the &man.xdm.1; manual page. Replacements for XDM Several replacements for the default XDM program exist. One of them, KDM (bundled with KDE) is described in a later section. Apart from various visual improvements and cosmetic frills, it can be easily configured to let users choose their window manager of choice at the time they log in. Valentino Vaschetto Contributed by Desktop Environments This section describes the different desktop environments available for X-Windows on FreeBSD. For our purposes a "desktop environment" will mean anything ranging from a simple window manager, to a complete suite of desktop applications such as KDE or GNOME. GNOME About GNOME GNOME is a user-friendly desktop environment that enables users to easily use and configure their computers. GNOME includes a panel (for starting applications and displaying status), a desktop (where data and applications can be placed), a set of standard desktop tools and applications, and a set of conventions that make it easy for applications to cooperate and be consistent with each other. Users of other operating systems or environments should feel right at home using the powerful graphics-driven environment that GNOME provides. Installing GNOME To install GNOME from the network, simply type: &prompt.root; pkg_add -r gnome If you would rather build GNOME from source, then use the ports tree: &prompt.root; cd /usr/ports/x11/gnome &prompt.root; make install clean Once GNOME is installed, we must have the X server start GNOME instead of a default window manager. If you have already customized your .xinitrc file then you should simply replace the line that starts your current window manager with one that starts /usr/X11R6/bin/gnome-session instead. If you haven't added anything special to your configuration file, then it is enough to simply type: &prompt.root; echo "/usr/X11R6/bin/gnome-session" > ~/.xinitrc That's it. Type startx and you will be in the GNOME desktop environment. If you're running a display manager like XDM, this will not work. Instead, you should create an executable .xsession file with the same command in it. To do this, edit your file (if you already have one) and replace the existing window manager command with /usr/X11R6/bin/gnome-session; or else, &prompt.root; echo "#!/bin/sh" > ~/.xsession &prompt.root; echo "/usr/X11R6/bin/gnome-session" >> ~/.xsession &prompt.root; chmod +x ~/.xsession Another option is to configure your display manager to allow choosing the window manager at login time; the section on KDE2 details explains how to do this for kdm, the display manager of KDE. KDE2 About KDE2 KDE is an easy to use contemporary desktop environment. Some of the things that KDE brings to the user are: A beautiful contemporary desktop A desktop exhibiting complete network transparency An integrated help system allowing for convenient, consistent access to help on the use of the KDE desktop and its applications Consistent look and feel of all KDE applications Standardized menu and toolbars, keybindings, color-schemes, etc. Internationalization: KDE is available in more than 40 languages Centralized consisted dialog driven desktop configuration A great number of useful KDE applications KDE has an office application suite based on KDE's KParts technology consisting of a spread-sheet, a presentation application, an organizer, a news client and more. KDE is also comes with a web browser called Konqeuror, which represents already a solid competitor to other existing web browsers on Unix systems. More information on KDE can be found on the KDE website Installing KDE2 At the time of writing, a package for kde2 doesn't exist yet. No problem! The ports tree hides all the complexity of building a package from source. To install KDE2, do this : &prompt.root; cd /usr/ports/x11/kde2 &prompt.root; make install clean This command will fetch all the necessary files from the Internet, configure and compile KDE2, install the applications, and then clean up after itself. Now you're going to have to tell the X server to launch KDE2 instead of a default window manager. Do this by typing this: &prompt.root; echo "/usr/X11R6/bin/startkde" > ~/.xinitrc Now, whenever you go into X-Windows, KDE2 will be your desktop. (Note: this will not work if you're logging in via a display manager like xdm. In that case you have two options: create an .xsession file as described in the section on GNOME, but with the /usr/X11R6/bin/startkde command instead of the gnome-session command; or, configure your display manager to allow choosing a desktop at login time. Below it is explained how to do this for kdm, KDE's display manager.) More Details on KDE2 Now that KDE2 is installed on your system, you'll find that you can learn a lot from its help pages, or just by pointing and clicking at various menus. Windows or Mac users will feel quite at home. The best reference for KDE is the on-line documentation. KDE comes with its own web browser, Konqueror, dozens of useful applications, and extensive documentation. This section only discusses somewhat technical things which are difficult to learn just by random exploration. The KDE display manager If you're an administrator on a multi-user system, you may like to have a graphical login screen to welcome users. You can use xdm, as described earlier. However, KDE includes an alternative, KDM, which is designed to look more attractive and include more login-time options. In particular, users can easily choose (via a menu) which desktop environment (KDE2, GNOME, or something else) to run after logging on. If you're slightly adventurous and you want this added flexibility and visual appeal, read on. To begin with, run the KDE2 control panel, kcontrol, as root. Note: it is generally considered unsafe to run your entire X environment as root. Instead, run your window manager as a normal user, open a terminal window (such as xterm or KDE's konsole, become root with su (you need to be in the wheel group in /etc/group for this), and then type kcontrol. Click on the icon on the left marked "System", then on "Login manager". On the right you'll see various configurable options, which the KDE manual will explain in greater detail. Click on "sessions" on the right. Depending on what window managers or desktop environments you have currently installed, you can type their names in "New type" and add them. (These are just labels so far, not commands, so you can write KDE and GNOME rather than startkde or gnome-session.) Include a label failsafe. Play with the other menus as you like (those are mainly cosmetic and self-explanatory). When you're done, click on "Apply" at the bottom, and quit the control center. To make sure kdm understands what your above labels (KDE, GNOME etc) mean, you need to edit some more files: the same ones used by xdm. In your terminal window, as root, edit the file /usr/X11R6/lib/X11/xdm/Xsession. You will come across a section in the middle looking like this (by default): case $# in 1) case $1 in failsafe) exec xterm -geometry 80x24-0-0 ;; esac esac You will need to add a few lines to this section. Assuming the labels you gave earlier were KDE2 and GNOME, the following will do: case $# in 1) case $1 in KDE2) exec /usr/X11R6/bin/startkde ;; GNOME) exec /usr/X11R6/bin/gnome-session ;; failsafe) exec xterm -geometry 80x24-0-0 ;; esac esac To make sure your KDE choice of a login-time desktop background is also honored, you will need to add the following line to /usr/X11R6/lib/X11/xdm/Xsetup_0: /usr/X11R6/bin/kdmdesktop Now, you need only to make sure kdm is started at the next bootup. To learn how to do this, read the section on xdm, and do the same thing replacing references to the xdm program by kdm. That's it. Your next login screen should have a pretty face and lots of menus. Anti-aliased Fonts Tired of blocky staircase edges to your fonts under X11? Tired of unreadable text in web browsers? Well, no more. Starting with version 4.0.2, XFree86 supports anti-aliasing via its "RENDER" extension, and starting with version 2.3, Qt (the toolkit used by KDE) supports this extension. Configuring this is described in on antialiasing X11 fonts. So if you're running up-to-date software, anti-aliasing is possible on your KDE2 desktop. Just go to your KDE2 menu, go to Preferences -> Look and Feel -> Style, and click on the checkbox "Use Anti-Aliasing for Fonts and Icons". That's all. If you're running a Qt application which is not part of KDE, you may need to set the environment variable QT_XFT to true before starting your program. XFCE About XFCE XFCE is based on the gtk+ toolkit used by GNOME, but is much more lightweight and meant for those who want a simple, efficient desktop which is nevertheless easy to use and configure. Visually, it looks very much like CDE, found on commercial Unix systems. Some of XFCE's features are: A simple, easy-to-handle desktop Fully configurable via mouse, with drag and drop, etc Main panel similar to CDE, with menus, applets and app launchers Integrated window manager, file manager, sound manager, GNOME compliance module, and other things Themeable (since it uses gtk+) Fast, light and efficient: ideal for older/slower machines or machines with memory limitations More information on XFCE can be found on the XFCE website. Installing XFCE A binary package for xfce exists (at the time of writing). To install, simply do this: &prompt.root; pkg_add -r xfce Alternatively, you may prefer to build from source. The ports tree comes to the rescue again: &prompt.root; cd /usr/ports/x11-wm/xfce &prompt.root; make install clean All necessary source packages (including dependencies) will be automagically fetched, built and installed, and the build areas cleaned up afterwards. Now you want to tell the X server to launch XFCE the next time you start X. Simply type this: &prompt.root; echo "/usr/X11R6/bin/startxfce" > ~/.xinitrc The next time you start X, XFCE will be your desktop. (Note, as before: if you're logging in via a display manager like xdm, you should either create an .xsession, as described in the section on GNOME, but with the /usr/X11R6/bin/startxfce command; or, configure your display manager to allow choosing a desktop at login time, as explained in the section on kdm.)