mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
ed00d8e519
pfsense/conf.default/config.xml
Matthew Grooms 45ee90edb3 Rewrite portions of the user manager to ensure data is properly synced to 
the system password and group databases. This is to provide better support
for centralized user management when local account administration is
preferred.

I also took this opportunity to do some housekeeping. A lot of funtions
that were only being used in one place or not at all were removed. The
user page privelege checks were also simplified in preperation for future
work in this area.
2008-07-25 02:28:31 +00:00

773 lines
17 KiB
XML
Raw Blame History

<?xml version="1.0"?>
<!-- pfSense default system configuration -->
<pfsense>
<version>2.9</version>
<lastchange></lastchange>
<theme>nervecenter</theme>
<sysctl>
<item>
<desc>Set the ephemeral port range to be lower.</desc>
<tunable>net.inet.ip.portrange.first</tunable>
<value>1024</value>
</item>
<item>
<desc>Drop packets to closed TCP ports without returning a RST</desc>
<tunable>net.inet.tcp.blackhole</tunable>
<value>2</value>
</item>
<item>
<desc>Do not send ICMP port unreachable messages for closed UDP ports</desc>
<tunable>net.inet.udp.blackhole</tunable>
<value>1</value>
</item>
<item>
<desc>Randomize the ID field in IP packets (default is 0: sequential IP IDs)</desc>
<tunable>net.inet.ip.random_id</tunable>
<value>1</value>
</item>
<item>
<desc>Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)</desc>
<tunable>net.inet.tcp.drop_synfin</tunable>
<value>1</value>
</item>
<item>
<desc>Enable sending IPv4 redirects</desc>
<tunable>net.inet.ip.redirect</tunable>
<value>1</value>
</item>
<item>
<desc>Enable sending IPv6 redirects</desc>
<tunable>net.inet6.ip6.redirect</tunable>
<value>1</value>
</item>
<item>
<desc>Generate SYN cookies for outbound SYN-ACK packets</desc>
<tunable>net.inet.tcp.syncookies</tunable>
<value>1</value>
</item>
<item>
<desc>Maximum incoming/outgoing TCP datagram size (receive)</desc>
<tunable>net.inet.tcp.recvspace</tunable>
<value>65228</value>
</item>
<item>
<desc>Maximum incoming/outgoing TCP datagram size (send)</desc>
<tunable>net.inet.tcp.sendspace</tunable>
<value>65228</value>
</item>
<item>
<desc>IP Fastforwarding</desc>
<tunable>net.inet.ip.fastforwarding</tunable>
<value>1</value>
</item>
<item>
<desc>Do not delay ACK to try and piggyback it onto a data packet</desc>
<tunable>net.inet.tcp.delayed_ack</tunable>
<value>0</value>
</item>
<item>
<desc>Maximum outgoing UDP datagram size</desc>
<tunable>net.inet.udp.maxdgram</tunable>
<value>57344</value>
</item>
<item>
<desc>Handling of non-IP packets which are not passed to pfil (see if_bridge(4))</desc>
<tunable>net.link.bridge.pfil_onlyip</tunable>
<value>0</value>
</item>
<item>
<desc>Allow unprivileged access to tap(4) device nodes</desc>
<tunable>net.link.tap.user_open</tunable>
<value>1</value>
</item>
<item>
<desc>Verbosity of the rndtest driver (0: do not display results on console)</desc>
<tunable>kern.rndtest.verbose</tunable>
<value>0</value>
</item>
<item>
<desc>Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())</desc>
<tunable>kern.randompid</tunable>
<value>347</value>
</item>
<item>
<desc>Maximum size of the IP input queue</desc>
<tunable>net.inet.ip.intr_queue_maxlen</tunable>
<value>1000</value>
</item>
<item>
<desc>Disable CTRL+ALT+Delete reboot from keyboard.</desc>
<tunable>hw.syscons.kbd_reboot</tunable>
<value>0</value>
</item>
<item>
<desc>Enable TCP Inflight mode</desc>
<tunable>net.inet.tcp.inflight.enable</tunable>
<value>1</value>
</item>
</sysctl>
<system>
<optimization>normal</optimization>
<hostname>pfSense</hostname>
<domain>local</domain>
<dnsserver></dnsserver>
<dnsallowoverride/>
<group>
<name>all</name>
<description>All Users</description>
<scope>system</scope>
</pages>
<gid>1998</gid>
</group>
<group>
<name>admins</name>
<description>System Administrators</description>
<scope>system</scope>
<pages>ANY</pages>
<gid>1999</gid>
</group>
<user>
<name>admin</name>
<fullname>System Administrator</fullname>
<scope>system</scope>
<groupname>admins</groupname>
<password>$1$dSJImFph$GvZ7.1UbuWu.Yb8etC0re.</password>
<uid>0</uid>
<priv>
<id>lockwc</id>
<name>Lock webConfigurator</name>
<descr>Indicates whether this user will lock access to the webConfigurator for other users.</descr>
</priv>
<priv>
<id>lock-ipages</id>
<name>Lock individual pages</name>
<descr>Indicates whether this user will lock individual HTML pages after having accessed a particular page(the lock will be freed if the user leaves or saves the page form).</descr>
</priv>
<priv>
<id>hasshell</id>
<name>Has shell access</name>
<descr>Indicates whether this user is able to login for example via SSH.</descr>
</priv>
<priv>
<id>isroot</id>
<name>Is root user</name>
<descr>This user is associated with the UNIX root user (you should associate this privilege only with one single user).</descr>
</priv>
</user>
<nextuid>2000</nextuid>
<nextgid>2000</nextgid>
<timezone>Etc/UTC</timezone>
<time-update-interval>300</time-update-interval>
<timeservers>0.pfsense.pool.ntp.org</timeservers>
<webgui>
<protocol>http</protocol>
<!--
<port></port>
<certificate></certificate>
<private-key></private-key>
<noassigninterfaces/>
<expanddiags/>
<noantilockout></noantilockout>
-->
</webgui>
<disablenatreflection>yes</disablenatreflection>
<!-- <disableconsolemenu/> -->
<!-- <disablefirmwarecheck/> -->
<!-- <shellcmd></shellcmd> -->
<!-- <earlyshellcmd></earlyshellcmd> -->
<!-- <harddiskstandby></harddiskstandby> -->
</system>
<interfaces>
<lan>
<if>sis0</if>
<ipaddr>192.168.1.1</ipaddr>
<subnet>24</subnet>
<media></media>
<mediaopt></mediaopt>
<bandwidth>100</bandwidth>
<bandwidthtype>Mb</bandwidthtype>
<!--
<wireless>
*see below (opt[n])*
</wireless>
-->
</lan>
<wan>
<if>sis1</if>
<mtu></mtu>
<ipaddr>dhcp</ipaddr>
<!-- *or* ipv4-address *or* 'pppoe' *or* 'pptp' *or* 'bigpond' -->
<subnet></subnet>
<gateway></gateway>
<blockpriv/>
<disableftpproxy/>
<dhcphostname></dhcphostname>
<media></media>
<mediaopt></mediaopt>
<bandwidth>100</bandwidth>
<bandwidthtype>Mb</bandwidthtype>
<!--
<wireless>
*see below (opt[n])*
</wireless>
-->
</wan>
<!--
<opt[n]>
<enable/>
<descr></descr>
<if></if>
<ipaddr></ipaddr>
<subnet></subnet>
<media></media>
<mediaopt></mediaopt>
<bridge>lan|wan|opt[n]</bridge>
<wireless>
<mode>hostap *or* bss *or* ibss</mode>
<ssid></ssid>
<channel></channel>
<wep>
<enable/>
<key>
<txkey/>
<value></value>
</key>
</wep>
</wireless>
</opt[n]>
-->
</interfaces>
<!--
<vlans>
<vlan>
<tag></tag>
<if></if>
<descr></descr>
</vlan>
</vlans>
-->
<staticroutes>
<!--
<route>
<interface>lan|opt[n]|pptp</interface>
<network>xxx.xxx.xxx.xxx/xx</network>
<gateway>xxx.xxx.xxx.xxx</gateway>
<descr></descr>
</route>
-->
</staticroutes>
<pppoe>
<username></username>
<password></password>
<provider></provider>
<!--
<ondemand/>
<timeout></timeout>
-->
</pppoe>
<pptp>
<username></username>
<password></password>
<local></local>
<subnet></subnet>
<remote></remote>
<!--
<ondemand/>
<timeout></timeout>
-->
</pptp>
<bigpond>
<username></username>
<password></password>
<authserver></authserver>
<authdomain></authdomain>
<minheartbeatinterval></minheartbeatinterval>
</bigpond>
<dyndns>
<!-- <enable/> -->
<type>dyndns</type>
<username></username>
<password></password>
<host></host>
<mx></mx>
<!-- <wildcard/> -->
</dyndns>
<dhcpd>
<lan>
<enable/>
<range>
<from>192.168.1.100</from>
<to>192.168.1.199</to>
</range>
<!--
<winsserver>xxx.xxx.xxx.xxx</winsserver>
<defaultleasetime></defaultleasetime>
<maxleasetime></maxleasetime>
<gateway>xxx.xxx.xxx.xxx</gateway>
<domain></domain>
<dnsserver></dnsserver>
<ntpserver>xxx.xxx.xxx.xxx</ntpserver>
<next-server></next-server>
<filename></filename>
-->
</lan>
<!--
<opt[n]>
...
</opt[n]>
-->
<!--
<staticmap>
<mac>xx:xx:xx:xx:xx:xx</mac>
<ipaddr>xxx.xxx.xxx.xxx</ipaddr>
<descr></descr>
</staticmap>
-->
</dhcpd>
<pptpd>
<mode><!-- off *or* server *or* redir --></mode>
<redir></redir>
<localip></localip>
<remoteip></remoteip>
<!-- <accounting/> -->
<!--
<user>
<name></name>
<password></password>
</user>
-->
</pptpd>
<ovpn>
<!--
<server>
<enable/>
<ca_cert></ca_cert>
<srv_cert></srv_cert>
<srv_key></srv_key>
<dh_param></dh_param>
<verb></verb>
<tun_iface></tun_iface>
<port></port>
<bind_iface></bind_iface>
<cli2cli/>
<maxcli></maxcli>
<prefix></prefix>
<ipblock></ipblock>
<crypto></crypto>
<dupcn/>
<psh_options>
<redir></redir>
<redir_loc></redir_loc>
<rte_delay></rte_delay>
<ping></ping>
<pingrst></pingrst>
<pingexit></pingexit>
<inact></inact>
</psh_options>
</server>
<client>
<tunnel></tunnel>
<ca_cert></ca_cert>
<cli_cert></cli_cert>
<cli_key></cli_key>
<type></type>
<tunnel>
<if></if>
<proto></proto>
<cport></cport>
<saddr></saddr>
<sport></sport>
<crypto></crypto>
</tunnel>
</client>
-->
</ovpn>
<dnsmasq>
<enable/>
<!--
<hosts>
<host></host>
<domain></domain>
<ip></ip>
<descr></descr>
</hosts>
-->
</dnsmasq>
<snmpd>
<!-- <enable/> -->
<syslocation></syslocation>
<syscontact></syscontact>
<rocommunity>public</rocommunity>
</snmpd>
<diag>
<ipv6nat>
<!-- <enable/> -->
<ipaddr></ipaddr>
</ipv6nat>
</diag>
<bridge>
<!-- <filteringbridge/> -->
</bridge>
<syslog>
<!--
<reverse/>
<enable/>
<remoteserver>xxx.xxx.xxx.xxx</remoteserver>
<filter/>
<dhcp/>
<system/>
<nologdefaultblock/>
-->
</syslog>
<!--
<captiveportal>
<enable/>
<interface>lan|opt[n]</interface>
<idletimeout>minutes</idletimeout>
<timeout>minutes</timeout>
<page>
<htmltext></htmltext>
<errtext></errtext>
</page>
<httpslogin/>
<httpsname></httpsname>
<certificate></certificate>
<private-key></private-key>
<redirurl></redirurl>
<radiusip></radiusip>
<radiusport></radiusport>
<radiuskey></radiuskey>
<nomacfilter/>
</captiveportal>
-->
<nat>
<ipsecpassthru>
<enable/>
</ipsecpassthru>
<!--
<rule>
<interface></interface>
<external-address></external-address>
<protocol></protocol>
<external-port></external-port>
<target></target>
<local-port></local-port>
<descr></descr>
</rule>
-->
<!--
<onetoone>
<interface></interface>
<external>xxx.xxx.xxx.xxx</external>
<internal>xxx.xxx.xxx.xxx</internal>
<subnet></subnet>
<descr></descr>
</onetoone>
-->
<!--
<advancedoutbound>
<enable/>
<rule>
<interface></interface>
<source>
<network>xxx.xxx.xxx.xxx/xx</network>
</source>
<destination>
<not/>
<any/>
*or*
<network>xxx.xxx.xxx.xxx/xx</network>
</destination>
<target>xxx.xxx.xxx.xxx</target>
<descr></descr>
</rule>
</advancedoutbound>
-->
<!--
<servernat>
<ipaddr></ipaddr>
<descr></descr>
</servernat>
-->
</nat>
<filter>
<!-- <tcpidletimeout></tcpidletimeout> -->
<rule>
<type>pass</type>
<descr>Default LAN -&gt; any</descr>
<interface>lan</interface>
<source>
<network>lan</network>
</source>
<destination>
<any/>
</destination>
</rule>
<!-- rule syntax:
<rule>
<disabled/>
<type>pass|block|reject</type>
<descr>...</descr>
<interface>lan|opt[n]|wan|pptp</interface>
<protocol>tcp|udp|tcp/udp|...</protocol>
<icmptype></icmptype>
<source>
<not/>
<address>xxx.xxx.xxx.xxx(/xx) or alias</address>
*or*
<network>lan|opt[n]|pptp</network>
*or*
<any/>
<port>a[-b]</port>
</source>
<destination>
*same as for source*
</destination>
<frags/>
<log/>
</rule>
-->
</filter>
<shaper>
<!-- <enable/> -->
<!-- <schedulertype>hfsc</schedulertype> -->
<!-- rule syntax:
<rule>
<disabled/>
<descr></descr>
<targetpipe>number (zero based)</targetpipe>
*or*
<targetqueue>number (zero based)</targetqueue>
<interface>lan|wan|opt[n]|pptp</interface>
<protocol>tcp|udp</protocol>
<direction>in|out</direction>
<source>
<not/>
<address>xxx.xxx.xxx.xxx(/xx)</address>
*or*
<network>lan|opt[n]|pptp</network>
*or*
<any/>
<port>a[-b]</port>
</source>
<destination>
*same as for source*
</destination>
<iplen>from[-to]</iplen>
<iptos>(!)lowdelay,throughput,reliability,mincost,congestion</iptos>
<tcpflags>(!)fin,syn,rst,psh,ack,urg</tcpflags>
</rule>
<pipe>
<descr></descr>
<bandwidth></bandwidth>
<delay></delay>
<mask>source|destination</mask>
</pipe>
<queue>
<descr></descr>
<targetpipe>number (zero based)</targetpipe>
<weight></weight>
<mask>source|destination</mask>
</queue>
-->
</shaper>
<ipsec>
<preferredoldsa/>
<!-- <enable/> -->
<!-- syntax:
<tunnel>
<disabled/>
<auto/>
<descr></descr>
<interface>lan|wan|opt[n]</interface>
<local-subnet>
<address>xxx.xxx.xxx.xxx(/xx)</address>
*or*
<network>lan|opt[n]</network>
</local-subnet>
<remote-subnet>xxx.xxx.xxx.xxx/xx</remote-subnet>
<remote-gateway></remote-gateway>
<p1>
<mode></mode>
<myident>
<myaddress/>
*or*
<address>xxx.xxx.xxx.xxx</address>
*or*
<fqdn>the.fq.dn</fqdn>
</myident>
<encryption-algorithm></encryption-algorithm>
<hash-algorithm></hash-algorithm>
<dhgroup></dhgroup>
<lifetime></lifetime>
<pre-shared-key></pre-shared-key>
</p1>
<p2>
<protocol></protocol>
<encryption-algorithm-option></encryption-algorithm-option>
<hash-algorithm-option></hash-algorithm-option>
<pfsgroup></pfsgroup>
<lifetime></lifetime>
</p2>
</tunnel>
<mobileclients>
<enable/>
<p1>
<mode></mode>
<myident>
<myaddress/>
*or*
<address>xxx.xxx.xxx.xxx</address>
*or*
<fqdn>the.fq.dn</fqdn>
</myident>
<encryption-algorithm></encryption-algorithm>
<hash-algorithm></hash-algorithm>
<dhgroup></dhgroup>
<lifetime></lifetime>
</p1>
<p2>
<protocol></protocol>
<encryption-algorithm-option></encryption-algorithm-option>
<hash-algorithm-option></hash-algorithm-option>
<pfsgroup></pfsgroup>
<lifetime></lifetime>
</p2>
</mobileclients>
<mobilekey>
<ident></ident>
<pre-shared-key></pre-shared-key>
</mobilekey>
-->
</ipsec>
<aliases>
<!--
<alias>
<name></name>
<address>xxx.xxx.xxx.xxx(/xx)</address>
<descr></descr>
</alias>
-->
</aliases>
<proxyarp>
<!--
<proxyarpnet>
<network>xxx.xxx.xxx.xxx/xx</network>
*or*
<range>
<from>xxx.xxx.xxx.xxx</from>
<to>xxx.xxx.xxx.xxx</to>
</range>
</proxyarpnet>
-->
</proxyarp>
<cron>
<item>
<minute>0</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 newsyslog</command>
</item>
<item>
<minute>1,31</minute>
<hour>0-5</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 adjkerntz -a</command>
</item>
<item>
<minute>1</minute>
<hour>3</hour>
<mday>1</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /etc/rc.update_bogons.sh</command>
</item>
<item>
<minute>*/60</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 sshlockout</command>
</item>
<item>
<minute>1</minute>
<hour>1</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /etc/rc.dyndns.update</command>
</item>
<item>
<minute>*/60</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot</command>
</item>
<item>
<minute>*/60</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -t 3600 snort2c</command>
</item>
<item>
<minute>*/5</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/local/bin/checkreload.sh</command>
</item>
<item>
<minute>*/5</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/etc/ping_hosts.sh</command>
</item>
<item>
<minute>*/140</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/local/sbin/reset_slbd.sh</command>
</item>
</cron>
<wol>
<!--
<wolentry>
<interface>lan|opt[n]</interface>
<mac>xx:xx:xx:xx:xx:xx</mac>
<descr></descr>
</wolentry>
-->
</wol>
</pfsense>
Reference in New Issue View Git Blame Copy Permalink