# ./configure --prefix=/usr/local/cfengine (기본은 /usr/local 에 설치) 
# make 
# make check (셀프 테스트) 
# make install

# yum -y install db4-devel openssl-devel

> ./sbin/cfagent
> ./sbin/cfservd
> ./sbin/cfrun
> ./sbin/cfkey
> ./sbin/cfenvd
> ./sbin/cfenvgraph
> ./sbin/cfexecd
> ./sbin/cfshow
> ./sbin/cfetool
> ./sbin/cfetoolgraph
> ./sbin/cfdoc
21a33,57
> ./share/cfengine
> ./share/cfengine/cfengine.el
> ./share/cfengine/cf.chflags.example
> ./share/cfengine/cf.freebsd.example
> ./share/cfengine/cf.ftp.example
> ./share/cfengine/cf.groups.example
> ./share/cfengine/cf.linux.example
> ./share/cfengine/cf.main.example
> ./share/cfengine/cf.motd.example
> ./share/cfengine/cf.preconf.example
> ./share/cfengine/cf.services.example
> ./share/cfengine/cf.site.example
> ./share/cfengine/cf.solaris.example
> ./share/cfengine/cf.sun4.example
> ./share/cfengine/cf.users.example
> ./share/cfengine/cfservd.conf.example
> ./share/cfengine/cfagent.conf.example
> ./share/cfengine/cfagent.conf-advanced.example
> ./share/cfengine/update.conf.example
> ./share/cfengine/cfrc.example
> ./share/cfengine/cfrun.hosts.example
> ./share/cfengine/README
> ./share/cfengine/ChangeLog
> ./share/cfengine/INSTALL
> ./share/cfengine/NEWS

##################################################
# 
#  cfagent.conf
#
#  This is a simple file for getting started with
#  cfengine. It is harmless. If you get cfengine
#  running with this file, you can build on it.
#
##################################################

###
#
# BEGIN cfagent.conf (Only hard classes in this file )
#
###

classes:
# cfengine master server
master_server = ( cfengine.tunelinux.pe.kr )

# server group
testingservers = ( cent.tunelinux.pe.kr cent2.tunelinux.pe.kr )
#testingservers = ( cent2.tunelinux.pe.kr )
webhosting = ( cent.tunelinux.pe.kr )
mailhosting = ( '/usr/bin/test -d /var/qmail' )
dnshosting = ( '/usr/bin/test -f /etc/named.conf' )
dnsservers = ( '/usr/bin/test -f /etc/named.conf' )
intraservers = ( cfengine.tunelinux.pe.kr intranet.tunelinux.pe.kr project.tunelinux.pe.kr )

#intra_ip_range = ( IPRange(111.112.137.1-100) )
intra_ip_range = ( IPRange(111.112.137.0/24) )

# tune servers
tuneservers = ( testingservers webhosting mailhosting dnshosting intraservers intra_ip_range )

# specific server
centosservers = ( '/usr/bin/test -d /usr/share/doc/centos-release-4' )
cfengineservers = ( '/usr/bin/test -f /usr/sbin/cfagent' )
yumservers = ( '/usr/bin/test -f /etc/yum.repos.d/CentOS-Base.repo' )
techlabservers = ( 111.112.137.141 techlab.tunelinux.pe.kr )

##################################################
control:

   domain         = ( tunelinux.pe.kr )
   timezone       = ( MET )

   smtpserver     = ( localhost )  # used by cfexecd
   sysadm         = ( joon@tunelinux.pe.kr )     # where to mail output

#   IfElapsed = ( 0 )

   schedule = ( Hr00 )

   ChecksumUpdates = ( on )

# cfengine tune repogitory
   master_files = ( /usr/local/var/cfengine/tune )
   master_server = ( cfengine.tunelinux.pe.kr )
# html repogitory
   html_files = ( /var/www/html/tune )

# security check
   SpoolDirectories = ( /var/spool/mail /var/spool/cron )
   WarnNonOwnerMail = ( true )
   WarnNonUserMail = ( true )
#!techlabservers::
#   NonAlphaNumFiles = ( on )

   actionsequence = ( disable copy editfiles files shellcommands directories tidy processes )

##################################################
 
resolve:
   # Add these name servers to the /etc/resolv.conf file
     210.220.163.82      # local nameserver
     210.94.6.67     # backup nameserver

##################################################
# 111.112.137 tune intra
# 222.239.157 IDC monitor
# 66.600.5 IDC intra

editfiles:
{ 
	/etc/crontab 
	AppendIfNoSuchLine "* 0 * * * root /usr/bin/rdate -s time.bora.net && /sbin/hwclock -w"
}

tuneservers::
{
	/etc/security/access.conf
	AppendIfNoSuchLine "-:root:All EXCEPT LOCAL localhost.localdomain 111.112.137. 222.239.157. 66.600.5."
}

{
	/etc/pam.d/sshd
	AppendIfNoSuchLine "account    required     pam_access.so"
}

{
	/etc/vsftpd/vsftpd.conf	
	ReplaceAll "anonymous_enable=YES" With "anonymous_enable=NO"
	DefineClasses "modified_ftp"
}

intraservers|intra_ip_range::
{
	/etc/aliases	
	AppendIfNoSuchLine "root:		joon@tunelinux.pe.kr"
	DefineClasses "modified_aliases"
}

centosservers::
{ 
	/etc/updatedb.conf
	ReplaceAll "DAILY_UPDATE=no" With "DAILY_UPDATE=yes"
}

tuneservers.cfengineservers::
{ 
	/etc/crontab 
	AppendIfNoSuchLine "* 0 * * * root /usr/sbin/cfexecd -F"
}

intra_ip_range|testingservers::
{
	/etc/bashrc
	AppendIfNoSuchLine "alias ll='ls -alF'"
}

##################################################

copy:

 #  Get a file from some trusted server, e.g. password sync
 #  To do this, you need to use cfkey to install keys

# tune yum repository
tuneservers::
$(master_files)/tune.repo dest=/etc/yum.repos.d/tune.repo mode=644 server=$(master_server)

# master file copy
master_server::
	/etc/hosts dest=$(master_files)/hosts backup=true
	/usr/local/var/cfengine/inputs/update.conf dest=$(html_files)/update.conf mode=644 
	$(master_files)/tune.repo dest=$(html_files)/tune.repo mode=644 server=$(master_server)

# iptables
intra_ip_range|intraservers::
	$(master_files)/intra-iptables dest=/etc/sysconfig/iptables mode=600 server=$(master_server) backup=true define=modified_iptables

testingservers.!master_server::
	$(master_files)/hosts dest=/etc/hosts mode=644 server=$(master_server) backup=true

##################################################

files:

tuneservers::
# file check
   /tmp mode=ugo-x recurse=inf action=fixall syslog=true inform=true
   /var/tmp mode=ugo-x recurse=inf action=fixall syslog=true inform=true
   /proc mode=700 owner=root action=fixall
# password 
   /etc/passwd mode=644 owner=root action=fixall checksum=md5 syslog=true inform=true
   /etc/shadow mode=600 owner=root action=fixall checksum=md5 syslog=true inform=true
   /etc/group  mode=644 owner=root action=fixall checksum=md5 syslog=true inform=true

#cfengine program file
cfengineservers::
   /usr/sbin   mode=700 owner=root action=fixall include=cf* recurse=inf 

##################################################

shellcommands:

# security check
# "/usr/bin/find /tmp/ '(' -nouser -o -nogroup ')' "
tuneservers.yumservers::
      "/bin/rm -f /etc/yum.repos.d/CentOS-*" 

tuneservers.yumservers.Sunday.Hr00::
      "/usr/bin/yum clean all"

modified_ftp::
	"/etc/init.d/vsftpd restart" 

modified_iptables::
	"/etc/init.d/iptables restart" 

modified_aliases::
	"/usr/bin/newaliases && /etc/init.d/sendmail restart && /sbin/chkconfig --level 345 sendmail on" 

any.Hr07::
	"/usr/bin/rdate -s time.bora.net && /sbin/hwclock -w" timeout=30

##################################################

directories:
#	/tmp mode=1777 owner=root group=root syslog=true inform=true

tidy:
#tuneservers.intra_ip_range::
tuneservers::
	/tmp recurse=inf pattern=* age=7 rmdirs=sub syslog=true inform=true
	/var/tmp recurse=inf pattern=* age=7 rmdirs=sub syslog=true inform=true
	/home  	recurse=inf 
		pat=core 
		pat=a.out
		pat=*.o
		age=1 
		rmdirs=sub 
		syslog=true 
		inform=true
#		pat=*%
#		pat=#*

disable:
tuneservers::
	/root/.rhosts syslog=true inform=true
	/etc/hosts.equiv syslog=true inform=true

##################################################

processes:
#   "xinetd"  signal=hup
#   "httpd"    signal=kill
#	"cfservd" signal=hup
#   	"cexecd"  signal=hup
tuneservers.cfengineservers::
   "cfexecd" restart "/usr/sbin/cfexecd"
   "cfservd" restart "/usr/sbin/cfservd"

###
#
# END cfagent.conf
#
###

#########################################################
#
# This is a cfd config file
#
# The access control here follows after any tcpd
# control in /etc/hosts.allow and /etc/hosts.deny
#
#########################################################

 #
 # Could import cf.groups here and use a structure like
 # in cfengine.conf, cf.main, cf.groups
 #

control:

  domain = ( tunelinux.pe.kr )

  AllowUsers = ( root )

  linux::

     cfrunCommand  = ( "/var/cfengine/bin/cfagent" )

  any::

#  ChecksumDatabase = ( /tmp/testDATABASEcache )

  IfElapsed = ( 1 )

  MaxConnections = ( 30 )

# access control
          Split = ( " " )
          hostlist = ( "111.112.137 222.239.157 66.600.5" )
#         hostlist = ( "111.112.137.162" )
          dirs = ( "inputs tune" )
          base = ( /usr/local/var/cfengine )

#########################################################

admit:   # or grant:

   $(base)/$(dirs)  $(hostlist)
#   /usr/local/var/cfengine/inputs *
#   /usr/local/var/cfengine/tune *

#######################################################
#
# cf.update - for iu.hio.no
#
#######################################################

###
#
# BEGIN cf.update
#
###

#######################################################################
#
# This script distributes the configuration, a simple file so that,
# if there are syntax errors in the main config, we can still
# distribute a correct configuration to the machines afterwards, even
# though the main config won't parse. It is read and run just before the
# main configuration is parsed.
#
#######################################################################

control:

   actionsequence  = ( copy processes tidy )  # Keep this simple and constant

   domain          = ( tunelinux.pe.kr )  # Needed for remote copy

   #
   # Which host/dir is the master for configuration roll-outs?
   #

   policyhost      = ( cfengine.tunelinux.pe.kr )
   master_cfinput  = ( /usr/local/var/cfengine/inputs ) 

   AddInstallable = ( new_cfenvd new_cfservd )

   #
   # Some convenient variables
   #

   workdir         = ( /var/cfengine )

  linux::

   cf_install_dir  = ( /usr/local/cfengine/sbin )

   ###################################################################
   #
   # Spread the load, make sure the servers get done first though
   #
   ###################################################################

  !AllBinaryServers::

     SplayTime = ( 1 )

############################################################################

 #
 # Make sure there is a local copy of the configuration and
 # the most important binaries in case we have no connectivity
 # e.g. for mobile stations or during DOS attacks
 #

copy:

     $(master_cfinput)            dest=$(workdir)/inputs
                                  r=inf
                                  mode=700
                                  type=binary
                                  exclude=*.lst
                                  exclude=*~
                                  exclude=#*
                                  server=$(policyhost)
                                  trustkey=true

#####################################################################

tidy:

     #
     # Cfexecd stores output in this directory.
     # Make sure we don't build up files and choke on our own words!
     #

     $(workdir)/outputs pattern=* age=7

#####################################################################

processes:

  new_cfservd::

    "cfservd" signal=term restart /usr/sbin/cfservd

  new_cfenvd::

    "cfenvd" signal=kill restart "/usr/sbin/cfenvd -H"


###
#
# END cf.update
#
###

# cat cfrun.hosts
domain=tunelinux.pe.kr
cent.tunelinux.pe.kr
cent2.tunelinux.pe.kr

# cfrun
cfrun(0):         .......... [ Hailing cent.tunelinux.pe.kr ] ..........
cfrun(0):         .......... [ Hailing cent2.tunelinux.pe.kr ] ..........

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

cfengine:cent2: Saving edit changes to file /etc/crontab
cfengine:cent2: Saving edit changes to file /etc/security/access.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -