/etc/daily: include blocklistctl dump
Brook Milligan <[email protected]>
| Newsgroups | gmane.os.netbsd.current |
|---|---|
| Message-ID | <[email protected]> |
For security, it seems valuable to be running blocklistd on all public facing hosts. Consequently, to monitor blocks, it would be helpful to include blocklistctl dump as a regular action for /etc/daily. I propose the following patch to do so. This sets the default to YES, but if people feel differently it can be set to NO. Note that blocklistctl dump creates an empty report if blocklistd is not running, which is the same behavior as for no blocks. Thoughts? Cheers, Brook
blocklist.patch
(application/octet-stream, 942 B)
Index: etc/daily
===================================================================
RCS file: /cvsroot/src/etc/daily,v
retrieving revision 1.93
diff -u -r1.93 daily
--- etc/daily 23 Sep 2018 23:16:34 -0000 1.93
+++ etc/daily 28 Sep 2025 22:47:37 -0000
@@ -246,6 +246,13 @@
fi
fi
+if checkyesno check_blocklist; then
+ echo ""
+ echo "blocklist:"
+ blocklistctl dump ${check_blocklist_flags}
+ echo ""
+fi
+
if checkyesno run_fsck; then
echo ""
echo "Checking file systems:"
Index: etc/defaults/daily.conf
===================================================================
RCS file: /cvsroot/src/etc/defaults/daily.conf,v
retrieving revision 1.18
diff -u -r1.18 daily.conf
--- etc/defaults/daily.conf 30 Jul 2012 17:09:34 -0000 1.18
+++ etc/defaults/daily.conf 28 Sep 2025 22:47:37 -0000
@@ -23,6 +23,7 @@
show_remote_fs=NO
check_mailq=YES
check_network=YES
+check_blocklist=YES
full_netstat=NO
run_fsck=NO
run_fsck_flags=""