OK, what I've got so far is a completed port of sysconftool which probably belongs in the devel section of FreeBSD ports. Recent Courier-MTA builds depend on it even though the INSTALL docs say that tarballs shouldn't have that dependency -- only CVS versions should. No matter, having

courier/rootcerts dependency on the OpenSSL tools/c_rehash. On FreeBSD it does exist in /usr/src/crypto/openssl/tools/c_rehash source tree but is not installed as part of the base system. I've got a workaround for this but a better alternative would be for courier to include the Makefile which comes with Apache+mod_ssl to do the same thing that OpenSSL's

Unless there's a reason that I don't know yet I believe it's a mistake to install binaries owned by user or group courier or daemon or bin unless the corresponding suid or sgid bit are also set for that binary. I believe all binarries should be owned by root:wheel except the ones that need a suid or sgid bit set to a different user. This provides an extra layer of protection to the binaries since most of the system runs as an unprivileged user which cannot modify files owned by root.

As it is now if most of the courier processes run as uid courier and most of the binaries are owned by user courier what's to stop a compromised process from installing a back door to the system by modifying a binary owned by the same unprivileged user courier?

On the plus side is that I'm already cleanly installing and deinstalling the package. I have a dialog configuration script like the one I addapted for postfix-current to select dependencies and options. And the package seems to conform to hier(7) at least as much as postfix does.

Oh yeah.. just to be clear I'm working on FreeBSD 4.4-STABLE porting Courier -0.35.1. I started with courier-0.35.1.20011014 but ran into some libtool problems.