Compare commits
No commits in common. "master" and "6.9.3" have entirely different histories.
26 changed files with 49 additions and 615 deletions
|
|
@ -70,11 +70,6 @@ case "$("$__explorer/os")" in
|
|||
macosx)
|
||||
sw_vers -productVersion
|
||||
;;
|
||||
freebsd)
|
||||
# Apparently uname -r is not a reliable way to get the patch level.
|
||||
# See: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=251743
|
||||
freebsd-version
|
||||
;;
|
||||
*bsd|solaris)
|
||||
uname -r
|
||||
;;
|
||||
|
|
|
|||
|
|
@ -1,104 +0,0 @@
|
|||
cdist-type__debian_backports(7)
|
||||
===============================
|
||||
|
||||
NAME
|
||||
----
|
||||
cdist-type__apt_backports - Install backports
|
||||
|
||||
|
||||
DESCRIPTION
|
||||
-----------
|
||||
This singleton type installs backports for the current OS release.
|
||||
It aborts if backports are not supported for the specified OS or
|
||||
no version codename could be fetched (like Debian unstable).
|
||||
|
||||
The package index will be automatically updated if required.
|
||||
|
||||
It supports backports from following OSes:
|
||||
|
||||
- Debian
|
||||
- Devuan
|
||||
- Ubuntu
|
||||
|
||||
|
||||
REQUIRED PARAMETERS
|
||||
-------------------
|
||||
None.
|
||||
|
||||
|
||||
OPTIONAL PARAMETERS
|
||||
-------------------
|
||||
state
|
||||
Represents the state of the backports repository. ``present`` or
|
||||
``absent``, defaults to ``present``.
|
||||
|
||||
Will be directly passed to :strong:`cdist-type__apt_source`\ (7).
|
||||
|
||||
mirror
|
||||
The mirror to fetch the backports from. Will defaults to the generic
|
||||
mirror of the current OS.
|
||||
|
||||
Will be directly passed to :strong:`cdist-type__apt_source`\ (7).
|
||||
|
||||
|
||||
BOOLEAN PARAMETERS
|
||||
------------------
|
||||
None.
|
||||
|
||||
|
||||
MESSAGES
|
||||
--------
|
||||
None.
|
||||
|
||||
|
||||
EXAMPLES
|
||||
--------
|
||||
|
||||
.. code-block:: sh
|
||||
|
||||
# setup the backports
|
||||
__apt_backports
|
||||
__apt_backports --state absent
|
||||
__apt_backports --state present --mirror "http://ftp.de.debian.org/debian/"
|
||||
|
||||
# install a backports package
|
||||
# currently for the buster release backports
|
||||
require="__apt_backports" __package_apt wireguard \
|
||||
--target-release buster-backports
|
||||
|
||||
|
||||
ABORTS
|
||||
------
|
||||
Aborts if the detected os is not Debian.
|
||||
|
||||
Aborts if no distribuition codename could be detected. This is common for the
|
||||
unstable distribution, but there is no backports repository for it already.
|
||||
|
||||
|
||||
CAVEATS
|
||||
-------
|
||||
For Ubuntu, it setup all componenents for the backports repository: ``main``,
|
||||
``restricted``, ``universe`` and ``multiverse``. The user may not want to
|
||||
install proprietary packages, which will only be installed if the user
|
||||
explicitly uses the backports target-release. The user may change this behavior
|
||||
to install backports packages without the need of explicitly select it.
|
||||
|
||||
|
||||
SEE ALSO
|
||||
--------
|
||||
`Official Debian Backports site <https://backports.debian.org/>`_
|
||||
|
||||
:strong:`cdist-type__apt_source`\ (7)
|
||||
|
||||
|
||||
AUTHORS
|
||||
-------
|
||||
Matthias Stecher <matthiasstecher at gmx.de>
|
||||
|
||||
|
||||
COPYING
|
||||
-------
|
||||
Copyright \(C) 2020 Matthias Stecher. You can redistribute it
|
||||
and/or modify it under the terms of the GNU General Public License as
|
||||
published by the Free Software Foundation, either version 3 of the
|
||||
License, or (at your option) any later version.
|
||||
|
|
@ -1,81 +0,0 @@
|
|||
#!/bin/sh -e
|
||||
# __apt_backports/manifest
|
||||
#
|
||||
# 2020 Matthias Stecher (matthiasstecher at gmx.de)
|
||||
#
|
||||
# This file is part of cdist.
|
||||
#
|
||||
# cdist is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# cdist is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
#
|
||||
# Enables/disables backports repository. Utilises __apt_source for it.
|
||||
#
|
||||
|
||||
|
||||
# Get the distribution codename by /etc/os-release.
|
||||
# is already executed in a subshell by string substitution
|
||||
# lsb_release may not be given in all installations
|
||||
codename_os_release() {
|
||||
# shellcheck disable=SC1090
|
||||
. "$__global/explorer/os_release"
|
||||
printf "%s" "$VERSION_CODENAME"
|
||||
}
|
||||
|
||||
# detect backport distribution
|
||||
os="$(cat "$__global/explorer/os")"
|
||||
case "$os" in
|
||||
debian)
|
||||
dist="$( codename_os_release )"
|
||||
components="main"
|
||||
mirror="http://deb.debian.org/debian/"
|
||||
;;
|
||||
devuan)
|
||||
dist="$( codename_os_release )"
|
||||
components="main"
|
||||
mirror="http://deb.devuan.org/merged"
|
||||
;;
|
||||
ubuntu)
|
||||
dist="$( codename_os_release )"
|
||||
components="main restricted universe multiverse"
|
||||
mirror="http://archive.ubuntu.com/ubuntu"
|
||||
;;
|
||||
|
||||
*)
|
||||
printf "Backports for %s are not supported!\n" "$os" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# error if no codename given (e.g. on Debian unstable)
|
||||
if [ -z "$dist" ]; then
|
||||
printf "No backports for unkown version of distribution %s!\n" "$os" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
# parameters
|
||||
state="$(cat "$__object/parameter/state")"
|
||||
|
||||
# mirror already set for the os, only override user-values
|
||||
if [ -f "$__object/parameter/mirror" ]; then
|
||||
mirror="$(cat "$__object/parameter/mirror")"
|
||||
fi
|
||||
|
||||
|
||||
# install the given backports repository
|
||||
__apt_source "${dist}-backports" \
|
||||
--state "$state" \
|
||||
--distribution "${dist}-backports" \
|
||||
--component "$components" \
|
||||
--uri "$mirror"
|
||||
|
|
@ -1 +0,0 @@
|
|||
present
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
state
|
||||
mirror
|
||||
|
|
@ -46,29 +46,28 @@ fi
|
|||
|
||||
remove_block() {
|
||||
cat << DONE
|
||||
tmpfile=\$(mktemp ${quoted_file}.cdist.XXXXXXXXXX)
|
||||
tmpfile=\$(mktemp ${file}.cdist.XXXXXXXXXX)
|
||||
# preserve ownership and permissions of existing file
|
||||
if [ -f $quoted_file ]; then
|
||||
cp -p $quoted_file "\$tmpfile"
|
||||
if [ -f "$file" ]; then
|
||||
cp -p "$file" "\$tmpfile"
|
||||
fi
|
||||
awk -v prefix=$(quote "$prefix") -v suffix=$(quote "$suffix") '
|
||||
awk -v prefix=^$(quote "$prefix")\$ -v suffix=^$(quote "$suffix")\$ '
|
||||
{
|
||||
if (\$0 == prefix) {
|
||||
if (match(\$0,prefix)) {
|
||||
triggered=1
|
||||
}
|
||||
if (triggered) {
|
||||
if (\$0 == suffix) {
|
||||
if (match(\$0,suffix)) {
|
||||
triggered=0
|
||||
}
|
||||
} else {
|
||||
print
|
||||
}
|
||||
}' $quoted_file > "\$tmpfile"
|
||||
mv -f "\$tmpfile" $quoted_file
|
||||
}' "$file" > "\$tmpfile"
|
||||
mv -f "\$tmpfile" "$file"
|
||||
DONE
|
||||
}
|
||||
|
||||
quoted_file="$(quote "$file")"
|
||||
case "$state_should" in
|
||||
present)
|
||||
if [ "$state_is" = "changed" ]; then
|
||||
|
|
@ -78,7 +77,7 @@ case "$state_should" in
|
|||
echo add >> "$__messages_out"
|
||||
fi
|
||||
cat << DONE
|
||||
cat >> $quoted_file << '${__type##*/}_DONE'
|
||||
cat >> "$file" << ${__type##*/}_DONE
|
||||
$(cat "$block")
|
||||
${__type##*/}_DONE
|
||||
DONE
|
||||
|
|
|
|||
|
|
@ -25,9 +25,6 @@ user
|
|||
OPTIONAL PARAMETERS
|
||||
-------------------
|
||||
|
||||
dirmode
|
||||
forwarded to :strong:`__directory` type as mode
|
||||
|
||||
mode
|
||||
forwarded to :strong:`__file` type
|
||||
|
||||
|
|
|
|||
|
|
@ -19,7 +19,6 @@ set -eu
|
|||
user="$(cat "${__object}/parameter/user")"
|
||||
home="$(cat "${__object}/explorer/home")"
|
||||
primary_group="$(cat "${__object}/explorer/primary_group")"
|
||||
dirmode="$(cat "${__object}/parameter/dirmode")"
|
||||
|
||||
# Create parent directory. Type __directory has flag 'parents', but it
|
||||
# will leave us with root-owned directory in user home, which is not
|
||||
|
|
@ -37,7 +36,6 @@ export CDIST_ORDER_DEPENDENCY
|
|||
for dir ; do
|
||||
__directory "${home}/${dir}" \
|
||||
--group "${primary_group}" \
|
||||
--mode "${dirmode}" \
|
||||
--owner "${user}"
|
||||
done
|
||||
|
||||
|
|
|
|||
|
|
@ -1 +0,0 @@
|
|||
0700
|
||||
|
|
@ -1,4 +1,3 @@
|
|||
state
|
||||
mode
|
||||
source
|
||||
dirmode
|
||||
|
|
|
|||
|
|
@ -1,4 +1,7 @@
|
|||
#!/bin/sh
|
||||
# Nico Schottelius
|
||||
# Zürisee, Mon Sep 2 18:38:27 CEST 2013
|
||||
#
|
||||
### BEGIN INIT INFO
|
||||
# Provides: iptables
|
||||
# Required-Start: $local_fs $remote_fs
|
||||
|
|
@ -11,72 +14,34 @@
|
|||
# and saves/restores previous status
|
||||
### END INIT INFO
|
||||
|
||||
# Originally written by:
|
||||
# Nico Schottelius
|
||||
# Zürisee, Mon Sep 2 18:38:27 CEST 2013
|
||||
#
|
||||
# 2013 Nico Schottelius (nico-cdist at schottelius.org)
|
||||
# 2020 Matthias Stecher (matthiasstecher at gmx.de)
|
||||
#
|
||||
# This file is distributed with cdist and licenced under the
|
||||
# GNU GPLv3+ WITHOUT ANY WARRANTY.
|
||||
|
||||
|
||||
# Read files and execute the content with the given commands
|
||||
#
|
||||
# Arguments:
|
||||
# 1: Directory
|
||||
# 2..n: Commands which should be used to execute the file content
|
||||
gothrough() {
|
||||
cd "$1" || return
|
||||
shift
|
||||
|
||||
# iterate through all rules and continue if it's not a file
|
||||
for rule in *; do
|
||||
[ -f "$rule" ] || continue
|
||||
echo "Appling iptables rule $rule ..."
|
||||
|
||||
# execute it with all commands specificed
|
||||
ruleparam="$(cat "$rule")"
|
||||
for cmd in "$@"; do
|
||||
# Command and Rule should be split.
|
||||
# shellcheck disable=SC2046
|
||||
command $cmd $ruleparam
|
||||
done
|
||||
done
|
||||
}
|
||||
|
||||
# Shortcut for iptables command to do IPv4 and v6
|
||||
# only applies to the "reset" target
|
||||
iptables() {
|
||||
command iptables "$@"
|
||||
command ip6tables "$@"
|
||||
}
|
||||
|
||||
basedir=/etc/iptables.d
|
||||
status4="${basedir}/.pre-start"
|
||||
status6="${basedir}/.pre-start6"
|
||||
status="${basedir}/.pre-start"
|
||||
|
||||
case $1 in
|
||||
start)
|
||||
# Save status
|
||||
iptables-save > "$status4"
|
||||
ip6tables-save > "$status6"
|
||||
iptables-save > "$status"
|
||||
|
||||
# Apply our ruleset
|
||||
gothrough "$basedir" iptables
|
||||
#gothrough "$basedir/v4" iptables # conflicts with $basedir
|
||||
gothrough "$basedir/v6" ip6tables
|
||||
gothrough "$basedir/all" iptables ip6tables
|
||||
cd "$basedir" || exit
|
||||
count="$(find . ! -name . -prune | wc -l)"
|
||||
|
||||
# Only do something if there are rules
|
||||
if [ "$count" -ge 1 ]; then
|
||||
for rule in *; do
|
||||
echo "Applying iptables rule $rule ..."
|
||||
# Rule should be split.
|
||||
# shellcheck disable=SC2046
|
||||
iptables $(cat "$rule")
|
||||
done
|
||||
fi
|
||||
;;
|
||||
|
||||
stop)
|
||||
# Restore from status before, if there is something to restore
|
||||
if [ -f "$status4" ]; then
|
||||
iptables-restore < "$status4"
|
||||
fi
|
||||
if [ -f "$status6" ]; then
|
||||
ip6tables-restore < "$status6"
|
||||
if [ -f "$status" ]; then
|
||||
iptables-restore < "$status"
|
||||
fi
|
||||
;;
|
||||
restart)
|
||||
|
|
|
|||
|
|
@ -10,24 +10,7 @@ DESCRIPTION
|
|||
-----------
|
||||
This cdist type deploys an init script that triggers
|
||||
the configured rules and also re-applies them on
|
||||
configuration. Rules are written from __iptables_rule
|
||||
into the folder ``/etc/iptables.d/``.
|
||||
|
||||
It reads all rules from the base folder as rules for IPv4.
|
||||
Rules in the subfolder ``v6/`` are IPv6 rules. Rules in
|
||||
the subfolder ``all/`` are applied to both rule tables. All
|
||||
files contain the arguments for a single ``iptables`` and/or
|
||||
``ip6tables`` command.
|
||||
|
||||
Rules are applied in the following order:
|
||||
1. All IPv4 rules
|
||||
2. All IPv6 rules
|
||||
2. All rules that should be applied to both tables
|
||||
|
||||
The order of the rules that will be applied are definite
|
||||
from the result the shell glob returns, which should be
|
||||
alphabetical. If rules must be applied in a special order,
|
||||
prefix them with a number like ``02-some-rule``.
|
||||
configuration.
|
||||
|
||||
|
||||
REQUIRED PARAMETERS
|
||||
|
|
@ -41,7 +24,7 @@ None
|
|||
EXAMPLES
|
||||
--------
|
||||
|
||||
None (__iptables_apply is used by __iptables_rule automatically)
|
||||
None (__iptables_apply is used by __iptables_rule)
|
||||
|
||||
|
||||
SEE ALSO
|
||||
|
|
@ -52,13 +35,11 @@ SEE ALSO
|
|||
AUTHORS
|
||||
-------
|
||||
Nico Schottelius <nico-cdist--@--schottelius.org>
|
||||
Matthias Stecher <matthiasstecher--@--gmx.de>
|
||||
|
||||
|
||||
COPYING
|
||||
-------
|
||||
Copyright \(C) 2013 Nico Schottelius.
|
||||
Copyright \(C) 2020 Matthias Stecher.
|
||||
You can redistribute it and/or modify it under the terms of the GNU
|
||||
General Public License as published by the Free Software Foundation,
|
||||
either version 3 of the License, or (at your option) any later version.
|
||||
Copyright \(C) 2013 Nico Schottelius. You can redistribute it
|
||||
and/or modify it under the terms of the GNU General Public License as
|
||||
published by the Free Software Foundation, either version 3 of the
|
||||
License, or (at your option) any later version.
|
||||
|
|
|
|||
|
|
@ -11,10 +11,6 @@ DESCRIPTION
|
|||
This cdist type allows you to manage iptable rules
|
||||
in a distribution independent manner.
|
||||
|
||||
See :strong:`cdist-type__iptables_apply`\ (7) for the
|
||||
execution order of these rules. It will be executed
|
||||
automaticly to apply all rules non-volaite.
|
||||
|
||||
|
||||
REQUIRED PARAMETERS
|
||||
-------------------
|
||||
|
|
@ -29,24 +25,6 @@ state
|
|||
'present' or 'absent', defaults to 'present'
|
||||
|
||||
|
||||
BOOLEAN PARAMETERS
|
||||
------------------
|
||||
All rules without any of these parameters will be treated like ``--v4`` because
|
||||
of backward compatibility.
|
||||
|
||||
v4
|
||||
Explicitly set it as rule for IPv4. If IPv6 is set, too, it will be
|
||||
threaten like ``--all``. Will be the default if nothing else is set.
|
||||
|
||||
v6
|
||||
Explicitly set it as rule for IPv6. If IPv4 is set, too, it will be
|
||||
threaten like ``--all``.
|
||||
|
||||
all
|
||||
Set the rule for both IPv4 and IPv6. It will be saved separately from the
|
||||
other rules.
|
||||
|
||||
|
||||
EXAMPLES
|
||||
--------
|
||||
|
||||
|
|
@ -70,16 +48,6 @@ EXAMPLES
|
|||
--state absent
|
||||
|
||||
|
||||
# IPv4-only rule for ICMPv4
|
||||
__iptables_rule icmp-v4 --v4 --rule "-A INPUT -p icmp -j ACCEPT"
|
||||
# IPv6-only rule for ICMPv6
|
||||
__iptables_rule icmp-v6 --v6 --rule "-A INPUT -p icmpv6 -j ACCEPT"
|
||||
|
||||
# doing something for the dual stack
|
||||
__iptables_rule fwd-eth0-eth1 --v4 --v6 --rule "-A INPUT -i eth0 -o eth1 -j ACCEPT"
|
||||
__iptables_rule fwd-eth1-eth0 --all --rule "-A -o eth1 -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT"
|
||||
|
||||
|
||||
SEE ALSO
|
||||
--------
|
||||
:strong:`cdist-type__iptables_apply`\ (7), :strong:`iptables`\ (8)
|
||||
|
|
@ -88,13 +56,11 @@ SEE ALSO
|
|||
AUTHORS
|
||||
-------
|
||||
Nico Schottelius <nico-cdist--@--schottelius.org>
|
||||
Matthias Stecher <matthiasstecher--@--gmx.de>
|
||||
|
||||
|
||||
COPYING
|
||||
-------
|
||||
Copyright \(C) 2013 Nico Schottelius.
|
||||
Copyright \(C) 2020 Matthias Stecher.
|
||||
You can redistribute it and/or modify it under the terms of the GNU
|
||||
General Public License as published by the Free Software Foundation,
|
||||
either version 3 of the License, or (at your option) any later version.
|
||||
Copyright \(C) 2013 Nico Schottelius. You can redistribute it
|
||||
and/or modify it under the terms of the GNU General Public License as
|
||||
published by the Free Software Foundation, either version 3 of the
|
||||
License, or (at your option) any later version.
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
#!/bin/sh -e
|
||||
#
|
||||
# 2013 Nico Schottelius (nico-cdist at schottelius.org)
|
||||
# 2020 Matthias Stecher (matthiasstecher at gmx.de)
|
||||
#
|
||||
# This file is part of cdist.
|
||||
#
|
||||
|
|
@ -25,36 +24,12 @@ base_dir=/etc/iptables.d
|
|||
name="$__object_id"
|
||||
state="$(cat "$__object/parameter/state")"
|
||||
|
||||
if [ -f "$__object/parameter/v4" ]; then
|
||||
only_v4="yes"
|
||||
# $specific_dir is $base_dir
|
||||
fi
|
||||
if [ -f "$__object/parameter/v6" ]; then
|
||||
only_v6="yes"
|
||||
specific_dir="$base_dir/v6"
|
||||
fi
|
||||
# If rules should be set for both protocols
|
||||
if { [ "$only_v4" = "yes" ] && [ "$only_v6" = "yes" ]; } ||
|
||||
[ -f "$__object/parameter/all" ]; then
|
||||
|
||||
# all to a specific directory
|
||||
specific_dir="$base_dir/all"
|
||||
fi
|
||||
|
||||
# set rule directory based on if it's the base or subdirectory
|
||||
rule_dir="${specific_dir:-$base_dir}"
|
||||
|
||||
################################################################################
|
||||
# Basic setup
|
||||
#
|
||||
|
||||
__directory "$base_dir" --state present
|
||||
|
||||
# sub-directory if required
|
||||
if [ "$specific_dir" ]; then
|
||||
require="__directory/$base_dir" __directory "$specific_dir" --state present
|
||||
fi
|
||||
|
||||
# Have apply do the real job
|
||||
require="$__object_name" __iptables_apply
|
||||
|
||||
|
|
@ -62,15 +37,6 @@ require="$__object_name" __iptables_apply
|
|||
# The rule
|
||||
#
|
||||
|
||||
for dir in "$base_dir" "$base_dir/v6" "$base_dir/all"; do
|
||||
# defaults to absent except the directory that should contain the file
|
||||
if [ "$rule_dir" = "$dir" ]; then
|
||||
curr_state="$state"
|
||||
else
|
||||
curr_state="absent"
|
||||
fi
|
||||
|
||||
require="__directory/$rule_dir" __file "$dir/$name" \
|
||||
require="__directory/$base_dir" __file "$base_dir/${name}" \
|
||||
--source "$__object/parameter/rule" \
|
||||
--state "$curr_state"
|
||||
done
|
||||
--state "$state"
|
||||
|
|
|
|||
|
|
@ -1,3 +0,0 @@
|
|||
all
|
||||
v4
|
||||
v6
|
||||
|
|
@ -75,7 +75,7 @@ execcmd(){
|
|||
esac
|
||||
|
||||
if [ -z "${pkg_bootstrapped}" ]; then
|
||||
echo "ASSUME_ALWAYS_YES=yes pkg bootstrap >/dev/null 2>&1"
|
||||
echo "pkg bootstrap -y >/dev/null 2>&1"
|
||||
fi
|
||||
|
||||
echo "$_cmd >/dev/null 2>&1" # Silence the output of the command
|
||||
|
|
|
|||
|
|
@ -89,7 +89,7 @@ function strdelim(s) { return strdelim_internal(s, 1) }
|
|||
function strdelimw(s) { return strdelim_internal(s, 0) }
|
||||
|
||||
function singleton_option(opt) {
|
||||
return tolower(opt) !~ /^(acceptenv|allowgroups|allowusers|denygroups|denyusers|hostcertificate|hostkey|listenaddress|logverbose|permitlisten|permitopen|port|setenv|subsystem)$/
|
||||
return tolower(opt) !~ /^(acceptenv|allowgroups|allowusers|authenticationmethods|authorizedkeysfile|denygroups|denyusers|hostcertificate|hostkey|listenaddress|logverbose|permitlisten|permitopen|port|setenv|subsystem)$/
|
||||
}
|
||||
|
||||
function print_update() {
|
||||
|
|
|
|||
|
|
@ -91,8 +91,7 @@ awk $(drop_awk_comments "${__type:?}/files/update_sshd_config.awk") \\
|
|||
|
||||
cmp -s $(quote "${sshd_config_file}") $(quote "${sshd_config_file}.tmp") || {
|
||||
sshd -t -f $(quote "${sshd_config_file}.tmp") \\
|
||||
&& cat $(quote "${sshd_config_file}.tmp") >$(quote "${sshd_config_file}") \\
|
||||
|| exit # stop if sshd_config file check fails
|
||||
&& cat $(quote "${sshd_config_file}.tmp") >$(quote "${sshd_config_file}")
|
||||
}
|
||||
rm -f $(quote "${sshd_config_file}.tmp")
|
||||
EOF
|
||||
|
|
|
|||
|
|
@ -79,10 +79,6 @@ BUGS
|
|||
- ``Include`` directives are ignored.
|
||||
- Config options are not added/removed to/from the config file if their value is
|
||||
the default value.
|
||||
- | The explorer will incorrectly report ``absent`` if OpenSSH internally
|
||||
transforms one value to another (e.g. ``permitrootlogin prohibit-password``
|
||||
is transformed to ``permitrootlogin without-password``).
|
||||
| Workaround: Use the value that OpenSSH uses internally.
|
||||
|
||||
|
||||
AUTHORS
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ set -e
|
|||
if [ "${debug}" ]
|
||||
then
|
||||
set -x
|
||||
cdist_params="${cdist_params} -l 3"
|
||||
cdist_params="${cdist_params} -d"
|
||||
fi
|
||||
|
||||
bootstrap_dir="${target_dir}"
|
||||
|
|
|
|||
|
|
@ -59,8 +59,6 @@ from scapy.all import *
|
|||
# Datetime overwrites scapy.all.datetime - needs to be imported AFTER
|
||||
import datetime
|
||||
|
||||
import cdist.config
|
||||
|
||||
log = logging.getLogger("scan")
|
||||
|
||||
|
||||
|
|
@ -127,18 +125,6 @@ class Scanner(object):
|
|||
with open(fname, "w") as fd:
|
||||
fd.write(f"{now}\n")
|
||||
|
||||
def config(self):
|
||||
"""
|
||||
Configure a host
|
||||
|
||||
- Assume we are only called if necessary
|
||||
- However we need to ensure to not run in parallel
|
||||
- Maybe keep dict storing per host processes
|
||||
- Save the result
|
||||
- Save the output -> probably aligned to config mode
|
||||
|
||||
"""
|
||||
|
||||
def start(self):
|
||||
self.process = Process(target=self.scan)
|
||||
self.process.start()
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@
|
|||
#
|
||||
#
|
||||
|
||||
import importlib
|
||||
import imp
|
||||
import os
|
||||
import sys
|
||||
import unittest
|
||||
|
|
@ -37,9 +37,8 @@ for possible_test in os.listdir(base_dir):
|
|||
|
||||
suites = []
|
||||
for test_module in test_modules:
|
||||
module_spec = importlib.util.find_spec("cdist.test.{}".format(test_module))
|
||||
module = importlib.util.module_from_spec(module_spec)
|
||||
module_spec.loader.exec_module(module)
|
||||
module_parameters = imp.find_module(test_module, [base_dir])
|
||||
module = imp.load_module("cdist.test." + test_module, *module_parameters)
|
||||
|
||||
suite = unittest.defaultTestLoader.loadTestsFromModule(module)
|
||||
# print("Got suite: " + suite.__str__())
|
||||
|
|
|
|||
|
|
@ -1,19 +1,6 @@
|
|||
Changelog
|
||||
---------
|
||||
|
||||
next:
|
||||
* Core: preos: Fix passing cdist debug parameter (Darko Poljak)
|
||||
* Type __sshd_config: Produce error if invalid config is generated, fix processing of AuthenticationMethods and AuthorizedKeysFile, document explorer bug (Dennis Camera)
|
||||
|
||||
6.9.4: 2020-12-21
|
||||
* Type __package_pkgng_freebsd: Fix bootstrapping pkg (Dennis Camera)
|
||||
* Core: Deal with deprecated imp in unit tests (Evil Ham)
|
||||
* Type __iptables: Add IPv6 support (Matthias Stecher)
|
||||
* Type __block: Fix escaping in here-doc (Matthias Stecher)
|
||||
* Explorer os_version: Improve FreeBSD support (Evil Ham)
|
||||
* New type: __apt_backports (Matthias Stecher)
|
||||
* Type __dot_file: Add dirmode parameter (Mark Verboom)
|
||||
|
||||
6.9.3: 2020-12-04
|
||||
* pip install: Add cdist.scan to packages in setup.py (Dennis Camera)
|
||||
|
||||
|
|
|
|||
|
|
@ -54,12 +54,4 @@ VERBOSE: scan: Host fe80::f29f:c2ff:fe7c:275e is alive
|
|||
VERBOSE: scan: Host fe80::ba69:f4ff:fec5:8db7 is alive
|
||||
VERBOSE: scan: Host fe80::42b0:34ff:fe6f:f863 is alive
|
||||
VERBOSE: scan: Host fe80::21b:fcff:feee:f4bc is alive
|
||||
** Better usage -> saving the env
|
||||
sudo -E cdist scan -b -I wlan0 -vv
|
||||
** TODO Implement actual configuration step
|
||||
- Also serves as a nice PoC
|
||||
- Might need to escape literal IPv6 addresses for scp
|
||||
** TODO Define how to map link local address to something useful
|
||||
- via reverse DNS?
|
||||
- via link local in manifest?
|
||||
** TODO define ignorehosts?
|
||||
...
|
||||
|
|
|
|||
|
|
@ -1,199 +0,0 @@
|
|||
#!/bin/sh -ex
|
||||
|
||||
# Copyright (c) 2021 Alexander Sieg
|
||||
|
||||
# cconn is a transparent wrapper that allows seamless usage of sudo/rsync and
|
||||
# FreeBSD jails, this makes it possible to configure a FreeBSD by just using
|
||||
# the host system sshd.
|
||||
# Configuration is done by throw the cdist invertory system.
|
||||
#
|
||||
#
|
||||
# Installation:
|
||||
#
|
||||
# Simply set this script as remote_exec and remote_copy implementation in your
|
||||
# cdist.cfg. You MUST always pass either copy or exec as the first parameter
|
||||
# to this script
|
||||
#
|
||||
# remote_exec = path/to/cconn exec
|
||||
# remote_copy = path/to/cconn copy
|
||||
#
|
||||
# As cconn uses the cdist inventory system for host specific configuration, it
|
||||
# ether need to be executed from the directory the contains the inventory
|
||||
# directory or be setting the INVENTORY environment variable to path were the
|
||||
# inventory entries are kept.
|
||||
#
|
||||
# Usage:
|
||||
#
|
||||
# To setup a host to use some form of connection "bending" (e.g. sudo) you need
|
||||
# to add a single __cconn_options tag to the host inventory file. Options are always a
|
||||
# key value pair separated by a '='. All options are passed in a single tag and
|
||||
# a separated by a space.
|
||||
#
|
||||
# __cconn_options options:
|
||||
#
|
||||
# NOTE: jail_host and iocage_jail can not be used at the same time and will
|
||||
# lead to a error
|
||||
#
|
||||
# jail_host:
|
||||
# hostname on which the FreeBSD jail resides on.
|
||||
#
|
||||
# iocage_host:
|
||||
# Same as jail_host, but for jails managed by iocage(8)
|
||||
#
|
||||
# jail_name:
|
||||
# By default cconn will use the __target_host as the FreeBSD jail name, set
|
||||
# this option to override this name
|
||||
#
|
||||
# sudo_user:
|
||||
# Username used to connect to the __target_host, all commands are then
|
||||
# prefixed with sudo and copy operations are done with rsync
|
||||
#
|
||||
# For this work you need to be able to execute all command without password entry.
|
||||
# sudoers(5)
|
||||
# %wheel ALL=(ALL) NOPASSWD: ALL
|
||||
#
|
||||
#Examples:
|
||||
#
|
||||
# inventory/jail.example.com:
|
||||
# some_other_tag
|
||||
# __cconn_options jail_host=example.com sudo_user=ada
|
||||
#
|
||||
|
||||
|
||||
#TODO: add sudo_pass and sudo_passfile option to support use without NOPASSWD
|
||||
#TODO: support SSH connection multiplexing. This requieres a patch to cdist, as
|
||||
# we need path to the tmp dir.
|
||||
|
||||
log() {
|
||||
# Uncomment this for debugging
|
||||
echo "$@" | logger -t "cdist-cconn-$COMMAND"
|
||||
:
|
||||
}
|
||||
|
||||
COMMAND="$1"; shift
|
||||
|
||||
if [ -z "$INVENTORY" ]; then
|
||||
INVENTORY="inventory"
|
||||
fi
|
||||
|
||||
# shellcheck disable=SC2154
|
||||
options="$(sed -n 's/^__cconn_options\(.*\)$/\1/p' "$INVENTORY/$__target_host" | cut -d' ' -f2-)"
|
||||
tmpcmd=$*
|
||||
for option in $options; do
|
||||
# shellcheck disable=SC2046
|
||||
set -- $(echo "$option" | tr '=' ' ')
|
||||
key="$1"
|
||||
value="$2"
|
||||
case "$1" in
|
||||
"jail_host")
|
||||
JAIL_HOST="$value"
|
||||
;;
|
||||
"iocage_host")
|
||||
IOCAGE_HOST="$value"
|
||||
;;
|
||||
"jail_name")
|
||||
JAIL_NAME="$value"
|
||||
;;
|
||||
"sudo_user")
|
||||
SUDO_USER="$value"
|
||||
;;
|
||||
*)
|
||||
log "unknown option $key=$value found"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
# shellcheck disable=SC2086
|
||||
set -- $tmpcmd
|
||||
|
||||
if [ -n "$IOCAGE_HOST" ] && [ -n "$JAIL_HOST" ]; then
|
||||
echo "WARING: jail_host and iocage_host can't be used at the same time"
|
||||
log "WARING: jail_host and iocage_host can't be used at the same time"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TARGET_HOST="$__target_host"
|
||||
SSH_USER="root"
|
||||
|
||||
if [ -n "$IOCAGE_HOST" ]; then
|
||||
JAIL_HOST="$IOCAGE_HOST"
|
||||
|
||||
if [ -z "$JAIL_NAME" ]; then
|
||||
JAIL_NAME="ioc-$(echo "$__target_host" | tr '.' '_')"
|
||||
else
|
||||
JAIL_NAME="ioc-$(echo "$JAIL_NAME" | tr '.' '_')"
|
||||
fi
|
||||
else
|
||||
if [ -z "$JAIL_NAME" ]; then
|
||||
JAIL_NAME="$TARGET_HOST"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -n "$JAIL_HOST" ]; then
|
||||
log "INSIDE_JAIL: TRUE"
|
||||
TARGET_HOST="$JAIL_HOST"
|
||||
WRAPPER="jexec $JAIL_NAME"
|
||||
fi
|
||||
|
||||
if [ -n "$SUDO_USER" ]; then
|
||||
log "SUDO_USER: $SUDO_USER"
|
||||
WRAPPER="sudo -- $WRAPPER"
|
||||
SSH_USER="$SUDO_USER"
|
||||
fi
|
||||
|
||||
log "TARGET_HOST: $TARGET_HOST"
|
||||
log "@:" "$@"
|
||||
if [ -n "$JAIL_HOST" ]; then
|
||||
log "IOCAGE_HOST: $IOCAGE_HOST"
|
||||
log "JAIL_HOST: $JAIL_HOST"
|
||||
log "JAIL_NAME: $JAIL_NAME"
|
||||
log "WRAPPER: $WRAPPER"
|
||||
fi
|
||||
|
||||
case "$COMMAND" in
|
||||
"exec")
|
||||
shift; # remove the jail host name from $@
|
||||
ssh -o User="$SSH_USER" -q "$TARGET_HOST" "$WRAPPER $*"
|
||||
;;
|
||||
"copy")
|
||||
if [ -n "$JAIL_HOST" ]; then
|
||||
# jls(8) dosen't need root to print this information
|
||||
jail_root=$(ssh -q "$TARGET_HOST" -- jls -j "$JAIL_NAME" path)
|
||||
log "JAIL_ROOT: $jail_root"
|
||||
fi
|
||||
|
||||
if [ -n "$JAIL_HOST" ]; then
|
||||
set -- "$(echo "$@" | sed "s|$__target_host:|$JAIL_HOST:$jail_root|g")"
|
||||
fi
|
||||
|
||||
if [ -n "$SUDO_USER" ]; then
|
||||
# For rsync to do the right thing, the source has to end with "/" if it is
|
||||
# a directory. The below preprocessor loop takes care of that.
|
||||
|
||||
# second last argument is the source
|
||||
source_index=$(($#-1))
|
||||
index=0
|
||||
for arg in "$@"; do
|
||||
if [ $index -eq 0 ]; then
|
||||
# reset $@
|
||||
set --
|
||||
fi
|
||||
index=$((index+=1))
|
||||
if [ $index -eq $source_index ] && [ -d "$arg" ]; then
|
||||
arg="${arg%/}/"
|
||||
fi
|
||||
set -- "$@" "$arg"
|
||||
done
|
||||
|
||||
rsync --copy-links -e "ssh -o User=$SSH_USER" --rsync-path='sudo rsync' "$@"
|
||||
else
|
||||
#shellcheck disable=SC2068
|
||||
scp -o "User=$SSH_USER" -q $@
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
echo "unkown command - $COMMAND"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
log "----"
|
||||
Loading…
Reference in a new issue