mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-08-23 08:02:29 +02:00
Koen van HoveandGitHub
0ccc5cdff4
This PR adds API access via a local Unix socket on Unix systems allowing to use the username of local user accessing the API as the authentication username. Configuration options are provided to map user names to roles similar to the configfile authentication provider. This will allow using Krill without authentication tokens if it is only accessed via krillc on the same machine. The PR also removes the example configuration files and moves the documentation included in those files into a krill.conf.5 manual page. By doing this, it simplifies the creation of the configuation file in the binary packages. Those are now very minimal and only contain the mandatory config options.
54 lines
1.6 KiB
Bash
Executable File
54 lines
1.6 KiB
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
|
|
KRILL_CONF="/etc/krill.conf"
|
|
KRILL_CONF_PERMS=640
|
|
KRILL_HOME="/var/lib/krill/"
|
|
KRILL_DATA="${KRILL_HOME}data/"
|
|
KRILL_USER="krill"
|
|
|
|
create_user() {
|
|
if id ${KRILL_USER} > /dev/null 2>&1; then return; fi
|
|
adduser --system --home "${KRILL_HOME}" --group ${KRILL_USER}
|
|
}
|
|
|
|
generate_password() {
|
|
# Tries not to depend on too many other commmands
|
|
# being installed.
|
|
cat /dev/random | tr -dc A-Za-z0-9 | head -c 32
|
|
}
|
|
|
|
create_first_time_configuration() {
|
|
if [ ! -f "${KRILL_CONF}" ]; then
|
|
# generate a token for authenticating with Krill
|
|
ADMIN_TOKEN="$(generate_password)"
|
|
|
|
# generate a config file using our preferred filesystem locations
|
|
# and generated admin token
|
|
# note: we don't configure Krill to store its PID file under /var/run/
|
|
# because that requires root privileges potentially at least once per
|
|
# boot, and Krill doesn't drop privileges yet so when run as a non-root
|
|
# user has no right to create the file or missing /var/run/subdir.
|
|
# See: https://stackoverflow.com/a/28312577
|
|
printf "%s\n" \
|
|
"log_type = \"syslog\"" \
|
|
"storage_uri = \"${KRILL_DATA}\"" \
|
|
"admin_token = \"${ADMIN_TOKEN}\"" > "${KRILL_CONF}"
|
|
|
|
# Ensure that the config file has the correct ownership
|
|
chown ${KRILL_USER}:${KRILL_USER} ${KRILL_CONF}
|
|
|
|
# Ensure that the config file has the correct permissions
|
|
chmod ${KRILL_CONF_PERMS} ${KRILL_CONF}
|
|
fi
|
|
}
|
|
|
|
case "$1" in
|
|
configure)
|
|
create_user
|
|
create_first_time_configuration
|
|
;;
|
|
esac
|
|
|
|
#DEBHELPER#
|