mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-06 09:37:39 +02:00
Koen van HoveandGitHub
0ccc5cdff4
This PR adds API access via a local Unix socket on Unix systems allowing to use the username of local user accessing the API as the authentication username. Configuration options are provided to map user names to roles similar to the configfile authentication provider. This will allow using Krill without authentication tokens if it is only accessed via krillc on the same machine. The PR also removes the example configuration files and moves the documentation included in those files into a krill.conf.5 manual page. By doing this, it simplifies the creation of the configuation file in the binary packages. Those are now very minimal and only contain the mandatory config options.
90 lines
3.0 KiB
TOML
Executable File
90 lines
3.0 KiB
TOML
Executable File
post_install_script = '''
|
|
#!/bin/bash -e
|
|
# Script based on the RPM %systemd_post scriptlet. See:
|
|
# - https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_systemd
|
|
# - https://cgit.freedesktop.org/systemd/systemd/tree/src/core/macros.systemd.in
|
|
|
|
KRILL_USER=krill
|
|
KRILL_GROUP=${KRILL_USER}
|
|
KRILL_HOME_DIR="/var/lib/krill"
|
|
KRILL_HOME_DIR_PERMS=700
|
|
KRILL_CONF="/etc/krill.conf"
|
|
KRILL_CONF_PERMS=640
|
|
KRILL_DATA="${KRILL_HOME_DIR}/data/"
|
|
|
|
if [ $EUID -ne 0 ]; then
|
|
echo >&2 "ERROR: RTRTR postinst script must be run as root"
|
|
exit 1
|
|
fi
|
|
|
|
create_user() {
|
|
# https://github.com/NLnetLabs/krill/issues/908
|
|
if ! id ${KRILL_USER} > /dev/null 2>&1; then
|
|
# According to the CentOS 7 useradd man page:
|
|
# --user-group causes a group by the same name as the user to be created
|
|
# --create-home should force creation of a home dir even for a system account.
|
|
useradd --home-dir ${KRILL_HOME_DIR} --system --create-home --user-group ${KRILL_USER}
|
|
fi
|
|
|
|
# Ensure that the home directory has the correct ownership
|
|
chown -R ${KRILL_USER}:${KRILL_GROUP} ${KRILL_HOME_DIR}
|
|
|
|
# Ensure that the home directory has the correct permissions
|
|
chmod ${KRILL_HOME_DIR_PERMS} ${KRILL_HOME_DIR}
|
|
}
|
|
|
|
init_systemd_service() {
|
|
systemctl preset krill.service 2>&1 || :
|
|
}
|
|
|
|
generate_password() {
|
|
# Tries not to depend on too many other commmands
|
|
# being installed.
|
|
cat /dev/random | tr -dc A-Za-z0-9 | head -c 32
|
|
}
|
|
|
|
create_first_time_configuration() {
|
|
if [ ! -f "${KRILL_CONF}" ]; then
|
|
# generate a token for authenticating with Krill
|
|
ADMIN_TOKEN="$(generate_password)"
|
|
|
|
# generate a config file using our preferred filesystem locations
|
|
# and generated admin token
|
|
# note: we don't configure Krill to store its PID file under /var/run/
|
|
# because that requires root privileges potentially at least once per
|
|
# boot, and Krill doesn't drop privileges yet so when run as a non-root
|
|
# user has no right to create the file or missing /var/run/subdir.
|
|
# See: https://stackoverflow.com/a/28312577
|
|
printf "%s\n" \
|
|
"log_type = \"syslog\"" \
|
|
"storage_uri = \"${KRILL_DATA}\"" \
|
|
"admin_token = \"${ADMIN_TOKEN}\"" > "${KRILL_CONF}"
|
|
|
|
# Ensure that the config file has the correct ownership
|
|
chown ${KRILL_USER}:${KRILL_GROUP} ${KRILL_CONF}
|
|
|
|
# Ensure that the config file has the correct permissions
|
|
chmod ${KRILL_CONF_PERMS} ${KRILL_CONF}
|
|
fi
|
|
}
|
|
|
|
if [ $1 -eq 1 ] ; then
|
|
# Initial installation
|
|
create_user
|
|
init_systemd_service
|
|
create_first_time_configuration
|
|
fi
|
|
'''
|
|
|
|
post_uninstall_script = '''
|
|
#!/bin/bash -e
|
|
# Script based on the RPM %systemd_postun scriptlet. See:
|
|
# - https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_systemd
|
|
# - https://cgit.freedesktop.org/systemd/systemd/tree/src/core/macros.systemd.in
|
|
|
|
systemctl daemon-reload >/dev/null 2>&1 || :
|
|
if [ $1 -ge 1 ] ; then
|
|
systemctl try-restart krill.service >/dev/null 2>&1 || :
|
|
fi
|
|
'''
|