--- loncom/init.d/loncontrol 2009/04/22 14:58:59 1.35 +++ loncom/init.d/loncontrol 2019/06/09 02:35:41 1.46 @@ -1,6 +1,6 @@ #!/usr/bin/perl # -# $Id: loncontrol,v 1.35 2009/04/22 14:58:59 raeburn Exp $ +# $Id: loncontrol,v 1.46 2019/06/09 02:35:41 raeburn Exp $ # # The LearningOnline Network with CAPA # @@ -40,9 +40,10 @@ # SuSE chkconfig/insserv info ### BEGIN INIT INFO # Provides: loncapa -# Required-Start: mysql apache2 $network $remote_fs +# Required-Start: SuSEfirewall2_setup mysql apache2 $network $remote_fs +# Should-Start: $ALL # Required-Stop: -# Default-Start: 3 4 5 +# Default-Start: 3 5 # Default-Stop: # Description: Starts the LON-CAPA services ### END INIT INFO @@ -50,148 +51,14 @@ use strict; use lib '/home/httpd/lib/perl/'; use LONCAPA::Configuration; +use LONCAPA::Firewall; +use Apache::lonnet; my $command=$ARGV[0]; $command=~s/[^a-z]//g; $ENV{'PATH'}="/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin"; $ENV{'BASH_ENV'}=""; -{ # Firewall variable scoping - # Firewall code is based on the code in FC2 /etc/init.d/ntpd - my $fw_chain = 'RH-Firewall-1-INPUT'; - my $iptables = '/sbin/iptables'; - if (! -e $iptables) { - $iptables = '/usr/sbin/iptables'; - if (!-e $iptables) { - print("Unable to find iptables command\n"); - } - } - my $suse_config = "/etc/sysconfig/SuSEfirewall2"; - if (!-e $suse_config) { - if (!-e '/etc/sysconfig/iptables') { - print("Unable to find iptables file containing static definitions\n"); - } - } - my $lond_port = &get_lond_port(); - if (!$lond_port) { - print("Unable to determine lond port number from LON-CAPA configuration.\n"); - } - -sub firewall_open_port { - return 'inactive firewall' if (! &firewall_is_active); - return 'port number unknown' if !$lond_port; - my @opened; - my $suse_config = "/etc/sysconfig/SuSEfirewall2"; - if (-e $suse_config) { - if (open(my $fh,"<$suse_config")) { - while(<$fh>) { - chomp(); - if (/^FW_SERVICES_EXT_TCP="([^"]+)"\s*$/) { - my $portstr = $1; - my @suseports = split(/\s+/,$portstr); - foreach my $port ($lond_port) { - if (grep/^\Q$port\E$/,@suseports) { - push(@opened,$port); - } - } - } - } - } - } else { - if (! `$iptables -L -n 2>/dev/null | grep $fw_chain | wc -l`) { - return 'chain error'; - } - # iptables is running with our chain - # - # We could restrict the servers allowed to attempt to communicate - # here, but the logistics of updating the /home/httpd/lonTabs/host.tab - # file are likely to be a problem - foreach my $port ($lond_port) { - print "Opening firewall access on port $port.\n"; - my $result; - my $firewall_command = - "$iptables -I $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT"; - system($firewall_command); - my $return_status = $?>>8; - if ($return_status == 1) { - # Error - print "Error opening port.\n"; - } elsif ($return_status == 2) { - # Bad command - print "Bad command error opening port. Command was\n". - " ".$firewall_command."\n"; - } elsif ($return_status == 0) { - push(@opened,$port); - } - } - } - foreach my $port ($lond_port) { - if (!grep(/^\Q$port\E$/,@opened)) { - return 'Required port not open: '.$port."\n"; - } - } - return 'ok'; -} - -sub firewall_is_port_open { - my ($port) = @_; - # returns 1 if the firewall port is open, 0 if not. - # - # check if firewall is active or installed - return if (! &firewall_is_active); - if (`$iptables -L -n 2>/dev/null | grep "tcp dpt:$port"`) { - return 1; - } else { - return 0; - } -} - -sub firewall_is_active { - if (-e '/proc/net/ip_tables_names') { - return 1; - } else { - return 0; - } -} - -sub firewall_close_port { - return 'inactive firewall' if (! &firewall_is_active); - return 'port number unknown' if !$lond_port; - my $suse_config = "/etc/sysconfig/SuSEfirewall2"; - return if (-e $suse_config); - foreach my $port ($lond_port) { - print "Closing firewall access on port $port\n"; - my $firewall_command = - "$iptables -D $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT"; - system($firewall_command); - my $return_status = $?>>8; - if ($return_status == 1) { - # Error - print "Error closing port.\n"; - } elsif ($return_status == 2) { - # Bad command - print "Bad command error closing port. Command was\n". - " ".$firewall_command."\n"; - } else { - print "Port closed.\n"; - } - } - return; -} - -sub get_lond_port { - my $perlvarref=&LONCAPA::Configuration::read_conf(); - my $lond_port; - if (ref($perlvarref) eq 'HASH') { - if (defined($perlvarref->{'londPort'})) { - $lond_port = $perlvarref->{'londPort'}; - } - } - return $lond_port; -} - -} # End firewall variable scope - sub stop_daemon { my ($daemon,$killallname)=@_; my $pidfile="/home/httpd/perl/logs/$daemon.pid"; @@ -226,6 +93,9 @@ sub stop_daemon { print(", killed off extraneous processes"); } unlink($pidfile); + if ($killallname eq 'loncnew') { + &clean_nossl_loncpids(); + } print("\n"); } @@ -240,76 +110,130 @@ sub clean_sockets { } } -if ($command eq "restart") { - print 'Restarting LON-CAPA'."\n"; - print 'Ending LON-CAPA client and daemon processes'."\n"; - foreach my $daemon ('lonsql','lond','lonc','lonmemcached','lonmaxima','lonr') { - my $killallname=$daemon; - if ($daemon eq 'lonc') { $killallname='loncnew'; } - &stop_daemon($daemon,$killallname); - } - print 'Starting LON-CAPA client and daemon processes (please be patient)'. - "\n"; - system("su www -c '/home/httpd/perl/loncron --justcheckdaemons'"); -} elsif ($command eq "stop") { - print 'Stopping LON-CAPA'."\n"; - foreach my $daemon ('lonsql','lond','lonc','lonmemcached','lonmaxima','lonr') { - my $killallname=$daemon; - if ($daemon eq 'lonc') { $killallname='loncnew'; } - &stop_daemon($daemon,$killallname); - } - my $firewall_result = &firewall_close_port(); - if ($firewall_result) { - print "$firewall_result\n"; +sub clean_nossl_loncpids { + my $childpiddir = '/home/httpd/perl/logs/loncpids'; + my $nossldir = '/home/httpd/sockets/nosslverify'; + foreach my $dir ($childpiddir,$nossldir) { + if (-d $dir) { + if (opendir(my $dh,$dir)) { + while (my $fname=readdir($dh)) { + next if ($fname =~ /^\./); + unlink("$dir/$fname"); + } + closedir($dh); + } + } } - &clean_sockets(); -} elsif ($command eq "start") { - my $firewall_result = &firewall_open_port(); - if (($firewall_result eq 'ok') || ($firewall_result eq 'inactive firewall')) { - if ($firewall_result eq 'inactive firewall') { - print "WARNING: iptables firewall is currently inactive\n"; +} + +if (($command eq "restart") || ($command eq 'stop') || + ($command eq 'start') || ($command eq "status")) { + my $iptables = &LONCAPA::Firewall::get_pathto_iptables(); + my @fw_chains = &LONCAPA::Firewall::get_fw_chains($iptables); + my $lond_port = &LONCAPA::Firewall::get_lond_port(); + my $firewalld = &LONCAPA::Firewall::uses_firewalld(); + my %iphost; + if ($command eq 'restart') { + print 'Restarting LON-CAPA'."\n"; + print 'Ending LON-CAPA client and daemon processes'."\n"; + foreach my $daemon ('lonsql','lond','lonc','lonmemcached','lonmaxima','lonr') { + my $killallname=$daemon; + if ($daemon eq 'lonc') { $killallname='loncnew'; } + &stop_daemon($daemon,$killallname); + } + %iphost = &Apache::lonnet::get_iphost('',1); + my $firewall_result = + &LONCAPA::Firewall::firewall_close_port($iptables,\@fw_chains, + $lond_port,\%iphost,[$lond_port], + $firewalld); + if ($firewall_result) { + print "$firewall_result\n"; + } + $firewall_result = + &LONCAPA::Firewall::firewall_open_port($iptables,\@fw_chains, + $lond_port,\%iphost,[$lond_port], + $firewalld); + if (($firewall_result eq 'ok') || ($firewall_result eq 'inactive firewall')) { + if ($firewall_result eq 'inactive firewall') { + print "WARNING: iptables firewall is currently inactive\n"; + } + } elsif ($firewall_result) { + print "$firewall_result\n"; } - print 'Starting LON-CAPA'."\n"; print 'Starting LON-CAPA client and daemon processes (please be patient)'. - "\n"; + "\n"; system("su www -c '/home/httpd/perl/loncron --justcheckdaemons'"); - } else { - print "Not starting LON-CAPA\n"; - if ($firewall_result eq 'port number unknown') { - print "Could not check for status of LON-CAPA port in running firewall - port number unknown. \n"; - } elsif ($firewall_result) { + } elsif ($command eq 'stop') { + print 'Stopping LON-CAPA'."\n"; + foreach my $daemon ('lonsql','lond','lonc','lonmemcached','lonmaxima','lonr') { + my $killallname=$daemon; + if ($daemon eq 'lonc') { $killallname='loncnew'; } + &stop_daemon($daemon,$killallname); + } + my $firewall_result = + &LONCAPA::Firewall::firewall_close_port($iptables,\@fw_chains, + $lond_port,\%iphost,[$lond_port], + $firewalld); + if ($firewall_result) { print "$firewall_result\n"; } - } -} elsif ($command eq "reload") { - print 'Reload LON-CAPA config files'."\n"; - system("su www -c '/home/httpd/perl/loncron --justreload'"); -} elsif ($command eq "status") { - my $lond_port = &get_lond_port(); - my $response=`/bin/cat /home/httpd/perl/logs/*.pid 2>&1`; - if ($response=~/No such file or directory/) { - print 'LON-CAPA is not running.'."\n"; - } else { - print 'LON-CAPA is running.'."\n"; - system("su www -c '/home/httpd/perl/loncron --justcheckconnections'"); - } - if (! &firewall_is_active) { - print 'The iptables firewall is not active'."\n"; - } - my $lond_port = &get_lond_port(); - if ($lond_port) { - if (&firewall_is_port_open($lond_port)) { - print "The LON-CAPA port ($lond_port) is open in firewall.\n"; - } elsif (&firewall_is_active) { - print "The LON-CAPA port ($lond_port) is NOT open in running firewall!\n"; + &clean_sockets(); + } elsif ($command eq "start") { + %iphost = &Apache::lonnet::get_iphost('',1); + my $firewall_result = + &LONCAPA::Firewall::firewall_open_port($iptables,\@fw_chains, + $lond_port,\%iphost,[$lond_port], + $firewalld); + if (($firewall_result eq 'ok') || ($firewall_result eq 'inactive firewall')) { + if ($firewall_result eq 'inactive firewall') { + print "WARNING: iptables firewall is currently inactive\n"; + } + print 'Starting LON-CAPA'."\n"; + print 'Starting LON-CAPA client and daemon processes (please be patient)'. + "\n"; + system("su www -c '/home/httpd/perl/loncron --justcheckdaemons'"); + } else { + print "Not starting LON-CAPA\n"; + if ($firewall_result eq 'port number unknown') { + print "Could not check for status of LON-CAPA port in running firewall - port number unknown. \n"; + } elsif ($firewall_result) { + print "$firewall_result\n"; + } } - } else { - if (&firewall_is_active) { - print "Could not check for status of LON-CAPA port in running firewall - port number unknown.\n"; + } elsif ($command eq "status") { + %iphost = &Apache::lonnet::get_iphost(); + my $response=`/bin/cat /home/httpd/perl/logs/*.pid 2>&1`; + if ($response=~/No such file or directory/) { + print 'LON-CAPA is not running.'."\n"; } else { - print "LON-CAPA port number is unknown, and firewall is not running.\n"; + print 'LON-CAPA is running.'."\n"; + system("su www -c '/home/httpd/perl/loncron --justcheckconnections'"); + } + if (! &LONCAPA::Firewall::firewall_is_active()) { + print 'The iptables firewall is not active'."\n"; + } + if ($lond_port) { + my $londopen; + foreach my $fw_chain (@fw_chains) { + my $numopen = &LONCAPA::Firewall::firewall_is_port_open($iptables,$fw_chain,$lond_port,$lond_port,\%iphost,$firewalld); + $londopen += $numopen; + } + if ($londopen) { + print "The LON-CAPA port ($lond_port) is open in firewall.\n"; + } elsif (&LONCAPA::Firewall::firewall_is_active()) { + print "The LON-CAPA port ($lond_port) is NOT open in running firewall!\n"; + } + } else { + if (&LONCAPA::Firewall::firewall_is_active()) { + print "Could not check for status of LON-CAPA port in running firewall - port number unknown.\n"; + } else { + print "LON-CAPA port number is unknown, and firewall is not running.\n"; + } } } +} elsif ($command eq "reload") { + print 'Reload LON-CAPA config files'."\n"; + system("su www -c '/home/httpd/perl/loncron --justreload'"); } else { - print "You need to specify one of restart|stop|start|status on the command line.\n"; + print "You need to specify one of reload|restart|stop|start|status on the command line.\n"; }