internet/ansible-freeipa
4
0
Fork 0
mirror of https://github.com/freeipa/ansible-freeipa.git synced 2026-03-26 21:33:05 +00:00
Code Issues Projects Releases Wiki Activity

infra/image/system-services: Enhance checks, also fix reverse zone

Browse Source 
Checks for IPv4 addresses have been added and reverse zone handling
for fixipaip.sh

The services are logging StandardOutput and StandardError to journal
now.
This commit is contained in:
Thomas Woerner
2024-08-02 17:00:12 +02:00
parent 7dbe6edbf0
commit e05fbce04c
4 changed files with 115 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
infra/image/system-service/fixipaip.service
View File

@@ -5,6 +5,8 @@ After=multi-user.target
[Service]
Type=oneshot
ExecStart=/root/fixipaip.sh
StandardOutput=journal
StandardError=journal
[Install]
WantedBy=default.target

76
infra/image/system-service/fixipaip.sh
View File

@@ -1,26 +1,82 @@
#!/bin/bash -eu
function valid_fqdn()
{
local name="${1}"
[[ "${name}" =~ [[:space:]] ]] && return 1
[[ "${name}" =~ \. ]] || return 1
[[ "${name}" =~ \.\. ]] && return 1
for i in ${name//./ }; do
[[ "${i}" =~ ^[a-z0-9_/]+$ ]] || return 1
done
[[ "${name}" == "localhost.localdomain" ]] && return 1
return 0
}
function valid_ipv4()
{
local ip="${1}"
local rematch="^([0-9]{1,3}\.){3}[0-9]{1,3}$"
[[ "${ip}" =~ ${rematch} ]] || return 1
for i in ${ip//./ }; do
[[ ${i} -le 255 ]] || return 1
done
return 0
}
HOSTNAME=$(hostname)
IP=$(hostname -I | cut -d " " -f 1)
export KRB5CCNAME=ansible_freeipa_cache
if [ -z "${HOSTNAME}" ]; then
echo "ERROR: Failed to retrieve hostname."
if [ -z "${HOSTNAME}" ] || ! valid_fqdn "${HOSTNAME}" ; then
echo "ERROR: Got invalid hostname: '${HOSTNAME}'"
exit 1
fi
if [ -z "${IP}" ]; then
echo "ERROR: Failed to retrieve IP address."
if [ -z "${IP}" ] || ! valid_ipv4 "${IP}" ; then
echo "ERROR: Got invalid IPv4 address: '${IP}'"
exit 1
fi
PTR=$(echo "${IP}" | awk -F"." '{print $4}')
if [ -z "${PTR}" ] || [ -n "${PTR//[0-9]}" ]; then
echo "ERROR: Failed to get PTR from IPv4 address: '${PTR}'"
exit 1
fi
if ! echo "SomeADMINpassword" | kinit -c ansible_freeipa_cache admin
echo "Fix IPA IP:"
echo " HOSTNAME: '${HOSTNAME}'"
echo " IP: '${IP}'"
echo " PTR: '${PTR}'"
if ! echo "SomeADMINpassword" | kinit -c "${KRB5CCNAME}"
then
echo "ERROR: Failed to obtain Kerberos ticket"
exit 1
fi
KRB5CCNAME=ansible_freeipa_cache \
ipa dnsrecord-mod test.local "${HOSTNAME%%.*}" --a-rec="$IP"
KRB5CCNAME=ansible_freeipa_cache \
ipa dnsrecord-mod test.local ipa-ca --a-rec="$IP"
kdestroy -c ansible_freeipa_cache -A
ZONES=$(ipa dnszone-find --name-from-ip="${HOSTNAME}." --raw --pkey-only \
| grep "idnsname:" | awk -F": " '{print $2}')
for zone in ${ZONES}; do
echo
if [[ "${zone}" == *".in-addr.arpa."* ]]; then
echo "Fixing reverse zone ${zone}:"
OLD_PTR=$(ipa dnsrecord-find "${zone}" --ptr-rec="${HOSTNAME}." \
--raw | grep "idnsname:" | awk -F": " '{print $2}')
if [ -z "${OLD_PTR}" ] || [ -n "${OLD_PTR//[0-9]}" ]; then
echo "ERROR: Failed to get old PTR from '${zone}': '${OLD_PTR}'"
else
ipa dnsrecord-mod "${zone}" "${OLD_PTR}" --ptr-rec="${HOSTNAME}." \
--rename="${PTR}"
fi
else
echo "Fixing forward zone ${zone}:"
ipa dnsrecord-mod test.local "${HOSTNAME%%.*}" --a-rec="$IP"
ipa dnsrecord-mod test.local ipa-ca --a-rec="$IP"
fi
done
kdestroy -c "${KRB5CCNAME}" -A
exit 0

2
infra/image/system-service/fixnet.service
View File

@@ -7,6 +7,8 @@ Before=ipa.service
[Service]
Type=oneshot
ExecStart=/root/fixnet.sh
StandardOutput=journal
StandardError=journal
[Install]
WantedBy=ipa.service

52
infra/image/system-service/fixnet.sh
View File

@@ -1,24 +1,62 @@
#!/bin/bash -eu
function valid_fqdn()
{
local name="${1}"
[[ "${name}" =~ [[:space:]] ]] && return 1
[[ "${name}" =~ \. ]] || return 1
[[ "${name}" =~ \.\. ]] && return 1
for i in ${name//./ }; do
[[ "${i}" =~ ^[a-z0-9_/]+$ ]] || return 1
done
[[ "${name}" == "localhost.localdomain" ]] && return 1
return 0
}
function valid_ipv4()
{
local ip="${1}"
local rematch="^([0-9]{1,3}\.){3}[0-9]{1,3}$"
[[ "${ip}" =~ ${rematch} ]] || return 1
for i in ${ip//./ }; do
[[ ${i} -le 255 ]] || return 1
done
return 0
}
HOSTNAME=$(hostname)
IP=$(hostname -I | cut -d " " -f 1)
if [ -z "${HOSTNAME}" ]; then
if [ -z "${HOSTNAME}" ] || ! valid_fqdn "${HOSTNAME}" ; then
echo "ERROR: Failed to retrieve hostname."
exit 1
fi
if [ -z "${IP}" ]; then
echo "ERROR: Failed to retrieve IP address."
if [ -z "${IP}" ] || ! valid_ipv4 "${IP}" ; then
echo "ERROR: Got invalid IPv4 address: '${IP}'"
exit 1
fi
# shellcheck disable=SC2143
if [ -n "$(grep -P "[[:space:]]${HOSTNAME}" /etc/hosts)" ]; then
sed -ie "s/.*${HOSTNAME}/${IP}\t${HOSTNAME}/" /etc/hosts
echo "Fix NET:"
echo " HOSTNAME: '${HOSTNAME}'"
echo " IP: '${IP}'"
echo
if grep -qE "^[^(#\s*)][0-9\.]+\s$HOSTNAME(\s|$)" /etc/hosts
then
sed -i.bak -e "s/.*${HOSTNAME}/${IP}\t${HOSTNAME}/" /etc/hosts
else
echo -e "$IP\t${HOSTNAME}" >> /etc/hosts
echo -e "$IP\t${HOSTNAME} ${HOSTNAME%%.*}" >> /etc/hosts
fi
echo "nameserver 127.0.0.1" > /etc/resolv.conf
echo "/etc/hosts:"
cat "/etc/hosts"
echo
echo "/etc/resolv.conf:"
cat "/etc/resolv.conf"
exit 0