2012-08-26 12:15:08 +00:00
|
|
|
#!/bin/rc
|
|
|
|
rfork e
|
2021-11-29 20:07:04 +00:00
|
|
|
fn checkether {
|
|
|
|
echo -n ' '$1'='$2
|
|
|
|
if(! ~ $2 [0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f])
|
|
|
|
echo ' has wrong format'
|
|
|
|
if not if(! grep -s $i /net/ether*/addr)
|
|
|
|
echo ' does not belong to any network interface'
|
|
|
|
if not
|
|
|
|
echo ' looks ok'
|
|
|
|
}
|
|
|
|
fn checkip {
|
|
|
|
echo -n ' '$1'='$2
|
|
|
|
if(! ~ $2 *.*.*.* *:*:*:*:*:*:*:* *::*)
|
|
|
|
echo ' does not look like an ip address'
|
|
|
|
if not
|
|
|
|
echo ' looks ok'
|
|
|
|
}
|
|
|
|
fn checkdom {
|
|
|
|
echo -n ' '$1'='$2
|
|
|
|
if(! ~ $2 *.*)
|
|
|
|
echo ' does not have a dot'
|
|
|
|
if not if(~ $2 *.)
|
|
|
|
echo ' has a trailing period'
|
|
|
|
if not
|
|
|
|
echo ' looks ok'
|
|
|
|
}
|
2012-08-26 12:15:08 +00:00
|
|
|
fn checkhost {
|
|
|
|
if(~ $sysname ''){
|
|
|
|
echo 'sysname= env var is not set'
|
|
|
|
exit 'fail'
|
|
|
|
}
|
|
|
|
echo 'checking this host''s tuple:'
|
2018-09-16 10:40:48 +00:00
|
|
|
ip=`{ndb/ipquery sys $sysname ip | sed 's/ip=//g'}
|
2012-10-07 22:56:00 +00:00
|
|
|
if(~ $ip '')
|
|
|
|
echo ' no ip= entry'
|
2021-11-29 20:07:04 +00:00
|
|
|
if not {
|
|
|
|
for(i in $ip){
|
|
|
|
checkip ip $i
|
|
|
|
}
|
|
|
|
}
|
2018-09-16 10:40:48 +00:00
|
|
|
dom=`{ndb/ipquery sys $sysname dom | sed 's/dom=//g'}
|
2012-08-26 13:56:16 +00:00
|
|
|
if(~ $dom '')
|
2012-08-26 12:15:08 +00:00
|
|
|
echo ' no dom= entry'
|
2018-09-16 10:40:48 +00:00
|
|
|
if not {
|
|
|
|
for(i in $dom){
|
2021-11-29 20:07:04 +00:00
|
|
|
checkdom dom $i
|
|
|
|
if(! ~ $i $sysname^.*)
|
2018-09-16 10:40:48 +00:00
|
|
|
echo ' dom='$i 'does not start with' $sysname^'; it''s supposed to be the FQDN, not the domain name!'
|
|
|
|
}
|
|
|
|
}
|
|
|
|
ether=`{ndb/ipquery sys $sysname ether | sed 's/ether=//g'}
|
2012-08-26 12:15:08 +00:00
|
|
|
if(~ $ether '')
|
|
|
|
echo ' no ether entry'
|
2018-09-16 10:40:48 +00:00
|
|
|
if not {
|
|
|
|
for(i in $ether){
|
2021-11-29 20:07:04 +00:00
|
|
|
checkether ether $i
|
2018-09-16 10:40:48 +00:00
|
|
|
}
|
|
|
|
}
|
2012-08-26 12:15:08 +00:00
|
|
|
}
|
|
|
|
fn checknet {
|
|
|
|
echo 'checking the network tuple:'
|
2018-09-16 10:40:48 +00:00
|
|
|
ipnet=`{ndb/ipquery sys $sysname ipnet | sed 's/ipnet=//g'}
|
2012-08-26 12:15:08 +00:00
|
|
|
if(~ $ipnet ''){
|
2012-10-07 22:56:00 +00:00
|
|
|
echo ' we are not in an ipnet, so looking for entries in host tuple only'
|
2012-08-26 12:15:08 +00:00
|
|
|
}
|
2021-11-29 20:07:04 +00:00
|
|
|
if not {
|
|
|
|
echo ' we are in ' 'ipnet='^$ipnet
|
|
|
|
}
|
2018-09-16 10:40:48 +00:00
|
|
|
ipgw=`{ndb/ipquery sys $sysname ipgw | sed 's/ipgw=//g'}
|
2013-05-14 16:54:42 +00:00
|
|
|
if(~ $ipgw '' '::'){
|
|
|
|
echo ' we do not have an internet gateway, no ipgw= entry'
|
|
|
|
}
|
|
|
|
if not {
|
2021-11-29 20:07:04 +00:00
|
|
|
for(i in $ipgw) {
|
|
|
|
checkip ipgw $i
|
|
|
|
}
|
2013-05-14 16:54:42 +00:00
|
|
|
}
|
2018-09-16 10:40:48 +00:00
|
|
|
dns=`{ndb/ipquery sys $sysname dns | sed 's/dns=//g'}
|
2012-08-26 12:15:08 +00:00
|
|
|
if(~ $dns '')
|
|
|
|
echo ' no dns= entry'
|
2018-09-16 10:40:48 +00:00
|
|
|
if not {
|
|
|
|
for(i in $dns){
|
|
|
|
if(! ip/ping -n 1 $i >/dev/null >[2=1])
|
|
|
|
echo ' dns='$i 'does not reply to ping'
|
|
|
|
if not
|
|
|
|
echo ' dns='$i 'looks ok'
|
|
|
|
}
|
|
|
|
}
|
|
|
|
auth=`{ndb/ipquery sys $sysname auth | sed 's/auth=//g'}
|
2012-08-26 12:15:08 +00:00
|
|
|
if(~ $auth '')
|
|
|
|
echo ' no auth= entry'
|
|
|
|
if not {
|
2018-09-16 10:40:48 +00:00
|
|
|
for(i in $auth){
|
|
|
|
if(! ip/ping -n 1 $i >/dev/null >[2=1])
|
|
|
|
echo ' auth='$i 'does not reply to ping'
|
|
|
|
if not {
|
|
|
|
authok=1
|
|
|
|
echo ' auth='$i 'looks ok'
|
|
|
|
}
|
|
|
|
}
|
2012-08-26 12:15:08 +00:00
|
|
|
}
|
2018-09-16 10:40:48 +00:00
|
|
|
fs=`{ndb/ipquery sys $sysname fs | sed 's/fs=//g'}
|
2017-10-04 15:56:53 +00:00
|
|
|
if(~ $fs '')
|
|
|
|
echo ' no fs= entry (needed for tls boot)'
|
2018-09-16 10:40:48 +00:00
|
|
|
if not {
|
|
|
|
for(i in $fs){
|
|
|
|
if(! ip/ping -n 1 $i >/dev/null >[2=1])
|
|
|
|
echo ' fs='$i 'does not reply to ping (needed for tls boot)'
|
|
|
|
if not
|
|
|
|
echo ' fs='$i 'looks ok'
|
|
|
|
}
|
|
|
|
}
|
2012-08-26 12:15:08 +00:00
|
|
|
}
|
|
|
|
fn checkauth {
|
|
|
|
echo 'checking auth server configuration:'
|
|
|
|
if(~ $auth ''){
|
|
|
|
echo ' no auth server'
|
|
|
|
exit fail
|
|
|
|
}
|
2018-09-16 10:40:48 +00:00
|
|
|
if not if(~ $sysname $auth){
|
2012-08-26 12:15:08 +00:00
|
|
|
echo ' we are the auth server'
|
|
|
|
authisus=1
|
|
|
|
}
|
2018-09-16 10:40:48 +00:00
|
|
|
if not if(~ $dom $auth){
|
2012-08-26 12:15:08 +00:00
|
|
|
echo ' we are the auth server'
|
|
|
|
authisus=1
|
|
|
|
}
|
2018-09-16 10:40:48 +00:00
|
|
|
if not if(~ $ip $auth){
|
2012-10-07 22:56:00 +00:00
|
|
|
echo ' we are the auth server'
|
|
|
|
authisus=1
|
|
|
|
}
|
2012-08-26 12:15:08 +00:00
|
|
|
if not {
|
|
|
|
echo ' we are not the auth server '^$auth
|
2021-11-29 20:07:04 +00:00
|
|
|
echo ' if this is a mistake, set auth='$sysname 'or auth='$dom
|
2012-08-26 12:15:08 +00:00
|
|
|
if(~ $authok 1)
|
|
|
|
echo ' run auth/debug to test the auth server'
|
|
|
|
}
|
|
|
|
if(~ $authisus 1){
|
|
|
|
if(! grep -s keyfs <{ps})
|
|
|
|
echo ' auth/keyfs is not running, try reboot'
|
|
|
|
if not
|
|
|
|
echo ' auth/keyfs is running'
|
|
|
|
if(! grep -s 'Listen *567' <{netstat -n})
|
|
|
|
echo ' no one listening on port 567, try reboot'
|
|
|
|
if not {
|
|
|
|
echo ' someone is listening on port 567'
|
|
|
|
echo ' run auth/debug to test the auth server'
|
|
|
|
}
|
2017-02-25 10:54:15 +00:00
|
|
|
echo ' run auth/asaudit to verify auth server configuration'
|
2012-08-26 12:15:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
fn checksec {
|
|
|
|
echo 'checking basic security:'
|
|
|
|
if(@{rfork n; mount -n /srv/boot /root >/dev/null >[2=1]})
|
2012-08-26 14:10:01 +00:00
|
|
|
echo ' file server does not require auth for user '^`{cat '#c'/user}
|
2012-08-26 12:15:08 +00:00
|
|
|
if not
|
|
|
|
echo ' file server seems to require auth'
|
|
|
|
}
|
|
|
|
checkhost
|
|
|
|
checknet
|
|
|
|
checkauth
|
2015-03-11 15:13:42 +00:00
|
|
|
#checksec
|