diff --git a/CHANGELOG.md b/CHANGELOG.md index 88b1c2e..ea4c32f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Security +## [2.7.0] - 2020-11-13 + +### Added + +* bkctld: add a [-f|--force] option to remove confirmation on some commands +* bkctld-remove: confirmation before removal of jails if not in force mode +* bkctld-rm: delete empty jails in incs directory + +### Changed + +* Better help message composition and formating +* bkctld-rm: list jails from incs directory + ## [2.6.0] - 2020-10-07 ### Added @@ -58,7 +71,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 * bkctld-update: start jail after upgrade if it was started before * bkctld: don't replace SSH host keys when creating/updating a jail * Split check into check-jails and check-setup -* bkctld-check-jails checks if jails +* bkctld-check-jails checks if jails * bkctld-check-setup checks if the partition is mounted and writable, if firewall is configured and if all jails are in their expected state * create new ssh keys for new jails instead of copying those from the host diff --git a/bkctld b/bkctld index 03342a8..07d399a 100755 --- a/bkctld +++ b/bkctld @@ -36,6 +36,10 @@ fi # Parse options # based on https://gist.github.com/deshion/10d3cb5f88a21671e17a +if [ "$#" = "0" ]; then + show_help + exit 1 +fi while :; do case $1 in -h|-\?|--help) @@ -46,6 +50,9 @@ while :; do show_version exit 0 ;; + -f|--force) + FORCE=1 + ;; *) # Default case: If no more options then break out of the loop. break @@ -81,7 +88,7 @@ case "${subcommand}" in show_help exit 1 else - "${LIBDIR}/bkctld-${subcommand}" "${jail_name}" + "${LIBDIR}/bkctld-${subcommand}" "${jail_name}" fi ;; "key" | "port" | "ip") diff --git a/lib/bkctld-check-incs b/lib/bkctld-check-incs index d862e70..1a1f5c3 100755 --- a/lib/bkctld-check-incs +++ b/lib/bkctld-check-incs @@ -1,6 +1,6 @@ #!/bin/sh # -# Run check on all expected incs of all jails +# Description: Run check on all expected incs of all jails # Usage: check-incs all # diff --git a/lib/bkctld-check-jails b/lib/bkctld-check-jails index 531ab27..aafa456 100755 --- a/lib/bkctld-check-jails +++ b/lib/bkctld-check-jails @@ -1,6 +1,6 @@ #!/bin/sh # -# Run check on jails (NRPE output) +# Description: Run check on jails (NRPE output) # Usage: check-jails # diff --git a/lib/bkctld-check-last-incs b/lib/bkctld-check-last-incs index c73e302..e0cafa1 100755 --- a/lib/bkctld-check-last-incs +++ b/lib/bkctld-check-last-incs @@ -1,6 +1,6 @@ #!/bin/sh # -# Run check on the last inc of all jails +# Description: Run check on the last inc of all jails # Usage: check-incs last # diff --git a/lib/bkctld-check-setup b/lib/bkctld-check-setup index a66b357..d2632a0 100755 --- a/lib/bkctld-check-setup +++ b/lib/bkctld-check-setup @@ -1,7 +1,7 @@ #!/bin/sh # -# Run check on jails (NRPE output) -# Usage: check-setup +# Description: Run check on jails (NRPE output) +# Usage: check setup # # shellcheck source=./includes diff --git a/lib/bkctld-firewall b/lib/bkctld-firewall index 2c1293f..7cb434c 100755 --- a/lib/bkctld-firewall +++ b/lib/bkctld-firewall @@ -1,7 +1,7 @@ #!/bin/sh # -# Update firewall rules of or all -# Usage: firewall |all +# Description: Update firewall rules +# Usage: firewall [|all] # # shellcheck source=./includes diff --git a/lib/bkctld-inc b/lib/bkctld-inc index 7c81404..d29c752 100755 --- a/lib/bkctld-inc +++ b/lib/bkctld-inc @@ -1,6 +1,6 @@ #!/bin/sh # -# Make incremental inc of all jails +# Description: Make dated copies (incs) of jails # Usage: inc # diff --git a/lib/bkctld-init b/lib/bkctld-init index a7dec49..6b52815 100755 --- a/lib/bkctld-init +++ b/lib/bkctld-init @@ -1,6 +1,6 @@ #!/bin/sh # -# Init jail +# Description: Initialize a new jail # Usage: init # diff --git a/lib/bkctld-ip b/lib/bkctld-ip index dae1913..83e8e33 100755 --- a/lib/bkctld-ip +++ b/lib/bkctld-ip @@ -1,6 +1,6 @@ #!/bin/sh # -# Set or get allowed(s) ip(s) of +# Description: Set or get allowed(s) ip(s) # Usage: ip [|all] # diff --git a/lib/bkctld-is-on b/lib/bkctld-is-on index 36deafb..9c2b904 100755 --- a/lib/bkctld-is-on +++ b/lib/bkctld-is-on @@ -1,6 +1,6 @@ #!/bin/sh # -# Check if a jail is on or not +# Description: Check if a SSH server is on (exit 0) or not (exit 100) # Usage: is-on # diff --git a/lib/bkctld-key b/lib/bkctld-key index bfe6e51..393afd7 100755 --- a/lib/bkctld-key +++ b/lib/bkctld-key @@ -1,6 +1,6 @@ #!/bin/sh # -# Set or get ssh pubic key of +# Description: Set or get ssh pubic key # Usage: key [] # diff --git a/lib/bkctld-list b/lib/bkctld-list index 3815871..10b11bf 100755 --- a/lib/bkctld-list +++ b/lib/bkctld-list @@ -1,6 +1,6 @@ #!/bin/sh # -# List jails +# Description: List jails # Usage: list # diff --git a/lib/bkctld-port b/lib/bkctld-port index dffe4e9..2b1f17d 100755 --- a/lib/bkctld-port +++ b/lib/bkctld-port @@ -1,6 +1,6 @@ #!/bin/sh # -# Set or get ssh port of +# Description: Set or get SSH port # Usage: port [|auto] # diff --git a/lib/bkctld-reload b/lib/bkctld-reload index 5feec92..1036618 100755 --- a/lib/bkctld-reload +++ b/lib/bkctld-reload @@ -1,7 +1,7 @@ #!/bin/sh # -# Reload jail or all -# Usage: reload |all +# Description: Reload SSH server +# Usage: reload [|all] # # shellcheck source=./includes diff --git a/lib/bkctld-remove b/lib/bkctld-remove index 7b4b152..94d6b19 100755 --- a/lib/bkctld-remove +++ b/lib/bkctld-remove @@ -1,7 +1,9 @@ #!/bin/sh # -# Remove jail or all +# Description: Remove jail and all dated copies (incs) # Usage: remove |all +# Return codes: +# * 101 : jail removal aborted # # shellcheck source=./includes @@ -16,6 +18,28 @@ incs_path=$(incs_path "${jail_name}") test -d "${jail_path}" || error "${jail_name}: jail not found" 2 +if [ "${FORCE}" != "1" ]; then + answer="" + while :; do + printf "> Are you sure you want to delete jail \`%s'? [Y,n,?] " "${jail_name}" + read -r answer + case $answer in + [Yy]|"" ) + break + ;; + [Nn] ) + tty -s && echo "Abort." >&2 + exit 101 + ;; + * ) + printf "y - yes, execute actions and exit\n" + printf "n - no, don't execute actions and exit\n" + printf "? - print this help\n" + ;; + esac + done +fi + "${LIBDIR}/bkctld-is-on" "${jail_name}" && "${LIBDIR}/bkctld-stop" "${jail_name}" rm -f "${CONFDIR}/${jail_name}" diff --git a/lib/bkctld-restart b/lib/bkctld-restart index 7aaa314..9394b9a 100755 --- a/lib/bkctld-restart +++ b/lib/bkctld-restart @@ -1,7 +1,7 @@ #!/bin/sh # -# Restart jail or all -# Usage: restart |all +# Description: Restart SSH server +# Usage: restart [|all] # set -eu diff --git a/lib/bkctld-rm b/lib/bkctld-rm index 59035da..7b1df54 100755 --- a/lib/bkctld-rm +++ b/lib/bkctld-rm @@ -1,6 +1,6 @@ #!/bin/sh # -# Remove old incremtal inc of all jails +# Description: Remove old dated copies (incs) according to policy # Usage: rm # @@ -84,6 +84,21 @@ delete_inc_ext4() { fi } +delete_empty_inc() { + jail_name=$1 + + incs_path=$(incs_path "${jail_name}") + empty_incs_list=$(find "${incs_path}" -mindepth 0 -maxdepth 0 -type d -empty) + + for empty_inc in ${empty_incs_list}; do + if dry_run; then + echo "[dry-run] Delete empty \`${empty_inc}'" + else + rmdir "${empty_inc}" + notice "Delete empty \`${empty_inc}' : OK" + fi + done +} lock_file="${LOCKDIR}/rm-global.lock" # shellcheck disable=SC2064 @@ -92,7 +107,9 @@ trap "rm -f ${lock_file}; cleanup_tmp;" 0 kill_or_clean_lockfile "${lock_file}" new_lock_file "${lock_file}" -jails_list=$(jails_list) +# We list jails in "incs" directory, not in "jails" directory +# so we can clean old incs after a jail is archived +jails_list=$(jails_with_incs_list) jails_total=$(echo $jails_list | wc -w) jails_count=0 @@ -102,7 +119,6 @@ for jail_name in ${jails_list}; do # If no incs policy is found, we don't remove incs if [ -n "${incs_policy_file}" ]; then # shellcheck disable=SC2046 - incs_to_delete=$(incs_to_delete "${jail_name}" "${incs_policy_file}") incs_total=$(echo ${incs_to_delete} | wc -w) incs_count=0 @@ -130,6 +146,8 @@ for jail_name in ${jails_list}; do else notice "Skip jail \`${jail_name}' : incs policy is missing" fi + # Delete empty incs directory for jail + delete_empty_inc "${jail_name}" done # Remove the lock file and cleanup tmp files diff --git a/lib/bkctld-start b/lib/bkctld-start index a0d6f9c..343e2db 100755 --- a/lib/bkctld-start +++ b/lib/bkctld-start @@ -1,6 +1,6 @@ #!/bin/sh # -# Start jail or all +# Description: Start SSH Server # Usage: start |all # diff --git a/lib/bkctld-stats b/lib/bkctld-stats index c619b2d..8e69f12 100755 --- a/lib/bkctld-stats +++ b/lib/bkctld-stats @@ -1,6 +1,6 @@ #!/bin/sh # -# Make and display stats on jails (size, lastconn) +# Description: Display stats on jails (size, last connection…) # Usage: stats # diff --git a/lib/bkctld-status b/lib/bkctld-status index 80e6769..e815927 100755 --- a/lib/bkctld-status +++ b/lib/bkctld-status @@ -1,7 +1,7 @@ #!/bin/sh # -# Print status of (default all jail) -# Usage: status [] +# Description: Display status of SSH server +# Usage: status [|all] # # shellcheck source=./includes diff --git a/lib/bkctld-stop b/lib/bkctld-stop index 2d8a76f..fa8809d 100755 --- a/lib/bkctld-stop +++ b/lib/bkctld-stop @@ -1,7 +1,7 @@ #!/bin/sh # -# Stop jail or all -# Usage: stop |all +# Description: Stop SSH server +# Usage: stop [|all] # # shellcheck source=./includes @@ -21,7 +21,7 @@ pid=$(cat "${jail_path}/${SSHD_PID}") pkill --parent "${pid}" -if kill "${pid}"; then +if kill "${pid}"; then notice "Stop jail \`${jail_name}' : OK [${pid}]" umount --lazy --recursive "${jail_path}/dev" diff --git a/lib/bkctld-sync b/lib/bkctld-sync index df18917..e982af3 100755 --- a/lib/bkctld-sync +++ b/lib/bkctld-sync @@ -1,7 +1,7 @@ #!/bin/sh # -# Sync jail or all to another node -# Usage: sync |all +# Description: Sync jail configuration and state on other node(s) +# Usage: sync [|all] # # shellcheck source=./includes diff --git a/lib/bkctld-update b/lib/bkctld-update index 3309030..c6af12a 100755 --- a/lib/bkctld-update +++ b/lib/bkctld-update @@ -1,7 +1,7 @@ #!/bin/sh # -# Update jail or all -# Usage: update |all +# Description: Update binaries and libraries +# Usage: update [|all] # # shellcheck source=./includes diff --git a/lib/bkctld-upgrade-config b/lib/bkctld-upgrade-config index 054ade4..e835f7b 100644 --- a/lib/bkctld-upgrade-config +++ b/lib/bkctld-upgrade-config @@ -1,7 +1,7 @@ #!/bin/sh # -# Upgrade chroot components for jail or all -# Usage: upgrade-config |all +# Description: Upgrade configuration to new convention +# Usage: upgrade-config [|all] # # shellcheck source=./includes diff --git a/lib/includes b/lib/includes index 2196e5e..c5870d9 100755 --- a/lib/includes +++ b/lib/includes @@ -2,11 +2,11 @@ # # Config for bkctld # +# shellcheck disable=SC2034 [ -f /etc/default/bkctld ] && . /etc/default/bkctld -# shellcheck disable=SC2034 -VERSION="2.6.0" +VERSION="2.7.0" LIBDIR=${LIBDIR:-/usr/lib/bkctld} CONFDIR="${CONFDIR:-/etc/evobackup}" @@ -27,6 +27,7 @@ LOGLEVEL="${LOGLEVEL:-6}" CRITICAL="${CRITICAL:-48}" WARNING="${WARNING:-24}" DUC=$(command -v duc-nox || command -v duc) +FORCE="${FORCE:-0}" show_version() { cat < "${CONFDIR}/${JAILNAME}.d/incs_policy" + inc_path="${INCSPATH}/${INC_NAME}" + + # Create the inc + /usr/lib/bkctld/bkctld-inc + # Inc should be removed + run test -d "${inc_path}" + assert_success + + # Remove incs + /usr/lib/bkctld/bkctld-rm + # Inc should be removed + run test -d "${inc_path}" + assert_failure +} + +@test "empty inc directory are removed" { + # Create an inc + /usr/lib/bkctld/bkctld-inc + # no inc should be kept + echo '' > "${CONFDIR}/${JAILNAME}.d/incs_policy" + + # The inc directory is present + run test -d "${INCSPATH}" + assert_success + + /usr/lib/bkctld/bkctld-rm + + # The inc directory is absent + run test -d "${INCSPATH}" + assert_failure +} + # TODO: add many tests for incs (creation and removal) diff --git a/test/test_helper.bash b/test/test_helper.bash index 92de516..386180b 100644 --- a/test/test_helper.bash +++ b/test/test_helper.bash @@ -20,7 +20,7 @@ setup() { teardown() { remove_variable "/etc/default/bkctld" "BACKUP_DISK" - /usr/lib/bkctld/bkctld-remove "${JAILNAME}" && rm -rf "${INCSPATH}" + FORCE=1 /usr/lib/bkctld/bkctld-remove "${JAILNAME}" && rm -rf "${INCSPATH}" } random_jail_name() {