{{anchor href="top"}}
Hits : **{{hits}}**
== cfengine ==
{{ToC from="h2" to="h4"}}
-----------
%%
http://en.wikipedia.org/wiki/Comparison_of_open_source_configuration_management_software
%%
Υποψήφια προς μελέτη:
* cfengine : https://cfengine.com/
* puppet : https://puppet.com/
* STAF : http://staf.sourceforge.net/
=== cfegine ===
Ακούει στην TCP Port: 5308
Κάθε host (client server) κάνει pull τις αλλαγές (εάν υπάρχουν) στα πρώτα 5 λεπτά της κάθε ώρας (by default) εάν τρέχει ως δαίμονας
ή όποτε του πούμε εμείς (standalone by cron).
Επίσης μπορούμε να στείλουμε και pull action από τον cfengine - server μας.
Χρησιμοποιεί Classes στην οποία περιγράφονται οι αλλαγές (το policy)
και είναι γραμμένο σε C
Μπορούμε να περάσουμε τον κατάλογο εργασίας (με τα configuration files) σε ένα versioning source management system (like subversion)
και να κρατάμε ξεχωριστά κάπου αλλού όλες τις αλλαγές.
Υποστηρίζει πολλαπλά configuration files με την χρήση του import
==== Supported Operation Systems ====
* AIX
* *BSD
* HP-UX
* Linux
* Mac OS X
* Solaris
==== Δυνατότητες ====
* Checking and configuring network interfaces.
* Creating, changing and deleting files.
* Making and maintaining symbolic links.
* Checking and setting file permissions.
* Deleting 'junk' files lying around your systems.
* Automated mounting of filesystems.
* Controlling execution of scripts and shell commands.
* Monitoring md5 file checksums against a database.
* Checking daemons and restarting them if needed.
* Configuring new installations according to standardized rules.
* Duplicating systems readily.
* Reverting unauthorized changes, whether malicious or not.
==== Εντολές ====
* cfagent: actually performs changes on a given machine.
* cfenvd: an optional daemon used to collect historical and statistical data from a host. (Requires BerkeleyDB).
* cfexecd: daemon providing scheduling and reporting on clients. A cfengine-specific cron-like service which by default runs cfagent every hour.
* cfkey: creates public/private key pair for communication between a policy host or file server and a cfengine client.
* cfrun: used to push updates to clients
* cfservd: daemon which provides the 'cfengine service' at port 5308. Should always be running all on cfengine-controlled hosts.
==== Ορολογία ====
* action: functional areas within cfengine, each providing a particular capability
* class: named booleans, typically denoting which changes to perform on a host. A typical example looks like:
==== Δομή ====
action:
class::
[do stuff]
* file server: a cfengine host that shares files to cfengine clients.
* policy client/cfengine client: a host controlled by a cfengine policy host. (Ed: This nomenclature invented for cfwiki.org.)
* policy server: central point of management for cfengine-controlled hosts. Stores all configuration files to be distributed to cfengine clients.
Δομή αρχείων:
* /var/cfengine/...: cfengine 'home directory'
o bin/: executables
o inputs/ : configuration files
+ update.conf: Used by cfagent on policy server to copy configuration files into /var/cfengine/inputs and binaries into /var/cfengine/bin.
Also used on policy client to copy files from policy server. In essence, specifies which configuration files to use and performs any preparation
needed for their use. (update.conf should not do anything on the policy server other than make it capable of running cfengine)
+ cfagent.conf: what cfagent should aim for
+ cfservd.conf: cfservd's configuration
+ cfrun.hosts: lists host to be updated via cfrun
o outputs/: logfiles
o pppkeys/: keys for clients, fileservers, and/or policy hosts
==== Ενέργειες ====
#|
|| mountall | mount filesystems in fstab ||
|| mountinfo | scan mounted filesystems ||
|| checktimezone | check timezone ||
|| netconfig | check net interface config ||
|| resolve | check resolver setup ||
|| unmount | unmount any filesystems ||
|| packages | install/upgrade/remove packages ||
|| shellcommands | execute shell commands ||
|| editfiles | edit files ||
|| addmounts | add new filesystems to system ||
|| directories | make any directories ||
|| links | check and maintain links (single and child) ||
|| mailcheck | check mailserver ||
|| required | check required filesystems ||
|| tidy | tidy files ||
|| disable | disable files ||
|| files | check file permissions ||
|| copy | make a copy/image of a master file ||
|| processes | signal / check processes ||
|| module:name | execute a user-defined module ||
|#
((#top))
-----------
====Εγκατάσταση====
%%
wget -c http://www.cfengine.org/downloads/cfengine-2.2.10.tar.gz
tar zxvf cfengine-2.2.10.tar.gz
cd cfengine-2.2.10
./configure LDFLAGS=-ldl
make
make install
%%
((#top))
-----------
==== Αρχεία ====
%%(html)
cfengine-2.2.10:
/usr/local/lib/libcfengine.a
/usr/local/lib/libcfengine.la
/usr/local/sbin/cfagent
/usr/local/sbin/cfdoc
/usr/local/sbin/cfenvd
/usr/local/sbin/cfenvgraph
/usr/local/sbin/cfetool
/usr/local/sbin/cfetoolgraph
/usr/local/sbin/cfexecd
/usr/local/sbin/cfkey
/usr/local/sbin/cfrun
/usr/local/sbin/cfservd
/usr/local/sbin/cfshow
/usr/local/share/cfengine/ChangeLog
/usr/local/share/cfengine/INSTALL
/usr/local/share/cfengine/NEWS
/usr/local/share/cfengine/README
/usr/local/share/cfengine/cf.chflags.example
/usr/local/share/cfengine/cf.freebsd.example
/usr/local/share/cfengine/cf.ftp.example
/usr/local/share/cfengine/cf.groups.example
/usr/local/share/cfengine/cf.linux.example
/usr/local/share/cfengine/cf.main.example
/usr/local/share/cfengine/cf.motd.example
/usr/local/share/cfengine/cf.preconf.example
/usr/local/share/cfengine/cf.services.example
/usr/local/share/cfengine/cf.site.example
/usr/local/share/cfengine/cf.solaris.example
/usr/local/share/cfengine/cf.sun4.example
/usr/local/share/cfengine/cf.users.example
/usr/local/share/cfengine/cfagent.conf-advanced.example
/usr/local/share/cfengine/cfagent.conf.example
/usr/local/share/cfengine/cfengine.el
/usr/local/share/cfengine/cfrc.example
/usr/local/share/cfengine/cfrun.hosts.example
/usr/local/share/cfengine/cfservd.conf.example
/usr/local/share/cfengine/update.conf.example
%%
((#top))
-----------
==== Pre-defined classes ====
%%
cfagent -p -v
%%
ένα τυπικό αποτέλεσμα:
%%
Reference time set to Sun May 17 14:08:17 2009
GNU Configuration Engine -
2.2.10
Free Software Foundation 1994-
Donated by Mark Burgess, Oslo University College, Norway
------------------------------------------------------------------------
Host name is: xubuntu
Operating System Type is linux
Operating System Release is 2.6.28-12-generic
Architecture = i686
Using internal soft-class linux for host linux
The time is now Sun May 17 14:08:17 2009
------------------------------------------------------------------------
Additional hard class defined as: 32_bit
Additional hard class defined as: linux_2_6_28_12_generic
Additional hard class defined as: linux_i686
Additional hard class defined as: linux_i686_2_6_28_12_generic
Additional hard class defined as: linux_i686_2_6_28_12_generic__43_Ubuntu_SMP_Fri_May_1_19_27_06_UTC_2009
GNU autoconf class from compile time: compiled_on_linux_gnu
Address given by nameserver: 127.0.1.1
Interface 1: lo
Interface 2: eth0
Trying to locate my IPv6 address
Found IPv6 address fe80::215:f2ff:febe:daed
Looking for environment from cfenvd...
Unable to detect environment from cfenvd
cfengine:xubuntu: No preconfiguration file
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
* (Changing context state to: main) *
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Looking for an input file /home/ebal/.cfagent/inputs/cfagent.conf
(No file /home/ebal/.cfagent/inputs/cfagent.conf)
Finished with /home/ebal/.cfagent/inputs/cfagent.conf
Defined Classes = ( 10_10_10 32_bit Day17 GMT_Hr11 Hr14 Hr14_Q1 May Min05_10 Min08 Q1 Sunday Yr2009 any cfengine_2 cfengine_2_2 cfengine_2_2_10 compiled_on_linux_gnu debian debian_5 debian_5_0 fe80__215_f2ff_febe_daed i686 ipv4_10 ipv4_10_10 ipv4_10_10_10 ipv4_10_10_10_118 linux linux_2_6_28_12_generic linux_i686 linux_i686_2_6_28_12_generic linux_i686_2_6_28_12_generic__43_Ubuntu_SMP_Fri_May_1_19_27_06_UTC_2009 lsb_compliant net_iface_eth0 net_iface_lo ubuntu ubuntu_9 ubuntu_9_4 ubuntu_jaunty undefined_domain xubuntu )
Negated Classes = ( )
Installable classes = ( no_default_route )
Global expiry time for locks: 120 minutes
Global anti-spam elapse time: 1 minutes
Extensions which should not be directories = ( )
Suspicious filenames to be warned about = ( )
%%
((#top))
-----------
==== Working Directory ===
Έχει αποφασιστεί από τους δημιουργούς του cfengine να γίνεται χρήση ενός συγκεκριμένου καταλόγου σε όλες τις διανομές:
%%
mkdir -pv /var/cfengine/bin /var/cfengine/inputs /var/cfengine/outputs
cp /usr/local/sbin/cfagent /var/cfengine/bin/
cp /usr/local/sbin/cfdoc /var/cfengine/bin/
cp /usr/local/sbin/cfenvd /var/cfengine/bin/
cp /usr/local/sbin/cfenvgraph /var/cfengine/bin/
cp /usr/local/sbin/cfetool /var/cfengine/bin/
cp /usr/local/sbin/cfetoolgraph /var/cfengine/bin/
cp /usr/local/sbin/cfexecd /var/cfengine/bin/
cp /usr/local/sbin/cfkey /var/cfengine/bin/
cp /usr/local/sbin/cfrun /var/cfengine/bin/
cp /usr/local/sbin/cfservd /var/cfengine/bin/
cp /usr/local/sbin/cfshow /var/cfengine/bin/
%%
==== Κλειδιά ====
Για να εξασφαλιστεί η ακεραιότητα των προγραμμάτων και αρχείων το cfengine δουλεύει με κρυπτογράφηση.
Οπότε χρειάζεται σε κάθε host να τρέξουμε την εντολή:
%%
cfkey
%%
Θα παρατηρήσουμε ότι έχουν γίνει αλλαγές στον κατάλογο **/var/cfengine**
((#top))
-----------
====Αρχεία Ρυθμίσεων====
**__ΠΡΟΣΟΧΗ:__** Τα αρχεία ρυθμίσεων του cfengine ΔΕΝ πρέπει να έχουν break line (αλλαγή γραμμής).
Μπορεί το parse των αρχείων να είναι σωστό - αλλά "σπάσει" κατά το run. Οπότε όλα σε μία γραμμή.
Το βασικό αρχείο ρυθμίσεων του cfengine για κάθε host είναι το **cfagent.conf**
Αλλά πως διασφαλίζεται η ακεραιτότητα του συγκεκριμένου αρχείου;
Πως επιτυγχάνουμε την απρόσκοπτη λειτουργία του cfengine ώστε ακόμα κι εάν γίνουν αλλαγές από τρίτους
το cfengine να διορθώσει όλες τις αλλαγές;
Πολύ απλά στην παραπάνω δομή καταλόγων δηλώνουμε με δύο αρχεία:
* cfservd.conf
* update.conf
ποιος είναι ο cfengine server μας (από τον οποίο δεχόμαστε αλλαγές) άρα από αυτό θα διορθωθεί το cfagent.conf αρχείο στον κάθε host.
((#top))
-----------
===== update.conf =====
Τυπικό παράδειγμα:
%%(html)
control:
actionsequence = ( copy processes tidy ) # Keep this simple and constant
domain = ( otenet.gr ) # Needed for remote copy
policyhost = ( xubuntu.otenet.gr )
master_cfinput = ( /var/cfengine/inputs )
AddInstallable = ( new_cfenvd new_cfservd )
workdir = ( /var/cfengine )
cf_install_dir = ( /usr/local/sbin )
copy:
$(master_cfinput) dest=$(workdir)/inputs
r=inf
mode=640
type=binary
exclude=*.svn ## ebal in case of subversion
exclude=*.lst
exclude=*~
exclude=#*
server=$(policyhost)
trustkey=true
$(cf_install_dir)/cfagent dest=$(workdir)/bin/cfagent
mode=755
backup=false
type=checksum
$(cf_install_dir)/cfservd dest=$(workdir)/bin/cfservd
mode=755
backup=false
type=checksum
define=new_cfservd
$(cf_install_dir)/cfexecd dest=$(workdir)/bin/cfexecd
mode=755
backup=false
type=checksum
$(cf_install_dir)/cfenvd dest=$(workdir)/bin/cfenvd
mode=755
backup=false
type=checksum
define=new_cfenvd
tidy:
$(workdir)/outputs pattern=* age=7
processes:
new_cfservd::
"cfservd" signal=term restart /usr/local/sbin/cfservd
new_cfenvd::
"cfenvd" signal=kill restart "/usr/local/sbin/cfenvd -H"
%%
((#top))
-----------
===== cfservd.conf =====
Τυπικό παράδειγμα:
%%(html)
control:
domain = ( otenet.gr )
AllowUsers = ( root )
cfrunCommand = ( "/usr/local/sbin/cfagent" )
AllowConnectionsFrom = ( 10.10.10 )
admit: # or grant:
/var/cfengine/inputs *.otenet.gr
/usr/local/sbin/cfagent *.otenet.gr
%%
((#top))
-----------
==== Client ====
O client χρειάζεται μόνο το **update.conf**, τα υπόλοιπα θα τα κατεβάσει.
Αλλά λείπει το cfagent.conf αρχείο και ένα τυπικό παράδειγμα είναι το εξής:
%%
control:
actionsequence = ( copy files )
domain = ( otenet.gr )
access = ( root )
smtserver = ( mail.otenet.gr )
sysadm = ( root@otenet.gr )
files:
/etc/passwd mode=644 owner=root action=fixall
/etc/shadow mode=600 owner=root action=fixall
/etc/sudoers mode=0440 owner=root group=root action=fixall
copy:
${master_cfinput}/etc/sudoers
dest=/etc/sudoers
%%
((#top))
-----------
=== Examples ===
Σε αυτή την ενότητα θα προσπαθήσω να καταγράψω μερικά απλά παραδείγματα από τα διάφορα actions του cfengine.
Τα παραπάνω παραδείγματα είναι για local χρήση.
==== files ====
Με το παρακάτω αρχείο διορθώνουμε τα δικαιώματα στο αρχείο /etc/sudoers
**sudoers.conf**
%%
control:
actionsequence = ( files )
files:
/etc/sudoers owner=root group=root mode=0440 action=fixall
%%
Πως το τρέχουμε:
%%
cfagent -f sudoers.conf
%%
==== copy ====
Με το εξής αρχείο πραγματοποιούμε αντιγραφή ενός αρχείου από το αποθετήριό μας
και εν συνεχεία αλλάζουμε τα δικαιώματα.
%%
control:
actionsequence = ( copy files )
working_dir = ( /var/cfengine/inputs )
copy:
$(working_dir)/etc/sudoers dest=/etc/sudoers type=checksum
files:
/etc/sudoers owner=root group=root mode=0440 action=fixall
%%
Πως το τρέχουμε:
%%
cfagent -v -f sudoers.conf
%%
((#top))
-----------
==== Useful Links ====
http://www.debian-administration.org/tag/cfengine
((#top))
-----------