242 lines
6.0 KiB
Bash
242 lines
6.0 KiB
Bash
#!/bin/bash
|
|
#
|
|
# ldap This shell script takes care of starting and stopping
|
|
# ldap servers (slapd and slurpd).
|
|
#
|
|
# chkconfig: - 27 73
|
|
# description: LDAP stands for Lightweight Directory Access Protocol, used \
|
|
# for implementing the industry standard directory services.
|
|
# processname: slapd
|
|
# config: /etc/openldap/slapd.conf
|
|
# pidfile: /var/run/openldap/slapd.pid
|
|
|
|
# Source function library.
|
|
. /etc/init.d/functions
|
|
|
|
# Source networking configuration and check that networking is up.
|
|
if [ -r /etc/sysconfig/network ] ; then
|
|
. /etc/sysconfig/network
|
|
[ ${NETWORKING} = "no" ] && exit 0
|
|
fi
|
|
|
|
# Source an auxiliary options file if we have one, and pick up OPTIONS,
|
|
# SLAPD_OPTIONS, SLURPD_OPTIONS, SLAPD_LDAPS, SLAPD_LDAPI, and maybe
|
|
# KRB5_KTNAME.
|
|
if [ -r /etc/sysconfig/ldap ] ; then
|
|
. /etc/sysconfig/ldap
|
|
fi
|
|
|
|
slapd=/usr/sbin/slapd
|
|
slurpd=/usr/sbin/slurpd
|
|
slaptest=/usr/sbin/slaptest
|
|
[ -x ${slapd} ] || exit 0
|
|
[ -x ${slurpd} ] || exit 0
|
|
|
|
RETVAL=0
|
|
|
|
#
|
|
# Pass commands given in $2 and later to "test" run as user given in $1.
|
|
#
|
|
function testasuser() {
|
|
local user= cmd=
|
|
user="$1"
|
|
shift
|
|
cmd="$@"
|
|
if test x"$user" != x ; then
|
|
if test x"$cmd" != x ; then
|
|
/sbin/runuser -f -m -s /bin/sh -c "test $cmd" -- "$user"
|
|
else
|
|
false
|
|
fi
|
|
else
|
|
false
|
|
fi
|
|
}
|
|
|
|
#
|
|
# Check for read-access errors for the user given in $1 for a service named $2.
|
|
# If $3 is specified, the command is run if "klist" can't be found.
|
|
#
|
|
function checkkeytab() {
|
|
local user= service= klist= default=
|
|
user="$1"
|
|
service="$2"
|
|
default="${3:-false}"
|
|
if test -x /usr/kerberos/bin/klist ; then
|
|
klist=/usr/kerberos/bin/klist
|
|
elif test -x /usr/bin/klist ; then
|
|
klist=/usr/bin/klist
|
|
fi
|
|
KRB5_KTNAME="${KRB5_KTNAME:-/etc/krb5.keytab}"
|
|
export KRB5_KTNAME
|
|
if test -s "$KRB5_KTNAME" ; then
|
|
if test x"$klist" != x ; then
|
|
if LANG=C $klist -k "$KRB5_KTNAME" | tail -n 4 | awk '{print $2}' | grep -q ^"$service"/ ; then
|
|
if ! testasuser "$user" -r ${KRB5_KTNAME:-/etc/krb5.keytab} ; then
|
|
true
|
|
else
|
|
false
|
|
fi
|
|
else
|
|
false
|
|
fi
|
|
else
|
|
$default
|
|
fi
|
|
else
|
|
false
|
|
fi
|
|
}
|
|
|
|
function configtest() {
|
|
local user= ldapuid= dbdir= file=
|
|
# Check for simple-but-common errors.
|
|
user=ldap
|
|
prog=`basename ${slapd}`
|
|
ldapuid=`id -u $user`
|
|
# Unaccessible database files.
|
|
slaptestflags=
|
|
for dbdir in `LANG=C egrep '^directory[[:space:]]+[[:print:]]+$' /etc/openldap/slapd.conf | sed s,^directory,,` ; do
|
|
for file in `find ${dbdir}/ -not -uid $ldapuid -and \( -name "*.dbb" -or -name "*.gdbm" -or -name "*.bdb" -or -name "__db.*" \)` ; do
|
|
echo -n $"$file is not owned by \"$user\"" ; warning ; echo
|
|
done
|
|
if ! test -s ${dbdir}/id2entry.dbb ; then
|
|
if ! test -s ${dbdir}/id2entry.gdbm ; then
|
|
if ! test -s ${dbdir}/id2entry.bdb ; then
|
|
slaptestflags=-u
|
|
fi
|
|
fi
|
|
fi
|
|
done
|
|
# Unaccessible keytab with an "ldap" key.
|
|
if checkkeytab $user ldap ; then
|
|
file=${KRB5_KTNAME:-/etc/krb5.keytab}
|
|
echo -n $"$file is not readable by \"$user\"" ; warning ; echo
|
|
fi
|
|
# Unaccessible TLS configuration files.
|
|
tlsconfigs=`LANG=C egrep '^(TLSCACertificateFile|TLSCertificateFile|TLSCertificateKeyFile)[[:space:]]' /etc/openldap/slapd.conf | awk '{print $2}'`
|
|
for file in $tlsconfigs ; do
|
|
if ! testasuser $user -r $file ; then
|
|
echo -n $"$file is not readable by \"$user\"" ; warning ; echo
|
|
fi
|
|
done
|
|
# Check the configuration file.
|
|
slaptestout=`/sbin/runuser -m -s "$slaptest" -- "$user" $slaptestflags 2>&1`
|
|
slaptestexit=$?
|
|
# print warning if slaptest passed but reports some problems
|
|
if test $slaptestexit == 0 -a -n "$slaptestout" ; then
|
|
echo -n $"Checking configuration files for $prog: " ; warning ; echo
|
|
echo "$slaptestout"
|
|
fi
|
|
# report error if configuration file is wrong
|
|
if test $slaptestexit != 0 ; then
|
|
echo -n $"Checking configuration files for $prog: " ; failure ; echo
|
|
echo "$slaptestout"
|
|
if /sbin/runuser -m -s "$slaptest" -- "$user" "-u" > /dev/null 2> /dev/null ; then
|
|
dirs=`LANG=C egrep '^directory[[:space:]]+[[:print:]]+$' /etc/openldap/slapd.conf | awk '{print $2}'`
|
|
for directory in $dirs ; do
|
|
if test -r $directory/__db.001 ; then
|
|
echo -n $"stale lock files may be present in $directory" ; warning ; echo
|
|
fi
|
|
done
|
|
fi
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
function start() {
|
|
configtest
|
|
# Define a couple of local variables which we'll need. Maybe.
|
|
user=ldap
|
|
prog=`basename ${slapd}`
|
|
harg="ldap:///"
|
|
if grep -q ^TLS /etc/openldap/slapd.conf || test x$SLAPD_LDAPS = xyes ; then
|
|
harg="$harg ldaps:///"
|
|
fi
|
|
if test x$SLAPD_LDAPI = xyes ; then
|
|
harg="$harg ldapi:///"
|
|
fi
|
|
# Start daemons.
|
|
echo -n $"Starting $prog: "
|
|
daemon --check=$prog ${slapd} -h "\"$harg\"" -u ${user} $OPTIONS $SLAPD_OPTIONS
|
|
RETVAL=$?
|
|
echo
|
|
if [ $RETVAL -eq 0 ]; then
|
|
if grep -q "^replogfile" /etc/openldap/slapd.conf; then
|
|
prog=`basename ${slurpd}`
|
|
i=1;
|
|
for replogfile in `grep "^replogfile" /etc/openldap/slapd.conf`
|
|
do
|
|
if [ "$replogfile" != "replogfile" ]
|
|
then
|
|
echo -n $"Starting $prog: "
|
|
daemon ${slurpd} -r $replogfile -n $i
|
|
# make the return value nozero if any of the slurpd failed
|
|
RET=$?
|
|
if [ $RET -ne 0 ] ; then
|
|
RETVAL=$RET
|
|
fi
|
|
i=$[i+1]
|
|
echo
|
|
fi
|
|
done
|
|
fi
|
|
fi
|
|
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/ldap
|
|
return $RETVAL
|
|
}
|
|
|
|
function stop() {
|
|
# Stop daemons.
|
|
prog=`basename ${slapd}`
|
|
echo -n $"Stopping $prog: "
|
|
killproc ${slapd}
|
|
RETVAL=$?
|
|
echo
|
|
if [ $RETVAL -eq 0 ]; then
|
|
if grep -q "^replogfile" /etc/openldap/slapd.conf; then
|
|
prog=`basename ${slurpd}`
|
|
echo -n $"Stopping $prog: "
|
|
killproc ${slurpd}
|
|
RETVAL=$?
|
|
echo
|
|
fi
|
|
fi
|
|
[ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/ldap /var/run/slapd.args
|
|
return $RETVAL
|
|
}
|
|
|
|
# See how we were called.
|
|
case "$1" in
|
|
configtest)
|
|
configtest
|
|
;;
|
|
start)
|
|
start
|
|
;;
|
|
stop)
|
|
stop
|
|
;;
|
|
status)
|
|
status ${slapd}
|
|
if grep -q "^replogfile" /etc/openldap/slapd.conf ; then
|
|
status ${slurpd}
|
|
fi
|
|
;;
|
|
restart)
|
|
stop
|
|
start
|
|
;;
|
|
condrestart)
|
|
if [ -f /var/lock/subsys/ldap ] ; then
|
|
stop
|
|
start
|
|
fi
|
|
;;
|
|
*)
|
|
echo $"Usage: $0 {start|stop|restart|status|condrestart}"
|
|
RETVAL=1
|
|
esac
|
|
|
|
exit $RETVAL
|