mirror of
https://github.com/apache/cloudstack.git
synced 2025-10-26 08:42:29 +01:00
SysVM: Cleanup and removal of old (and dangerous) config files
* ports.conf * default & default-ssl sites * SSL config in httpd.conf * deprecated & dead setup_redundant_router in cloud-early-config
This commit is contained in:
Ronald van Zantvoort
Wido den Hollander
parent
72e83085e1
commit
58bdb44135
3
LICENSE
3
LICENSE
@ -221,9 +221,6 @@ Within the patches/systemvm/debian/config/etc/apache2 directory
|
|||||||
Copyright (c) 2012 The Apache Software Foundation
|
Copyright (c) 2012 The Apache Software Foundation
|
||||||
from The Apache Software Foundation http://www.apache.org/
|
from The Apache Software Foundation http://www.apache.org/
|
||||||
httpd.conf
|
httpd.conf
|
||||||
ports.conf
|
|
||||||
sites-available/default
|
|
||||||
sites-available/default-ssl
|
|
||||||
vhost.template
|
vhost.template
|
||||||
|
|
||||||
Within the patches/systemvm/debian/config/etc/ssh/ directory
|
Within the patches/systemvm/debian/config/etc/ssh/ directory
|
||||||
|
|||||||
3
pom.xml
3
pom.xml
@ -892,9 +892,6 @@
|
|||||||
<exclude>systemvm/patches/debian/systemvm.vmx</exclude>
|
<exclude>systemvm/patches/debian/systemvm.vmx</exclude>
|
||||||
<exclude>systemvm/patches/debian/config/root/.ssh/authorized_keys</exclude>
|
<exclude>systemvm/patches/debian/config/root/.ssh/authorized_keys</exclude>
|
||||||
<exclude>systemvm/patches/debian/config/etc/apache2/httpd.conf</exclude>
|
<exclude>systemvm/patches/debian/config/etc/apache2/httpd.conf</exclude>
|
||||||
<exclude>systemvm/patches/debian/config/etc/apache2/ports.conf</exclude>
|
|
||||||
<exclude>systemvm/patches/debian/config/etc/apache2/sites-available/default</exclude>
|
|
||||||
<exclude>systemvm/patches/debian/config/etc/apache2/sites-available/default-ssl</exclude>
|
|
||||||
<exclude>systemvm/patches/debian/config/etc/apache2/vhost.template</exclude>
|
<exclude>systemvm/patches/debian/config/etc/apache2/vhost.template</exclude>
|
||||||
<exclude>systemvm/patches/debian/config/etc/dnsmasq.conf.tmpl</exclude>
|
<exclude>systemvm/patches/debian/config/etc/dnsmasq.conf.tmpl</exclude>
|
||||||
<exclude>systemvm/patches/debian/config/etc/vpcdnsmasq.conf</exclude>
|
<exclude>systemvm/patches/debian/config/etc/vpcdnsmasq.conf</exclude>
|
||||||
|
|||||||
@ -1,3 +1 @@
|
|||||||
SSLProtocol all -SSLv2 -SSLv3
|
# Empty
|
||||||
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
|
|
||||||
SSLHonorCipherOrder on
|
|
||||||
|
|||||||
@ -1,23 +0,0 @@
|
|||||||
# If you just change the port or add more ports here, you will likely also
|
|
||||||
# have to change the VirtualHost statement in
|
|
||||||
# /etc/apache2/sites-enabled/000-default
|
|
||||||
# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
|
|
||||||
# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
|
|
||||||
# README.Debian.gz
|
|
||||||
|
|
||||||
NameVirtualHost 10.1.1.1:80
|
|
||||||
Listen 10.1.1.1:80
|
|
||||||
|
|
||||||
<IfModule mod_ssl.c>
|
|
||||||
# If you add NameVirtualHost *:443 here, you will also have to change
|
|
||||||
# the VirtualHost statement in /etc/apache2/sites-available/default-ssl
|
|
||||||
# to <VirtualHost *:443>
|
|
||||||
# Server Name Indication for SSL named virtual hosts is currently not
|
|
||||||
# supported by MSIE on Windows XP.
|
|
||||||
Listen 10.1.1.1:443
|
|
||||||
</IfModule>
|
|
||||||
|
|
||||||
<IfModule mod_gnutls.c>
|
|
||||||
Listen 10.1.1.1:443
|
|
||||||
</IfModule>
|
|
||||||
|
|
||||||
@ -1,41 +0,0 @@
|
|||||||
<VirtualHost 10.1.1.1:80>
|
|
||||||
ServerAdmin webmaster@localhost
|
|
||||||
|
|
||||||
DocumentRoot /var/www/html
|
|
||||||
<Directory />
|
|
||||||
Options FollowSymLinks
|
|
||||||
AllowOverride None
|
|
||||||
</Directory>
|
|
||||||
<Directory /var/www/html>
|
|
||||||
Options Indexes FollowSymLinks MultiViews
|
|
||||||
AllowOverride All
|
|
||||||
Order allow,deny
|
|
||||||
allow from all
|
|
||||||
</Directory>
|
|
||||||
|
|
||||||
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
|
|
||||||
<Directory "/usr/lib/cgi-bin">
|
|
||||||
AllowOverride None
|
|
||||||
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
|
|
||||||
Order allow,deny
|
|
||||||
Allow from all
|
|
||||||
</Directory>
|
|
||||||
|
|
||||||
ErrorLog ${APACHE_LOG_DIR}/error.log
|
|
||||||
|
|
||||||
# Possible values include: debug, info, notice, warn, error, crit,
|
|
||||||
# alert, emerg.
|
|
||||||
LogLevel warn
|
|
||||||
|
|
||||||
CustomLog ${APACHE_LOG_DIR}/access.log combined
|
|
||||||
|
|
||||||
Alias /doc/ "/usr/share/doc/"
|
|
||||||
<Directory "/usr/share/doc/">
|
|
||||||
Options Indexes MultiViews FollowSymLinks
|
|
||||||
AllowOverride None
|
|
||||||
Order deny,allow
|
|
||||||
Deny from all
|
|
||||||
Allow from 127.0.0.0/255.0.0.0 ::1/128
|
|
||||||
</Directory>
|
|
||||||
|
|
||||||
</VirtualHost>
|
|
||||||
@ -1,175 +0,0 @@
|
|||||||
<IfModule mod_ssl.c>
|
|
||||||
<VirtualHost 10.1.1.1:443>
|
|
||||||
ServerAdmin webmaster@localhost
|
|
||||||
|
|
||||||
DocumentRoot /var/www/html
|
|
||||||
<Directory />
|
|
||||||
Options FollowSymLinks
|
|
||||||
AllowOverride None
|
|
||||||
</Directory>
|
|
||||||
<Directory /var/www/html>
|
|
||||||
Options Indexes FollowSymLinks MultiViews
|
|
||||||
AllowOverride all
|
|
||||||
Order allow,deny
|
|
||||||
allow from all
|
|
||||||
</Directory>
|
|
||||||
|
|
||||||
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
|
|
||||||
<Directory "/usr/lib/cgi-bin">
|
|
||||||
AllowOverride None
|
|
||||||
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
|
|
||||||
Order allow,deny
|
|
||||||
Allow from all
|
|
||||||
</Directory>
|
|
||||||
|
|
||||||
ErrorLog ${APACHE_LOG_DIR}/error.log
|
|
||||||
|
|
||||||
# Possible values include: debug, info, notice, warn, error, crit,
|
|
||||||
# alert, emerg.
|
|
||||||
LogLevel warn
|
|
||||||
|
|
||||||
CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
|
|
||||||
|
|
||||||
Alias /doc/ "/usr/share/doc/"
|
|
||||||
<Directory "/usr/share/doc/">
|
|
||||||
Options Indexes MultiViews FollowSymLinks
|
|
||||||
AllowOverride None
|
|
||||||
Order deny,allow
|
|
||||||
Deny from all
|
|
||||||
Allow from 127.0.0.0/255.0.0.0 ::1/128
|
|
||||||
</Directory>
|
|
||||||
|
|
||||||
# SSL Engine Switch:
|
|
||||||
# Enable/Disable SSL for this virtual host.
|
|
||||||
SSLEngine on
|
|
||||||
SSLProtocol all -SSLv2 -SSLv3
|
|
||||||
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
|
|
||||||
SSLHonorCipherOrder on
|
|
||||||
|
|
||||||
# A self-signed (snakeoil) certificate can be created by installing
|
|
||||||
# the ssl-cert package. See
|
|
||||||
# /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
|
|
||||||
# If both key and certificate are stored in the same file, only the
|
|
||||||
# SSLCertificateFile directive is needed.
|
|
||||||
SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
|
|
||||||
SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
|
|
||||||
|
|
||||||
# Server Certificate Chain:
|
|
||||||
# Point SSLCertificateChainFile at a file containing the
|
|
||||||
# concatenation of PEM encoded CA certificates which form the
|
|
||||||
# certificate chain for the server certificate. Alternatively
|
|
||||||
# the referenced file can be the same as SSLCertificateFile
|
|
||||||
# when the CA certificates are directly appended to the server
|
|
||||||
# certificate for convinience.
|
|
||||||
#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
|
|
||||||
|
|
||||||
# Certificate Authority (CA):
|
|
||||||
# Set the CA certificate verification path where to find CA
|
|
||||||
# certificates for client authentication or alternatively one
|
|
||||||
# huge file containing all of them (file must be PEM encoded)
|
|
||||||
# Note: Inside SSLCACertificatePath you need hash symlinks
|
|
||||||
# to point to the certificate files. Use the provided
|
|
||||||
# Makefile to update the hash symlinks after changes.
|
|
||||||
#SSLCACertificatePath /etc/ssl/certs/
|
|
||||||
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
|
|
||||||
|
|
||||||
# Certificate Revocation Lists (CRL):
|
|
||||||
# Set the CA revocation path where to find CA CRLs for client
|
|
||||||
# authentication or alternatively one huge file containing all
|
|
||||||
# of them (file must be PEM encoded)
|
|
||||||
# Note: Inside SSLCARevocationPath you need hash symlinks
|
|
||||||
# to point to the certificate files. Use the provided
|
|
||||||
# Makefile to update the hash symlinks after changes.
|
|
||||||
#SSLCARevocationPath /etc/apache2/ssl.crl/
|
|
||||||
#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
|
|
||||||
|
|
||||||
# Client Authentication (Type):
|
|
||||||
# Client certificate verification type and depth. Types are
|
|
||||||
# none, optional, require and optional_no_ca. Depth is a
|
|
||||||
# number which specifies how deeply to verify the certificate
|
|
||||||
# issuer chain before deciding the certificate is not valid.
|
|
||||||
#SSLVerifyClient require
|
|
||||||
#SSLVerifyDepth 10
|
|
||||||
|
|
||||||
# Access Control:
|
|
||||||
# With SSLRequire you can do per-directory access control based
|
|
||||||
# on arbitrary complex boolean expressions containing server
|
|
||||||
# variable checks and other lookup directives. The syntax is a
|
|
||||||
# mixture between C and Perl. See the mod_ssl documentation
|
|
||||||
# for more details.
|
|
||||||
#<Location />
|
|
||||||
#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
|
|
||||||
# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
|
|
||||||
# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
|
|
||||||
# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
|
|
||||||
# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
|
|
||||||
# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
|
|
||||||
#</Location>
|
|
||||||
|
|
||||||
# SSL Engine Options:
|
|
||||||
# Set various options for the SSL engine.
|
|
||||||
# o FakeBasicAuth:
|
|
||||||
# Translate the client X.509 into a Basic Authorisation. This means that
|
|
||||||
# the standard Auth/DBMAuth methods can be used for access control. The
|
|
||||||
# user name is the `one line' version of the client's X.509 certificate.
|
|
||||||
# Note that no password is obtained from the user. Every entry in the user
|
|
||||||
# file needs this password: `xxj31ZMTZzkVA'.
|
|
||||||
# o ExportCertData:
|
|
||||||
# This exports two additional environment variables: SSL_CLIENT_CERT and
|
|
||||||
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
|
|
||||||
# server (always existing) and the client (only existing when client
|
|
||||||
# authentication is used). This can be used to import the certificates
|
|
||||||
# into CGI scripts.
|
|
||||||
# o StdEnvVars:
|
|
||||||
# This exports the standard SSL/TLS related `SSL_*' environment variables.
|
|
||||||
# Per default this exportation is switched off for performance reasons,
|
|
||||||
# because the extraction step is an expensive operation and is usually
|
|
||||||
# useless for serving static content. So one usually enables the
|
|
||||||
# exportation for CGI and SSI requests only.
|
|
||||||
# o StrictRequire:
|
|
||||||
# This denies access when "SSLRequireSSL" or "SSLRequire" applied even
|
|
||||||
# under a "Satisfy any" situation, i.e. when it applies access is denied
|
|
||||||
# and no other module can change it.
|
|
||||||
# o OptRenegotiate:
|
|
||||||
# This enables optimized SSL connection renegotiation handling when SSL
|
|
||||||
# directives are used in per-directory context.
|
|
||||||
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
|
|
||||||
<FilesMatch "\.(cgi|shtml|phtml|php)$">
|
|
||||||
SSLOptions +StdEnvVars
|
|
||||||
</FilesMatch>
|
|
||||||
<Directory /usr/lib/cgi-bin>
|
|
||||||
SSLOptions +StdEnvVars
|
|
||||||
</Directory>
|
|
||||||
|
|
||||||
# SSL Protocol Adjustments:
|
|
||||||
# The safe and default but still SSL/TLS standard compliant shutdown
|
|
||||||
# approach is that mod_ssl sends the close notify alert but doesn't wait for
|
|
||||||
# the close notify alert from client. When you need a different shutdown
|
|
||||||
# approach you can use one of the following variables:
|
|
||||||
# o ssl-unclean-shutdown:
|
|
||||||
# This forces an unclean shutdown when the connection is closed, i.e. no
|
|
||||||
# SSL close notify alert is send or allowed to received. This violates
|
|
||||||
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
|
|
||||||
# this when you receive I/O errors because of the standard approach where
|
|
||||||
# mod_ssl sends the close notify alert.
|
|
||||||
# o ssl-accurate-shutdown:
|
|
||||||
# This forces an accurate shutdown when the connection is closed, i.e. a
|
|
||||||
# SSL close notify alert is send and mod_ssl waits for the close notify
|
|
||||||
# alert of the client. This is 100% SSL/TLS standard compliant, but in
|
|
||||||
# practice often causes hanging connections with brain-dead browsers. Use
|
|
||||||
# this only for browsers where you know that their SSL implementation
|
|
||||||
# works correctly.
|
|
||||||
# Notice: Most problems of broken clients are also related to the HTTP
|
|
||||||
# keep-alive facility, so you usually additionally want to disable
|
|
||||||
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
|
|
||||||
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
|
|
||||||
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
|
|
||||||
# "force-response-1.0" for this.
|
|
||||||
BrowserMatch "MSIE [2-6]" \
|
|
||||||
nokeepalive ssl-unclean-shutdown \
|
|
||||||
downgrade-1.0 force-response-1.0
|
|
||||||
# MSIE 7 and newer should be able to use keepalive
|
|
||||||
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
|
|
||||||
|
|
||||||
</VirtualHost>
|
|
||||||
</IfModule>
|
|
||||||
@ -808,22 +808,23 @@ setup_vpc_apache2() {
|
|||||||
|
|
||||||
|
|
||||||
clean_ipalias_config() {
|
clean_ipalias_config() {
|
||||||
# Old
|
# Old
|
||||||
rm -f /etc/apache2/conf.d/ports.*.meta-data.conf
|
rm -f /etc/apache2/conf.d/ports.*.meta-data.conf
|
||||||
rm -f /etc/apache2/sites-available/ipAlias*
|
rm -f /etc/apache2/sites-available/ipAlias*
|
||||||
rm -f /etc/apache2/sites-enabled/ipAlias*
|
rm -f /etc/apache2/sites-enabled/ipAlias*
|
||||||
rm -f /etc/apache2/conf.d/vhost*.conf
|
rm -f /etc/apache2/conf.d/vhost*.conf
|
||||||
|
rm -f /etc/apache2/ports.conf
|
||||||
|
rm -f /etc/apache2/sites-available/default
|
||||||
|
rm -f /etc/apache2/sites-available/default-ssl
|
||||||
|
|
||||||
# New
|
# New
|
||||||
rm -f /etc/apache2/sites-enabled/vhost-*.conf
|
rm -f /etc/apache2/sites-enabled/vhost-*.conf
|
||||||
rm -f /etc/apache2/ports.conf
|
|
||||||
rm -f /etc/apache2/sites-available/default
|
|
||||||
rm -f /etc/apache2/sites-available/default-ssl
|
|
||||||
|
|
||||||
rm -rf /etc/failure_config
|
rm -rf /etc/failure_config
|
||||||
}
|
}
|
||||||
|
|
||||||
setup_apache2_common() {
|
setup_apache2_common() {
|
||||||
|
sed -i 's/^Include ports.conf.*/# CS: Done by Python CsApp config\n#Include ports.conf/g' /etc/apache2/apache2.conf
|
||||||
[ -f /etc/apache2/conf.d/security ] && sed -i -e "s/^ServerTokens .*/ServerTokens Prod/g" /etc/apache2/conf.d/security
|
[ -f /etc/apache2/conf.d/security ] && sed -i -e "s/^ServerTokens .*/ServerTokens Prod/g" /etc/apache2/conf.d/security
|
||||||
[ -f /etc/apache2/conf.d/security ] && sed -i -e "s/^ServerSignature .*/ServerSignature Off/g" /etc/apache2/conf.d/security
|
[ -f /etc/apache2/conf.d/security ] && sed -i -e "s/^ServerSignature .*/ServerSignature Off/g" /etc/apache2/conf.d/security
|
||||||
|
|
||||||
@ -847,74 +848,6 @@ setup_apache2() {
|
|||||||
# [ -f /etc/apache2/ports.conf ] && sed -i -e "s/NameVirtualHost .*:80/NameVirtualHost $ip:80/g" /etc/apache2/ports.conf
|
# [ -f /etc/apache2/ports.conf ] && sed -i -e "s/NameVirtualHost .*:80/NameVirtualHost $ip:80/g" /etc/apache2/ports.conf
|
||||||
}
|
}
|
||||||
|
|
||||||
setup_redundant_router() {
|
|
||||||
rrouter_bin_path="/ramdisk/rrouter"
|
|
||||||
rrouter_log="/ramdisk/rrouter/keepalived.log"
|
|
||||||
rrouter_bin_path_str="\/ramdisk\/rrouter"
|
|
||||||
rrouter_log_str="\/ramdisk\/rrouter\/keepalived.log"
|
|
||||||
mkdir -p /ramdisk
|
|
||||||
mount tmpfs /ramdisk -t tmpfs
|
|
||||||
mkdir -p /ramdisk/rrouter
|
|
||||||
ip route delete default
|
|
||||||
cp /root/redundant_router/keepalived.conf.templ /etc/keepalived/keepalived.conf
|
|
||||||
cp /root/redundant_router/conntrackd.conf.templ /etc/conntrackd/conntrackd.conf
|
|
||||||
cp /root/redundant_router/enable_pubip.sh.templ $rrouter_bin_path/enable_pubip.sh
|
|
||||||
cp /root/redundant_router/master.sh.templ $rrouter_bin_path/master.sh
|
|
||||||
cp /root/redundant_router/backup.sh.templ $rrouter_bin_path/backup.sh
|
|
||||||
cp /root/redundant_router/fault.sh.templ $rrouter_bin_path/fault.sh
|
|
||||||
cp /root/redundant_router/primary-backup.sh.templ $rrouter_bin_path/primary-backup.sh
|
|
||||||
cp /root/redundant_router/heartbeat.sh.templ $rrouter_bin_path/heartbeat.sh
|
|
||||||
cp /root/redundant_router/check_heartbeat.sh.templ $rrouter_bin_path/check_heartbeat.sh
|
|
||||||
cp /root/redundant_router/arping_gateways.sh.templ $rrouter_bin_path/arping_gateways.sh
|
|
||||||
cp /root/redundant_router/check_bumpup.sh $rrouter_bin_path/
|
|
||||||
cp /root/redundant_router/disable_pubip.sh $rrouter_bin_path/
|
|
||||||
cp /root/redundant_router/checkrouter.sh.templ /opt/cloud/bin/checkrouter.sh
|
|
||||||
cp /root/redundant_router/services.sh $rrouter_bin_path/
|
|
||||||
sed -i "s/\[ROUTER_ID\]/$NAME/g" /etc/keepalived/keepalived.conf
|
|
||||||
sed -i "s/\[ROUTER_IP\]/$GUEST_GW\/$GUEST_CIDR_SIZE/g" /etc/keepalived/keepalived.conf
|
|
||||||
sed -i "s/\[BOARDCAST\]/$GUEST_BRD/g" /etc/keepalived/keepalived.conf
|
|
||||||
sed -i "s/\[PRIORITY\]/$ROUTER_PR/g" /etc/keepalived/keepalived.conf
|
|
||||||
sed -i "s/\[RROUTER_BIN_PATH\]/$rrouter_bin_path_str/g" /etc/keepalived/keepalived.conf
|
|
||||||
sed -i "s/\[DELTA\]/2/g" /etc/keepalived/keepalived.conf
|
|
||||||
sed -i "s/\[LINK_IF\]/eth0/g" /etc/conntrackd/conntrackd.conf
|
|
||||||
sed -i "s/\[LINK_IP\]/$ETH0_IP/g" /etc/conntrackd/conntrackd.conf
|
|
||||||
sed -i "s/\[IGNORE_IP1\]/$GUEST_GW/g" /etc/conntrackd/conntrackd.conf
|
|
||||||
sed -i "s/\[IGNORE_IP2\]/$ETH0_IP/g" /etc/conntrackd/conntrackd.conf
|
|
||||||
sed -i "s/\[IGNORE_IP3\]/$ETH1_IP/g" /etc/conntrackd/conntrackd.conf
|
|
||||||
sed -i "s/\[ETH2IP\]/$ETH2_IP/g" $rrouter_bin_path/enable_pubip.sh
|
|
||||||
sed -i "s/\[ETH2MASK\]/$ETH2_MASK/g" $rrouter_bin_path/enable_pubip.sh
|
|
||||||
sed -i "s/\[GATEWAY\]/$GW/g" $rrouter_bin_path/enable_pubip.sh
|
|
||||||
sed -i "s/\[GATEWAY\]/$GW/g" $rrouter_bin_path/master.sh
|
|
||||||
|
|
||||||
sed -i "s/\[RROUTER_BIN_PATH\]/$rrouter_bin_path_str/g" $rrouter_bin_path/master.sh
|
|
||||||
sed -i "s/\[RROUTER_BIN_PATH\]/$rrouter_bin_path_str/g" $rrouter_bin_path/backup.sh
|
|
||||||
sed -i "s/\[RROUTER_BIN_PATH\]/$rrouter_bin_path_str/g" $rrouter_bin_path/fault.sh
|
|
||||||
sed -i "s/\[RROUTER_BIN_PATH\]/$rrouter_bin_path_str/g" $rrouter_bin_path/heartbeat.sh
|
|
||||||
sed -i "s/\[RROUTER_BIN_PATH\]/$rrouter_bin_path_str/g" $rrouter_bin_path/check_heartbeat.sh
|
|
||||||
sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" $rrouter_bin_path/master.sh
|
|
||||||
sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" $rrouter_bin_path/backup.sh
|
|
||||||
sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" $rrouter_bin_path/fault.sh
|
|
||||||
sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" $rrouter_bin_path/primary-backup.sh
|
|
||||||
sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" $rrouter_bin_path/check_heartbeat.sh
|
|
||||||
sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" $rrouter_bin_path/arping_gateways.sh
|
|
||||||
sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" /opt/cloud/bin/checkrouter.sh
|
|
||||||
|
|
||||||
if [ $ADVERT_INT ]
|
|
||||||
then
|
|
||||||
sed -i "s/advert_int 1/advert_int $ADVERT_INT/g" /etc/keepalived/keepalived.conf
|
|
||||||
fi
|
|
||||||
|
|
||||||
chmod a+x $rrouter_bin_path/*.sh
|
|
||||||
|
|
||||||
sed -i "s/--exec\ \$DAEMON;/--exec\ \$DAEMON\ --\ --vrrp;/g" /etc/init.d/keepalived
|
|
||||||
crontab -l|grep "check_heartbeat.sh"
|
|
||||||
if [ $? -ne 0 ]
|
|
||||||
then
|
|
||||||
(crontab -l; echo -e "SHELL=/bin/bash\nPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\n*/1 * * * * $rrouter_bin_path/check_heartbeat.sh 2>&1 > /dev/null") | crontab
|
|
||||||
fi
|
|
||||||
load_modules
|
|
||||||
}
|
|
||||||
|
|
||||||
setup_aesni() {
|
setup_aesni() {
|
||||||
if [ `grep aes /proc/cpuinfo | wc -l` -gt 0 ]
|
if [ `grep aes /proc/cpuinfo | wc -l` -gt 0 ]
|
||||||
then
|
then
|
||||||
|
|||||||
@ -2771,9 +2771,6 @@ Within the patches/systemvm/debian/config/etc/apache2 directory
|
|||||||
Copyright (c) 2012 The Apache Software Foundation
|
Copyright (c) 2012 The Apache Software Foundation
|
||||||
from The Apache Software Foundation http://www.apache.org/
|
from The Apache Software Foundation http://www.apache.org/
|
||||||
httpd.conf
|
httpd.conf
|
||||||
ports.conf
|
|
||||||
sites-available/default
|
|
||||||
sites-available/default-ssl
|
|
||||||
vhost.template
|
vhost.template
|
||||||
|
|
||||||
Within the patches/systemvm/debian/config/etc/ssh/ directory
|
Within the patches/systemvm/debian/config/etc/ssh/ directory
|
||||||
|
|||||||
@ -2459,10 +2459,7 @@ Copyright (c) 2012 The Apache Software Foundation
|
|||||||
</copyright-notice>
|
</copyright-notice>
|
||||||
<by-organisation id='apache.org.2'>
|
<by-organisation id='apache.org.2'>
|
||||||
<resource name='httpd.conf' />
|
<resource name='httpd.conf' />
|
||||||
<resource name='ports.conf' />
|
|
||||||
<resource name='vhost.template' />
|
<resource name='vhost.template' />
|
||||||
<resource name='sites-available/default' />
|
|
||||||
<resource name='sites-available/default-ssl' />
|
|
||||||
</by-organisation>
|
</by-organisation>
|
||||||
</with-license>
|
</with-license>
|
||||||
</within>
|
</within>
|
||||||
|
|||||||
@ -2443,10 +2443,7 @@ Copyright (c) 2012 The Apache Software Foundation
|
|||||||
</copyright-notice>
|
</copyright-notice>
|
||||||
<by-organisation id='apache.org.2'>
|
<by-organisation id='apache.org.2'>
|
||||||
<resource name='httpd.conf' />
|
<resource name='httpd.conf' />
|
||||||
<resource name='ports.conf' />
|
|
||||||
<resource name='vhost.template' />
|
<resource name='vhost.template' />
|
||||||
<resource name='sites-available/default' />
|
|
||||||
<resource name='sites-available/default-ssl' />
|
|
||||||
</by-organisation>
|
</by-organisation>
|
||||||
</with-license>
|
</with-license>
|
||||||
</within>
|
</within>
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user