X-Git-Url: http://git.grml.org/?a=blobdiff_plain;f=grml-terminalserver;h=93fe965a87961a2f131d3d6985832b36829aa56a;hb=e6de44d04958371381f368da6e923e448559065d;hp=8ad2ae0a09e470e2ce750102c5ce349e57aa771f;hpb=fa14c03a6ee9cd0ad616ed9e134f26be8397a2c3;p=grml-terminalserver.git diff --git a/grml-terminalserver b/grml-terminalserver index 8ad2ae0..93fe965 100755 --- a/grml-terminalserver +++ b/grml-terminalserver @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # Filename: terminalserver # Purpose: Program to do something # Authors: grml-team (grml.org), (c) Michael Gebetsroither @@ -52,6 +52,7 @@ COMMANDS: SERVICES: tftp Tftp daemon dhcp Dhcp daemon + ipt Iptables setup (snat for clients) nfs All necessary nfs daemons <> ALL services @@ -131,37 +132,61 @@ function runDhcp sleep 1 startDhcp } +# }}} -# make sure tcp/113 is rejected +# IPTABLES {{{ function runIptables { - if [ -x /sbin/iptables ] ; then - # something keeps answering all tftp requests with auth requests (SYN - # packets to the client tcp/113). Since the PXE client doesn't answer with - # RST, the auth query has to wait until it times out. Forbidding the - # terminalserver to send out packets to tcp/113 via iptables _greatly_ - # speeds up the process. But of course the real fix would be to have grml - # stop sending out auth queries to tftp clients. according to netstat, it - # is in.tftpd itself sending out the auth queries. - # Thanks to Marc Haber and Wolfgang Karall for noticing and current fix. - if iptables -L | grep -q '^REJECT.*tcp dpt:auth reject-with tcp-reset' ; then - echo "Rule for tcp/113 already present, nothing to be done." - else - echo "Rejecting tcp/113 via iptables to speed up booting via PXE, running:" - echo -n '* iptables -A OUTPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset' - iptables -A OUTPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset && echo done || echo failed - fi - # deactivate Multicast-DNS - if iptables -L | grep -q '^REJECT.*dpt:mdns reject-with icmp-port-unreachable' ; then - echo "Rule for udp/5353 already present, nothing to be done." - else - echo "Rejecting udp/5353 via iptables for deactivating Multicast-DNS, running:" - echo -n '* iptables -A OUTPUT -p udp -d 224.0.0.0/8 --dport 5353 -j REJECT' - iptables -A OUTPUT -p udp -d 224.0.0.0/8 --dport 5353 -j REJECT && echo done || echo failed + if [[ $IPTABLES_SNAT_ != "true" ]]; then + return + fi + startIptables +} + +function startIptables +{ + if [ -x /sbin/iptables ] ; then + if [[ $NAT_INTERFACE_ != "" ]]; then + local nat_source_ip_=`netGetIp "$NAT_INTERFACE_" warn` + + if iptables -t nat -vnL POSTROUTING | grep -q "SNAT.*${NAT_INTERFACE_}.*to:${nat_source_ip_}" ; then + echo "Rule for SNAT already present, nothing to be done." + else + echo "Setting up SNAT for terminalserver clients on ${NAT_INTERFACE_}:" + echo "* iptables -t nat -F POSTROUTING" + echo -n "* iptables -t nat -A POSTROUTING -o $NAT_INTERFACE_ -j SNAT --to-source $nat_source_ip_ ... " + { iptables -t nat -F POSTROUTING && \ + iptables -t nat -A POSTROUTING -o "$NAT_INTERFACE_" -j SNAT --to-source "$nat_source_ip_" ; } && \ + echo done || echo failed + fi + if [ `cat /proc/sys/net/ipv4/ip_forward` -eq 1 ]; then + echo "IP-Forwarding already enabled, nothing to be done." + else + echo -n "Enabling IP-Forwarding: " + echo 1 > /proc/sys/net/ipv4/ip_forward && echo done || echo failed + fi fi - else + else warn "iptables executable not avilable" - fi + fi +} + +function stopIptables +{ + if [[ $IPTABLES_SNAT_ != "true" ]]; then + return + fi + if [ -x /sbin/iptables ] ; then + if [[ $NAT_INTERFACE_ != "" ]]; then + local nat_source_ip_=`netGetIp "$NAT_INTERFACE_" warn` + + if iptables -t nat -vnL POSTROUTING | grep -q "SNAT.*${NAT_INTERFACE_}.*to:${nat_source_ip_}" ; then + iptables -t nat -F POSTROUTING &>/dev/null && \ + iptables -t nat -D POSTROUTING -o "$NAT_INTERFACE_" -j SNAT --to-source "$nat_source_ip_" + fi + echo 0 > /proc/sys/net/ipv4/ip_forward + fi + fi } # }}} @@ -174,7 +199,7 @@ function createTftpConf { removeTftpConf - execute "mkdir $TFTPD_DATA_DIR_/pxelinux.cfg" die + execute "mkdir -p $TFTPD_DATA_DIR_/pxelinux.cfg" die execute "install -m 644 /usr/lib/syslinux/pxelinux.0 $TFTPD_DATA_DIR_" die execute "install -m 644 $PATH_/minirt26.gz $TFTPD_DATA_DIR_" die execute "install -m 644 $KERNEL_IMAGE_ $TFTPD_DATA_DIR_/linux26" die @@ -187,12 +212,12 @@ function createTftpConf function stopTftp { - start-stop-daemon --stop --quiet --name "${TFTPD_BIN_##*/}" + start-stop-daemon --stop --quiet -p "$TFTPD_PID_" } function startTftp { test -f $TFTPD_BIN_ || die "could not find \"$TFTPD_BIN_\"" - start-stop-daemon --start --quiet --exec "$TFTPD_BIN_" -- -l -a "$IP_" -s "$TFTPD_DATA_DIR_" || \ + start-stop-daemon --start --quiet --exec "$TFTPD_BIN_" -- --daemon --no-multicast --pidfile "$TFTPD_PID_" --bind-address "$IP_" "$TFTPD_DATA_DIR_" || \ warn "problems starting tftpd server" } function runTftp @@ -221,6 +246,7 @@ function startNfs /etc/init.d/nfs-common start # FIXME /etc/init.d/nfs-kernel-server start $USR_SHARE_/nfs-kernel-server start + echo createNfsConfig } @@ -261,13 +287,14 @@ function actionStart runIptables echo "Finally starting nfs services..." - startNfs && echo "Sucessfully finished startup of grml-terminalserver." || echo 'Startup of grml-terminalserver-config failed!' + startNfs && echo "Successfully finished startup of grml-terminalserver." || echo 'Startup of grml-terminalserver failed!' } function actionStop { stopTftp stopDhcp + stopIptables stopNfs notice "Terminal-server stopped" } @@ -302,6 +329,7 @@ function serviceStart "") actionStart ;; tftp) runTftp ;; dhcp) runDhcp ;; + ipt) startIptables ;; nfs) startNfs ;; *) warn "Service $service_ not available" ;; esac @@ -315,6 +343,7 @@ function serviceStop "") actionStop ;; tftp) stopTftp ;; dhcp) stopDhcp ;; + ipt) stopIptables ;; nfs) stopNfs ;; *) warn "Service $service_ not available" ;; esac