Merge pull request #2348 from szepeviktor/deb-initd-retry

Safer, nicer, uniform Debian initd script - into 0.10
pull/2387/head
Sergey G. Brester 2019-03-27 14:00:40 +01:00 committed by GitHub
commit 0e5ce68d4c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 86 additions and 64 deletions

View File

@ -41,6 +41,8 @@ install:
- if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then travis_retry sudo apt-get install -qq python-gamin && cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then travis_retry sudo apt-get install -qq python-gamin && cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi
# pyinotify # pyinotify
- travis_retry pip install pyinotify - travis_retry pip install pyinotify
# Install helper tools
- sudo apt-get install shellcheck
before_script: before_script:
# Manually execute 2to3 for now # Manually execute 2to3 for now
- if [[ "$F2B_PY" = 3 ]]; then ./fail2ban-2to3; fi - if [[ "$F2B_PY" = 3 ]]; then ./fail2ban-2to3; fi
@ -53,6 +55,8 @@ script:
- sudo $VENV_BIN/pip install . - sudo $VENV_BIN/pip install .
# Doc files should get installed on Travis under Linux # Doc files should get installed on Travis under Linux
- test -e /usr/share/doc/fail2ban/FILTERS - test -e /usr/share/doc/fail2ban/FILTERS
# Test initd script
- shellcheck -s bash -e SC1090,SC1091 files/debian-initd
after_success: after_success:
- if [[ "$F2B_COV" = 1 ]]; then coveralls; fi - if [[ "$F2B_COV" = 1 ]]; then coveralls; fi
- codecov - codecov

View File

@ -1,4 +1,4 @@
#! /bin/sh #!/bin/sh
### BEGIN INIT INFO ### BEGIN INIT INFO
# Provides: fail2ban # Provides: fail2ban
# Required-Start: $local_fs $remote_fs # Required-Start: $local_fs $remote_fs
@ -22,28 +22,28 @@
# rename this file: (sudo) mv /etc/init.d/fail2ban.init /etc/init.d/fail2ban # rename this file: (sudo) mv /etc/init.d/fail2ban.init /etc/init.d/fail2ban
# same with the logrotate file: (sudo) mv /etc/logrotate.d/fail2ban.logrotate /etc/logrotate.d/fail2ban # same with the logrotate file: (sudo) mv /etc/logrotate.d/fail2ban.logrotate /etc/logrotate.d/fail2ban
# #
PATH=/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin PATH="/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin"
DESC="authentication failure monitor" DESC="Authentication failure monitor"
NAME=fail2ban NAME="fail2ban"
# fail2ban-client is not a daemon itself but starts a daemon and # fail2ban-client is not a daemon itself but starts a daemon and
# loads its with configuration # loads its with configuration
DAEMON=/usr/local/bin/$NAME-client DAEMON="/usr/local/bin/$NAME-client"
SCRIPTNAME=/etc/init.d/$NAME SCRIPTNAME="/etc/init.d/$NAME"
# Ad-hoc way to parse out socket file name # Ad-hoc way to parse out socket file name
SOCKFILE=`grep -h '^[^#]*socket *=' /etc/$NAME/$NAME.conf /etc/$NAME/$NAME.local 2>/dev/null \ SOCKFILE="$(grep -h '^[^#]*socket *=' "/etc/$NAME/$NAME.conf" "/etc/$NAME/$NAME.local" 2>/dev/null \
| tail -n 1 | sed -e 's/.*socket *= *//g' -e 's/ *$//g'` | tail -n 1 | sed -e 's/.*socket *= *//g' -e 's/ *$//g')"
[ -z "$SOCKFILE" ] && SOCKFILE='/var/run/fail2ban.sock' [ -z "$SOCKFILE" ] && SOCKFILE="/var/run/fail2ban.sock"
# Exit if the package is not installed # Exit if the package is not installed
[ -x "$DAEMON" ] || exit 0 [ -x "$DAEMON" ] || exit 0
# Run as root by default. # Run as root by default.
FAIL2BAN_USER=root FAIL2BAN_USER="root"
# Read configuration variable file if it is present # Read configuration variable file if it is present
[ -r /etc/default/$NAME ] && . /etc/default/$NAME [ -r "/etc/default/$NAME" ] && . "/etc/default/$NAME"
DAEMON_ARGS="$FAIL2BAN_OPTS" DAEMON_ARGS="$FAIL2BAN_OPTS"
# Load the VERBOSE setting and other rcS variables # Load the VERBOSE setting and other rcS variables
@ -51,7 +51,8 @@ DAEMON_ARGS="$FAIL2BAN_OPTS"
# Predefine what can be missing from lsb source later on -- necessary to run # Predefine what can be missing from lsb source later on -- necessary to run
# on sarge. Just present it in a bit more compact way from what was shipped # on sarge. Just present it in a bit more compact way from what was shipped
log_daemon_msg () { log_daemon_msg()
{
[ -z "$1" ] && return 1 [ -z "$1" ] && return 1
echo -n "$1:" echo -n "$1:"
[ -z "$2" ] || echo -n " $2" [ -z "$2" ] || echo -n " $2"
@ -68,7 +69,7 @@ log_daemon_msg () {
# #
report_bug() report_bug()
{ {
echo $* echo "$*"
echo "Please submit a bug report to Debian BTS (reportbug fail2ban)" echo "Please submit a bug report to Debian BTS (reportbug fail2ban)"
exit 1 exit 1
} }
@ -80,10 +81,10 @@ report_bug()
check_socket() check_socket()
{ {
# Return # Return
# 0 if socket is present and readable # 0 if socket is present and readable
# 1 if socket file is not present # 1 if socket file is not present
# 2 if socket file is present but not readable # 2 if socket file is present but not readable
# 3 if socket file is present but is not a socket # 3 if socket file is present but is not a socket
[ -e "$SOCKFILE" ] || return 1 [ -e "$SOCKFILE" ] || return 1
[ -r "$SOCKFILE" ] || return 2 [ -r "$SOCKFILE" ] || return 2
[ -S "$SOCKFILE" ] || return 3 [ -S "$SOCKFILE" ] || return 3
@ -96,14 +97,14 @@ check_socket()
do_start() do_start()
{ {
# Return # Return
# 0 if daemon has been started # 0 if daemon has been started
# 1 if daemon was already running # 1 if daemon was already running
# 2 if daemon could not be started # 2 if daemon could not be started
do_status && return 1 do_status && return 1
if [ -e "$SOCKFILE" ]; then if [ -e "$SOCKFILE" ]; then
log_failure_msg "Socket file $SOCKFILE is present" log_failure_msg "Socket file $SOCKFILE is present"
[ "$1" = "force-start" ] \ [ "$1" = force-start ] \
&& log_success_msg "Starting anyway as requested" \ && log_success_msg "Starting anyway as requested" \
|| return 2 || return 2
DAEMON_ARGS="$DAEMON_ARGS -x" DAEMON_ARGS="$DAEMON_ARGS -x"
@ -112,18 +113,20 @@ do_start()
# Assure that /var/run/fail2ban exists # Assure that /var/run/fail2ban exists
[ -d /var/run/fail2ban ] || mkdir -p /var/run/fail2ban [ -d /var/run/fail2ban ] || mkdir -p /var/run/fail2ban
if [ "$FAIL2BAN_USER" != "root" ]; then if [ "$FAIL2BAN_USER" != root ]; then
# Make the socket directory, IP lists and fail2ban log # Make the socket directory, IP lists and fail2ban log
# files writable by fail2ban # files writable by fail2ban
chown "$FAIL2BAN_USER" /var/run/fail2ban chown "$FAIL2BAN_USER" /var/run/fail2ban
# Create the logfile if it doesn't exist # Create the logfile if it doesn't exist
touch /var/log/fail2ban.log touch /var/log/fail2ban.log
chown "$FAIL2BAN_USER" /var/log/fail2ban.log chown "$FAIL2BAN_USER" /var/log/fail2ban.log
find /proc/net/xt_recent -name 'fail2ban-*' -exec chown "$FAIL2BAN_USER" {} \; find /proc/net/xt_recent -name "fail2ban-*" -exec chown "$FAIL2BAN_USER" "{}" ";"
fi fi
start-stop-daemon --start --quiet --chuid "$FAIL2BAN_USER" --exec $DAEMON -- \ # $DAEMON_ARGS need to be expanded possibly with multiple or no options
$DAEMON_ARGS start > /dev/null\ # shellcheck disable=SC2086
start-stop-daemon --start --quiet --chuid "$FAIL2BAN_USER" --exec "$DAEMON" -- \
$DAEMON_ARGS start >/dev/null \
|| return 2 || return 2
return 0 return 0
@ -136,8 +139,8 @@ do_start()
# #
do_status() do_status()
{ {
$DAEMON ping > /dev/null 2>&1 $DAEMON ping >/dev/null 2>&1
return $? return "$?"
} }
# #
@ -146,22 +149,22 @@ do_status()
do_stop() do_stop()
{ {
# Return # Return
# 0 if daemon has been stopped # 0 if daemon has been stopped
# 1 if daemon was already stopped # 1 if daemon was already stopped
# 2 if daemon could not be stopped # 2 if daemon could not be stopped
# other if a failure occurred # other if a failure occurred
$DAEMON status > /dev/null 2>&1 || return 1 $DAEMON status >/dev/null 2>&1 || return 1
$DAEMON stop > /dev/null || return 2 $DAEMON stop >/dev/null || return 2
# now we need actually to wait a bit since it might take time # now we need actually to wait a bit since it might take time
# for server to react on client's stop request. Especially # for server to react on client's stop request. Especially
# important for restart command on slow boxes # important for restart command on slow boxes
count=1 count=1
while do_status && [ $count -lt 60 ]; do while do_status && [ "$count" -lt 60 ]; do
sleep 1 sleep 1
count=$(($count+1)) count="$((count + 1))"
done done
[ $count -lt 60 ] || return 3 # failed to stop [ "$count" -lt 60 ] || return 3 # failed to stop
return 0 return 0
} }
@ -169,8 +172,9 @@ do_stop()
# #
# Function to reload configuration # Function to reload configuration
# #
do_reload() { do_reload()
$DAEMON reload > /dev/null && return 0 || return 1 {
"$DAEMON" reload >/dev/null && return 0 || return 1
return 0 return 0
} }
@ -180,16 +184,16 @@ do_reload() {
# #
log_end_msg_wrapper() log_end_msg_wrapper()
{ {
if [ $1 != 0 ] && [ $1 != $2 ]; then if [ "$1" != 0 ] && [ "$1" != "$2" ]; then
value=1 value="1"
else else
value=0 value="0"
fi fi
if [ "$3" != "no" ]; then if [ "$3" != no ]; then
log_end_msg $value log_end_msg "$value"
fi fi
if [ $value != "0" ]; then if [ "$value" != 0 ]; then
exit $1 exit "$1"
fi fi
} }
@ -198,13 +202,13 @@ case "$command" in
start|force-start) start|force-start)
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
do_start "$command" do_start "$command"
log_end_msg_wrapper $? 255 "$VERBOSE" log_end_msg_wrapper "$?" 255 "$VERBOSE"
;; ;;
stop) stop)
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME" [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
do_stop do_stop
log_end_msg_wrapper $? 255 "$VERBOSE" log_end_msg_wrapper "$?" 255 "$VERBOSE"
;; ;;
restart|force-reload) restart|force-reload)
@ -213,41 +217,55 @@ case "$command" in
case "$?" in case "$?" in
0|1) 0|1)
do_start do_start
log_end_msg_wrapper $? 0 "always" log_end_msg_wrapper "$?" 0 always
;; ;;
*) *)
# Failed to stop # Failed to stop
log_end_msg 1 log_end_msg 1
;; ;;
esac esac
;; ;;
reload|force-reload) reload)
log_daemon_msg "Reloading $DESC" "$NAME" log_daemon_msg "Reloading $DESC" "$NAME"
do_reload do_reload
log_end_msg $? log_end_msg "$?"
;; ;;
status) status)
log_daemon_msg "Status of $DESC" log_daemon_msg "Status of $DESC"
do_status do_status
case $? in case "$?" in
0) log_success_msg " $NAME is running" ;; 0)
log_success_msg " $NAME is running"
;;
255) 255)
check_socket check_socket
case $? in case "$?" in
1) log_failure_msg " $NAME is not running" && exit 3 ;; 1)
0) log_failure_msg " $NAME is not running but $SOCKFILE exists" && exit 3 ;; log_failure_msg " $NAME is not running" && exit 3
2) log_failure_msg " $SOCKFILE not readable, status of $NAME is unknown" && exit 3 ;; ;;
3) log_failure_msg " $SOCKFILE exists but not a socket, status of $NAME is unknown" && exit 3 ;; 0)
*) report_bug "Unknown return code from $NAME:check_socket." && exit 4 ;; log_failure_msg " $NAME is not running but $SOCKFILE exists" && exit 3
;;
2)
log_failure_msg " $SOCKFILE not readable, status of $NAME is unknown" && exit 3
;;
3)
log_failure_msg " $SOCKFILE exists but not a socket, status of $NAME is unknown" && exit 3
;;
*)
report_bug "Unknown return code from $NAME:check_socket." && exit 4
;;
esac esac
;; ;;
*) report_bug "Unknown $NAME status code" && exit 4 *)
report_bug "Unknown $NAME status code" && exit 4
;;
esac esac
;; ;;
*) *)
echo "Usage: $SCRIPTNAME {start|force-start|stop|restart|force-reload|status}" >&2 echo "Usage: $SCRIPTNAME {start|force-start|stop|restart|force-reload|status}" 1>&2
exit 3 exit 3
;; ;;
esac esac