Page MenuHomeClusterLabs Projects
Files F3687503

No OneTemporary
Actions

View Options

diff --git a/tools/cibsecret.in b/tools/cibsecret.in
index f35e7317ec..aa1efb67df 100644
--- a/tools/cibsecret.in
+++ b/tools/cibsecret.in
@@ -1,415 +1,417 @@
#!/bin/sh
# Copyright 2011-2020 the Pacemaker project contributors
#
# The version control history for this file may have further details.
#
# This source code is licensed under the GNU General Public License version 2
# or later (GPLv2+) WITHOUT ANY WARRANTY.
#
# cibsecret
#
# Manage the secrets directory (by default, /var/lib/pacemaker/lrm/secrets).
# Secrets are ASCII files, holding one value per file:
# <secrets-directory>/<rsc>/<param>
-LRM_CIBSECRETS=@LRM_CIBSECRETS_DIR@
+LRM_CIBSECRETS="@LRM_CIBSECRETS_DIR@"
-PROG=`basename $0`
+PROG="$(basename "$0")"
SSH_OPTS="-o StrictHostKeyChecking=no"
usage() {
cat <<EOF
cibsecret - manage sensitive information in Pacemaker CIB
Usage:
$PROG [<options>] <command> [<parameters>]
Options:
--help Show this message, then exit
--version Display version information, then exit
-C Don't read or write the CIB
Commands and their parameters:
set <resource-id> <resource-parameter> <value>
Set the value of a sensitive resource parameter.
get <resource-id> <resource-parameter>
Display the locally stored value of a sensitive resource parameter.
check <resource-id> <resource-parameter>
Verify that the locally stored value of a sensitive resource parameter
matches its locally stored MD5 hash.
stash <resource-id> <resource-parameter>
Make a non-sensitive resource parameter that is already in the CIB
sensitive (move its value to a locally stored and protected file).
This may not be used with -C.
unstash <resource-id> <resource-parameter>
Make a sensitive resource parameter that is already in the CIB
non-sensitive (move its value from the locally stored file to the CIB).
This may not be used with -C.
delete <resource-id> <resource-parameter>
Remove a sensitive resource parameter value.
sync
Copy all locally stored secrets to all other nodes.
This command manages sensitive resource parameter values that should not be
stored directly in Pacemaker's Cluster Information Base (CIB). Such values
are handled by storing a special string directly in the CIB that tells
Pacemaker to look in a separate, protected file for the actual value.
The secret files are not encrypted, but protected by file system permissions
such that only root can read or modify them.
Since the secret files are stored locally, they must be synchronized across all
cluster nodes. This command handles the synchronization using (in order of
preference) pssh, pdsh, or ssh, so one of those must be installed. Before
synchronizing, this command will ping the cluster nodes to determine which are
alive, using fping if it is installed, otherwise the ping command. Installing
fping is strongly recommended for better performance.
Known limitations:
This command can only be run from full cluster nodes (not Pacemaker Remote
nodes).
Changes are not atomic, so the cluster may use different values while a
change is in progress. To avoid problems, it is recommended to put the
cluster in maintenance mode when making changes with this command.
Changes in secret values do not trigger a reload or restart of the affected
resource, since they do not change the CIB. If a response is desired before
the next cluster recheck interval, any CIB change (such as setting a node
attribute) will trigger it.
If any node is down when changes to secrets are made, or a new node is
later added to the cluster, it may have different values when it joins the
cluster, before "$PROG sync" is run. To avoid this, it is recommended to
run the sync command (from another node) before starting Pacemaker on the
node.
Examples:
$PROG set ipmi_node1 passwd SecreT_PASS
$PROG get ipmi_node1 passwd
$PROG check ipmi_node1 passwd
$PROG stash ipmi_node2 passwd
$PROG sync
EOF
- exit $1
+ exit "$1"
}
fatal() {
echo "ERROR: $*"
exit 1
}
warn() {
echo "WARNING: $*"
}
info() {
echo "INFO: $*"
}
check_env() {
which md5sum >/dev/null 2>&1 ||
fatal "please install md5sum to run $PROG"
if which pssh >/dev/null 2>&1; then
rsh=pssh_fun
- rcp=pscp_fun
+ rcp_to_from=pscp_fun
elif which pdsh >/dev/null 2>&1; then
rsh=pdsh_fun
- rcp=pdcp_fun
+ rcp_to_from=pdcp_fun
elif which ssh >/dev/null 2>&1; then
rsh=ssh_fun
- rcp=scp_fun
+ rcp_to_from=scp_fun
else
fatal "please install pssh, pdsh, or ssh to run $PROG"
fi
ps -ef | grep '[p]acemaker-controld' >/dev/null ||
fatal "pacemaker not running? $PROG needs pacemaker"
}
-get_other_nodes() {
- crm_node -l | awk '{print $2}' | grep -v `uname -n`
-}
-
+# This must be called (and return success) before calling $rsh or $rcp_to_from
get_live_nodes() {
- if [ `id -u` = 0 ] && which fping >/dev/null 2>&1; then
- fping -a $@ 2>/dev/null
+ # Get a list of all cluster nodes
+ GLN_ALL_NODES="$(crm_node -l | awk '{print $2}' | grep -v "$(uname -n)")"
+
+ # Make a list of those that respond to pings
+ if [ "$(id -u)" = "0" ] && which fping >/dev/null 2>&1; then
+ LIVE_NODES=$(fping -a $GLN_ALL_NODES 2>/dev/null)
else
- local h
- for h; do ping -c 2 -q $h >/dev/null 2>&1 && echo $h; done
+ LIVE_NODES=""
+ for GLN_NODE in $GLN_ALL_NODES; do \
+ ping -c 2 -q "$GLN_NODE" >/dev/null 2>&1 &&
+ LIVE_NODES="$LIVE_NODES $GLN_NODE"
+ done
fi
-}
-check_down_nodes() {
- local n down_nodes
- down_nodes=`(for n; do echo $n; done) | sort | uniq -u`
- if [ -n "$down_nodes" ]; then
- if [ `echo $down_nodes | wc -w` = 1 ]; then
- warn "node $down_nodes is down"
- warn "you'll need to update it using $PROG sync later"
- else
- warn "nodes `echo $down_nodes` are down"
- warn "you'll need to update them using $PROG sync later"
- fi
+ # Warn the user about any that didn't respond to pings
+ GLN_DOWN="$( (for GLN_NODE in $LIVE_NODES $GLN_ALL_NODES; do echo "$GLN_NODE"; done) | sort | uniq -u)"
+ if [ "$(echo "$GLN_DOWN" | wc -w)" = "1" ]; then
+ warn "node $GLN_DOWN is down"
+ warn "you'll need to update it using \"$PROG sync\" later"
+ elif [ -n "$GLN_DOWN" ]; then
+ warn "nodes $(echo "$GLN_DOWN" | tr '\n' ' ')are down"
+ warn "you'll need to update them using \"$PROG sync\" later"
fi
+
+ if [ "$LIVE_NODES" = "" ]; then
+ info "no other nodes live"
+ return 1
+ fi
+ return 0
}
pssh_fun() {
- pssh -qi -H "$nodes" -x "$SSH_OPTS" $*
+ pssh -qi -H "$LIVE_NODES" -x "$SSH_OPTS" -- "$@"
}
pscp_fun() {
- pscp -q -H "$nodes" -x "-pr" -x "$SSH_OPTS" $*
+ PSCP_DEST="$1"
+ shift
+ pscp -q -H "$LIVE_NODES" -x "-pr" -x "$SSH_OPTS" -- "$@" "$PSCP_DEST"
}
pdsh_fun() {
- local pdsh_nodes=`echo $nodes | tr ' ' ','`
+ PDSH_NODES=$(echo "$LIVE_NODES" | tr '[:space:]' ',')
export PDSH_SSH_ARGS_APPEND="$SSH_OPTS"
- pdsh -w $pdsh_nodes $*
+ pdsh -w "$PDSH_NODES" -- "$@"
}
pdcp_fun() {
- local pdsh_nodes=`echo $nodes | tr ' ' ','`
+ PDCP_DEST="$1"
+ shift
+ PDCP_NODES=$(echo "$LIVE_NODES" | tr '[:space:]' ',')
export PDSH_SSH_ARGS_APPEND="$SSH_OPTS"
- pdcp -pr -w $pdsh_nodes $*
+ pdcp -pr -w "$PDCP_NODES" -- "$@" "$PDCP_DEST"
}
ssh_fun() {
- local h
- for h in $nodes; do
- ssh $SSH_OPTS $h $* || return
+ for SSH_NODE in $LIVE_NODES; do
+ ssh $SSH_OPTS "$SSH_NODE" -- "$@" || return
done
}
scp_fun() {
- local h src="$1" dest=$2
- for h in $nodes; do
- scp -pr -q $SSH_OPTS $src $h:$dest || return
+ SCP_DEST="$1"
+ shift
+ for SCP_NODE in $LIVE_NODES; do
+ scp -pqr $SSH_OPTS "$@" "$SCP_NODE:$SCP_DEST" || return
done
}
# TODO: this procedure should be replaced with csync2
# provided that csync2 has already been configured
sync_files() {
- local crm_nodes=`get_other_nodes`
- local nodes=`get_live_nodes $crm_nodes`
- check_down_nodes $nodes $crm_nodes
- [ "$nodes" = "" ] && {
- info "no other nodes live"
- return
- }
- info "syncing $LRM_CIBSECRETS to `echo $nodes` ..."
- $rsh rm -rf $LRM_CIBSECRETS &&
- $rsh mkdir -p `dirname $LRM_CIBSECRETS` &&
- $rcp $LRM_CIBSECRETS `dirname $LRM_CIBSECRETS`
+ get_live_nodes || return
+ info "syncing $LRM_CIBSECRETS to $(echo "$LIVE_NODES" | tr '\n' ' ') ..."
+ $rsh rm -rf "$LRM_CIBSECRETS" &&
+ $rsh mkdir -p "$(dirname "$LRM_CIBSECRETS")" &&
+ $rcp_to_from "$(dirname "$LRM_CIBSECRETS")" "$LRM_CIBSECRETS"
}
sync_one() {
- local f=$1 f_all="$1 $1.sign"
- local crm_nodes=`get_other_nodes`
- local nodes=`get_live_nodes $crm_nodes`
- check_down_nodes $nodes $crm_nodes
- [ "$nodes" = "" ] && {
- info "no other nodes live"
- return
- }
- info "syncing $f to `echo $nodes` ..."
- $rsh mkdir -p `dirname $f` &&
- if [ -f "$f" ]; then
- $rcp "$f_all" `dirname $f`
+ SO_FILE="$1"
+ get_live_nodes || return
+ info "syncing $SO_FILE to $(echo "$LIVE_NODES" | tr '\n' ' ') ..."
+ $rsh mkdir -p "$(dirname "$SO_FILE")" &&
+ if [ -f "$SO_FILE" ]; then
+ $rcp_to_from "$(dirname "$SO_FILE")" "$SO_FILE" "${SO_FILE}.sign"
else
- $rsh rm -f $f_all
+ $rsh rm -f "$SO_FILE" "${SO_FILE}.sign"
fi
}
is_secret() {
- # assume that the secret is in the CIB if we cannot talk to
- # cib
+ # assume that the secret is in the CIB if we cannot talk to cib
[ "$NO_CRM" ] || test "$1" = "$MAGIC"
}
check_cib_rsc() {
- local rsc=$1 output
- output=`$NO_CRM crm_resource -r $rsc -W >/dev/null 2>&1` ||
- fatal "resource $rsc doesn't exist: $output"
+ CCR_RSC="$1"
+ CCR_OUT="$($NO_CRM crm_resource -r "$CCR_RSC" -W >/dev/null 2>&1)" ||
+ fatal "resource $CCR_RSC doesn't exist: $CCR_OUT"
}
get_cib_param() {
- local rsc=$1 param=$2
- check_cib_rsc $rsc
- $NO_CRM crm_resource -r $rsc -g $param 2>/dev/null
+ GCP_RSC="$1"
+ GCP_PARAM="$2"
+ check_cib_rsc "$GCP_RSC"
+ $NO_CRM crm_resource -r "$GCP_RSC" -g "$GCP_PARAM" 2>/dev/null
}
set_cib_param() {
- local rsc=$1 param=$2 value=$3
- check_cib_rsc $rsc
- $NO_CRM crm_resource -r $rsc -p $param -v "$value" 2>/dev/null
+ SET_RSC="$1"
+ SET_PARAM="$2"
+ SET_VAL="$3"
+ check_cib_rsc "$SET_RSC"
+ $NO_CRM crm_resource -r "$SET_RSC" -p "$SET_PARAM" -v "$SET_VAL" 2>/dev/null
}
remove_cib_param() {
- local rsc=$1 param=$2
- check_cib_rsc $rsc
- $NO_CRM crm_resource -r $rsc -d $param 2>/dev/null
+ RM_RSC="$1"
+ RM_PARAM="$2"
+ check_cib_rsc "$RM_RSC"
+ $NO_CRM crm_resource -r "$RM_RSC" -d "$RM_PARAM" 2>/dev/null
}
localfiles() {
- local cmd=$1
- local rsc=$2 param=$3 value=$4
- local local_file=$LRM_CIBSECRETS/$rsc/$param
- case $cmd in
+ LF_CMD="$1"
+ LF_RSC="$2"
+ LF_PARAM="$3"
+ LF_VALUE="$4"
+ LF_FILE="$LRM_CIBSECRETS/$LF_RSC/$LF_PARAM"
+ case "$LF_CMD" in
get)
- cat $local_file 2>/dev/null
+ cat "$LF_FILE" 2>/dev/null
true
;;
getsum)
- cat $local_file.sign 2>/dev/null
+ cat "${LF_FILE}.sign" 2>/dev/null
true
;;
set)
- local md5sum
- md5sum=`printf $value | md5sum` ||
- fatal "md5sum failed to produce hash for resource $rsc parameter $param"
- md5sum=`echo $md5sum | awk '{print $1}'`
- mkdir -p `dirname $local_file` &&
- echo $value > $local_file &&
- echo $md5sum > $local_file.sign &&
- sync_one $local_file
+ LF_SUM="$(printf %s "$LF_VALUE" | md5sum)" ||
+ fatal "md5sum failed to produce hash for resource $LF_RSC parameter $LF_PARAM"
+ LF_SUM="$(echo "$LF_SUM" | awk '{print $1}')"
+ mkdir -p "$(dirname "$LF_FILE")" &&
+ echo "$LF_VALUE" > "$LF_FILE" &&
+ echo "$LF_SUM" > "${LF_FILE}.sign" &&
+ sync_one "$LF_FILE"
;;
remove)
- rm -f $local_file
- rm -f $local_file.sign
- sync_one $local_file
+ rm -f "$LF_FILE" "${LF_FILE}.sign"
+ sync_one "$LF_FILE"
;;
*)
# not reached, this is local interface
;;
esac
}
get_local_param() {
- local rsc=$1 param=$2
- localfiles get $rsc $param
+ GLP_RSC="$1"
+ GLP_PARAM="$2"
+ localfiles get "$GLP_RSC" "$GLP_PARAM"
}
set_local_param() {
- local rsc=$1 param=$2 value=$3
- localfiles set $rsc $param $value
+ SLP_RSC="$1"
+ SLP_PARAM="$2"
+ SLP_VALUE="$3"
+ localfiles set "$SLP_RSC" "$SLP_PARAM" "$SLP_VALUE"
}
remove_local_param() {
- local rsc=$1 param=$2
- localfiles remove $rsc $param
+ RLP_RSC="$1"
+ RLP_PARAM="$2"
+ localfiles remove "$RLP_RSC" "$RLP_PARAM"
}
cibsecret_set() {
- local value=$1
+ CS_VALUE="$1"
- if [ -z "$NO_CRM" ]; then
- [ "$current" -a "$current" != "$MAGIC" -a "$current" != "$value" ] &&
- fatal "CIB value <$current> different for $rsc parameter $param; please delete it first"
- fi
- set_local_param $rsc $param $value &&
- set_cib_param $rsc $param "$MAGIC"
+ [ -z "$NO_CRM" ] &&
+ [ ! -z "$current" ] &&
+ [ "$current" != "$MAGIC" ] &&
+ [ "$current" != "$CS_VALUE" ] &&
+ fatal "CIB value <$current> different for $rsc parameter $param; please delete it first"
+ set_local_param "$rsc" "$param" "$CS_VALUE" &&
+ set_cib_param "$rsc" "$param" "$MAGIC"
}
cibsecret_check() {
- local md5sum local_md5sum
is_secret "$current" ||
fatal "resource $rsc parameter $param not set as secret, nothing to check"
- local_md5sum=`localfiles getsum $rsc $param`
- [ "$local_md5sum" ] ||
+ CSC_LOCAL_SUM="$(localfiles getsum "$rsc" "$param")"
+ [ "$CSC_LOCAL_SUM" ] ||
fatal "no MD5 hash for resource $rsc parameter $param"
- md5sum=`printf "$current_local" | md5sum | awk '{print $1}'`
- [ "$md5sum" = "$local_md5sum" ] ||
+ CSC_CALC_SUM="$(printf "%s" "$current_local" | md5sum | awk '{print $1}')"
+ [ "$CSC_CALC_SUM" = "$CSC_LOCAL_SUM" ] ||
fatal "MD5 hash mismatch for resource $rsc parameter $param"
}
cibsecret_get() {
cibsecret_check
echo "$current_local"
}
cibsecret_delete() {
- remove_local_param $rsc $param &&
- remove_cib_param $rsc $param
+ remove_local_param "$rsc" "$param" && remove_cib_param "$rsc" "$param"
}
cibsecret_stash() {
- [ "$NO_CRM" ] &&
- fatal "no access to Pacemaker, stash not supported"
+ [ "$NO_CRM" ] && fatal "no access to Pacemaker, stash not supported"
[ "$current" = "" ] &&
fatal "nothing to stash for resource $rsc parameter $param"
is_secret "$current" &&
fatal "resource $rsc parameter $param already set as secret, nothing to stash"
cibsecret_set "$current"
}
cibsecret_unstash() {
- [ "$NO_CRM" ] &&
- fatal "no access to Pacemaker, unstash not supported"
+ [ "$NO_CRM" ] && fatal "no access to Pacemaker, unstash not supported"
[ "$current_local" = "" ] &&
fatal "nothing to unstash for resource $rsc parameter $param"
is_secret "$current" ||
warn "resource $rsc parameter $param not set as secret, but we have local value so proceeding anyway"
- remove_local_param $rsc $param &&
- set_cib_param $rsc $param $current_local
+ remove_local_param "$rsc" "$param" &&
+ set_cib_param "$rsc" "$param" "$current_local"
}
cibsecret_sync() {
sync_files
}
MAGIC="lrm://"
umask 0077
if [ "$1" = "-C" ]; then
NO_CRM=':'
shift 1
fi
-cmd=$1
-rsc=$2
-param=$3
-value=$4
+cmd="$1"
+rsc="$2"
+param="$3"
+value="$4"
case "$cmd" in
set) [ $# -ne 4 ] && usage 1 ;;
get) [ $# -ne 3 ] && usage 1 ;;
check) [ $# -ne 3 ] && usage 1 ;;
stash) [ $# -ne 3 ] && usage 1 ;;
unstash) [ $# -ne 3 ] && usage 1 ;;
delete) [ $# -ne 3 ] && usage 1 ;;
sync) [ $# -ne 1 ] && usage 1 ;;
--help) usage 0 ;;
--version) crm_attribute --version; exit $? ;;
*) usage 1 ;;
esac
-. @OCF_ROOT_DIR@/lib/heartbeat/ocf-shellfuncs
+. "@OCF_ROOT_DIR@/lib/heartbeat/ocf-shellfuncs"
check_env
# we'll need these two often
-current=`get_cib_param $rsc $param`
-current_local=`get_local_param $rsc $param`
+current="$(get_cib_param "$rsc" "$param")"
+current_local="$(get_local_param "$rsc" "$param")"
-cibsecret_$cmd $value
+"cibsecret_$cmd" "$value"
# vim: set expandtab tabstop=8 softtabstop=4 shiftwidth=4 textwidth=80:

File Metadata

Mime Type
text/x-diff
Expires
Mon, Apr 21, 7:36 PM (10 h, 57 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1665586
Default Alt Text
(16 KB)

Event Timeline