mirror of
https://github.com/ovh/the-bastion.git
synced 2025-01-06 07:22:14 +08:00
103 lines
3.1 KiB
Perl
Executable file
103 lines
3.1 KiB
Perl
Executable file
#! /usr/bin/perl -T
|
|
# vim: set filetype=perl ts=4 sw=4 sts=4 et:
|
|
# NEEDGROUP osh-admin
|
|
# SUDOERS %osh-admin ALL=(allowkeeper) NOPASSWD:/usr/bin/env perl -T /opt/bastion/bin/helper/osh-adminMaintenance *
|
|
# FILEMODE 0750
|
|
# FILEOWN 0 allowkeeper
|
|
|
|
#>HEADER
|
|
use common::sense;
|
|
use Getopt::Long qw(:config no_auto_abbrev no_ignore_case);
|
|
|
|
use File::Basename;
|
|
use lib dirname(__FILE__) . '/../../lib/perl';
|
|
use OVH::Bastion;
|
|
use OVH::Bastion::Helper;
|
|
|
|
# Fetch command options
|
|
my $fnret;
|
|
my ($result, @optwarns);
|
|
my ($action, $message);
|
|
eval {
|
|
local $SIG{__WARN__} = sub { push @optwarns, shift };
|
|
$result = GetOptions(
|
|
"action=s" => sub { $action //= $_[1] },
|
|
"message=s" => sub { $message //= $_[1] },
|
|
);
|
|
};
|
|
if ($@) { die $@ }
|
|
|
|
if (!$result) {
|
|
local $" = ", ";
|
|
HEXIT('ERR_BAD_OPTIONS', msg => "Error parsing options: @optwarns");
|
|
}
|
|
|
|
OVH::Bastion::Helper::check_spurious_args();
|
|
|
|
if (not $action) {
|
|
HEXIT('ERR_MISSING_PARAMETER', msg => "Missing argument 'action'");
|
|
}
|
|
|
|
if (not grep { $action eq $_ } qw{ set unset }) {
|
|
HEXIT('ERR_INVALID_PARAMETER', msg => "Expected action 'set' or 'unset'");
|
|
}
|
|
|
|
#<HEADER
|
|
|
|
#>RIGHTSCHECK
|
|
if ($self eq 'root') {
|
|
osh_debug "Real root, skipping checks of permissions";
|
|
}
|
|
else {
|
|
# need to perform another security check
|
|
$fnret = OVH::Bastion::is_user_in_group(user => $self, group => "osh-admin");
|
|
if (!$fnret) {
|
|
HEXIT('ERR_SECURITY_VIOLATION', msg => "You're not allowed to run this, dear $self");
|
|
}
|
|
}
|
|
|
|
#<RIGHTSCHECK
|
|
|
|
#>CODE
|
|
|
|
my $retmsg;
|
|
if ($action eq 'set') {
|
|
if (-e '/home/allowkeeper/maintenance') {
|
|
HEXIT('OK_NO_CHANGE', msg => "Nothing to do, maintenance mode was already set");
|
|
}
|
|
$fnret = OVH::Bastion::touch_file('/home/allowkeeper/maintenance', 0644); ## no critic (ProhibitLeadingZeros)
|
|
if (!$fnret) {
|
|
HEXIT('KO', msg => "Couldn't set the bastion to maintenance mode (" . $fnret->msg . ")");
|
|
}
|
|
$message = "(no reason given)" if not $message;
|
|
$message .= " [set by $self at " . localtime(time()) . "]";
|
|
if (open(my $fh, '>', '/home/allowkeeper/maintenance')) {
|
|
print $fh $message;
|
|
}
|
|
else {
|
|
osh_warn("Couldn't write the maintenance message ($!), but we're still setting the maintenance mode ",
|
|
", users just won't see your maintenance message.");
|
|
}
|
|
$retmsg =
|
|
"Maintenance mode is now enabled, new connections are disallowed (except for admins).\nGiven reason: $message";
|
|
}
|
|
elsif ($action eq 'unset') {
|
|
if (-e '/home/allowkeeper/maintenance') {
|
|
if (!unlink('/home/allowkeeper/maintenance')) {
|
|
HEXIT('KO', msg => "Couldn't unset the bastion maintenance mode ($!)");
|
|
}
|
|
}
|
|
else {
|
|
HEXIT('OK_NO_CHANGE', msg => "Nothing to do, maintenance mode was not set previously");
|
|
}
|
|
$retmsg = "Maintenance mode is now disabled, new connections are allowed.";
|
|
}
|
|
|
|
OVH::Bastion::syslogFormatted(
|
|
severity => 'info',
|
|
type => 'maintenance',
|
|
fields => [['action', $action], ['message', $message],]
|
|
);
|
|
|
|
# done at last!
|
|
HEXIT('OK', value => {action => $action, message => $message}, msg => $retmsg);
|