mirror of
https://github.com/nsacyber/HIRS.git
synced 2025-01-19 11:16:59 +00:00
Merge pull request #713 from nsacyber/v3_issue_687
[#687] Fixed mariadb service stop with ACA RPM install
This commit is contained in:
iadgovuser26
GitHub
commit
442bf93419
@ -2,7 +2,7 @@ plugins {
|
||||
id 'application'
|
||||
id 'java'
|
||||
id 'war'
|
||||
id 'com.netflix.nebula.ospackage' version '11.4.0'
|
||||
id 'com.netflix.nebula.ospackage' version '11.8.0'
|
||||
id 'org.springframework.boot' version '3.0.6'
|
||||
id 'io.spring.dependency-management' version '1.1.0'
|
||||
id 'checkstyle'
|
||||
@ -87,13 +87,20 @@ test {
|
||||
useJUnitPlatform()
|
||||
}
|
||||
|
||||
task buildVersion() {
|
||||
doLast {
|
||||
def verFile = new File(projectDir, "build/VERSION")
|
||||
verFile.write("${jarVersion}")
|
||||
}
|
||||
}
|
||||
|
||||
ospackage {
|
||||
packageName = 'HIRS_AttestationCA'
|
||||
os = LINUX
|
||||
arch = NOARCH
|
||||
version = "$packVersion"
|
||||
release = '1'
|
||||
|
||||
|
||||
user 'root'
|
||||
fileMode = 0755
|
||||
|
||||
@ -108,39 +115,62 @@ ospackage {
|
||||
// copy springboot property file
|
||||
into ('/etc/hirs/aca/') {
|
||||
from '../HIRS_AttestationCAPortal/src/main/resources/application.properties'
|
||||
from 'build/VERSION'
|
||||
}
|
||||
// copy setup scripts to /opt/hirs/aca
|
||||
into ('/opt/hirs/aca/scripts/') {
|
||||
from '../package/scripts/'
|
||||
from '../package/linux/'
|
||||
}
|
||||
// copy the war file into /opt/hirs/aca
|
||||
into ('/opt/hirs/aca/') {
|
||||
from '../HIRS_AttestationCAPortal/build/libs/HIRS_AttestationCAPortal.war'
|
||||
user 'root'
|
||||
fileMode = 0755
|
||||
fileMode = 0755
|
||||
}
|
||||
|
||||
// Post Install
|
||||
postInstall 'bash /opt/hirs/aca/scripts/aca/aca_setup.sh -u'
|
||||
// add chrontab to run ACA at boot
|
||||
postInstall 'echo "@reboot root /opt/hirs/aca/scripts/aca/aca_bootRun.sh -w" >> /etc/crontab'
|
||||
// run ACA after install
|
||||
postInstall '/opt/hirs/aca/scripts/aca/aca_bootRun.sh -w &'
|
||||
postInstall 'chmod +x /opt/hirs/aca/scripts/aca/*'
|
||||
postInstall 'bash /opt/hirs/aca/scripts/aca/check_for_aca.sh'
|
||||
postInstall 'mkdir -p /etc/hirs/aca && touch /etc/hirs/aca/VERSION'
|
||||
postInstall "echo ${jarVersion} > /etc/hirs/aca/VERSION"
|
||||
|
||||
// Uninstall
|
||||
preUninstall 'bash /opt/hirs/aca/scripts/aca/aca_remove_setup.sh'
|
||||
postUninstall 'rm -rf /etc/hirs'
|
||||
|
||||
postUninstall 'if [ -d /etc/hirs ]; then rm -rf /etc/hirs; fi;'
|
||||
|
||||
buildRpm {
|
||||
dependsOn ':HIRS_AttestationCAPortal:buildVersion'
|
||||
dependsOn ':HIRS_AttestationCAPortal:bootWar'
|
||||
arch = X86_64
|
||||
// Required apps will be aut installed by dnf if not present
|
||||
requires('java-17-openjdk', '17.0', GREATER | EQUAL)
|
||||
requires('mariadb-server' , '10.3' , GREATER | EQUAL)
|
||||
requires('procps-ng', '3.3.15', GREATER | EQUAL)
|
||||
requires('alternatives', '1.19', GREATER | EQUAL)
|
||||
// Post Trans stage (Occurs after required app and postInstall stage)
|
||||
// Note postInstall wont wait forrequired apps
|
||||
postTrans 'update-alternatives --set java java-17-openjdk.x86_64'
|
||||
postTrans 'firewall-cmd --add-port=8443/tcp --permanent'
|
||||
postTrans 'firewall-cmd --reload'
|
||||
postTrans 'bash /opt/hirs/aca/scripts/aca/aca_setup.sh -u'
|
||||
postTrans 'bash /opt/hirs/aca/scripts/aca/aca_bootRun.sh -w &'
|
||||
// add chrontab to run ACA at boot
|
||||
postTrans 'echo "@reboot root /opt/hirs/aca/scripts/aca/aca_bootRun.sh -w" >> /etc/crontab'
|
||||
postTrans 'chmod +x /opt/hirs/aca/scripts/aca/*'
|
||||
postTrans 'if [ -f /opt/hirs/aca/VERSION ]; then rm /opt/hirs/aca/VERSION; fi;'
|
||||
// Wait for ACA to start up before finishing the install
|
||||
postTrans 'bash /opt/hirs/aca/scripts/aca/check_for_aca.sh'
|
||||
}
|
||||
|
||||
buildDeb {
|
||||
dependsOn ':HIRS_AttestationCAPortal:buildVersion'
|
||||
dependsOn ':HIRS_AttestationCAPortal:bootWar'
|
||||
packageName = 'hirs-attestationca'
|
||||
arch = 'amd64'
|
||||
requires('openjdk-17-jdk', '17.0', GREATER | EQUAL)
|
||||
requires('mariadb-server' , '10.3' , GREATER | EQUAL)
|
||||
requires('curl')
|
||||
// Install after required packages
|
||||
postInstall 'bash /opt/hirs/aca/scripts/aca/aca_setup.sh -u'
|
||||
postInstall '/opt/hirs/aca/scripts/aca/aca_bootRun.sh -w &'
|
||||
postInstall 'echo "@reboot root /opt/hirs/aca/scripts/aca/aca_bootRun.sh -w" >> /etc/crontab'
|
||||
postInstall 'chmod +x /opt/hirs/aca/scripts/aca/*'
|
||||
postInstall 'if [ -f /opt/hirs/aca/VERSION ]; then rm /opt/hirs/aca/VERSION; fi;'
|
||||
// Wait for ACA to start up before finishing the install
|
||||
postInstall 'bash /opt/hirs/aca/scripts/aca/check_for_aca.sh'
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,18 +1,16 @@
|
||||
|
||||
# Logging Config (tomcat may have further config)
|
||||
logging.level.org.springframework=TRACE
|
||||
logging.level.org.apache.catalina=TRACE
|
||||
logging.level.org.springframework.web: TRACE
|
||||
logging.level.org.hibernate: ERROR
|
||||
logging.level.org.springframework=ERROR
|
||||
logging.level.org.apache.catalina=ERROR
|
||||
logging.level.org.springframework.web=ERROR
|
||||
logging.level.org.hibernate=ERROR
|
||||
logging.file.path=/var/log/hirs
|
||||
logging.file.name=hirs.spring.log
|
||||
logging.file.name=HIRS_AttestationCA_Portal.log
|
||||
|
||||
# Database Config
|
||||
spring.jpa.hibernate.ddl-auto=update
|
||||
jakarta.persistence.sharedCache.mode = UNSPECIFIED
|
||||
spring.datasource.driver-class-name=org.mariadb.jdbc.Driver
|
||||
#spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
|
||||
#spring.datasource.driverClassName=com.mysql.cj.jdbc.Driver
|
||||
aca.certificates.validity = 3652
|
||||
|
||||
# Tomcat Config
|
||||
server.tomcat.additional-tld-skip-patterns=jakarta.persistence-api*.jar, jakarta.xml.bind-api*.jar, txw2*.jar, *commons*.jar, *annotations*.jar, *checker*.jar, *lombok*.jar, *jsr*.jar, *guava*.jar, *access*.jar, *activation*.jar, *bcprov*.jar, *bcmail*.jar, *bcutil*.jar, *bcpkix*.jar, *json*.jar
|
||||
server.tomcat.basedir=/opt/embeddedtomcat
|
||||
@ -37,16 +35,6 @@ server.ssl.key-store-type=JKS
|
||||
server.ssl.key-store=/etc/hirs/certificates/HIRS/KeyStore.jks
|
||||
server.ssl.key-alias=hirs_aca_tls_rsa_3k_sha384
|
||||
|
||||
#--server.ssl.key-store-password=123456
|
||||
#--server.ssl.trust-store-password=123456
|
||||
# ACA specific default properties
|
||||
aca.certificates.validity = 3652
|
||||
|
||||
#jdbc.driverClassName = com.mysql.cj.jdbc.Driver
|
||||
#jdbc.url = jdbc:mysql://localhost:3306/hirs_db?autoReconnect=true&useSSL=false
|
||||
#jdbc.username = root
|
||||
#jdbc.password = hirspass
|
||||
#entitymanager.packagesToScan: hirs.attestationca.portal.page.controllers
|
||||
#spring.jpa.hibernate.ddl-auto=update
|
||||
#spring.jpa.show-sql=true
|
||||
|
||||
# DB dfault password.
|
||||
#spring.datasource.password=hirs_db
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
|
||||
# Logging Config (tomcat may have further config)
|
||||
logging.level.org.springframework=TRACE
|
||||
logging.level.org.apache.catalina=TRACE
|
||||
logging.level.org.springframework.web=TRACE
|
||||
logging.level.org.springframework=ERROR
|
||||
logging.level.org.apache.catalina=ERROR
|
||||
logging.level.org.springframework.web=ERROR
|
||||
logging.level.org.hibernate=ERROR
|
||||
logging.file.path=C:/ProgramData/hirs/log
|
||||
logging.file.name=hirs.spring.log
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
<PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss} [%C.%M] %-5p : %m%n"/>
|
||||
</Console>
|
||||
<RollingFile name="FILE" fileName="/var/log/hirs/HIRS_AttestationCA_Portal.log"
|
||||
filePattern="./logs/HIRS_AttestationCA_Portal.log-%d{yyyy-MM-dd}-%i.log" >
|
||||
filePattern="/var/log/hirs/HIRS_AttestationCA_Portal-%d{yyyy-MM-dd}-%i.log" >
|
||||
<PatternLayout>
|
||||
<pattern>%d{yyyy-MM-dd HH:mm:ss} [%C.%M] %-5p : %m%n</pattern>
|
||||
</PatternLayout>
|
||||
@ -18,18 +18,18 @@
|
||||
<DefaultRolloverStrategy max="10"/>
|
||||
</RollingFile>
|
||||
</Appenders>
|
||||
<Loggers>
|
||||
<Root level = "WARN">
|
||||
<AppenderRef ref="STDOUT" level="WARN" />
|
||||
<Loggers>
|
||||
<Root level = "ERROR">
|
||||
<AppenderRef ref="STDOUT" level="ERROR" />
|
||||
<AppenderRef ref="FILE"/>
|
||||
</Root>
|
||||
<SpringProfile name="!development, !production">
|
||||
<Logger name="hirs.attestationca" level="trace" />
|
||||
<Logger name="hirs.attestationca" level="info" />
|
||||
</SpringProfile>
|
||||
<Logger name="org.hibernate" level="DEBUG" />
|
||||
<Logger name="org.hibernate" level="ERROR" />
|
||||
</Loggers>
|
||||
<!-- prevents an out-of-memory exception caused by the debug logging of very large inserts -->
|
||||
<category name="org.hibernate.event.def.AbstractFlushingEventListener">
|
||||
<priority value="INFO"/>
|
||||
<priority value="ERROR"/>
|
||||
</category>
|
||||
</Configuration>
|
||||
@ -87,7 +87,7 @@ if [ $ALG = "RSA" ]; then
|
||||
ALIAS="hirs_aca_tls_ecc_512_sha384"
|
||||
fi
|
||||
|
||||
check_for_container
|
||||
check_systemd
|
||||
start_mysqlsd
|
||||
|
||||
if [ ! -d "$CERT_PATH" ]; then
|
||||
@ -122,15 +122,15 @@ keyStore="$CLIENT_DB_P12" "
|
||||
WEB_TLS_PARAMS="--server.ssl.key-store-password=$hirs_pki_password \
|
||||
--server.ssl.trust-store-password=$hirs_pki_password"
|
||||
|
||||
# uncomment to show spring boot and hibernate properties used as gradle argumanets
|
||||
# uncomment to show spring boot and hibernate properties used as gradle arguments
|
||||
#echo "--args=\"$CONNECTOR_PARAMS $WEB_TLS_PARAMS\""
|
||||
|
||||
if [ -z "$USE_WAR" ]; then
|
||||
echo "Booting the ACA from local build..."
|
||||
# ./gradlew bootRun --args="$CONNECTOR_PARAMS$WEB_TLS_PARAMS"
|
||||
./gradlew bootRun --args="--spring.config.location=$SPRING_PROP_FILE"
|
||||
else
|
||||
# ./gradlew bootRun --args="$CONNECTOR_PARAMS$WEB_TLS_PARAMS"
|
||||
./gradlew bootRun --args="--spring.config.location=$SPRING_PROP_FILE"
|
||||
else
|
||||
echo "Booting the ACA from a war file..."
|
||||
# java -jar $WAR_PATH $CONNECTOR_PARAMS$WEB_TLS_PARAMS &
|
||||
java -jar $WAR_PATH --spring.config.location=$SPRING_PROP_FILE
|
||||
java -jar $WAR_PATH --spring.config.location=$SPRING_PROP_FILE & disown -h
|
||||
fi
|
||||
@ -5,6 +5,7 @@
|
||||
############################################################################################
|
||||
|
||||
SCRIPT_DIR=$( dirname -- "$( readlink -f -- "$0"; )"; )
|
||||
|
||||
LOG_FILE=/dev/null
|
||||
CERT_PATH="/etc/hirs/certificates/HIRS/"
|
||||
RSA_PATH=rsa_3k_sha384_certs
|
||||
@ -83,8 +84,11 @@ echo "Checking HIRS ACA Setup on this device..."
|
||||
elif [ $ID = 'ubuntu' ]; then
|
||||
echo "Ubuntu distro detected"
|
||||
dpkg -l "hirs-attestationca" > /dev/null
|
||||
elif [ $ID = 'rocky' ]; then
|
||||
echo "Rocky distro detected"
|
||||
rpm -q --quiet HIRS_AttestationCA
|
||||
else
|
||||
echo "Unsupported OS Distro encountered"
|
||||
echo "$ID OS distro encountered"
|
||||
fi
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "HIRS ACA was installed via an OS package on this device"
|
||||
@ -97,12 +101,14 @@ echo "Checking HIRS ACA Setup on this device..."
|
||||
echo "HIRS ACA was NOT installed via an OS package on this device"
|
||||
fi
|
||||
|
||||
check_systemd -p
|
||||
|
||||
# Check install setup pki files
|
||||
if [ ! -d $CERT_PATH ]; then
|
||||
check_db_cleared
|
||||
echo " $CERT_PATH directory does not exist."
|
||||
echo " Exiting..."
|
||||
echo "Please run aca_setup.sh and try again"
|
||||
echo "Please run aca_setup.sh or dnf/apt-get install HIRS_AttestationCA* and try again."
|
||||
exit 1;
|
||||
fi
|
||||
|
||||
@ -150,6 +156,12 @@ check_mysql_setup () {
|
||||
fi
|
||||
|
||||
if [ ! -z $mysql_admin_password ]; then
|
||||
mysql -u root --password=$mysql_admin_password -e "STATUS;" &> /dev/null
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Mysql Root password verified"
|
||||
else
|
||||
echo "Mysql Root password verification failed!"
|
||||
fi
|
||||
if [ ! -z "${ARG_VERBOSE}" ]; then
|
||||
echo "Mysql status:"
|
||||
mysql -u root --password=$mysql_admin_password -e "STATUS;"
|
||||
@ -170,7 +182,7 @@ check_cert () {
|
||||
ALL_CERTS_PASSED=false
|
||||
fi
|
||||
if [ ! -z "${ARG_VERBOSE}" ]; then
|
||||
echo " "$RESULT
|
||||
echo " "$RESULTACA_PROP_FILE
|
||||
fi
|
||||
}
|
||||
|
||||
@ -232,7 +244,7 @@ check_db () {
|
||||
if [ "$RESULT" == "YES" ]; then
|
||||
echo " Mysql Server side TLS is enabled:"
|
||||
else
|
||||
echo " Mysql Sever side TLS is NOT enabled:"
|
||||
echo " Mysql Server side TLS is NOT enabled:"
|
||||
ALL_CHECKS_PASSED=false
|
||||
fi
|
||||
|
||||
@ -258,7 +270,6 @@ check_db () {
|
||||
echo "MYSQL Log:"
|
||||
mysql -u root --password=$mysql_admin_password -e "SHOW GLOBAL VARIABLES LIKE 'log_error'"
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
# Check selinux status and files that require specific contexts
|
||||
@ -267,32 +278,36 @@ check_selinux () {
|
||||
echo "Skipping selinux check on ubuntu"
|
||||
return
|
||||
fi
|
||||
SELINUXSTATUS=$(getenforce)
|
||||
DB_SRV_CONTEXT=$(ls -Z $DB_SRV_CONF)
|
||||
DB_CLIENT_CONTEXT=$(ls -Z $DB_CLIENT_CONF)
|
||||
echo "Checking device selinux status..."
|
||||
if [[ "$SELINUXSTATUS" == *"Enforcing"* ]]; then
|
||||
echo " Selinux is in Enforcing mode."
|
||||
if [[ "$DB_SRV_CONTEXT" == *"mysqld_etc_t"* && "$DB_CLIENT_CONTEXT" == *"mysqld_etc_t"* ]]; then
|
||||
command -v setenforce >> /dev/null
|
||||
if [ $? -eq 0 ]; then
|
||||
SELINUXSTATUS=$(getenforce)
|
||||
DB_SRV_CONTEXT=$(ls -Z $DB_SRV_CONF)
|
||||
DB_CLIENT_CONTEXT=$(ls -Z $DB_CLIENT_CONF)
|
||||
echo "Checking device selinux status..."
|
||||
if [[ "$SELINUXSTATUS" == *"Enforcing"* ]]; then
|
||||
echo " Selinux is in Enforcing mode."
|
||||
if [[ "$DB_SRV_CONTEXT" == *"mysqld_etc_t"* && "$DB_CLIENT_CONTEXT" == *"mysqld_etc_t"* ]]; then
|
||||
echo " Selinux status is $SELINUXSTATUS and both $DB_SRV_CONF and $DB_CLIENT_CONF contexts are correct"
|
||||
elif [[ "$DB_CLIENT_CONTEXT" == *"mysqld_etc_t"* ]]; then
|
||||
echo " Selinux status is $SELINUXSTATUS and $DB_CLIENT_CONF context is incorrect: $DB_CLIENT_CONTEXT"
|
||||
ALL_CHECKS_PASSED=false
|
||||
elif [[ "$DB_CLIENT_CONTEXT" == *"mysqld_etc_t"* ]]; then
|
||||
echo " Selinux status is $SELINUXSTATUS and $DB_CLIENT_CONF context is incorrect: $DB_CLIENT_CONTEXT"
|
||||
ALL_CHECKS_PASSED=false
|
||||
else
|
||||
echo " Selinux status is $SELINUXSTATUS and $DB_SRV_CONF context is incorrect: $DB_SRV_CONTEXT"
|
||||
ALL_CHECKS_PASSED=false
|
||||
fi
|
||||
else
|
||||
else
|
||||
echo " Selinux is in NOT in Enforcing mode."
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
check_fips () {
|
||||
echo "Checking FIPS mode on this device..."
|
||||
echo " "$(sysctl -a | grep crypto.fips_enabled)
|
||||
fips=$(sysctl -a 2>&1 | grep crypto.fips_enabled)
|
||||
echo " "$fips
|
||||
}
|
||||
# Run Checks
|
||||
check_for_container -p
|
||||
|
||||
check_pwds
|
||||
check_pki
|
||||
check_mysql_setup
|
||||
@ -8,16 +8,28 @@
|
||||
|
||||
SCRIPT_DIR=$( dirname -- "$( readlink -f -- "$0"; )"; )
|
||||
LOG_FILE=/dev/null
|
||||
|
||||
LOG_DIR="/var/log/hirs/"
|
||||
# Check for Admin privileges
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "This script requires root. ACA setup not removed. Please run as root."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -d "/etc/hirs" ]; then
|
||||
echo "/etc/hirs does not exist, aborting removal."
|
||||
exit 1
|
||||
fi
|
||||
if [ ! -d "/opt/hirs" ]; then
|
||||
echo "/opt/hirs does not exist, aborting removal."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
source $SCRIPT_DIR/../db/mysql_util.sh
|
||||
|
||||
# Make sure myswl root password is available and set $DB_ADIM_PWD before continuing...
|
||||
# Make sure mysql root password is available before continuing...
|
||||
check_mariadb_install
|
||||
|
||||
check_mysql_root
|
||||
|
||||
# remove the hrs-db and hirs_db user
|
||||
@ -27,8 +39,19 @@ popd &>/dev/null
|
||||
|
||||
# remove pki files and config files if not installed by rpm
|
||||
echo "Removing certificates and config files..."
|
||||
if [ ! -d /opt/hirs/aca ]; then
|
||||
rm -rf /etc/hirs
|
||||
|
||||
# Remove /opt/hirs only if not configured by a package based install:
|
||||
if [ -f /opt/hirs/aca/VERSION ]; then
|
||||
if [ -d "/etc/hirs" ]; then
|
||||
rm -rf /etc/hirs >/dev/null 2>&1
|
||||
fi
|
||||
if [ -d "/opt/hirs" ]; then
|
||||
rm -rf /opt/hirs >/dev/null 2>&1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -d $LOG_DIR ]; then
|
||||
rm -rf $LOG_DIR;
|
||||
fi
|
||||
|
||||
# Remove crontab and current ACA process
|
||||
@ -2,7 +2,7 @@
|
||||
#####################################################################################
|
||||
#
|
||||
# Script to create ACA setup files and configure the hirs_db database.
|
||||
#
|
||||
#
|
||||
#
|
||||
#####################################################################################
|
||||
# Capture location of the script to allow from invocation from any location
|
||||
@ -31,8 +31,6 @@ help () {
|
||||
}
|
||||
|
||||
# Process parameters Argument handling
|
||||
POSITIONAL_ARGS=()
|
||||
ORIGINAL_ARGS=("$@")
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case $1 in
|
||||
-sd|--skip-db)
|
||||
@ -59,13 +57,23 @@ while [[ $# -gt 0 ]]; do
|
||||
;;
|
||||
*)
|
||||
POSITIONAL_ARGS+=("$1") # save positional arg
|
||||
# shift # past argument
|
||||
# shift # past argumfrom 'build/VERSION'ent
|
||||
break
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters
|
||||
# Check for existing installation folders and exist if found
|
||||
if [ -z $ARG_UNATTEND ]; then
|
||||
if [ -d "/etc/hirs" ]; then
|
||||
echo "/etc/hirs exists, aborting install."
|
||||
exit 1
|
||||
fi
|
||||
if [ -d "/opt/hirs" ]; then
|
||||
echo "/opt/hirs exists, aborting install."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
mkdir -p $HIRS_CONF_DIR $LOG_DIR $HIRS_JSON_DIR $ACA_OPT_DIR
|
||||
touch "$LOG_FILE"
|
||||
@ -88,8 +96,10 @@ fi
|
||||
echo "HIRS ACA Setup initiated on $(date +%Y-%m-%d)" >> "$LOG_FILE"
|
||||
|
||||
# Create a version file for bootRun to use
|
||||
jarVersion=$(cat '../../../VERSION').$(date +%s).$(git rev-parse --short HEAD)
|
||||
echo $jarVersion > $ACA_VERSION_FILE
|
||||
if command -v git ; then
|
||||
jarVersion=$(cat '../../../VERSION').$(date +%s).$(git rev-parse --short HEAD)
|
||||
echo $jarVersion > $ACA_VERSION_FILE
|
||||
fi
|
||||
|
||||
# Set HIRS PKI password
|
||||
if [ -z $HIRS_PKI_PWD ]; then
|
||||
@ -34,8 +34,8 @@ SSL_DB_CLIENT_KEY="/etc/hirs/certificates/HIRS/rsa_3k_sha384_certs/HIRS_db_clien
|
||||
mkdir -p /etc/hirs/aca/
|
||||
mkdir -p /var/log/hirs/
|
||||
|
||||
source $ACA_PROP_FILE
|
||||
source $SCRIPT_DIR/mysql_util.sh
|
||||
source $ACA_PROP_FILE
|
||||
source /etc/os-release
|
||||
|
||||
# Setup distro specifc paths and variables
|
||||
@ -60,7 +60,6 @@ check_mysql_root_pwd () {
|
||||
if [ -z "$HIRS_MYSQL_ROOT_PWD" ]; then
|
||||
# Check if property file exists and look for properties
|
||||
if [ -f $ACA_PROP_FILE ]; then
|
||||
echo "Found existing aca.properties, using existing variables..."
|
||||
source $ACA_PROP_FILE
|
||||
if [ ! -z $hirs_pki_password ]; then PKI_PASS=$hirs_pki_password; fi
|
||||
if [ ! -z $mysql_admin_password ]; then HIRS_MYSQL_ROOT_PWD=$mysql_admin_password; fi
|
||||
@ -91,6 +90,7 @@ check_mysql_root_pwd () {
|
||||
DB_ADMIN_PWD=$HIRS_MYSQL_ROOT_PWD
|
||||
echo "Using system variable supplied password" | tee -a "$LOG_FILE"
|
||||
fi
|
||||
|
||||
# Make sure root password is correct
|
||||
$(mysql -u root -p$DB_ADMIN_PWD -e 'quit' &> /dev/null);
|
||||
if [ $? -eq 0 ]; then
|
||||
@ -114,12 +114,15 @@ set_mysql_server_tls () {
|
||||
# Make sure mysql can access them
|
||||
chown mysql:mysql $SSL_DB_SRV_CHAIN $SSL_DB_SRV_CERT $SSL_DB_SRV_KEY
|
||||
# Make selinux contexts for config files, if selinux is enabled
|
||||
if [ $ID = "rhel" ]; then
|
||||
selinuxenabled
|
||||
if [[ $ID = "rhel" ]] || [[ $ID = "rocky" ]] ||[[ $ID = "fedora" ]]; then
|
||||
command -v selinuxenabled > /dev/null
|
||||
if [ $? -eq 0 ]; then
|
||||
semanage fcontext -a -t mysqld_etc_t $DB_SRV_CONF > /dev/null #adds the context type to file
|
||||
restorecon -v -F $DB_SRV_CONF > /dev/null # changes the file's context type
|
||||
fi
|
||||
selinuxenabled
|
||||
if [ $? -eq 0 ]; then
|
||||
#semanage fcontext -a -t mysqld_etc_t $DB_SRV_CONF > /dev/null #adds the context type to file
|
||||
restorecon -v -F $DB_SRV_CONF > /dev/null # changes the file's context type
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
else
|
||||
echo "mysql.cnf contians existing entry for ssl, skipping..." | tee -a "$LOG_FILE"
|
||||
@ -135,13 +138,16 @@ if [[ $(cat "$DB_CLIENT_CONF" | grep -c "HIRS") < 1 ]]; then
|
||||
echo "ssl_key=$SSL_DB_CLIENT_KEY" >> $DB_CLIENT_CONF
|
||||
chown mysql:mysql $SSL_DB_CLIENT_CHAIN $SSL_DB_CLIENT_CERT $SSL_DB_CLIENT_KEY
|
||||
# Make selinux contexts for config files, if selinux is enabled
|
||||
if [ $ID = "rhel" ]; then
|
||||
selinuxenabled
|
||||
if [[ $ID = "rhel" ]] || [[ $ID = "rocky" ]] ||[[ $ID = "fedora" ]]; then
|
||||
command -v selinuxenabled > /dev/null
|
||||
if [ $? -eq 0 ]; then
|
||||
semanage fcontext -a -t mysqld_etc_t $DB_CLIENT_CONFf > /dev/null #adds the context type to file
|
||||
selinuxenabled
|
||||
if [ $? -eq 0 ]; then
|
||||
#semanage fcontext -a -t mysqld_etc_t $DB_CLIENT_CONF > /dev/null #adds the context type to file
|
||||
restorecon -F $DB_CLIENT_CONF > /dev/null #changes the file's context type
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
@ -158,25 +164,31 @@ set_hirs_db_pwd () {
|
||||
if [ -z $HIRS_DB_PWD ]; then
|
||||
HIRS_DB_PWD=$(head -c 64 /dev/urandom | md5sum | tr -dc 'a-zA-Z0-9')
|
||||
fi
|
||||
|
||||
echo "hirs_db_username=hirs_db" >> $ACA_PROP_FILE
|
||||
echo "hirs_db_password=$HIRS_DB_PWD" >> $ACA_PROP_FILE
|
||||
echo "hibernate.connection.username=hirs_db" >> $SPRING_PROP_FILE
|
||||
echo "hibernate.connection.password=$HIRS_DB_PWD" >> $SPRING_PROP_FILE
|
||||
# Add key/values only if they dont exist
|
||||
if [[ $(grep -c "hirs_db_username" $ACA_PROP_FILE) -eq 0 ]]; then
|
||||
echo "hirs_db_username=hirs_db" >> $ACA_PROP_FILE
|
||||
fi
|
||||
if [[ $(grep -c "hirs_db_password" $ACA_PROP_FILE) -eq 0 ]]; then
|
||||
echo "hirs_db_password=$HIRS_DB_PWD" >> $ACA_PROP_FILE
|
||||
fi
|
||||
if [[ $(grep -c "hibernate.connection.username" $SPRING_PROP_FILE) -eq 0 ]]; then
|
||||
echo "hibernate.connection.username=hirs_db" >> $SPRING_PROP_FILE
|
||||
fi
|
||||
if [[ $(grep -c "hibernate.connection.password" $SPRING_PROP_FILE) -eq 0 ]]; then
|
||||
echo "hibernate.connection.password=$HIRS_DB_PWD" >> $SPRING_PROP_FILE
|
||||
fi
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
# Create a hirs_db with client side TLS enabled
|
||||
create_hirs_db_with_tls () {
|
||||
# Check if hirs_db not created and create it if it wasn't
|
||||
mysqlshow --user=root --password="$DB_ADMIN_PWD" | grep "hirs_db" > /dev/null 2>&1
|
||||
mysqlshow --user=root --password="$DB_ADMIN_PWD" | grep "hirs_db" >> $LOG_FILE 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "hirs_db exists, skipping hirs_db create"
|
||||
else
|
||||
mysql -u root --password=$DB_ADMIN_PWD < $MYSQL_DIR/db_create.sql
|
||||
mysql -u root --password=$DB_ADMIN_PWD < $MYSQL_DIR/secure_mysql.sql
|
||||
# mysql -u root --password=$DB_ADMIN_PWD -e "ALTER USER 'hirs_db'@'localhost' IDENTIFIED BY '"$HIRS_DB_PWD"'; FLUSH PRIVILEGES;";
|
||||
mysql -u root --password=$DB_ADMIN_PWD -e "SET PASSWORD FOR 'hirs_db'@'localhost' = PASSWORD('"$HIRS_DB_PWD"'); FLUSH PRIVILEGES;";
|
||||
fi
|
||||
}
|
||||
@ -207,18 +219,22 @@ keyStoreType=PKCS12&\
|
||||
keyStorePassword=$PKI_PASS&\
|
||||
keyStore="$CLIENT_DB_P12" "
|
||||
|
||||
echo $CONNECTOR_URL >> $SPRING_PROP_FILE
|
||||
if [[ $(grep -c "hibernate.connection.url" $SPRING_PROP_FILE) -eq 0 ]]; then
|
||||
echo $CONNECTOR_URL >> $SPRING_PROP_FILE
|
||||
fi
|
||||
|
||||
}
|
||||
# HIRS ACA Mysqld processing ...
|
||||
check_systemd -p
|
||||
check_mariadb_install
|
||||
check_for_container -p
|
||||
set_mysql_server_tls
|
||||
set_mysql_client_tls
|
||||
|
||||
start_mysqlsd
|
||||
check_mysql
|
||||
check_mysql_root_pwd
|
||||
clear_hirs_user
|
||||
set_hirs_db_pwd
|
||||
set_mysql_server_tls
|
||||
set_mysql_client_tls
|
||||
create_hirs_db_with_tls
|
||||
create_hibernate_url "RSA" "hirs_db"
|
||||
mysqld_reboot
|
||||
@ -10,6 +10,8 @@ DB_ADMIN_PWD=$1
|
||||
source $SCRIPT_DIR/mysql_util.sh
|
||||
source /etc/os-release
|
||||
|
||||
check_systemd
|
||||
|
||||
# Check for sudo or root user, not actually needed but a good idea
|
||||
if [ "$EUID" -ne 0 ]
|
||||
then echo "This script requires root. Please run as root"
|
||||
@ -30,14 +32,11 @@ fi
|
||||
|
||||
echo "dropping hirs_db database"
|
||||
|
||||
if pgrep mysqld >/dev/null 2>&1; then
|
||||
mysql -u root --password=$DB_ADMIN_PWD -e "FLUSH HOSTS; FLUSH LOGS; FLUSH STATUS; FLUSH PRIVILEGES; FLUSH USER_RESOURCES"
|
||||
mysql -u root --password=$DB_ADMIN_PWD -e "DROP USER 'hirs_db'@'localhost';"
|
||||
mysql -u root --password=$DB_ADMIN_PWD -e "DROP DATABASE IF EXISTS hirs_db;"
|
||||
echo "hirs_db database and hirs_db user removed"
|
||||
else
|
||||
echo "mysql is not running. DB was not removed."
|
||||
fi
|
||||
mysql -u root --password=$DB_ADMIN_PWD -e "FLUSH HOSTS; FLUSH LOGS; FLUSH STATUS; FLUSH PRIVILEGES; FLUSH USER_RESOURCES"
|
||||
mysql -u root --password=$DB_ADMIN_PWD -e "DROP USER 'hirs_db'@'localhost';"
|
||||
mysql -u root --password=$DB_ADMIN_PWD -e "DROP DATABASE IF EXISTS hirs_db;"
|
||||
echo "hirs_db database and hirs_db user removed"
|
||||
|
||||
|
||||
# reset the mysql root if the password was left in the properties fiel
|
||||
if [ ! -z $DB_ADMIN_PWD ]; then
|
||||
@ -56,7 +55,5 @@ grep -v "hirs" $DB_CLIENT_CONF > tmpfile && mv tmpfile $DB_CLIENT_CONF
|
||||
|
||||
echo "restarting mariadb"
|
||||
|
||||
mysql -u root -e "SHUTDOWN"
|
||||
sleep 2
|
||||
check_for_container
|
||||
start_mysqlsd
|
||||
mysqld_reboot
|
||||
|
||||
236
package/linux/db/mysql_util.sh
Executable file
236
package/linux/db/mysql_util.sh
Executable file
@ -0,0 +1,236 @@
|
||||
#!/bin/bash
|
||||
#####################################################################################
|
||||
#
|
||||
# Functions to check mysql and start if not running.
|
||||
# Also a function for checking if running in a container
|
||||
#
|
||||
#####################################################################################
|
||||
SQL_SERVICE="mariadb"
|
||||
|
||||
# Checks to see if systemctl is available
|
||||
# -p to print status
|
||||
check_systemd () {
|
||||
DB_SERVICE=false
|
||||
PRINT_STATUS=$1
|
||||
# Check if systemctl is present (not present in a Docker container)
|
||||
if [[ $(ps --no-headers -o comm 1) == "systemd" ]]; then
|
||||
systemctl is-active --quiet mariadb
|
||||
if [[ $? -eq 0 ]]; then
|
||||
DB_SERVICE=true
|
||||
fi
|
||||
fi
|
||||
if [[ $PRINT_STATUS == "-p" ]] && [[ $DB_SERVICE == "true" ]]; then echo "Systemd:MariaDB service is available" | tee -a "$LOG_FILE"; fi
|
||||
if [[ $PRINT_STATUS == "-p" ]] && [[ $DB_SERVICE == "false" ]]; then echo "Systemd:MariaDB service is NOT available" | tee -a "$LOG_FILE"; fi
|
||||
if [ -d /opt/hirs/aca/scripts/db ]; then
|
||||
MYSQL_DIR="/opt/hirs/aca/scripts/db"
|
||||
else
|
||||
MYSQL_DIR="$SCRIPT_DIR/../db"
|
||||
fi
|
||||
}
|
||||
|
||||
# Check for mysql command line
|
||||
check_mariadb_install () {
|
||||
type mysql >/dev/null 2>&1 && installed=true || installed=false
|
||||
if [ $installed = true ]; then
|
||||
echo "mysql has been installed"
|
||||
else
|
||||
echo "mysql has NOT been installed, aborting install"
|
||||
exit 1;
|
||||
fi
|
||||
}
|
||||
# Starts mariadb during intial install
|
||||
start_mysqlsd () {
|
||||
PRINT_STATUS=$1
|
||||
PROCESS="mysqld"
|
||||
source /etc/os-release
|
||||
if [ $ID = "ubuntu" ]; then
|
||||
PROCESS="mariadb"
|
||||
fi
|
||||
# Make sure log file has correct permissions
|
||||
chown -R mysql:mysql /var/lib/mysql/ >> "$LOG_FILE"
|
||||
if [ $DB_SERVICE = true ]; then
|
||||
systemctl is-active --quiet mariadb
|
||||
if [[ $? -ne 0 ]]; then
|
||||
echo "mariadb service not running , attempting to restart"
|
||||
systemctl start mariadb >> "$LOG_FILE";
|
||||
sleep 2
|
||||
fi
|
||||
else # Not using Systemd
|
||||
# Check if mysql is already running, if not initialize
|
||||
if [[ $(pgrep -c $PROCESS) -eq 0 ]]; then
|
||||
# Check if mariadb is setup
|
||||
if [ ! -d "/var/lib/mysql/mysql/" ]; then
|
||||
echo "Installing mariadb" | tee -a "$LOG_FILE";
|
||||
/usr/bin/mysql_install_db >> "$LOG_FILE"
|
||||
chown -R mysql:mysql /var/log/mariadb/
|
||||
fi
|
||||
if [[ $PRINT_STATUS == "-p" ]]; then echo "Starting mysql..."; fi
|
||||
/usr/bin/mysqld_safe --skip-syslog >> "$LOG_FILE" &
|
||||
chown -R mysql:mysql /var/lib/mysql/ >> "$LOG_FILE"
|
||||
echo "Attempting to start mariadb process..." | tee -a "$LOG_FILE";
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Basic check for marai db status, attempts restart if not running
|
||||
check_mysql () {
|
||||
PROCESS="mysqld"
|
||||
source /etc/os-release
|
||||
if [ $ID = "ubuntu" ]; then
|
||||
PROCESS="mariadb"
|
||||
fi
|
||||
|
||||
echo "Checking mysqld status..."
|
||||
if [ $DB_SERVICE = true ]; then
|
||||
systemctl is-active --quiet mariadb
|
||||
if [[ $? -ne 0 ]]; then
|
||||
echo "mariadb service not running , attempting to restart"
|
||||
systemctl start mariadb
|
||||
fi
|
||||
else # No systemctl
|
||||
if [[ $(pgrep -c $PROCESS ) -eq 0 ]]; then
|
||||
echo "mariadb process not running , attempting to restart"
|
||||
chown mysql:mysql /var/log/mariadb/mariadb.log >> "$LOG_FILE";
|
||||
/usr/bin/mysqld_safe --skip-syslog >> "$LOG_FILE" &
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ $DB_SERVICE = true ]; then
|
||||
systemctl is-active --quiet mariadb
|
||||
if [[ $? -eq 0 ]]; then
|
||||
echo "mariadb service started" | tee -a "$LOG_FILE";
|
||||
fi
|
||||
else
|
||||
# Wait for mysql to start before continuing.
|
||||
count=1;
|
||||
if [[ $PRINT_STATUS == "-p" ]]; then echo "Testing mysqld connection..."| tee -a "$LOG_FILE"; fi
|
||||
until mysqladmin ping -h "localhost" --silent ; do
|
||||
((count++))
|
||||
if [[ $count -gt 20 ]]; then
|
||||
break;
|
||||
fi
|
||||
sleep 1;
|
||||
done
|
||||
if [[ $count -gt 20 ]]; then
|
||||
echo "Timed out waiting for Mariadb to respond" | tee -a "$LOG_FILE";
|
||||
exit 1;
|
||||
else
|
||||
echo "Mariadb started" | tee -a "$LOG_FILE";
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Check for mysql root password , abort if not available
|
||||
check_mysql_root () {
|
||||
if [ -z $HIRS_MYSQL_ROOT_PWD ]; then
|
||||
if [ ! -f /etc/hirs/aca/aca.properties ]; then
|
||||
echo "aca.properties does not exist." | tee -a "$LOG_FILE";
|
||||
else
|
||||
source /etc/hirs/aca/aca.properties;
|
||||
DB_ADMIN_PWD=$mysql_admin_password
|
||||
fi
|
||||
else #HIRS_MYSQL_ROOT_PWD set
|
||||
DB_ADMIN_PWD=$HIRS_MYSQL_ROOT_PWD
|
||||
fi
|
||||
|
||||
# Allow user to enter password if not using env variabel or file
|
||||
if [ -z $DB_ADMIN_PWD ]; then
|
||||
read -p "Enter mysql root password" DB_ADMIN_PWD
|
||||
else
|
||||
DB_ADMIN_PWD=$mysql_admin_password
|
||||
fi
|
||||
|
||||
# Make sure root password is correct
|
||||
$(mysql -u root -p$DB_ADMIN_PWD -e 'quit' &> /dev/null);
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "root password verified" | tee -a "$LOG_FILE"
|
||||
else
|
||||
echo "MYSQL root password was not the default, not supplied, or was incorrect"
|
||||
echo " please set the HIRS_MYSQL_ROOT_PWD system variable and retry."
|
||||
echo " ********** ACA Mysql setup aborted ********" ;
|
||||
exit 1;
|
||||
fi
|
||||
}
|
||||
|
||||
check_db_cleared () {
|
||||
$(mysql -u root -e 'quit' &> /dev/null);
|
||||
if [ $? -eq 0 ]; then
|
||||
echo " Empty Mysql root password verified" | tee -a "$LOG_FILE"
|
||||
else
|
||||
echo " Mysql Root password is not empty" | tee -a "$LOG_FILE";
|
||||
fi
|
||||
HIRS_DB_USER_EXISTS="$(mysql -uroot -sse "SELECT EXISTS(SELECT 1 FROM mysql.user WHERE user = 'hirs_db')")"
|
||||
if [[ $HIRS_DB_USER_EXISTS == 1 ]]; then
|
||||
echo " hirs_db user exists" | tee -a "$LOG_FILE";
|
||||
else
|
||||
echo " hirs_db user does not exist" | tee -a "$LOG_FILE";
|
||||
fi
|
||||
HIRS_DB_EXISTS=`mysql -uroot -e "SHOW DATABASES" | grep hirs_db`
|
||||
if [[ $HIRS_DB_EXISTS == "hirs_db" ]]; then
|
||||
echo " hirs_db databse exists" | tee -a "$LOG_FILE";
|
||||
else
|
||||
echo " hirs_db database does not exists" | tee -a "$LOG_FILE";
|
||||
fi
|
||||
}
|
||||
|
||||
clear_hirs_user () {
|
||||
$(mysql -u root -e 'quit' &> /dev/null);
|
||||
if [ $? -eq 0 ]; then
|
||||
HIRS_DB_USER_EXISTS="$(mysql -uroot -sse "SELECT EXISTS(SELECT 1 FROM mysql.user WHERE user = 'hirs_db')")"
|
||||
if [[ $HIRS_DB_USER_EXISTS == 1 ]]; then
|
||||
mysql -u root --password=$DB_ADMIN_PWD -e "DROP USER 'hirs_db'@'localhost';"
|
||||
echo "hirs_db user found and deleted"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
clear_hirs_db () {
|
||||
$(mysql -u root -e 'quit' &> /dev/null);
|
||||
if [ $? -eq 0 ]; then
|
||||
mysql -u root --password=$DB_ADMIN_PWD -e "DROP DATABASE IF EXISTS hirs_db;"
|
||||
fi
|
||||
}
|
||||
|
||||
wait_for_mysql () {
|
||||
echo "Waiting for Mariadb..." | tee -a "$LOG_FILE";
|
||||
count=0
|
||||
until [ "mysqladmin ping -h localhost --silent" ] || [ "$count" -gt 20 ]; do
|
||||
((count++))
|
||||
sleep 1
|
||||
done
|
||||
if [[ $count -gt 20 ]]; then
|
||||
echo "Timed out waiting for Mysqld to respond" | tee -a "$LOG_FILE";
|
||||
else
|
||||
echo "Mariadb started" | tee -a "$LOG_FILE";
|
||||
fi
|
||||
}
|
||||
|
||||
# restart maraidb
|
||||
mysqld_reboot () {
|
||||
# reboot mysql server
|
||||
PROCESS="mysqld"
|
||||
source /etc/os-release
|
||||
if [ $ID = "ubuntu" ]; then
|
||||
PROCESS="mariadb"
|
||||
fi
|
||||
echo "Restarting Mariadb ...." | tee -a "$LOG_FILE";
|
||||
if [ $DB_SERVICE = true ]; then
|
||||
echo "Shutting down and restarting mysql service" | tee -a "$LOG_FILE";
|
||||
systemctl stop mariadb >> "$LOG_FILE";
|
||||
sleep 2
|
||||
systemctl start mariadb >> "$LOG_FILE";
|
||||
else # No systemd
|
||||
echo "Shutting down and restarting mysql process" | tee -a "$LOG_FILE";
|
||||
mysql -u root --password=$DB_ADMIN_PWD -e "SHUTDOWN"
|
||||
sleep 1
|
||||
# Make sure mysql has stopped
|
||||
if [[ $(pgrep -c $PROCESS) -ne 0 ]]; then
|
||||
pkill $PROCESS
|
||||
fi
|
||||
chown mysql:mysql /var/log/mariadb/mariadb.log >> "$LOG_FILE";
|
||||
/usr/bin/mysqld_safe --skip-syslog >> "$LOG_FILE" &
|
||||
sleep 1
|
||||
check_mysql
|
||||
wait_for_mysql
|
||||
fi
|
||||
}
|
||||
@ -1,182 +0,0 @@
|
||||
#!/bin/bash
|
||||
#####################################################################################
|
||||
#
|
||||
# Functions to check mysql and start if not running.
|
||||
# Also a function for checking if running in a container
|
||||
#
|
||||
#####################################################################################
|
||||
SQL_SERVICE="mariadb"
|
||||
|
||||
# Checks to see if running in a container
|
||||
# -p to print status
|
||||
check_for_container () {
|
||||
PRINT_STATUS=$1
|
||||
# Check if we're in a Docker container
|
||||
if [[ $(cat /proc/1/cgroup | head -n 1) == *"docker"* ]] || [ -f /.dockerenv ]; then
|
||||
DOCKER_CONTAINER=true
|
||||
if [[ $PRINT_STATUS == "-p" ]]; then echo "ACA is running in a container..." | tee -a "$LOG_FILE"; fi
|
||||
else
|
||||
DOCKER_CONTAINER=false
|
||||
if [[ $PRINT_STATUS == "-p" ]]; then echo "ACA is not running in a container..." | tee -a "$LOG_FILE"; fi
|
||||
fi
|
||||
if [ -d /opt/hirs/scripts/db ]; then
|
||||
MYSQL_DIR="/opt/hirs/scripts/db"
|
||||
else
|
||||
MYSQL_DIR="$SCRIPT_DIR/../db"
|
||||
fi
|
||||
}
|
||||
|
||||
# Check for mysql command line
|
||||
check_mariadb_install () {
|
||||
type mysql >/dev/null 2>&1 && installed=true || installed=false
|
||||
if [ $installed = true ]; then
|
||||
echo "mysql has been installed"
|
||||
else
|
||||
echo "mysql has NOT been installed, aborting install"
|
||||
exit 1;
|
||||
fi
|
||||
}
|
||||
# Starts mariadb during intial install
|
||||
start_mysqlsd () {
|
||||
PRINT_STATUS=$1
|
||||
PROCESS="mysqld"
|
||||
source /etc/os-release
|
||||
if [ $ID = "ubuntu" ]; then
|
||||
PROCESS="mariadb"
|
||||
fi
|
||||
# Check if mysql is already running, if not initialize
|
||||
if [[ $(pgrep -c -u mysql $PROCESS) -eq 0 ]]; then
|
||||
# Check if running in a container
|
||||
if [ $DOCKER_CONTAINER = true ]; then
|
||||
# if in Docker container, avoid services that invoke the D-Bus
|
||||
# Check if mariadb is setup
|
||||
if [ ! -d "/var/lib/mysql/mysql/" ]; then
|
||||
echo "Installing mariadb"
|
||||
/usr/bin/mysql_install_db >> "$LOG_FILE"
|
||||
chown -R mysql:mysql /var/lib/mysql/ >> "$LOG_FILE"
|
||||
fi
|
||||
if [[ $PRINT_STATUS == "-p" ]]; then echo "Starting mysql..."; fi
|
||||
/usr/bin/mysqld_safe --skip-syslog >> "$LOG_FILE" &
|
||||
chown -R mysql:mysql /var/lib/mysql/ >> "$LOG_FILE"
|
||||
echo "Attempting to start mariadb"
|
||||
else #not a container
|
||||
systemctl enable $SQL_SERVICE & >> "$LOG_FILE";
|
||||
systemctl start $SQL_SERVICE & >> "$LOG_FILE";
|
||||
fi
|
||||
else # mysql process is running
|
||||
# check if mysql service is running
|
||||
if [ ! $DOCKER_CONTAINER = true ]; then
|
||||
DB_STATUS=$(systemctl status mysql |grep 'running' | wc -l )
|
||||
if [ $DB_STATUS -eq 0 ]; then
|
||||
echo "mariadb not running , attempting to restart"
|
||||
systemctl start mariadb >> "$LOG_FILE";
|
||||
fi
|
||||
fi # non container mysql start
|
||||
fi
|
||||
}
|
||||
|
||||
# Basic check for maria db status, attempts restart if not running
|
||||
check_mysql () {
|
||||
PROCESS="mysqld"
|
||||
source /etc/os-release
|
||||
if [ $ID = "ubuntu" ]; then
|
||||
PROCESS="mariadb"
|
||||
fi
|
||||
|
||||
echo "Checking mysqld status..."
|
||||
if [ $DOCKER_CONTAINER = true ]; then
|
||||
if [[ $(pgrep -c -u mysql $PROCESS ) -eq 0 ]]; then
|
||||
echo "mariadb not running , attempting to restart"
|
||||
chown mysql:mysql /var/log/mariadb/mariadb.log >> "$LOG_FILE";
|
||||
/usr/bin/mysqld_safe --skip-syslog >> "$LOG_FILE" &
|
||||
fi
|
||||
else # not in a container
|
||||
DB_STATUS=$(systemctl status mysql |grep 'running' | wc -l )
|
||||
if [ $DB_STATUS -eq 0 ]; then
|
||||
echo "mariadb not running , attempting to restart"
|
||||
systemctl start mariadb
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
# Wait for mysql to start before continuing.
|
||||
count=1;
|
||||
if [[ $PRINT_STATUS == "-p" ]]; then echo "Testing mysqld connection..."| tee -a "$LOG_FILE"; fi
|
||||
|
||||
until mysqladmin ping -h "localhost" --silent ; do
|
||||
((count++))
|
||||
if [[ $count -gt 20 ]]; then
|
||||
break;
|
||||
fi
|
||||
sleep 1;
|
||||
done
|
||||
if [[ $count -gt 20 ]]; then
|
||||
echo "Timed out waiting for Mariadb to respond"
|
||||
exit 1;
|
||||
else
|
||||
echo "Mariadb started"
|
||||
fi
|
||||
}
|
||||
|
||||
# Check for mysql root password, abort if not available
|
||||
check_mysql_root () {
|
||||
if [ -z $HIRS_MYSQL_ROOT_PWD ]; then
|
||||
if [ ! -f /etc/hirs/aca/aca.properties ]; then
|
||||
echo "aca.properties does not exist."
|
||||
else
|
||||
source /etc/hirs/aca/aca.properties;
|
||||
DB_ADMIN_PWD=$mysql_admin_password
|
||||
fi
|
||||
else #HIRS_MYSQL_ROOT_PWD set
|
||||
DB_ADMIN_PWD=$HIRS_MYSQL_ROOT_PWD
|
||||
fi
|
||||
|
||||
# Allow user to enter password if not using env variable or file
|
||||
if [ -z $DB_ADMIN_PWD ]; then
|
||||
read -p "Enter mysql root password" DB_ADMIN_PWD
|
||||
else
|
||||
DB_ADMIN_PWD=$mysql_admin_password
|
||||
fi
|
||||
|
||||
# Make sure root password is correct
|
||||
$(mysql -u root -p$DB_ADMIN_PWD -e 'quit' &> /dev/null);
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "root password verified" | tee -a "$LOG_FILE"
|
||||
else
|
||||
echo "MYSQL root password was not the default, not supplied, or was incorrect"
|
||||
echo " please set the HIRS_MYSQL_ROOT_PWD system variable and retry."
|
||||
echo " ********** ACA Mysql setup aborted ********" ;
|
||||
exit 1;
|
||||
fi
|
||||
}
|
||||
|
||||
check_db_cleared () {
|
||||
$(mysql -u root -e 'quit' &> /dev/null);
|
||||
if [ $? -eq 0 ]; then
|
||||
echo " Empty root password verified" | tee -a "$LOG_FILE"
|
||||
else
|
||||
echo " Mysql Root password is not empty"
|
||||
fi
|
||||
HIRS_DB_USER_EXISTS="$(mysql -uroot -sse "SELECT EXISTS(SELECT 1 FROM mysql.user WHERE user = 'hirs_db')")"
|
||||
if [[ $HIRS_DB_USER_EXISTS == 1 ]]; then
|
||||
echo " hirs_db user exists"
|
||||
else
|
||||
echo " hirs_db user does not exist"
|
||||
|
||||
fi
|
||||
HIRS_DB_EXISTS=`mysql -uroot -e "SHOW DATABASES" | grep hirs_db`
|
||||
if [[ $HIRS_DB_EXISTS == "hirs_db" ]]; then
|
||||
echo " hirs_db databse exists"
|
||||
else
|
||||
echo " hirs_db database does not exists"
|
||||
fi
|
||||
}
|
||||
|
||||
# restart mariadb
|
||||
mysqld_reboot () {
|
||||
# reboot mysql server
|
||||
mysql -u root --password=$DB_ADMIN_PWD -e "SHUTDOWN"
|
||||
sleep 2
|
||||
check_for_container
|
||||
start_mysqlsd >> "$LOG_FILE";
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user