.jh
A Darker Shade of Black

rdist(1)

Posted by
.jh
on

On the primary node (I have a well defined carp master so the primary node will be the same unless it’s demoted manually or fails) I have a file /etc/Distfile which contains all files that should exist in identical fashion on the other node. If you name your distfile exactly that (with a capital D), it will be run automatically by the daily(8) script by cron(8), if the file in question has been updated. You do have to make sure that root can log in remotely to the other host, so setup ssh keys between the hosts. Now letting root log in remotely is generally a bad idea, and I’m sure you could do some fancy footwork with a restricted user and doas to accomplish this, but that is left as an exercise to the reader. I modified my sshd_config to only allow root logins on the internal carp interface not connected to the internet and only from the other host. So you’d already have had to have gotten in and become root to then be able to access the partner firewall, at which point I probably have bigger issues. This could look something like this:

In the main section of sshd_config you make sure you disallow root logins:

PermitRootLogin no

At the end of the file you then create a section:

Match Address 10.0.0.1/32
    PermitRootLogin prohibit-password
    AllowUsers root

this will only allow root logins from 10.0.0.1 and only with keys (no passwords). There are probably better and more secure solutions, once again left as an exercise for the reader.

With the prerequisites out of the way it’s time to look at rdist itself. As noted above the configuration file is /etc/Distfile, and it consists of blocks within parentheses where you define various variables which you can then reference. A simple example:

HOSTS = ( myhost )

you’ve now created a group for your hosts. If you need to distribute to more than one host it’s a space separated list.

HOSTS = ( myhost1 myhost2 myhost3 )

Now you would define some groups of files you want to transfer.

FILES = (
            /etc/dhcpd.conf
            /etc/someOtherFile
        ) 

To then make something happen you have to tell rdist what to do, so you create a stanza of commands:

$\{FILES\} -> $\{HOSTS\}
        install ;
        cmdspecial "/usr/sbin/rcctl restart dhcpd" ;
        notify someone@example.com ; 

This will install the file, and then restart dhcpd (as we installed a new dhcpd.conf), and send a notification to someone@example.com that this has been done. Now if you only run this through daily and you read your daily emails it contains the same information so having a notify rule is not necessary. If you have files you simply want to copy over without executing any commands or notifications you simply leave those off.

You can of course define multiple stanzas for various files and various commands. An example could be that you run unbound and nsd and want to ensure those are up to date, but changes to those and dhcpd don’t necessarily happen at the same time, so you only want to restart that which has changed. You’d simply create different file and command stanzas.

DNSFILES = (
            /var/nsd/etc/nsd.conf
            /var/nsd/zones/master
            /var/unbound/etc/unbound.conf
        )

$\{DNSFILES\} -> $\{HOSTS\}
            install ;
            cmdspecial "/usr/sbin/rcctl reload nsd unbound" ;

Create stanzas for each file and associated program you want action to be taken on. If the command you need to be run needs action to be taken on the file you distributed you can tell rdist to use $REMFILE. Example:

/etc/pf.conf -> $\{HOSTS\}
            install ;
            special "/sbin/pfctl -f $REMFILE" ;

So putting all this together you could have a Distfile that looks something like this:

HOSTS = ( myhost )

FILES = (
            /etc/dhcpd.conf
            /etc/someOtherFile
        )

DNSFILES = (
            /var/nsd/etc/nsd.conf
            /var/nsd/zones/master
            /var/unbound/etc/unbound.conf
        )

/etc/pf.conf -> $\{HOSTS\}
            install ;
            special "/sbin/pfctl -f $REMFILE" ;

$\{DNSFILES\} -> $\{HOSTS\}
            install ;
            cmdspecial "/usr/sbin/rcctl reload nsd unbound" ;

$\{FILES\} -> $\{HOSTS\}
        install ;
        cmdspecial "/usr/sbin/rcctl restart dhcpd" ;
        notify someone@example.com ; 

Well that’s it for a quick crash course in rdist, hopefully it’s proven useful to someone.

Permalink, Source, Tags: openbsdrdistblog

Latest

All posts →

Tags

blog music best of 2013 playlist running 2011 2009 2010 best of 2009 2018 2017 best of 2018 best of 2017 best of 2013 best of 2011 best of 2010 best of 2020 best of 2019 best of 2016 best of 2015 best of 2014 best of 2012 2016 2015 2014 2012 Blut Aus Nord riding Nightbringer Deathspell Omega Shining Peste Noire Mgła Mephorash Anaal Nathrakh traffic thoughts driving cars about Spektr Selbst Sargeist Porta Nigra Misery Index Funereal Presence Funeral Mist Cénotaphe Blaze of Perdition Behexen Ashencult Ash Pool Akhlys מזמור ÞÞÞÞÞÞÞÞÞÞÞ worst idea ever trip report travel rdist politics people i can do without openbsd mdf marriage holiday decorations hate family guy end dmv darker Yodh X - Varg Utan Flock Woods of Desolation With Hearts Towards None What Once Was Liber III Watain Vermis Venenum Scorpionis Varg och Björn Vanum Vanitas Vallendusk VII: Född Förlorare V: The Inside Scriptures Ungfell Unbound Ulcerate Uada Tyrany Transient The Synarchy of Molten Bones The Poisonous Path The Killing Gods The Irrepassable Gate The Harrowing of Hearts The Furnaces of Palingensia The Dreaming I The Confessor The Art To Disappear The Archer Takes Aim The Acausal Mass Thantifaxath Terra Damnata Tempest Sjukdom Shroud of Despondency Shem Ha Mephorash Shaped By Aeolian Winds Schöpfungswut Satanic Warmaster Sangus Sacred White Noise Resilient Relatos De Angustia Quantos Possunt Ad Satanitatem Trahunt Pedicabo Mundi Passion Paracletus Opus Serpens One Master Ondskapt Ofte Jeg Drømmer Mig Død Nothing But The Whole Nightside Emanations Nazxul Nachtmystium Mythen Murg Mournful Congregation Monte Verità Monsters Misþyrming Merrimack Menhir Memoria Vetusta III: Saturnian Poetry Memoria Vetusta II: Dialogue With the Stars Melinoë Mare Maranatha MCMXV L’Homme Absurde Lycus Lycanthropic Burrowing Lord Impaler Limbo Lifelover Let The Devil In Lenience Lawless Darkness Lamp of Murmuur La Chaise-Dyable LVTHN L'esprit Des Vents L'Ordure à l'état Pur Krieg Klagopsalmer Katharsis Kampfar Kaiserschnitt Journey Towards Ruin Inquisition In the Constellation of the Black Widow Immortal Iconoclast III I Hæthen Holókauston Holmengraa Hekatomb Heirs To Thievery Heir of Ecliptical Romanticism Handful of Stars Hallucinogen Grafvitnir Gorgoroth Gods Without Name George Carlin Gaerea Fourth Reich Four Phantoms Forlet Sires For You Men Who Gaze Into the Sun For Which He Plies The Lash Fimbulwinter Farvegir Fyrndar Exercises in Futility Eradication of Nescience Empyrée Emptiness Embracing the Lightless Depths Eleven Dragons Ego Dominus Tuus Dødsengel Délétère Dumal Drudkh Drought Deus Salutis Meæ Det Eviga Leendet Deströyer666 Demiurage of the Void Deivos Definace De Horae Leprae Darkspace Cypher Cult of a Dying Sun Cull Cremation is Irreversible Crafteon Cosmic Reawakening Conscious Darkness Condemnation Circumambulations of the Solar Inferno Canopy Burzum Book of Kings Bloodshed Across the Empyrean Altar Beyond the Celestial Zenith Blood Magick Necromance Blodhemn Black Flame Gnosis Black Clouds Gathering Bestia Arcana Belus Belphegor Bell Witch Barghest Babylon Whore Auðn Ash Borer As The Stars Arisen From The Ashes Arckanum Apocalypse Sun Aosoth Aorlhac Aoratos Antzaat Antaeus All Shall Fall Algleymi Aldebaran Ageless Fire Age of Excuse Afsky Aeons in Tectonic Interment Acrimonious Achatius Abbotoir 777 - Sect(s) 777 - Cosmosophy 1557 Rites Of Nullification