.jh
A Darker Shade of Black

rdist(1)

Posted by
.jh
on

On the primary node (I have a well defined carp master so the primary node will be the same unless it’s demoted manually or fails) I have a file /etc/Distfile which contains all files that should exist in identical fashion on the other node. If you name your distfile exactly that (with a capital D), it will be run automatically by the daily(8) script by cron(8), if the file in question has been updated. You do have to make sure that root can log in remotely to the other host, so setup ssh keys between the hosts. Now letting root log in remotely is generally a bad idea, and I’m sure you could do some fancy footwork with a restricted user and doas to accomplish this, but that is left as an exercise to the reader. I modified my sshd_config to only allow root logins on the internal carp interface not connected to the internet and only from the other host. So you’d already have had to have gotten in and become root to then be able to access the partner firewall, at which point I probably have bigger issues. This could look something like this:

In the main section of sshd_config you make sure you disallow root logins:

PermitRootLogin no

At the end of the file you then create a section:

Match Address 10.0.0.1/32
    PermitRootLogin prohibit-password
    AllowUsers root

this will only allow root logins from 10.0.0.1 and only with keys (no passwords). There are probably better and more secure solutions, once again left as an exercise for the reader.

With the prerequisites out of the way it’s time to look at rdist itself. As noted above the configuration file is /etc/Distfile, and it consists of blocks within parentheses where you define various variables which you can then reference. A simple example:

HOSTS = ( myhost )

you’ve now created a group for your hosts. If you need to distribute to more than one host it’s a space separated list.

HOSTS = ( myhost1 myhost2 myhost3 )

Now you would define some groups of files you want to transfer.

FILES = (
            /etc/dhcpd.conf
            /etc/someOtherFile
        ) 

To then make something happen you have to tell rdist what to do, so you create a stanza of commands:

$\{FILES\} -> $\{HOSTS\}
        install ;
        cmdspecial "/usr/sbin/rcctl restart dhcpd" ;
        notify someone@example.com ; 

This will install the file, and then restart dhcpd (as we installed a new dhcpd.conf), and send a notification to someone@example.com that this has been done. Now if you only run this through daily and you read your daily emails it contains the same information so having a notify rule is not necessary. If you have files you simply want to copy over without executing any commands or notifications you simply leave those off.

You can of course define multiple stanzas for various files and various commands. An example could be that you run unbound and nsd and want to ensure those are up to date, but changes to those and dhcpd don’t necessarily happen at the same time, so you only want to restart that which has changed. You’d simply create different file and command stanzas.

DNSFILES = (
            /var/nsd/etc/nsd.conf
            /var/nsd/zones/master
            /var/unbound/etc/unbound.conf
        )

$\{DNSFILES\} -> $\{HOSTS\}
            install ;
            cmdspecial "/usr/sbin/rcctl reload nsd unbound" ;

Create stanzas for each file and associated program you want action to be taken on. If the command you need to be run needs action to be taken on the file you distributed you can tell rdist to use $REMFILE. Example:

/etc/pf.conf -> $\{HOSTS\}
            install ;
            special "/sbin/pfctl -f $REMFILE" ;

So putting all this together you could have a Distfile that looks something like this:

HOSTS = ( myhost )

FILES = (
            /etc/dhcpd.conf
            /etc/someOtherFile
        )

DNSFILES = (
            /var/nsd/etc/nsd.conf
            /var/nsd/zones/master
            /var/unbound/etc/unbound.conf
        )

/etc/pf.conf -> $\{HOSTS\}
            install ;
            special "/sbin/pfctl -f $REMFILE" ;

$\{DNSFILES\} -> $\{HOSTS\}
            install ;
            cmdspecial "/usr/sbin/rcctl reload nsd unbound" ;

$\{FILES\} -> $\{HOSTS\}
        install ;
        cmdspecial "/usr/sbin/rcctl restart dhcpd" ;
        notify someone@example.com ; 

Well that’s it for a quick crash course in rdist, hopefully it’s proven useful to someone.

Permalink, Source, Tags: openbsdrdistblog2019

Latest

All posts →

Tags

blog music best of 2013 playlist running 2011 2009 2021 2010 best of 2009 2018 2019 2017 best of 2018 best of 2017 best of 2013 best of 2011 best of 2010 2022 best of 2022 best of 2021 best of 2020 best of 2019 best of 2016 best of 2015 best of 2014 best of 2012 2020 2016 2015 2014 2012 Blut Aus Nord riding ThrowbackThursday Nightbringer Deathspell Omega about Spektr Shining Peste Noire Mgła Mephorash Funeral Mist Anaal Nathrakh traffic thoughts openbsd driving cars Ungfell Selbst Sargeist Porta Nigra Nazxul Misery Index Jordfäst Gaerea Funereal Presence Drudkh Cénotaphe Blaze of Perdition Behexen Ashencult Ash Pool Aorlhac Akhlys Aara מזמור and מזמור Всі належать ночі π ÞÞÞÞÞÞÞÞÞÞÞ Ô Laudate Dominvs worst idea ever trip report travel tech sblg rdist politics people i can do without nostalgia mdf marriage holiday decorations hate family guy end dmv darker Yodh X - Varg Utan Flock Woods of Desolation With Hearts Towards None What Once Was Liber III Watain Véhémence Vom schwarzen Schmied Vermis Venenum Scorpionis Varg och Björn Vanum Vanitas Vallendusk VII: Född Förlorare V: The Inside Scriptures Unbound Ulcerate Uada Tyrany Tyrannemord Triade II: Hemera Triade I: Eos Transient Totem Thou The Synarchy of Molten Bones The Poisonous Path The Killing Gods The Irrepassable Gate The Harrowing of Hearts The Furnaces of Palingensia The Dreaming I The Confessor The Art To Disappear The Archer Takes Aim The Acausal Mass Thantifaxath Terra Damnata Tempest Superior Massacre Sphere Sjukdom Sisyphean Shroud of Despondency Shem Ha Mephorash Shaped By Aeolian Winds Schöpfungswut Satanic Warmaster Sangus Sacred White Noise Resilient Relatos De Angustia Quantos Possunt Ad Satanitatem Trahunt Pierres Brûlées Pensées Nocturnes Pedicabo Mundi Passion Paracletus Ordalies Opus Serpens One Master Ondskapt Ofte Jeg Drømmer Mig Død Nothing But The Whole Nightside Emanations Near Death Experience Nachtmystium Mythen Myrkskog Myopia Murg Mournful Congregation Monte Verità Monsters Mondocane Misþyrming Misotheist Mirage Merrimack Menhir Memoria Vetusta III: Saturnian Poetry Memoria Vetusta II: Dialogue With the Stars Melinoë Mare Maranatha MCMXV L’Ordure à l’état Pur L’Homme Absurde Lycus Lycanthropic Burrowing Lord Impaler Limbo Lifelover Let The Devil In Lenience Lawless Darkness Lamp of Murmuur La Chaise-Dyable LVTHN L'esprit Des Vents Krieg Klagopsalmer Katharsis Kampfar Kaiserschnitt Journey Towards Ruin Inquisition In the Constellation of the Black Widow Immortal Iconoclast III I Hæthen Hädanefter Holókauston Holmengraa Hekatomb Heirs To Thievery Heir of Ecliptical Romanticism Handful of Stars Hallucinogen Grafvitnir Gorgoroth Gods Without Name Glorior Belli George Carlin Fourth Reich Four Phantoms Forlet Sires For the Glory of Your Redeemer For You Men Who Gaze Into the Sun For Which He Plies The Lash Fimbulwinter Ferriterium Farvegir Fyrndar Exercises in Futility Es Grauet Eradication of Nescience Empyrée Emptiness Embracing the Lightless Depths Eleven Dragons Egrégore Ego Dominus Tuus Dødsengel Délétère Dvala Dumal Drought Douce Fange Discipline Deus Salutis Meæ Det Eviga Leendet Deströyer666 Demiurage of the Void Deivos Deiform Definace De Horae Leprae Dauþuz Darkspace Cypher Cult of a Dying Sun Cull Cremation is Irreversible Crafteon Cosmic Reawakening Conscious Darkness Condemnation Colours of Faith Circumambulations of the Solar Inferno Canopy Calvaire Cadaver Inc. Bâ'a Burzum Book of Kings Bloodshed Across the Empyrean Altar Beyond the Celestial Zenith Blood Magick Necromance Blodhemn Black Flame Gnosis Black Clouds Gathering Bestia Arcana Belus Belphegor Bell Witch Barghest Babylon Whore Av Stoft Auðn Ateiggär Ash Borer As The Stars Arisen From The Ashes Arckanum Apocalypse Sun Aosoth Aoratos Antzaat Antaeus Amon Amarth All Shall Fall Algleymi Aldebaran Ageless Fire Age of Excuse Afsky Aeons in Tectonic Interment Acrimonious Achatius Abbotoir 777 - Sect(s) 777 - Cosmosophy 1557 Rites Of Nullification