limit fai nfs export to host being installed

diff --git a/chost b/chost
index 3e1acd216f8cf5fe055641021c95844f7f53b070..77e17d467b3447468c59b832efbd3da893e59b06 100755 (executable)
--- a/chost
+++ b/chost
@@ -7,7 +7,6 @@ set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
 host=$1
-addr=$(host $host | sed -rn 's/^.*has address (.*)/\1/p;T;q')
-h=$(host $addr)
-h=${h##* }
+addr=$(getent hosts $host | awk '{print $1}')
+h=$(getent hosts $addr | awk '{print $2}')
 echo ${h%%.*}

diff --git a/fai-redep b/fai-redep
index b8fabac4ac14e42da83fd3f6afc6a83cd44ae8ac..4e354a2d176fb4b2cde8e26483aadc5579c2cad0 100755 (executable)
--- a/fai-redep
+++ b/fai-redep
@@ -81,4 +81,3 @@ chmod -R a+rX /srv/fai/config/distro-install-common
 #wget -nv -N $u
 EOF
 
-faiserver-enable

diff --git a/faiserver-disable b/faiserver-disable
old mode 100755 (executable)
new mode 100644 (file)
index 8f920d8..93819cc
--- a/faiserver-disable
+++ b/faiserver-disable
@@ -15,4 +15,4 @@ if [[ $1 ]]; then
     usage 1
 fi
 
-ssh root@$(chost faiserver) "sed -ri --follow-symlinks 's,^/srv/fai/,#\0,' /etc/exports; exportfs -ra"
+ssh root@$(chost faiserver) "sed -ri --follow-symlinks '\%^/srv/fai/d' /etc/exports; exportfs -ra"

diff --git a/faiserver-enable b/faiserver-enable
deleted file mode 100755 (executable)
index 2492b2e..0000000
--- a/faiserver-enable
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/bash
-
-set -eE -o pipefail
-trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
-
-usage() {
-    cat <<EOF
-Usage: ${0##*/}
-Disable the fai nfs server.
-EOF
-    exit $1
-}
-
-if [[ $1 ]]; then
-    usage 1
-fi
-
-host=$(chost faiserver)
-ssh root@$host "sed -ri --follow-symlinks 's,^\s*#\s*(/srv/fai/.*),\1,' /etc/exports; exportfs -ra"

diff --git a/faiserver-setup b/faiserver-setup
index fd2ab0073cec3db458076edc57278c75b0c3aab5..951ec8812ac609a7cde61911ac4d47bcffb731a2 100755 (executable)
--- a/faiserver-setup
+++ b/faiserver-setup
@@ -113,7 +113,7 @@ $sed 's/#LOGUSER/LOGUSER/' /etc/fai/fai.conf
 if ! grep cryptsetup /etc/fai/NFSROOT &>/dev/null; then
   $sed '/^PACKAGES install$/a cryptsetup' /etc/fai/NFSROOT
 fi
-e fai-setup -vf
+e fai-setup -e -vf
 { head -n 1 /srv/fai/nfsroot/root/.ssh/known_hosts | awk '{print $1}' \
     | tr '\n' ' '; ssh-keyscan localhost | grep -o "ecdsa-sha2-nistp256.*"; \
   } >>/srv/fai/nfsroot/root/.ssh/known_hosts

diff --git a/myfai-chboot b/myfai-chboot
index 11c3eae30cb7b22db5cd9b67826f773e4a72d5c0..2a6e02590d2a7fc6e59ce50521db6ac44a1dcf91 100755 (executable)
--- a/myfai-chboot
+++ b/myfai-chboot
@@ -7,11 +7,12 @@ x=$(readlink -f "$BASH_SOURCE"); cd ${x%/*}
 
 usage() {
     cat <<EOF
-usage: ${0##*/} [-h|--help] [hostname|ip|default]...
+usage: ${0##*/} [-h|--help] [hostname|ip]
 
-Sets up tftp pxe config on host "faiserver". Argument sets the host to
-enable it for, "default" is for all hosts.  No argument disables for all
-hosts.
+Sets up tftp pxe config and nfs config on host "faiserver". Argument
+sets the host to enable it for.  No argument disables pxe config for all
+hosts, but leaves nfs server alone. Use faiserver-disable to disable
+the nfs server.
 EOF
     exit $1
 }

diff --git a/myfai-chboot-local b/myfai-chboot-local
index 66c496d069afa8dfb4f0b07782364a914c25cb1f..9ba87dcd5ff8e2a88aa61308a45a1c35289d9c6c 100755 (executable)
--- a/myfai-chboot-local
+++ b/myfai-chboot-local
@@ -20,6 +20,9 @@ if [[ ! $1 ]]; then
     exit 0
 fi
 
+host=$1
+ip=$(getent hosts $host | awk '{print $1}')
+
 std_arg="-u nfs://faiserver/srv/fai/config"
 e fai-chboot -Iv $std_arg default # set it to default to get a val out of it next
 kernel=$(fai-chboot -L '^default$' | awk '{print $3}')
@@ -31,7 +34,16 @@ my_ip=$(host faiserver $gateway_ip | sed -rn 's/^\S+ has address //p')
 k_args=$(fai-chboot -L '^default$' | \
              sed -r "s/^(\S+\s+){3}(.*root=)(.*)/\2$my_ip:\3/")
 rm -f /srv/tftp/fai/pxelinux.cfg/*
-e fai-chboot -k "$k_args" -v -f verbose,sshd,createvt,reboot $std_arg $kernel "$@"
+e fai-chboot -k "$k_args" -v -f verbose,sshd,createvt,reboot $std_arg $kernel "$host"
+
+# fai-setup without -e sets the ip to the local_ip/local_network, eg 192.168.1.3/24
+# I restrict it to one ip as simple but imperfect access control.
+sed -ri --follow-symlinks '\%^/srv/fai/%d' /etc/exports
+cat >>/etc/exports <<EOF
+/srv/fai/config $ip/32(async,ro,no_subtree_check)
+/srv/fai/nfsroot $ip/32(async,ro,no_subtree_check,no_root_squash)
+EOF
+exportfs -ra
 
 
 # todo, remove the nopxe script. adjust fai-check to reboot if it fails on the kexec.