From 1885f9677fdf2bfeac95285cf13a7d60273d096a Mon Sep 17 00:00:00 2001
From: Ian Kelling <ian@iankelling.org>
Date: Sat, 8 Apr 2017 16:42:58 -0700
Subject: [PATCH] limit fai nfs export to host being installed

---
 chost              |  5 ++---
 fai-redep          |  1 -
 faiserver-disable  |  2 +-
 faiserver-enable   | 19 -------------------
 faiserver-setup    |  2 +-
 myfai-chboot       |  9 +++++----
 myfai-chboot-local | 14 +++++++++++++-
 7 files changed, 22 insertions(+), 30 deletions(-)
 mode change 100755 => 100644 faiserver-disable
 delete mode 100755 faiserver-enable

diff --git a/chost b/chost
index 3e1acd2..77e17d4 100755
--- a/chost
+++ b/chost
@@ -7,7 +7,6 @@ set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
 host=$1
-addr=$(host $host | sed -rn 's/^.*has address (.*)/\1/p;T;q')
-h=$(host $addr)
-h=${h##* }
+addr=$(getent hosts $host | awk '{print $1}')
+h=$(getent hosts $addr | awk '{print $2}')
 echo ${h%%.*}
diff --git a/fai-redep b/fai-redep
index b8fabac..4e354a2 100755
--- a/fai-redep
+++ b/fai-redep
@@ -81,4 +81,3 @@ chmod -R a+rX /srv/fai/config/distro-install-common
 #wget -nv -N $u
 EOF
 
-faiserver-enable
diff --git a/faiserver-disable b/faiserver-disable
old mode 100755
new mode 100644
index 8f920d8..93819cc
--- a/faiserver-disable
+++ b/faiserver-disable
@@ -15,4 +15,4 @@ if [[ $1 ]]; then
     usage 1
 fi
 
-ssh root@$(chost faiserver) "sed -ri --follow-symlinks 's,^/srv/fai/,#\0,' /etc/exports; exportfs -ra"
+ssh root@$(chost faiserver) "sed -ri --follow-symlinks '\%^/srv/fai/d' /etc/exports; exportfs -ra"
diff --git a/faiserver-enable b/faiserver-enable
deleted file mode 100755
index 2492b2e..0000000
--- a/faiserver-enable
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/bash
-
-set -eE -o pipefail
-trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
-
-usage() {
-    cat <<EOF
-Usage: ${0##*/}
-Disable the fai nfs server.
-EOF
-    exit $1
-}
-
-if [[ $1 ]]; then
-    usage 1
-fi
-
-host=$(chost faiserver)
-ssh root@$host "sed -ri --follow-symlinks 's,^\s*#\s*(/srv/fai/.*),\1,' /etc/exports; exportfs -ra"
diff --git a/faiserver-setup b/faiserver-setup
index fd2ab00..951ec88 100755
--- a/faiserver-setup
+++ b/faiserver-setup
@@ -113,7 +113,7 @@ $sed 's/#LOGUSER/LOGUSER/' /etc/fai/fai.conf
 if ! grep cryptsetup /etc/fai/NFSROOT &>/dev/null; then
   $sed '/^PACKAGES install$/a cryptsetup' /etc/fai/NFSROOT
 fi
-e fai-setup -vf
+e fai-setup -e -vf
 { head -n 1 /srv/fai/nfsroot/root/.ssh/known_hosts | awk '{print $1}' \
     | tr '\n' ' '; ssh-keyscan localhost | grep -o "ecdsa-sha2-nistp256.*"; \
   } >>/srv/fai/nfsroot/root/.ssh/known_hosts
diff --git a/myfai-chboot b/myfai-chboot
index 11c3eae..2a6e025 100755
--- a/myfai-chboot
+++ b/myfai-chboot
@@ -7,11 +7,12 @@ x=$(readlink -f "$BASH_SOURCE"); cd ${x%/*}
 
 usage() {
     cat <<EOF
-usage: ${0##*/} [-h|--help] [hostname|ip|default]...
+usage: ${0##*/} [-h|--help] [hostname|ip]
 
-Sets up tftp pxe config on host "faiserver". Argument sets the host to
-enable it for, "default" is for all hosts.  No argument disables for all
-hosts.
+Sets up tftp pxe config and nfs config on host "faiserver". Argument
+sets the host to enable it for.  No argument disables pxe config for all
+hosts, but leaves nfs server alone. Use faiserver-disable to disable
+the nfs server.
 EOF
     exit $1
 }
diff --git a/myfai-chboot-local b/myfai-chboot-local
index 66c496d..9ba87dc 100755
--- a/myfai-chboot-local
+++ b/myfai-chboot-local
@@ -20,6 +20,9 @@ if [[ ! $1 ]]; then
     exit 0
 fi
 
+host=$1
+ip=$(getent hosts $host | awk '{print $1}')
+
 std_arg="-u nfs://faiserver/srv/fai/config"
 e fai-chboot -Iv $std_arg default # set it to default to get a val out of it next
 kernel=$(fai-chboot -L '^default$' | awk '{print $3}')
@@ -31,7 +34,16 @@ my_ip=$(host faiserver $gateway_ip | sed -rn 's/^\S+ has address //p')
 k_args=$(fai-chboot -L '^default$' | \
              sed -r "s/^(\S+\s+){3}(.*root=)(.*)/\2$my_ip:\3/")
 rm -f /srv/tftp/fai/pxelinux.cfg/*
-e fai-chboot -k "$k_args" -v -f verbose,sshd,createvt,reboot $std_arg $kernel "$@"
+e fai-chboot -k "$k_args" -v -f verbose,sshd,createvt,reboot $std_arg $kernel "$host"
+
+# fai-setup without -e sets the ip to the local_ip/local_network, eg 192.168.1.3/24
+# I restrict it to one ip as simple but imperfect access control.
+sed -ri --follow-symlinks '\%^/srv/fai/%d' /etc/exports
+cat >>/etc/exports <<EOF
+/srv/fai/config $ip/32(async,ro,no_subtree_check)
+/srv/fai/nfsroot $ip/32(async,ro,no_subtree_check,no_root_squash)
+EOF
+exportfs -ra
 
 
 # todo, remove the nopxe script. adjust fai-check to reboot if it fails on the kexec.
-- 
2.30.2