mirror of
https://github.com/FirebirdSQL/firebird.git
synced 2025-01-25 00:43:03 +01:00
544 lines
14 KiB
Bash
544 lines
14 KiB
Bash
#!/bin/sh
|
|
|
|
|
|
#------------------------------------------------------------------------
|
|
# Prompt for response, store result in Answer
|
|
|
|
Answer=""
|
|
|
|
AskQuestion() {
|
|
Test=$1
|
|
DefaultAns=$2
|
|
echo -n "${1}"
|
|
Answer="$DefaultAns"
|
|
read Answer
|
|
}
|
|
|
|
|
|
#------------------------------------------------------------------------
|
|
# add a service line in the (usually) /etc/services or /etc/inetd.conf file
|
|
# Here there are three cases, not found => add service line,
|
|
# found & different => ask user to check
|
|
# found & same => do nothing
|
|
#
|
|
|
|
replaceLineInFile() {
|
|
FileName=$1
|
|
newLine=$2
|
|
oldLine=$3
|
|
Silent=$4
|
|
|
|
if [ -z "$oldLine" ]
|
|
then
|
|
echo "$newLine" >> $FileName
|
|
|
|
elif [ "$oldLine" != "$newLine" ]
|
|
then
|
|
if [ "$Silent" != "Silent" ]
|
|
then
|
|
echo ""
|
|
echo "--- Warning ----------------------------------------------"
|
|
echo ""
|
|
echo " In file $FileName found line: "
|
|
echo " $oldLine"
|
|
echo " Which differs from the expected line:"
|
|
echo " $newLine"
|
|
echo ""
|
|
fi
|
|
|
|
# AskQuestion "Press return to update file or ^C to abort install"
|
|
|
|
cat $FileName | grep -v "$oldLine" > ${FileName}.tmp
|
|
mv ${FileName}.tmp $FileName
|
|
echo "$newLine" >> $FileName
|
|
echo "Updated $FileName."
|
|
|
|
fi
|
|
}
|
|
|
|
#------------------------------------------------------------------------
|
|
# Add new user and group
|
|
|
|
|
|
addFirebirdUser() {
|
|
|
|
testStr=`grep firebird /etc/group`
|
|
|
|
if [ -z "$testStr" ]
|
|
then
|
|
groupadd -g 84 -o -r firebird
|
|
fi
|
|
|
|
testStr=`grep firebird /etc/passwd`
|
|
if [ -z "$testStr" ]
|
|
then
|
|
useradd -o -r -M -d $IBRootDir -s /bin/false \
|
|
-c "Firebird Database Administrator" -g firebird -u 84 firebird
|
|
|
|
# >/dev/null 2>&1
|
|
fi
|
|
}
|
|
|
|
|
|
#------------------------------------------------------------------------
|
|
# changeInitPassword
|
|
|
|
|
|
changeInitPassword() {
|
|
|
|
NewPasswd=$1
|
|
|
|
InitFile=/etc/rc.d/init.d/firebird
|
|
if [ ! -f $InitFile ]
|
|
then
|
|
InitFile=/etc/init.d/firebird
|
|
fi
|
|
|
|
if [ -f $InitFile ]
|
|
then
|
|
ed $InitFile <<EOF
|
|
/ISC_PASSWORD/s/ISC_PASSWORD=.*/ISC_PASSWORD=$NewPasswd/g
|
|
w
|
|
q
|
|
EOF
|
|
chmod u=rwx,g=rx,o= $InitFile
|
|
|
|
fi
|
|
}
|
|
|
|
|
|
#------------------------------------------------------------------------
|
|
# Unable to generate the password for the rpm, so put out a message
|
|
# instead
|
|
|
|
|
|
keepOrigDBAPassword() {
|
|
|
|
NewPasswd='masterkey'
|
|
echo "Firebird initial install password " > $DBAPasswordFile
|
|
echo "for user SYSDBA is : $NewPasswd" >> $DBAPasswordFile
|
|
|
|
echo "for install on `hostname` at time `date`" >> $DBAPasswordFile
|
|
echo "You should change this password at the earliest oportunity" >> $DBAPasswordFile
|
|
echo ""
|
|
|
|
echo "(For superserver you will also want to check the password in the" >> $DBAPasswordFile
|
|
echo "daemon init routine in the file /etc/rc.d/init.d/firebird)" >> $DBAPasswordFile
|
|
echo "" >> $DBAPasswordFile
|
|
echo "Your should password can be changed to a more suitable one using the" >> $DBAPasswordFile
|
|
echo "@prefix@/bin/gsec program as show below:" >> $DBAPasswordFile
|
|
echo "" >> $DBAPasswordFile
|
|
echo ">cd @prefix@" >> $DBAPasswordFile
|
|
echo ">bin/gsec -user sysdba -password <password>" >> $DBAPasswordFile
|
|
echo "GSEC>modify sysdba -pw <newpassword>" >> $DBAPasswordFile
|
|
echo "GSEC>quit" >> $DBAPasswordFile
|
|
|
|
chmod u=r,go= $DBAPasswordFile
|
|
|
|
|
|
}
|
|
|
|
|
|
#------------------------------------------------------------------------
|
|
# Generate new sysdba password - this routine is used only in the
|
|
# rpm file not in the install acript.
|
|
|
|
|
|
generateNewDBAPassword() {
|
|
|
|
# openssl generates random data.
|
|
if [ -f /usr/bin/openssl ]
|
|
then
|
|
NewPasswd=`openssl rand -base64 10 | cut -c1-8`
|
|
fi
|
|
|
|
# mkpasswd is a bit of a hassle, but check to see if it's there
|
|
if [ -z "$NewPasswd" ]
|
|
then
|
|
if [ -f /usr/bin/mkpasswd ]
|
|
then
|
|
NewPasswd=`/usr/bin/mkpasswd -l 8`
|
|
fi
|
|
fi
|
|
|
|
if [ -z "$NewPasswd" ]
|
|
then
|
|
keepOrigDBAPassword
|
|
return
|
|
fi
|
|
|
|
NewPasswd=`echo $NewPasswd | awk '{ for(i=1; i<=8; i++) {x = substr($1, i, 1); if (x == "/") x = "_"; printf "%c", x }; print ""}'`
|
|
|
|
echo "Firebird generated password " > $DBAPasswordFile
|
|
echo "for user SYSDBA is : $NewPasswd" >> $DBAPasswordFile
|
|
echo "generated on `hostname` at time `date`" >> $DBAPasswordFile
|
|
echo "(For superserver you will also want to check the password in the" >> $DBAPasswordFile
|
|
echo "daemon init routine in the file /etc/rc.d/init.d/firebird)" >> $DBAPasswordFile
|
|
echo "" >> $DBAPasswordFile
|
|
echo "Your password can be changed to a more suitable one using the" >> $DBAPasswordFile
|
|
echo "@prefix@/bin/changeDBAPassword.sh script" >> $DBAPasswordFile
|
|
echo "" >> $DBAPasswordFile
|
|
chmod u=r,go= $DBAPasswordFile
|
|
|
|
echo ""
|
|
echo Running gsec to modify SYSDBA password
|
|
$IBBin/gsec -user sysdba -password masterkey <<EOF
|
|
modify sysdba -pw $NewPasswd
|
|
EOF
|
|
echo ""
|
|
echo Running ed to modify /etc/init.d/firebird
|
|
|
|
changeInitPassword "$NewPasswd"
|
|
}
|
|
|
|
#------------------------------------------------------------------------
|
|
# Change sysdba password - this routine is interactive and is only
|
|
# used in the install shell script not the rpm one.
|
|
|
|
|
|
askUserForNewDBAPassword() {
|
|
|
|
NewPasswd=""
|
|
|
|
echo ""
|
|
while [ -z "$NewPasswd" ]
|
|
do
|
|
AskQuestion "Please enter new password for SYSDBA user: "
|
|
NewPasswd=$Answer
|
|
if [ ! -z "$NewPasswd" ]
|
|
then
|
|
$IBBin/gsec -user sysdba -password masterkey <<EOF
|
|
modify sysdba -pw $NewPasswd
|
|
EOF
|
|
echo ""
|
|
changeInitPassword "$NewPasswd"
|
|
fi
|
|
|
|
done
|
|
}
|
|
|
|
|
|
#------------------------------------------------------------------------
|
|
# Change sysdba password - this routine is interactive and is only
|
|
# used in the install shell script not the rpm one.
|
|
|
|
# On some systems the mkpasswd program doesn't appear and on others
|
|
# there is another mkpasswd which does a different operation. So if
|
|
# the specific one isn't available then keep the original password.
|
|
|
|
|
|
changeDBAPassword() {
|
|
|
|
if [ -z "$InteractiveInstall" ]
|
|
then
|
|
generateNewDBAPassword
|
|
else
|
|
askUserForNewDBAPassword
|
|
fi
|
|
}
|
|
|
|
|
|
#------------------------------------------------------------------------
|
|
# installInitdScript
|
|
# Everbody stores this one in a seperate location, so there is a bit of
|
|
# running around to actually get it for each packager.
|
|
# Update rcX.d with Firebird initd entries
|
|
# initd script for SuSE >= 7.2 is a part of RPM package
|
|
|
|
installInitdScript() {
|
|
|
|
# This is for RH and MDK specific
|
|
|
|
if [ -e /etc/rc.d/init.d/functions ]
|
|
then
|
|
srcScript=firebird.init.d.mandrake
|
|
initScript=/etc/rc.d/init.d/firebird
|
|
|
|
# SuSE specific
|
|
|
|
elif [ -r /etc/SuSE-release ]
|
|
then
|
|
srcScript=firebird.init.d.suse
|
|
initScript=/etc/init.d/firebird
|
|
rm -f /usr/sbin/rcfirebird
|
|
ln -s ../../etc/init.d/firebird /usr/sbin/rcfirebird
|
|
|
|
# Debian specific
|
|
|
|
elif [ -r /etc/debian_version ]
|
|
then
|
|
srcScript=firebird.init.d.debian
|
|
initScript=/etc/init.d/firebird
|
|
rm -f /usr/sbin/rcfirebird
|
|
ln -s ../../etc/init.d/firebird /usr/sbin/rcfirebird
|
|
|
|
# Gentoo specific
|
|
|
|
elif [ -r /etc/gentoo-release ]
|
|
then
|
|
srcScript=firebird.init.d.gentoo
|
|
initScript=/etc/init.d/firebird
|
|
|
|
# Generic...
|
|
|
|
elif [ -d /etc/rc.d/init.d ]
|
|
then
|
|
srcScript=firebird.init.d.generic
|
|
initScript=/etc/rc.d/init.d/firebird
|
|
fi
|
|
|
|
|
|
|
|
# Install the firebird init.d script
|
|
cp $IBRootDir/misc/$srcScript $initScript
|
|
chown root:root $initScript
|
|
chmod ug=rx,o= $initScript # contains password hence no world read.
|
|
|
|
|
|
# RedHat and Mandrake specific
|
|
if [ -x /sbin/chkconfig ]
|
|
then
|
|
/sbin/chkconfig --add firebird
|
|
fi
|
|
|
|
# Suse (& Debian ?) specific
|
|
if [ -x /sbin/insserv ]
|
|
then
|
|
/sbin/insserv /etc/init.d/firebird
|
|
fi
|
|
|
|
# More SuSE rc.config fillup
|
|
if [ -x /bin/fillup ]
|
|
then
|
|
/bin/fillup -q -d = etc/rc.config $IBRootDir/misc/rc.config.firebird
|
|
fi
|
|
|
|
if [ -d /etc/sysconfig ]
|
|
then
|
|
cp $IBRootDir/misc/rc.config.firebird /etc/sysconfig/firebird
|
|
fi
|
|
|
|
}
|
|
|
|
#------------------------------------------------------------------------
|
|
# startInetService
|
|
# Now that we've installed it start up the service.
|
|
|
|
startInetService() {
|
|
|
|
initScript=/etc/init.d/firebird
|
|
if [ ! -f $initScript ]
|
|
then
|
|
initScript=/etc/rc.d/init.d/firebird
|
|
fi
|
|
|
|
if [ -f $initScript ]
|
|
then
|
|
#don't start at install time if running SuSE
|
|
if [ ! -r /etc/SuSE-release ]; then
|
|
$initScript start
|
|
fi
|
|
|
|
fi
|
|
}
|
|
|
|
|
|
#------------------------------------------------------------------------
|
|
# UpdateHostsDotEquivFile
|
|
# The /etc/hosts.equiv file is needed to allow local access for super server
|
|
# from processes on the machine to port 3050 on the local machine.
|
|
# The two host names that are needed there are
|
|
# localhost.localdomain and whatever hostname returns.
|
|
|
|
updateHostsDotFile() {
|
|
|
|
hostEquivFile=$1
|
|
|
|
if [ ! -f $hostEquivFile ]
|
|
then
|
|
touch $hostEquivFile
|
|
chown root:root $hostEquivFile
|
|
chmod u=rw,go=r $hostEquivFile
|
|
fi
|
|
|
|
newLine="localhost"
|
|
oldLine=`grep "^$newLine\$" $hostEquivFile`
|
|
replaceLineInFile "$hostEquivFile" "$newLine" "$oldLine"
|
|
|
|
newLine="localhost.localdomain"
|
|
oldLine=`grep "^$newLine\$" $hostEquivFile`
|
|
replaceLineInFile "$hostEquivFile" "$newLine" "$oldLine"
|
|
|
|
newLine="`hostname`"
|
|
oldLine=`grep "^$newLine\$" $hostEquivFile`
|
|
replaceLineInFile "$hostEquivFile" "$newLine" "$oldLine"
|
|
|
|
}
|
|
|
|
|
|
#------------------------------------------------------------------------
|
|
# For security reasons most files in firebird installation are
|
|
# root-owned and world-readable(executable) only (including firebird).
|
|
|
|
# For some files RunUser (firebird) must have write access -
|
|
# lock and log are such.
|
|
|
|
|
|
MakeFileFirebirdWritable() {
|
|
FileName=$1
|
|
chown $RunUser.$RunUser $FileName
|
|
chmod 0644 $FileName
|
|
}
|
|
|
|
|
|
#------------------------------------------------------------------------
|
|
# remove line from config file if it exists in it.
|
|
|
|
removeLineFromFile() {
|
|
FileName=$1
|
|
oldLine=$2
|
|
|
|
if [ -f $FileName ]
|
|
then
|
|
if [ ! -z "$oldLine" ]
|
|
then
|
|
cat $FileName | grep -v "$oldLine" > ${FileName}.tmp
|
|
mv ${FileName}.tmp $FileName
|
|
echo "Updated."
|
|
fi
|
|
fi
|
|
}
|
|
|
|
|
|
|
|
#= Main Post ===============================================================
|
|
|
|
# Make sure the links are in place
|
|
if [ ! -L @prefix@ -a ! -d @prefix@ ]
|
|
then
|
|
# Main link and...
|
|
ln -s $RPM_INSTALL_PREFIX/interbase @prefix@
|
|
fi
|
|
|
|
|
|
IBRootDir=@prefix@
|
|
IBBin=$IBRootDir/bin
|
|
# RunUser=root
|
|
RunUser=firebird
|
|
DBAPasswordFile=$IBRootDir/SYSDBA.password
|
|
export IBRootDir
|
|
export IBBin
|
|
export RunUser
|
|
export DBAPasswordFile
|
|
|
|
# If run from tar-install, copy uninstall files to misc
|
|
if [ -f manifest.txt -a -d scripts ]
|
|
then
|
|
cp manifest.txt $IBRootDir/misc
|
|
mkdir $IBRootDir/misc/scripts
|
|
cp scripts/preuninstall.sh $IBRootDir/misc/scripts
|
|
cp scripts/postuninstall.sh $IBRootDir/misc/scripts
|
|
cp scripts/taruninstall.sh $IBRootDir/misc/scripts
|
|
cp scripts/tarMainUninstall.sh $IBRootDir/misc/uninstall.sh
|
|
fi
|
|
|
|
# Update /etc/services
|
|
|
|
FileName=/etc/services
|
|
newLine="gds_db 3050/tcp # InterBase Database Remote Protocol"
|
|
oldLine=`grep "^gds_db" $FileName`
|
|
|
|
replaceLineInFile "$FileName" "$newLine" "$oldLine"
|
|
|
|
|
|
# Add entries to host.equiv & hosts.allow files
|
|
updateHostsDotFile /etc/hosts.equiv
|
|
updateHostsDotFile /etc/hosts.allow
|
|
|
|
|
|
# remove any gds_db line in the /etc/inetd.conf
|
|
FileName=/etc/inetd.conf
|
|
if [ -f $FileName ]
|
|
then
|
|
oldLine=`grep "^gds_db" $FileName`
|
|
|
|
removeLineFromFile "$FileName" "$oldLine"
|
|
fi
|
|
|
|
|
|
# Get inetd to reread new init files.
|
|
|
|
if [ -f /var/run/inetd.pid ]
|
|
then
|
|
kill -HUP `cat /var/run/inetd.pid`
|
|
fi
|
|
|
|
|
|
# Update ownership of files
|
|
if [ $RunUser = firebird ]
|
|
then
|
|
# Prepare firebird user
|
|
addFirebirdUser
|
|
fi
|
|
|
|
# For security reasons initially force all root:root non-writable
|
|
chown -R root.root $IBRootDir
|
|
chmod -R uga-w $IBRootDir
|
|
|
|
# Prepare bin
|
|
cd $IBBin
|
|
|
|
# Create the fbmgr shell script.
|
|
cat > fbmgr <<EOF
|
|
#!/bin/sh
|
|
FIREBIRD=$IBRootDir
|
|
export FIREBIRD
|
|
exec \$FIREBIRD/bin/fbmgr.bin \$@
|
|
EOF
|
|
|
|
# Everyone may execute clients
|
|
chmod 0555 *
|
|
|
|
# Shell scripts changing security attributes are for root only
|
|
chmod 0500 *.sh
|
|
|
|
# These two should only be executed by firebird user.
|
|
#fbservices=fbguard fbserver
|
|
#chown $RunUser.$RunUser $fbservices
|
|
#chmod 0544 $fbservices
|
|
|
|
|
|
# Lock files
|
|
cd $IBRootDir
|
|
|
|
for i in isc_init1 isc_lock1 isc_event1 isc_guard1
|
|
do
|
|
FileName=$i.`hostname`
|
|
touch $FileName
|
|
MakeFileFirebirdWritable $FileName
|
|
done
|
|
|
|
touch firebird.log
|
|
MakeFileFirebirdWritable firebird.log
|
|
|
|
# Security database
|
|
# Nobody besides firebird permitted to even read this file
|
|
chown $RunUser.$RunUser security.fdb
|
|
chmod 0600 security.fdb
|
|
|
|
# make examples writable by firebird
|
|
for i in examples/*.fdb
|
|
do
|
|
MakeFileFirebirdWritable $i
|
|
done
|
|
|
|
# Set up Firebird for run with init.d
|
|
installInitdScript
|
|
|
|
# start the db server so we can change the password
|
|
startInetService
|
|
|
|
# Change sysdba password
|
|
cd $IBRootDir
|
|
changeDBAPassword
|