--- doc/install/linux/install.pl 2021/12/21 14:31:52 1.81 +++ doc/install/linux/install.pl 2024/08/01 12:56:58 1.94 @@ -78,7 +78,7 @@ if (!open(LOG,">>loncapa_install.log")) &mt('Stopping execution.')."\n"; exit; } else { - print LOG '$Id: install.pl,v 1.81 2021/12/21 14:31:52 raeburn Exp $'."\n"; + print LOG '$Id: install.pl,v 1.94 2024/08/01 12:56:58 raeburn Exp $'."\n"; } # @@ -437,7 +437,7 @@ sub check_prerequisites { sub check_locale { my ($distro) = @_; - my ($fh,$langvar,$command,$earlyout); + my ($fh,$langvar,$command,$langcmd,$earlyout,$default); $langvar = 'LANG'; if ($distro =~ /^(ubuntu|debian)/) { if (!open($fh,"= 7) { if (!open($fh,"; chomp(@data); + close($fh); foreach my $item (@data) { if ($item =~ /^\Q$langvar\E=\"?([^\"]*)\"?/) { - my $default = $1; + $default = $1; if ($default ne 'en_US.UTF-8') { if ($distro =~ /^debian/) { $command = 'locale-gen en_US.UTF-8'."\n". @@ -517,8 +518,72 @@ sub check_locale { last; } } - close($fh); - return $command; +# Check for locales + if ($default ne 'en_US.UTF-8') { + my ($has_us_english,$has_other_code,$has_other_lang); + if (open(PIPE,"locale -a 2>/dev/null |")) { + while () { + chomp(); + next if (/^(C(|\.utf8)|POSIX)$/i); + if (/^en_US\.utf8/i) { + $has_us_english = 1; + } elsif (/^[A-Za-z]{2}_[A-Za-z]{2}/) { + $has_other_code = 1; + } elsif (/^[A-Za-z]{3,}/) { + $has_other_lang = 1; + } + } + close(PIPE); + if (!$has_us_english) { + if ($has_other_code || $has_other_lang) { + if ($distro =~ /^ubuntu/) { + $langcmd = "sudo apt-get install language-pack-en\n"; + } elsif ($distro =~ /^debian/) { + $langcmd = "apt-get install language-pack-en\n"; + } elsif ($distro =~ /^(suse|sles)/) { + $langcmd = &mt('Use yast: System > Language > Primary Language = English')."\n"; + } elsif ($distro =~ /^fedora(\d+)$/) { + if ($1 > 23) { + $langcmd = "dnf install glibc-langpack-en\n"; + } else { + $langcmd = "yum install glibc-common\n"; + } + } elsif ($distro =~ /^(?:rhes|centos|scientific|oracle|rocky|alma)(\d+)/) { + if ($1 > 7) { + $langcmd = "dnf install glibc-langpack-en\n"; + } else { + $langcmd = "yum install glibc-common\n"; + } + } + } else { + if ($distro =~ /^ubuntu/) { + $langcmd = "sudo apt-get install language-pack-en\n"; + } elsif ($distro =~ /^debian/) { + $langcmd = "apt-get install language-pack-en\n"; + } elsif ($distro =~ /^(suse|sles)/) { + $langcmd = &mt('Use yast: System > Language > Primary Language = English')."\n"; + } elsif ($distro =~ /^fedora(\d+)$/) { + if ($1 > 23) { + $langcmd = &mt('Either install all languages[_1]or install English only[_2]', + ":\ndnf install glibc-all-langpacks\n\n", + ":\ndnf install glibc-langpack-en\n"); + } else { + $langcmd = "yum install glibc-common\n"; + } + } elsif ($distro =~ /^(?:rhes|centos|scientific|oracle|rocky|alma)(\d+)/) { + if ($1 > 7) { + $langcmd = &mt('Either install all languages[_1]or install English only[_2]', + ":\ndnf install glibc-all-langpacks\n\n", + ":\ndnf install glibc-langpack-en\n"); + } else { + $langcmd = "yum install glibc-common\n"; + } + } + } + } + } + } + return ($command,$langcmd); } sub check_required { @@ -529,11 +594,11 @@ sub check_required { } my $gotprereqs = &check_prerequisites($packagecmd,$distro); if ($gotprereqs eq '') { - return ($distro,$gotprereqs,'',$packagecmd,$updatecmd); + return ($distro,$gotprereqs,'','',$packagecmd,$updatecmd); } - my $localecmd = &check_locale($distro); + my ($localecmd,$langcmd) = &check_locale($distro); unless ($localecmd eq '') { - return ($distro,$gotprereqs,$localecmd); + return ($distro,$gotprereqs,$localecmd,$langcmd); } my ($mysqlon,$mysqlsetup,$mysqlrestart,$dbh,$has_pass,$mysql_unix_socket,$has_lcdb, %recommended,$downloadstatus,$filetouse,$production,$testing,$apachefw, @@ -572,10 +637,10 @@ sub check_required { if ($mysqlsetup eq 'needsrestart') { $mysqlrestart = ''; if ($distro eq 'ubuntu') { - $mysqlrestart = 'sudo '; + $mysqlrestart = 'sudo '; } $mysqlrestart .= 'service mysql restart'; - return ($distro,$gotprereqs,$localecmd,$packagecmd,$updatecmd,$installnow,$mysqlrestart); + return ($distro,$gotprereqs,$localecmd,$langcmd,$packagecmd,$updatecmd,$installnow,$mysqlrestart); } else { if ($mysqlsetup eq 'noroot') { $recommended{'mysqlperms'} = 1; @@ -595,13 +660,16 @@ sub check_required { my ($sslhostsfilesref,$has_std,$has_int,$rewritenum,$nochgstd,$nochgint); ($recommended{'firewall'},$apachefw) = &chkfirewall($distro); ($recommended{'runlevels'},$tostop,$uses_systemctl) = &chkconfig($distro,$instdir); + if ((ref($uses_systemctl) eq 'HASH') && ($uses_systemctl->{'apache'})) { + $recommended{'systemd'} = &check_systemd_security($distro); + } $recommended{'apache'} = &chkapache($distro,$instdir); ($recommended{'apachessl'},$sslhostsfilesref,$has_std,$has_int,$rewritenum, $nochgstd,$nochgint) = &chkapachessl($distro,$instdir,$hostname,$hostip); $recommended{'stopsrvcs'} = &chksrvcs($distro,$tostop); ($recommended{'download'},$downloadstatus,$filetouse,$production,$testing) = &need_download($distro,$instdir); - return ($distro,$gotprereqs,$localecmd,$packagecmd,$updatecmd,$installnow, + return ($distro,$gotprereqs,$localecmd,$langcmd,$packagecmd,$updatecmd,$installnow, $mysqlrestart,\%recommended,$dbh,$has_pass,$mysql_unix_socket, $has_lcdb,$downloadstatus,$filetouse,$production,$testing,$apachefw, $uses_systemctl,$hostname,$hostip,$sslhostsfilesref,$has_std,$has_int, @@ -622,6 +690,20 @@ sub check_mysql_running { $process = 'mysqld'; $proc_owner = 'mysql'; } + if ($1 >= 16) { + $use_systemctl = 1; + } + } elsif ($distro =~ /^debian(\w+)/) { + if ($1 >= 10) { + $process = 'mysql'; + $proc_owner = 'mysql'; + } + if ($1 >= 11) { + $mysqldaemon = 'mariadb'; + } + if ($1 >= 9) { + $use_systemctl = 1; + } } elsif ($distro =~ /^fedora(\d+)/) { if ($1 >= 16) { $process = 'mysqld'; @@ -641,6 +723,9 @@ sub check_mysql_running { $proc_owner = 'mysql'; $use_systemctl = 1; } + if ($1 >= 9) { + $process = 'mariadb'; + } } elsif ($distro =~ /^sles(\d+)/) { if ($1 >= 12) { $use_systemctl = 1; @@ -761,9 +846,13 @@ sub chkconfig { if (($distro =~ /^ubuntu/) && ($version <= 8)) { $daemon{'cups'} = 'cupsys'; } - if (($distro =~ /^ubuntu/) && ($version >= 18)) { + if ((($distro =~ /^ubuntu/) && ($version >= 18)) || + (($distro =~ /^debian/) && ($version >= 10))) { $daemon{'ntp'} = 'chrony'; } + if (($distro =~ /^debian/) && ($version >= 11)) { + $daemon{'mysql'} = 'mariadb'; + } } elsif ($distro =~ /^fedora(\d+)/) { my $version = $1; if ($version >= 15) { @@ -886,6 +975,26 @@ sub chkconfig { return (\%needfix,\%tostop,\%uses_systemctl); } +sub check_systemd_security { + my ($distro) = @_; + my $service = 'httpd.service'; + if ($distro =~ /^(suse|sles|ubuntu|debian)/) { + $service = 'apache2.service'; + } + system("systemctl daemon-reload"); + if (open(PIPE,"systemctl show $service --property=ProtectHome 2>/dev/null |")) { + my $protection = ; + close(PIPE); + chomp($protection); + if ($protection =~ /^ProtectHome=(read-only|yes)$/i) { + return 1; + } + } else { + print &mt('Could not check systemctl configuration for Apache')."\n"; + } + return 0; +} + sub uses_firewalld { my ($distro) = @_; my ($inuse,$checkfirewalld,$zone); @@ -989,7 +1098,8 @@ sub chkapache { my $distname = $1; my $version = $2; my ($stdconf,$stdsite); - if (($distname eq 'ubuntu') && ($version > 12)) { + if ((($distname eq 'ubuntu') && ($version > 12)) || + (($distname eq 'debian') && ($version >= 10))) { $stdconf = "$instdir/debian-ubuntu/ubuntu14/loncapa_conf"; $stdsite = "$instdir/debian-ubuntu/ubuntu14/loncapa_sites"; } else { @@ -1000,7 +1110,8 @@ sub chkapache { print &mt('Warning: No LON-CAPA Apache configuration file found for installation check.')."\n"; } else { my ($configfile,$sitefile); - if (($distname eq 'ubuntu') && ($version > 12)) { + if ((($distname eq 'ubuntu') && ($version > 12)) || + (($distname eq 'debian') && ($version >= 10))) { $sitefile = '/etc/apache2/sites-available/loncapa.conf'; $configfile = '/etc/apache2/conf-available/loncapa.conf'; } else { @@ -1016,13 +1127,16 @@ sub chkapache { } } } - if ((!$fixapache) && ($distname eq 'ubuntu') && ($version > 12)) { + if ((!$fixapache) && ((($distname eq 'ubuntu') && ($version > 12)) || + (($distname eq 'debian') && ($version >= 10)))) { if (($sitefile ne '') && (-e $sitefile) && (-e $stdsite)) { if (open(PIPE, "diff --brief $stdsite $sitefile |")) { my $diffres = ; close(PIPE); chomp($diffres); - unless ($diffres) { + if ($diffres) { + $fixapache = 1; + } else { $fixapache = 0; } } @@ -1036,7 +1150,7 @@ sub chkapache { } } } - if ((!$fixapache) && ($distname eq 'ubuntu')) { + if ((!$fixapache) && (($distname eq 'ubuntu') || ($distname eq 'debian'))) { my $sitestatus = "/etc/apache2/mods-available/status.conf"; my $stdstatus = "$instdir/debian-ubuntu/status.conf"; if ((-e $stdstatus) && (-e $sitestatus)) { @@ -1387,7 +1501,11 @@ sub chkapachessl { foreach my $file (sort(keys(%{$sslfiles{$key}}))) { unless ((-l "$enabled_dir/$file") && (readlink("$enabled_dir/$file") eq "$ssldir/$file")) { - print_and_log(&mt("Warning, use: 'sudo a2ensite $file' to activate LON-CAPA SSL Apache config\n")); + if ($distro =~ /^debian(\d+)$/) { + print_and_log(&mt("Warning, use: 'a2ensite $file' to activate LON-CAPA SSL Apache config\n")); + } elsif ($distro =~ /^ubuntu(\d+)$/) { + print_and_log(&mt("Warning, use: 'sudo a2ensite $file' to activate LON-CAPA SSL Apache config\n")); + } } } } @@ -1550,8 +1668,8 @@ sub check_mysql_setup { my ($instdir,$dsn,$distro) = @_; my ($mysqlsetup,$has_pass,$mysql_unix_socket,$mysql_has_wwwuser); my $dbh = DBI->connect($dsn,'root','',{'PrintError'=>0}); - my ($mysqlversion,$mysqlsubver,$mysqlname) = &get_mysql_version(); - if (($mysqlname =~ /^MariaDB/i) && ($mysqlversion >= 10.4)) { + my ($mysqlversion,$mysqlminorversion,$mysqlsubver,$mysqlname) = &get_mysql_version(); + if (($mysqlname =~ /^MariaDB/i) && (($mysqlversion == 10 && $mysqlminorversion >= 4) || ($mysqlversion >= 11))) { if ($dbh) { my $sth = $dbh->prepare("SELECT Priv FROM mysql.global_priv WHERE (User = 'root' AND Host ='localhost')"); $sth->execute(); @@ -1572,7 +1690,7 @@ sub check_mysql_setup { } if ($dbh) { $mysqlsetup = 'noroot'; - if (($mysqlname !~ /^MariaDB/i) && ($mysqlversion >= 5.7)) { + if (($mysqlname !~ /^MariaDB/i) && (($mysqlversion == 5 && $mysqlminorversion >= 7) || ($mysqlversion >= 6))) { my $sth = $dbh->prepare("SELECT plugin from mysql.user where User='root'"); $sth->execute(); while (my $priv = $sth->fetchrow_array) { @@ -1697,14 +1815,30 @@ sub get_pathto_iptables { sub firewall_is_active { if (-e '/proc/net/ip_tables_names') { + my $status; if (open(PIPE,'cat /proc/net/ip_tables_names |grep filter |')) { - my $status = ; + $status = ; close(PIPE); chomp($status); if ($status eq 'filter') { return 1; } } + unless ($status) { + if (open(PIPE,'nft list tables |')) { + while() { + chomp(); + if (/filter$/) { + $status = 1; + last; + } + } + close(PIPE); + if ($status) { + return 1; + } + } + } } return 0; } @@ -1866,12 +2000,13 @@ print " ".&mt('3.')." ".&mt('Set-up the MySQL database.')." ".&mt('4.')." ".&mt('Set-up MySQL permissions.')." ".&mt('5.')." ".&mt('Configure Apache web server.')." -".&mt('6.')." ".&mt('Configure SSL for Apache web server.')." -".&mt('7.')." ".&mt('Configure start-up of services.')." -".&mt('8.')." ".&mt('Check firewall settings.')." -".&mt('9.')." ".&mt('Stop services not used by LON-CAPA,')." +".&mt('6.')." ".&mt('Configure systemd security settings for Apache web server.')." +".&mt('7.')." ".&mt('Configure SSL for Apache web server.')." +".&mt('8.')." ".&mt('Configure start-up of services.')." +".&mt('9.')." ".&mt('Check firewall settings.')." +".&mt('10.')." ".&mt('Stop services not used by LON-CAPA,')." ".&mt('i.e., services for a print server: [_1] daemon.',"'cups'")." -".&mt('10.')." ".&mt('Download LON-CAPA source code in readiness for installation.')." +".&mt('11.')." ".&mt('Download LON-CAPA source code in readiness for installation.')." ".&mt('Typically, you will run this script only once, when you first install LON-CAPA.')." @@ -1900,7 +2035,7 @@ my $instdir = `pwd`; chomp($instdir); my %callsub; -my @actions = ('wwwuser','pwauth','mysql','mysqlperms','apache', +my @actions = ('wwwuser','pwauth','mysql','mysqlperms','apache','systemd', 'apachessl','runlevels','firewall','stopsrvcs','download'); my %prompts = &texthash( wwwuser => "Create the 'www' user?", @@ -1908,7 +2043,8 @@ my %prompts = &texthash( mysql => 'Set-up the MySQL database?', mysqlperms => 'Set-up MySQL permissions?', apache => 'Configure Apache web server?', - apachessl => 'Configure SSL for Apache web server?', + systemd => 'Configure systemd security settings for Apache web server?', + apachessl => 'Configure SSL for Apache web server?', runlevels => 'Set overrides for start-up order of services?', firewall => 'Configure firewall settings for Apache', stopsrvcs => 'Stop extra services not required on a LON-CAPA server?', @@ -1918,7 +2054,7 @@ my %prompts = &texthash( print "\n".&mt('Checking system status ...')."\n\n"; my $dsn = "DBI:mysql:database=mysql"; -my ($distro,$gotprereqs,$localecmd,$packagecmd,$updatecmd,$installnow,$mysqlrestart, +my ($distro,$gotprereqs,$localecmd,$langcmd,$packagecmd,$updatecmd,$installnow,$mysqlrestart, $recommended,$dbh,$has_pass,$mysql_unix_socket,$has_lcdb,$downloadstatus, $filetouse,$production,$testing,$apachefw,$uses_systemctl,$hostname,$hostip, $sslhostsfiles,$has_std,$has_int,$rewritenum,$nochgstd,$nochgint) = @@ -1939,8 +2075,12 @@ if ($mysqlrestart) { exit; } if ($localecmd ne '') { - print "\n".&mt('Although the LON-CAPA application itself is localized for a number of different languages, the default locale language for the Linux OS on which it runs should be US English.')."\n"; - print "\n".&mt('Run the following command from the command line to set the default language for your OS, and then run this LON-CAPA installation set-up script again.')."\n\n". + print "\n".&mt('Although the LON-CAPA application itself is localized for a number of different languages,[_1]the default locale language for the Linux OS on which it runs should be US English.',"\n")."\n\n"; + if ($langcmd ne '') { + print &mt('Use the following command(s) or action(s) to install a required language package.')."\n\n". + "$langcmd\n"; + } + print &mt('Run the following command from the command line to set the default language for your OS,[_1]and then run this LON-CAPA installation set-up script again.',"\n")."\n\n". $localecmd."\n\n". &mt('Stopping execution.')."\n"; exit; @@ -1950,6 +2090,7 @@ if (!$gotprereqs) { &mt('The following command can be used to install the package (and dependencies):')."\n\n". $updatecmd."\n\n"; if ($installnow eq '') { + print &mt('Stopping execution.')."\n"; exit; } else { print &mt('Run command? ~[Y/n~]'); @@ -1963,7 +2104,7 @@ if (!$gotprereqs) { &mt('Stopping execution.')."\n"; exit; } else { - ($distro,$gotprereqs,$localecmd,$packagecmd,$updatecmd,$installnow, + ($distro,$gotprereqs,$localecmd,$langcmd,$packagecmd,$updatecmd,$installnow, $mysqlrestart,$recommended,$dbh,$has_pass,$mysql_unix_socket, $has_lcdb,$downloadstatus,$filetouse,$production,$testing,$apachefw, $uses_systemctl,$hostname,$hostip,$sslhostsfiles,$has_std,$has_int, @@ -2117,6 +2258,12 @@ if ($callsub{'apache'}) { print_and_log(&mt('Skipping configuration of Apache web server.')."\n"); } +if ($callsub{'systemd'}) { + &check_systemd_update($distro); +} else { + print_and_log('Skipping systemd configuration update for web server'); +} + if ($callsub{'apachessl'}) { my $targetdir = '/etc/httpd/conf.d'; if ($distro =~ /^(suse|sles)/) { @@ -2240,7 +2387,7 @@ if ($callsub{'firewall'}) { 'ssh, http')."\n"; } else { my $version; - if ($distro =~ /^(redhat|centos)(\d+)/) { + if ($distro =~ /^(redhat|centos|rocky|alma)(\d+)/) { $version = $1; } if ($version > 5) { @@ -2271,7 +2418,7 @@ if ($callsub{'download'}) { print &mt('LON-CAPA is available for download from: [_1]', 'http://install.loncapa.org/')."\n"; if (!-e '/etc/loncapa-release') { - &print_and_log(&mt('LON-CAPA is not yet installed on your system.')."\n\n"; + &print_and_log(&mt('LON-CAPA is not yet installed on your system.')."\n\n"); unless ($filetouse) { &print_and_log(&mt('You may retrieve the source for LON-CAPA by executing:')."\n". "wget http://install.loncapa.org/versions/$lctarball\n"); @@ -2330,10 +2477,18 @@ if ($have_tarball && !$updateshown) { $lc_uses_systemctl = 1; } $uses_sudo = 1; + } elsif ($distro =~ /^debian(\d+)$/) { + if ($1 >= 10) { + $lc_uses_systemctl = 1; + } } elsif ($distro =~ /^sles(\d+)$/) { if ($1 > 12) { $lc_uses_systemctl = 1; } + } elsif ($distro =~ /^fedora(\d+)$/) { + if ($1 > 25) { + $lc_uses_systemctl = 1; + } } if (!-e '/etc/loncapa-release') { print &mt('If you are now ready to install LON-CAPA, enter the following commands:')."\n\n"; @@ -2450,6 +2605,29 @@ sub build_and_install_mod_auth_external > #define SERVER_UIDS $num /* user "www" */ ENDPATCH + my $patch_code = <<"ENDPATCH"; +127a128 +> #include +214a216 +> #include +566c568 +< check_fails() +--- +> int check_fails() +589c591 +< log_failure() +--- +> void log_failure() +629c631 +< snooze(int seconds) +--- +> void snooze(int seconds) +653c655 +< main(int argc, char **argv) +--- +> int main(int argc, char **argv) +ENDPATCH + if (! -e "/usr/bin/patch") { print_and_log(&mt('You must install the software development tools package: [_1], when installing Linux.',"'patch'")."\n"); print_and_log(&mt('Authentication installation not completed.')."\n"); @@ -2460,9 +2638,17 @@ ENDPATCH return; } my $dir = "/tmp/pwauth-2.2.8"; + my $patchedok; if (open(PATCH,"| patch $dir/config.h")) { print PATCH $patch; close(PATCH); + if (open(PATCH,"| patch $dir/pwauth.c")) { + print PATCH $patch_code; + close(PATCH); + $patchedok = 1; + } + } + if ($patchedok) { print_and_log("\n"); ## ## Compile patched pwauth @@ -2533,7 +2719,8 @@ sub kill_extra_services { &print_and_log(&mt('Removing [_1] from startup.',$service)."\n"); if ($distro =~ /^(?:debian|ubuntu)(\d+)/) { my $version = $1; - if (($distro =~ /^ubuntu/) && ($version > 16)) { + if ((($distro =~ /^ubuntu/) && ($version > 16)) || + (($distro =~ /^debian/) && ($version >= 10))) { if (ref($uses_systemctl) eq 'HASH') { if ($uses_systemctl->{$service}) { if (`systemctl is-enabled $service`) { @@ -2603,21 +2790,23 @@ CREATE TABLE IF NOT EXISTS metadata (tit sub setup_mysql_permissions { my ($dbh,$has_pass,$mysql_unix_socket,@mysql_lc_commands) = @_; - my ($mysqlversion,$mysqlsubver,$mysqlname) = &get_mysql_version(); + my ($mysqlversion,$mysqlminorversion,$mysqlsubver,$mysqlname) = &get_mysql_version(); my ($usescreate,$usesauth,$is_mariadb,$hasauthcol,@mysql_commands); if ($mysqlname =~ /^MariaDB/i) { $is_mariadb = 1; - if ($mysqlversion >= 10.4) { + if ((($mysqlversion == 10) && ($mysqlminorversion >= 4)) || ($mysqlversion >= 11)) { $usescreate = 1; - } elsif ($mysqlversion >= 10.2) { + } elsif (($mysqlversion == 10) && ($mysqlminorversion >= 2)) { $usesauth = 1; - } elsif ($mysqlversion >= 5.5) { + } elsif (($mysqlversion == 5) && ($mysqlminorversion >= 5)) { $hasauthcol = 1; } } else { - if (($mysqlversion > 5.7) || (($mysqlversion == 5.7) && ($mysqlsubver > 5))) { + if (($mysqlversion > 5) || (($mysqlminorversion == 5) && ($mysqlminorversion > 7)) || + (($mysqlversion == 5) && ($mysqlminorversion == 7) && ($mysqlsubver > 5))) { $usesauth = 1; - } elsif (($mysqlversion >= 5.6) || (($mysqlversion == 5.5) && ($mysqlsubver >= 7))) { + } elsif (($mysqlversion == 5) && + (($mysqlminorversion >= 6) || (($mysqlminorversion == 5) && ($mysqlsubver >= 7)))) { $hasauthcol = 1; } } @@ -2731,17 +2920,129 @@ sub new_mysql_rootpasswd { } sub get_mysql_version { - my ($version,$subversion,$name); + my ($version,$minorversion,$subversion,$name); if (open(PIPE," mysql -V |")) { my $info = ; chomp($info); close(PIPE); - ($version,$subversion,$name) = ($info =~ /(\d+\.\d+)\.(\d+)(?:\-?(\w*),|)/); + ($version,$minorversion,$subversion,$name) = ($info =~ /(\d+)\.(\d+)\.(\d+)(?:\-?(\w*),|)/); } else { print &mt('Could not determine which version of MySQL is installed.'). "\n"; } - return ($version,$subversion,$name); + return ($version,$minorversion,$subversion,$name); +} + +sub check_systemd_update { + my ($distro) = @_; + my ($use_systemctl,$service); + $service = 'apache2.service'; + if ($distro =~ /^ubuntu(\w+)/) { + if ($1 >= 16) { + $use_systemctl = 1; + } + } elsif ($distro =~ /^debian(\w+)/) { + if ($1 >= 9) { + $use_systemctl = 1; + } + } elsif ($distro =~ /^fedora(\d+)/) { + $service = 'httpd.service'; + if ($1 >= 16) { + $use_systemctl = 1; + } + } elsif ($distro =~ /^(?:centos|rhes|scientific|oracle|rocky|alma)(\d+)/) { + $service = 'httpd.service'; + if ($1 >= 7) { + $use_systemctl = 1; + } + } elsif ($distro =~ /^sles(\d+)/) { + if ($1 >= 12) { + $use_systemctl = 1; + } + } elsif ($distro =~ /^suse(\d+)/) { + if ($1 >= 13) { + $use_systemctl = 1; + } + } + if ($use_systemctl) { + my $needsupdate = &check_systemd_security($distro); + if ($needsupdate) { + if (!-d '/etc/systemd/system/'.$service.'.d') { + mkdir '/etc/systemd/system/'.$service.'.d', 0755; + } + if (-d '/etc/systemd/system/'.$service.'.d') { + if (-e '/etc/systemd/system/'.$service.'.d/override.conf') { + if (open(my $fh,'<','/etc/systemd/system/'.$service.'.d/override.conf')) { + my ($inservice,$addservice,$protectoff,$linenum,$change,@lines); + while (my $entry = <$fh>) { + $linenum ++; + chomp($entry); + if ($entry eq '[Service]') { + if (!$protectoff) { + $inservice = $linenum; + push(@lines,$entry); + } else { + $addservice = 1; + next; + } + } + if ($entry =~ /^ProtectHome\s*=\s*([\w-]+)\s*$/) { + my $value = $1; + if ($protectoff) { + next; + if (lc($value) eq 'no') { + $protectoff = $linenum; + push(@lines,$entry); + } else { + if ($protectoff) { + next; + } else { + push(@lines,'ProtectHome=no'); + $protectoff = $linenum; + $change = $linenum; + } + } + } + } + } + close($fh); + if ($addservice || $change || !$protectoff) { + if (open(my $fh,'>','/etc/systemd/system/'.$service.'.d/override.conf')) { + if ($addservice) { + print $fh "[Service]\n"; + } + foreach my $entry (@lines) { + print $fh "$entry\n"; + } + close($fh); + print_and_log('Updated /etc/systemd/system/'.$service.'.d/override.conf'); + system('systemctl daemon-reload'); + } else { + print_and_log('Could not open /etc/systemd/system/'.$service.'.d/override.conf for writing.'); + } + } else { + print_and_log('No change needed in /etc/systemd/system/'.$service.'.d/override.conf'); + } + } else { + print_and_log('Could not open /etc/systemd/system/'.$service.'.d/override.conf for reading.'); + } + } else { + if (open(my $fh,'>','/etc/systemd/system/'.$service.'.d/override.conf')) { + print $fh '[Service]'."\n".'ProtectHome=no'."\n"; + close($fh); + print_and_log('Created /etc/systemd/system/'.$service.'.d/override.conf'); + system('systemctl daemon-reload'); + } + } + } else { + print_and_log('No /etc/systemd/system/'.$service.'.d directory exists and creating one failed,'); + } + } else { + print_and_log('No update needed to systemd security settings for Apache web server.'); + } + } else { + print_and_log('No update needed to systemd, as this Linux distro does not use systemctl'); + } } ########################################################### @@ -3322,11 +3623,13 @@ sub copy_apache2_debconf { $distname = $1; $version = $2; } - if (($distname eq 'ubuntu') && ($version > 12)) { + if ((($distname eq 'ubuntu') && ($version > 12)) || + (($distname eq 'debian') && ($version >= 10))) { $defaultconfig = "$apache2_sites_enabled_dir/000-default.conf"; } my ($skipconf,$skipsite,$skipstatus); - if (($distname eq 'ubuntu') && ($version > 12)) { + if ((($distname eq 'ubuntu') && ($version > 12)) || + (($distname eq 'debian') && ($version >= 10))) { my $apache2_conf_enabled_dir = '/etc/apache2/conf-enabled'; my $apache2_conf_available_dir = '/etc/apache2/conf-available'; my $defaultconf = $apache2_conf_enabled_dir.'/loncapa.conf'; @@ -3479,7 +3782,7 @@ sub copy_apache2_debconf { } } } - if ($distname eq 'ubuntu') { + if (($distname eq 'ubuntu') || ($distname eq 'debian')) { my $sitestatus = "$apache2_mods_available_dir/status.conf"; my $stdstatus = "$instdir/debian-ubuntu/status.conf"; if ((-e $sitestatus) && (-e $stdstatus)) {