debian/postinst

   1 #!/bin/sh
   2
   3 set -e
   4
   5 [ "$DEBIAN_SCRIPT_DEBUG" ] && set -vx
   6
   7 case "$1" in
   8         configure)
   9         # continue below
  10         ;;
  11
  12         abort-upgrade|abort-remove|abort-deconfigure)
  13         exit 0
  14         ;;
  15
  16         *)
  17         echo "postinst called with unknown argument \`$1'" >&2
  18         exit 0
  19         ;;
  20 esac
  21
  22
  23 # Load debconf
  24 . /usr/share/debconf/confmodule
  25
  26 # Include CARNet functions
  27 . /usr/share/carnet-tools/functions.sh
  28
  29 PKG="mod-security-cn"
  30 A2DIR="/etc/apache2"
  31 CONFDIR="$A2DIR/conf.d"
  32 CONF="$CONFDIR/apache2.conf"
  33 A2MODEDIR="$A2DIR/mods-enabled"
  34 MODSECDIR="$A2DIR/mod-security"
  35 MODSECCONF="$MODSECDIR/mod-security-cn.conf"
  36 MODSECTDIR="/usr/share/mod-security-cn"
  37
  38 temp_files=
  39 need_restart=0
  40
  41
  42 # cleanup()
  43 #
  44 #   Cleanup all temp files or directories.
  45 #
  46 cleanup () {
  47
  48         local item
  49
  50         if [ -n "$temp_files" ]; then
  51             for item in $temp_files; do
  52                 if [ -e "$item" ]; then
  53                     rm -rf $item
  54                 fi
  55             done
  56         fi
  57 }
  58
  59 # chk_conf_tag ()
  60 #
  61 #   Check if configuration file has CARNet package info lines.
  62 #   return:  $RET => 0 - tagged
  63 #                    1 - file does not exists
  64 #                    2 - file exists, but it is not tagged
  65 #
  66 chk_conf_tag () {
  67
  68         local conf_file
  69         conf_file="$1"
  70         RET=1
  71
  72         if [ -f "$conf_file" ]; then
  73             if egrep -q "^## Begin - Generated by CARNet package mod-security-cn$" "$conf_file"; then
  74                 RET=0
  75             else
  76                 RET=2
  77             fi
  78         fi
  79 }
  80
  81 # install_conf()
  82 #
  83 #   Install specified ModSecurity configuration file.
  84 #
  85 install_conf () {
  86
  87         local conftmpl conf
  88         conftmpl="$MODSECTDIR/$1"
  89         conf="$MODSECDIR/$1"
  90
  91         if [ ! -e "$conf" ]; then
  92             cp_echo "CN: Creating new configuration file $conf"
  93             cp "$conftmpl" "$conf"
  94             need_restart=1
  95         else
  96             if ! cmp -s "$conf" "$conftmpl"; then
  97                 cp_echo "CN: Updating configuration file $conf"
  98                 cp "$conftmpl" "$conf"
  99                 need_restart=1
 100             else
 101                 cp_echo "CN: $conf already exists." 1>&2
 102             fi
 103         fi
 104 }
 105
 106
 107 # Set trap for deleting all temp files.
 108 #
 109 trap cleanup 0 1 2 15
 110
 111
 112 # Enable ModSecurity and unique_id Apache2 modules.
 113 #
 114 if [ -e "$CONF" ]; then
 115
 116         # Enable mod-security.load
 117         if [ ! -e "$A2MODEDIR/mod-security.load" ]; then
 118             cp_echo "CN: Enabling ModSecurity module for Apache2 web server."
 119             a2enmod mod-security >/dev/null || true
 120             need_restart=1
 121         fi
 122
 123         # Enable unique_id.load
 124         if [ ! -e "$A2MODEDIR/unique_id.load" ]; then
 125             cp_echo "CN: Enabling unique_id module for Apache2 web server."
 126             a2enmod unique_id >/dev/null || true
 127             need_restart=1
 128         fi
 129 fi
 130
 131
 132 # Generate ModSecurity configuration file and activate RBL lookup
 133 # for ModSecurity if needed.
 134 #
 135 chk_conf_tag "$MODSECCONF"
 136 if [ $RET -eq 0 ] || [ $RET -eq 1 ]; then
 137
 138         # Create /etc/apache2/conf.d/ directory if missing.
 139         if [ ! -d "$CONFDIR" ]; then
 140             cp_echo "CN: Creating configuration directory $CONFDIR/"
 141             mkdir -p $CONFDIR/
 142         fi
 143
 144         # Create /etc/apache2/mod-security/ directory if missing.
 145         if [ ! -d "$MODSECDIR" ]; then
 146             cp_echo "CN: Creating ModSecurity configuration directory $MODSECDIR/"
 147             mkdir -p $MODSECDIR/
 148         fi
 149
 150         install_conf "mod-security-cn.conf"
 151
 152         db_get mod-security-cn/rbl || true
 153         if [ "$RET" = "true" ]; then
 154
 155             cp_echo "CN: Enabling ModSecurity RBL lookup in $MODSECCONF"
 156
 157             # Add RBL configuration.
 158             chk_conf_tag "$MODSECDIR/rbl_lookup.conf"
 159             if [ $RET -eq 0 ] || [ $RET -eq 1 ]; then
 160                 install_conf "rbl_lookup.conf"
 161             fi
 162         else
 163
 164             cp_echo "CN: Disabling ModSecurity RBL lookup in $MODSECCONF"
 165
 166             # Remove RBL configuration.
 167             out=$(mktemp $MODSECCONF.XXXXXX)
 168             temp_files="${temp_files} ${out}"
 169             sed -r "s/^([[:space:]]*)(Include[[:space:]]+\/etc\/apache2\/mod-security\/rbl_lookup\.conf)$/\1#\2/I" \
 170                 "$MODSECCONF" > "$out"
 171             mv -f "$out" "$MODSECCONF"
 172             if [ -f "$out" ]; then rm -f $out; fi
 173
 174             chk_conf_tag "$MODSECDIR/rbl_lookup.conf"
 175             if [ $RET -eq 0 ] || [ $RET -eq 1 ]; then
 176                 rm -f "$MODSECDIR/rbl_lookup.conf"
 177             fi
 178
 179             need_restart=1
 180         fi
 181
 182         # Enable ModSecurity configuration.
 183         if [ ! -e "$CONFDIR/mod-security-cn.conf" ]; then
 184             cp_echo "CN: Enabling ModSecurity configuration."
 185             ln -fs "$MODSECCONF" "$CONFDIR/."
 186             need_restart=1
 187         fi
 188 fi
 189
 190 db_stop || true
 191
 192
 193 # Restart Apache2 web server if needed.
 194 #
 195 if [ $need_restart -eq 1 ]; then
 196
 197         # Check Apache2 web server configuration.
 198         if /usr/sbin/apache2ctl configtest 2>/dev/null; then
 199
 200             # Restart Apache2 web server.
 201             if [ -x "/etc/init.d/apache2" ]; then
 202                 if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
 203                     invoke-rc.d apache2 restart || true
 204                 else
 205                     /etc/init.d/apache2 restart || true
 206                 fi
 207             fi
 208         else
 209
 210             # Something is broken.
 211             cp_echo "CN: Your Apache2 configuration is broken."
 212             cp_echo "CN: Please, check the service after the installation finishes!"
 213         fi
 214 fi
 215
 216
 217 # Mail root
 218 #
 219 cp_mail "$PKG"
 220
 221 exit 0