Project

General

Profile

1
#
2
# control-services.pl -- Monitor a listed set of services to be sure
3
#             they are running.  If not running, modify the DNS system
4
#             to remove them from the lookup for that service
5
#
6
#  '$RCSfile$'
7
#  Copyright: 2005 Regents of the University of California 
8
#
9
#   '$Author: jones $'
10
#     '$Date: 2005-10-13 15:43:22 -0700 (Thu, 13 Oct 2005) $'
11
# '$Revision: 2674 $' 
12
#
13
#  This program is free software; you can redistribute it and/or modify
14
#  it under the terms of the GNU General Public License as published by
15
#  the Free Software Foundation; either version 2 of the License, or
16
#  (at your option) any later version.
17
#
18
#  This program is distributed in the hope that it will be useful,
19
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
20
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
21
#  GNU General Public License for more details.
22
#
23
#  You should have received a copy of the GNU General Public License
24
#  along with this program; if not, write to the Free Software
25
#  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
26
#
27

    
28
Welcome to the control-services.pl program.
29

    
30
This program is designed to run as a script under the Hobbit system monitoring
31
program (http://hobbitmon.sourceforge.net/).  When Hobbit is configured 
32
properly, this script will be called to make changes to the DNS services that
33
are registered in your DNS server.  The changes are accomplished using 
34
Dynamic DNS (DDNS).  The system is intended to help manage a set of services
35
that are running on several hosts in round-robin DNS fashion and to remove
36
inaccessible hosts when they are detected as failed, and restore them when 
37
they recover.
38

    
39
Configuration consists of:
40
  1) Install and configure Hobbit (see http://hobbitmon.sourceforge.net)
41
  2) Install and configure BIND for DDNS (see below)
42
  3) Install this script (see below)
43

    
44
3) Setting up BIND for DDNS
45
-----------------------------
46

    
47
You need to configure BIND to accept signed dynamic updates for your zone.  
48

    
49
    a) Create a key using dnssec-keygen.
50

    
51
        % dnssec-keygen  -b 256 -n HOST -a HMAC-MD5 example
52

    
53
        This will create 2 key files in different formats
54

    
55
    b) Add the key to your named.conf file in a block (copy it from either 
56
       of the two generated key files):
57

    
58
        key "examplekey" {
59
            algorithm       hmac-md5;
60
            secret "0QI/OEYtZA5aI6rpMTwrodfMpg1xxCaDHdR/tvI9Lgc=";
61
        };
62

    
63
    c) For each zone that you want to enable updates, add this key to
64
       your 'allow-update' and 'allow-transfer' blocks:
65
    
66
       zone "example.com" {
67
           type master;
68
           file "/var/named/example.com.zone"
69
           allow-update ( key examplekey; };
70
           allow-transfer { key examplekey; };
71
       }
72

    
73
    d) Reload named to reload your configuration (killall -HUP named).
74

    
75
3) Install the control-services.pl script
76
-----------------------------------------
77
Prerequisites:
78

    
79
    The following Perl Modules are required:
80
        Net::DNS
81
        LWP::UserAgent
82
        HTTP::Request
83
        HTTP::Response
84
        URI::URL
85
    These modules are available through CPAN, and are most easily gotten using
86
    the CPAN shell (as root, "perl -MCPAN -e shell").
87

    
88
Installation:
89
  1) copy the file to a commonly accessible location (typically /usr/local/bin)
90
  2) change ownership to the web-server user
91
  3) copy the configuration file to /etc and customize for your situation
92
     -- set the key name and value from your DDNS server
93
     -- set domain and other parameters properly
94
  4) change ownership of the config file to the web-server user
95
  5) restrict access to the config file to only the web server user
96
  6) Create the log file directory, writable by the hobbit user
97
  7) Place alert rules in the hobbit/server/etc/hobbit-alerts.cfg file that
98
     use the script.  See the hobbit-alerts.cfg man page for details. An
99
     example rule might be:
100

    
101
     HOST=ldap.example.com SERVICE=ldap RECOVERED
102
          SCRIPT /usr/local/bin/control-services.pl ldap FORMAT=SCRIPT REPEAT=1
103

    
104

    
105
IMPORTANT NOTE
106
----------------
107
Make sure that the configuration file is only readable by the webserver user
108
and writable by root. The config file contains the key to allow updates
109
to your DNS server, so be sure the config file is secure.
110

    
111
Enjoy!
(1-1/4)