19 Commits (1054cb4d74dfd43912a4fe7fc64c7e19f0253069)

Author	SHA1	Message	Date
Guillem Jover	2665215e64	TT#51701 Switch from deprecated /var/run to /run ... Change-Id: I657b18e6f064d93eeb53d8ab28976b4f647b95d7	7 years ago
Guillem Jover	9aa94b0319	Revert "TT#7570 Add /usr to the list of directories to manage configs for" ... This reverts commit 55c5c6df89. We need to inject scripts that requires ngcpcfg services files to be executed, which does not work because those are only honored for /etc pathnames. Instead we will just create a symlink back to /etc where we will install all the needed scripts. Change-Id: I66b61dea93ed320117bbdf019a4c0a4b2582042f	7 years ago
Guillem Jover	55c5c6df89	TT#7570 Add /usr to the list of directories to manage configs for ... The monit-services OCF Resource Agent for pacemaker needs to be installed there. Ideally we would not need this, but as this is the only location allowed by pacemaker, let's add it, even if we might at some point end up not using it, as we can just not install any templates in those directories. Change-Id: Ib14b68388f018b45bc4d7cf6895ca17d0fc802a3	7 years ago
Richard Fuchs	92dccb4b10	TT#55162 add ngcp-admin group ... according to security framework spec 5.5.4 Allow r/w access /etc/ngcp-config/config.yml for users in security domain ngcp-admin This file contains operational configuration data of the NGCP system. Reading and editing it is part of day-to-day operations. As such it has to be read- and writable by users in security domain ngcp-admin. It is also readable by users of any other security domain. This file is also read by many NGCP processes. The current default setup of the NGCP does not implement permissions as required by tightened user security. Required permission settings have to be applied manually issuing command: chgrp ngcp-admin /etc/ngcp-config/config.yml Security domain: ngcp-admin User ownership: root Group ownership: ngcp-admin File permissions: 664 IMPACT: Configuration data can be edited by all users in group ngcp-admin, the sipwise user, and user root. If for some reason (e.g. after upgrade) the proposed settings are reverted to default settings, this does not pose a security risk. However, write access to configuration data in this file will be denied to named users. 5.5.5 Allow r/w access to /etc/ngcp-config/network.yml for users in security domain ngcp-admin This file contains information about the network configuration of the NGCP cluster. This information should not frequently change. Nevertheless, this file and its content is meant for the operator and as such is read- and writable by users in security domain ngcp-admin. It is also readable by users of any other security domain. This file is also read by many NGCP processes. The current default setup of the NGCP does not implement permissions as required by tightened user security. Required permission settings have to be applied manually issuing command: chgrp ngcp-admin /etc/ngcp-config/network.yml Security domain: ngcp-admin User ownership: root Group ownership: ngcp-admin File permissions: 664 IMPACT: Configuration data can be edited by all users in group ngcp-admin, the sipwise user, and user root. If for some reason (e.g. after upgrade) the proposed settings are reverted to default settings, this does not pose a security risk. However, write access to configuration data in this file will be denied to named users. 5.5.6 Restrict access to /etc/ngcp-config/constants.yml to users in security domain root This file contains values set during the initialization of the NGCP system. It contains passwords used by different NGCP functions to connect to other secured subsystems (e.g. DB or lawful intercept). As such the file has a high security impact and is read- and writeable to users of security domain root only. The current default setup of the NGCP does not implement permissions as required by tightened user security. Required permission settings have to be applied manually issuing command: chmod 600 /etc/ngcp-config/constants.yml Security domain: root User ownership: root Group ownership: root File permissions: 600 IMPACT: Data in this configuration file are usually entered once during commissioning of the platform. Only users root or sipwise can edit or read this file. The customer’s named users have no access to this data. If for some reason (e.g. after upgrade) the proposed settings are reverted to default settings, this poses a security risk as credentials used internally may be leaked to unprivileged users. Change-Id: I49a2994a227b9c296966c805c9370ae3b067de12	7 years ago
Alexander Lutay	84e3367d69	TT#8405 Enable YML schema validation on 'ngcpcfg check/build/apply' ... Corrupted YML schema is the popular way for time spending on debug mystery behaviour on NGCP. We have validation schema since mr4.5 and it coverts all YML files nowadays. Let's enable it by default, since in field testing shows good results. In case of the inconsistent schema, apply is still possible with ngcpcfg option '--no-validate': > root@sp1:~# ngcpcfg --no-validate apply 'some changes with inconsistent schema' > 2018-08-29 13:12:27: Error: Invalid schema detected for /etc/ngcp-config/config.yml > /etc/ngcp-config/config.yml#0: INVALID > - [/apps] Expected required key 'malicious_call' > > DANGEROUS ZONE: invalid configs detected, continue anyway due to option '--no-validate' > Checking state of local storage: > ... Change-Id: Ifa51c9e0c2fd396696f73760d89eadcbe9763456	8 years ago
Alexander Lutay	2c03892233	MT#17781 Define NGCPCTL_BASE to fix PRO/Carrier installation ... As soon as we merge 2e74d71 to ngcpcfg.git we cannot install PRO/Carrier: > /usr/share/ngcp-ngcpcfg/functions/ha_features: line 54: cd: /etc /var: No such file or directory Change-Id: I124adc4e42d3c87d0f4fbf19b076986d757cff39	10 years ago
Alexander Lutay	2e74d71971	MT#17781 Enable /var handling via ngcpcfg for sipwise user bash aliases ... Change-Id: I7cdfc58c672acdbe993d2a6ea98762c4f930babc	10 years ago
Michael Prokop	c9b62658a1	MT#15973 Report in 'status' action when build/apply run is needed ... In a previous implementation using timestamps we ran into timing problems on slower systems. So instead lets record the git commit ID of the latest ngcpcfg commit and check whether we have a match between this commit and an according ngcpcfg build. If the "ngcpcfg build" was executed without an "ngcpcfg commit" before then we mark it as dirty since we don't have an according git commit available for testing against. Since that's a common workflow we don't report it as a real problem though, instead we inform the user using: | OK: nothing to build (latest build newer than latest commit) As we commit AFTER the build in the apply action we can use a workaround for this situation, so build and commit state match with each other in that case then. Change-Id: I48e32db6f42b53fe97a0b88805e7ddbee8576133	11 years ago
Michael Prokop	0d828d4108	MT#15973 Revert "MT#15973 Report in 'status' action when build/apply run is needed" ... This reverts commit db373d3927. Conflicts: etc/ngcp-config/ngcpcfg.cfg Until we've a working solution for this let's revert the broken change so we avoid this being a release stopper. Change-Id: If03d9b3913de23c698b430d583dc7babfcc4ff04	11 years ago
Guillem Jover	301cb7cd3c	MT#16387 Report pending requested reboots ... There are some times when a configuration, service or system upgrade requires a reboot to take effect. When a component requires a reboot, it will record this fact in the file system through the file «/var/run/reboot-required», and «ngcpcfg status» will notify the user that a reboot has been requested. We use the «/var/run/reboot-required» because it is already being used in the unattended-upgrades package on Debian/Ubuntu which does something similar. Change-Id: I43997bfb83892f67bd57bb55ad3ec0a41a5e088d	11 years ago
Michael Prokop	db373d3927	MT#15973 Report in 'status' action when build/apply run is needed ... If the latest git commit has a newer timestamp than our latest "build" action then a "build" (or apply) run is required, inform the user about it. Change-Id: I83e2ff47ba54da733d368d78b6616d13d31a66d4	11 years ago
Alexander Lutay	34f731bb1d	MT#13669 Add YML configs validation accordingly to kwalify schema ... Disabled by default as we need a time to check it carefuly. Also we need to solve the "tilda" problem reported upstream: https://github.com/eserte/p5-Kwalify/issues/1 Change-Id: Ia2c3d48f0ac6fc6ac9899d44f4291544373806d9	11 years ago
Michael Prokop	2deea0fb39	MT#9557 Provide timestamps in console output ... Change-Id: I5be915fa876014cbb9c792b03be325d6595daac9	11 years ago
Victor Seva	3aa645c003	MT#10059 move /etc/ngcp-config/generated.yml to /etc/ngcp-rtpengine-daemon ... Change-Id: I99d104fd24d9c2d0d8f1f4303f09d04e8aeb68a7	12 years ago
Richard Fuchs	3b030ceb89	MT#10059 support configurable rtp interfaces ... adds get_all_rtp_for_host helper script update sync-db to process rtp_interface preference Squashed commit of the following: commit f2be1ea221cd9da2e4d400bcfcac4baf914563db Author: Richard Fuchs <rfuchs@sipwise.com> Date: Thu Jan 22 11:59:27 2015 -0500 implement db syncing for rtp_interface enum prefs commit 584f52c6b0094c2ca01641cdac898436f3efce86 Author: Richard Fuchs <rfuchs@sipwise.com> Date: Thu Jan 22 10:32:08 2015 -0500 change name of generated.yml commit b980dff6a106256264c81ae1bf74aba20bf32383 Author: Richard Fuchs <rfuchs@sipwise.com> Date: Wed Jan 21 12:46:07 2015 -0500 MT#10059 make sync-db load generated yml commit 92d17d8c1895f4b04663a3e485be80402382522d Author: Richard Fuchs <rfuchs@sipwise.com> Date: Wed Jan 21 12:32:58 2015 -0500 fix comment syntax error commit af8500dc315b6c142250ab0119179cb1adc67e8c Author: Richard Fuchs <rfuchs@sipwise.com> Date: Wed Jan 21 12:04:25 2015 -0500 MT#10059 support undefined hostname commit 84b8a91de59ad8ae8ad944a784850e8ac08d94fe Author: Richard Fuchs <rfuchs@sipwise.com> Date: Wed Jan 21 11:57:16 2015 -0500 MT#10059 support plain list output format commit 2b9ec081c27842dc6839218f4e5c22b761d38550 Author: Richard Fuchs <rfuchs@sipwise.com> Date: Wed Jan 21 11:38:04 2015 -0500 MT#10059 adding get_all_rtp_for_host helper	12 years ago
Alexander Lutay	f8326b4aa8	MT#8763 Add backward compatibility for mr3.4->mr3.5 PRO upgrade ... Otherwise we faced the error during upgrading the second node (sp2): > Script started on Fri 29 Aug 2014 10:34:23 AM CEST > Not prompting user for approval because environment variable FORCE_UPGRADE is present. > /usr/share/ngcp-upgrade-trunk/upgrade-stable-to-trunk - start on Fri Aug 29 10:34:23 CEST 2014 > Looks like you are running Debian 7 already. > Checking for (possibly) outstanding ngcpcfg changes > /usr/share/ngcp-ngcpcfg/functions//main: line 78: TEMPLATE_POOL: unbound variable The node sp1 has been upgraded succesfully but new config ngcpcfg.cfg has been delievered to sp2 and old ngcpcfg framework failed to start with new config. Those workaround can be reverted as soon as next LTS release is released. Change-Id: Idb1f4ca05e88e7a30054ace0c0b47dc0eadf1b7a	12 years ago
Victor Seva	5ed308c1a0	MT#8763 allow multiple config directories on templates not only "/etc" ... Change-Id: I1c8fc5fd45a0c34ba7542ddc6ce24793bd568cb5	12 years ago
Michael Prokop	c3e1cb68d4	support additional configuration yml files via configuration directory ... Files in configuration directory EXTRA_CONFIG_DIR (being /etc/ngcp-config/config.d/ by default) with the suffix yml (so e.g. a file named pbx.yml can be shipped by an external Debian package) are additionally taken into consideration as main configuration files. Those extra configuration file(s) have higher precedence than the other yml configuration files (config.yml, network.yml,...), *except* for constants.yml which has the power to override all settings, including the ones from files inside EXTRA_CONFIG_DIR. Closes: sipwise-#3059	13 years ago
Michael Prokop	3436c08361	Initial checkin	13 years ago