Skip to content

Commit eaf0656

Browse files
yadvryadvr
committed
systemd: fix services to allow TLS configurations via java.security.ciphers
This fixes the management server and systemd services to allow the java.security.ciphers file to configure disabled TLS protocols and algorithms. This also cleans up systemd service files for agent and usage server. This fixes #3140 Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
1 parent e56c499 commit eaf0656

12 files changed

Lines changed: 40 additions & 182 deletions

‎client/conf/java.security.ciphers.in‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
1-
# Licensed to the Apache Software Foundation (ASF) under one
2-
# or more contributor license agreements. See the NOTICE file
3-
# distributed with this work for additional information
4-
# regarding copyright ownership. The ASF licenses this file
5-
# to you under the Apache License, Version 2.0 (the
6-
# "License"); you may not use this file except in compliance
7-
# with the License. You may obtain a copy of the License at
8-
#
9-
# http://www.apache.org/licenses/LICENSE-2.0
10-
#
11-
# Unless required by applicable law or agreed to in writing,
12-
# software distributed under the License is distributed on an
13-
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14-
# KIND, either express or implied. See the License for the
15-
# specific language governing permissions and limitations
16-
# under the License.
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
1717

1818
jdk.tls.disabledAlgorithms=SSLv2Hello, SSLv3, TLSv1, TLSv1.1, DH keySize < 128, RSA keySize < 128, DES keySize < 128, SHA1 keySize < 128, MD5 keySize < 128, RC4

‎debian/cloudstack-agent.postinst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ case "$1" in
2525
NEWCONFDIR="/etc/cloudstack/agent"
2626
CONFFILES="agent.properties log4j.xml log4j-cloud.xml"
2727

28+
mkdir -m 0755 -p /usr/share/cloudstack-agent/tmp
29+
2830
# Copy old configuration so the admin doesn't have to do that
2931
# Only do so when we are installing for the first time
3032
if [ -z "$2" ]; then

‎packaging/centos63/cloud-management.rc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ setJavaHome() {
7171
setJavaHome
7272

7373
JARS=$(ls /usr/share/cloudstack-management/lib/*.jar | tr '\n' ':' | sed s'/.$//')
74-
CLASSPATH="$JARS:$CLASSPATH"
74+
CLASSPATH="$JARS:$CLASSPATH:/usr/share/java/commons-daemon.jar"
7575

7676
start() {
7777
if [ -s "$PIDFILE" ] && kill -0 $(cat "$PIDFILE") >/dev/null 2>&1; then

‎packaging/centos7/cloud-agent.rc‎

Lines changed: 0 additions & 122 deletions
This file was deleted.

‎packaging/centos7/cloud.spec‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,6 @@ intelligent IaaS cloud implementation.
5959
%package management
6060
Summary: CloudStack management server UI
6161
Requires: java-1.8.0-openjdk
62-
Requires: apache-commons-daemon-jsvc
6362
Requires: python
6463
Requires: bash
6564
Requires: bzip2
@@ -425,6 +424,7 @@ if [ ! -d %{_sysconfdir}/libvirt/hooks ] ; then
425424
mkdir %{_sysconfdir}/libvirt/hooks
426425
fi
427426
cp -a ${RPM_BUILD_ROOT}%{_datadir}/%{name}-agent/lib/libvirtqemuhook %{_sysconfdir}/libvirt/hooks/qemu
427+
mkdir -m 0755 -p /usr/share/cloudstack-agent/tmp
428428
/sbin/service libvirtd restart
429429
/sbin/systemctl enable cloudstack-agent > /dev/null 2>&1 || true
430430

‎packaging/debian/init/cloud-management‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ if [ -f "$DEFAULT" ]; then
7575
fi
7676

7777
JARS=$(ls /usr/share/cloudstack-management/lib/*.jar | tr '\n' ':' | sed s'/.$//')
78-
CLASSPATH="$JARS:$CLASSPATH"
78+
CLASSPATH="$JARS:$CLASSPATH:/usr/share/java/commons-daemon.jar"
7979

8080
[ -f "$DAEMON" ] || exit 0
8181

‎packaging/systemd/cloudstack-agent.default‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@
1515
# specific language governing permissions and limitations
1616
# under the License.
1717

18-
JAVA=/usr/bin/java
19-
JAVA_HEAP_INITIAL=256m
20-
JAVA_HEAP_MAX=2048m
18+
JAVA_OPTS="-Djava.io.tmpdir=/usr/share/cloudstack-agent/tmp -Xms256m -Xmx2048m"
19+
20+
CLASSPATH="/usr/share/cloudstack-agent/lib/*:/usr/share/cloudstack-agent/plugins/*:/etc/cloudstack/agent:/usr/share/cloudstack-common/scripts"
21+
2122
JAVA_CLASS=com.cloud.agent.AgentShell
22-
JAVA_TMPDIR=/usr/share/cloudstack-agent/tmp

‎packaging/systemd/cloudstack-agent.service‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,8 @@ After=libvirtd.service
2323

2424
[Service]
2525
Type=simple
26-
EnvironmentFile=-/etc/default/cloudstack-agent
27-
ExecStart=/bin/sh -ec '\
28-
export ACP=`ls /usr/share/cloudstack-agent/lib/*.jar /usr/share/cloudstack-agent/plugins/*.jar 2>/dev/null|tr "\\n" ":"`; \
29-
export CLASSPATH="$ACP:/etc/cloudstack/agent:/usr/share/cloudstack-common/scripts"; \
30-
mkdir -m 0755 -p ${JAVA_TMPDIR}; \
31-
${JAVA} -Djava.io.tmpdir="${JAVA_TMPDIR}" -Xms${JAVA_HEAP_INITIAL} -Xmx${JAVA_HEAP_MAX} -cp "$CLASSPATH" $JAVA_CLASS'
26+
EnvironmentFile=/etc/default/cloudstack-agent
27+
ExecStart=/usr/bin/java $JAVA_OPTS -cp $CLASSPATH $JAVA_CLASS
3228
Restart=always
3329
RestartSec=10s
3430

‎packaging/systemd/cloudstack-management.default‎

Lines changed: 2 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -15,21 +15,8 @@
1515
# specific language governing permissions and limitations
1616
# under the License.
1717

18-
# Where your java installation lives
19-
#JAVA_HOME="/usr/lib/jvm/java"
18+
JAVA_OPTS="-Djava.security.properties=/etc/cloudstack/management/java.security.ciphers -Djava.awt.headless=true -Dcom.sun.management.jmxremote=false -Xmx2G -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/cloudstack/management/ -XX:ErrorFile=/var/log/cloudstack/management/cloudstack-management.err "
2019

21-
if [ -r "/etc/cloudstack/management/cloud.jks" ] ; then
22-
JAVA_OPTS="-Djava.awt.headless=true -Dcom.sun.management.jmxremote=false -Xmx2g -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/cloudstack/management/ -XX:PermSize=512M -XX:MaxPermSize=800m -Djavax.net.ssl.trustStore=/etc/cloudstack/management/cloud.jks -Djavax.net.ssl.trustStorePassword=vmops.com -Djava.security.properties=/etc/cloudstack/management/java.security.ciphers "
23-
else
24-
JAVA_OPTS="-Djava.awt.headless=true -Dcom.sun.management.jmxremote=false -Xmx2g -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/cloudstack/management/ -XX:PermSize=512M -XX:MaxPermSize=800m -Djava.security.properties=/etc/cloudstack/management/java.security.ciphers "
25-
fi
26-
27-
CLOUDSTACK_USER="cloud"
28-
29-
CLOUDSTACK_PID="/var/run/cloudstack-management.pid"
30-
31-
LOGDIR="/var/log/cloudstack/management"
32-
33-
CLASSPATH="/etc/cloudstack/management:/usr/share/cloudstack-common:/usr/share/cloudstack-management/setup:/usr/share/cloudstack-management:/usr/share/java/mysql-connector-java.jar:/usr/share/java/commons-daemon.jar"
20+
CLASSPATH="/usr/share/cloudstack-management/lib/*:/etc/cloudstack/management:/usr/share/cloudstack-common:/usr/share/cloudstack-management/setup:/usr/share/cloudstack-management:/usr/share/java/mysql-connector-java.jar"
3421

3522
BOOTSTRAP_CLASS=org.apache.cloudstack.ServerDaemon

‎packaging/systemd/cloudstack-management.service‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,14 +23,12 @@ After=syslog.target network.target
2323

2424
[Service]
2525
UMask=0022
26-
Type=forking
27-
Environment="NAME=cloudstack-management"
26+
Type=simple
27+
User=cloud
2828
EnvironmentFile=/etc/default/cloudstack-management
29-
ExecStartPre=/bin/bash -c "/bin/systemctl set-environment JAVA_HOME=$( readlink -f $( which java ) | sed s:bin/.*$:: )"
30-
ExecStartPre=/bin/bash -c "/bin/systemctl set-environment JARS=$(ls /usr/share/cloudstack-management/lib/*.jar | tr '\n' ':' | sed s'/.$//')"
31-
ExecStart=/usr/bin/jsvc -home "${JAVA_HOME}" -user "${CLOUDSTACK_USER}" -cp "${JARS}:${CLASSPATH}" -errfile "${LOGDIR}/${NAME}.err" -cwd "${LOGDIR}" -pidfile "${CLOUDSTACK_PID}" "${JAVA_OPTS}" "${BOOTSTRAP_CLASS}"
32-
ExecStop=/usr/bin/jsvc -cp "${JARS}:${CLASSPATH}" -pidfile "${CLOUDSTACK_PID}" -stop "${BOOTSTRAP_CLASS}"
33-
SuccessExitStatus=143
29+
WorkingDirectory=/var/log/cloudstack/management
30+
PIDFile=/var/run/cloudstack-management.pid
31+
ExecStart=/usr/bin/java $JAVA_OPTS -cp $CLASSPATH $BOOTSTRAP_CLASS
3432

3533
[Install]
3634
WantedBy=multi-user.target

0 commit comments

Comments
 (0)