So I ran across your posts last night and decided that would be a nice thing to have for my network. What follows is two possible solutions. (I personally did not want to use a NFS type setup, if you are able to it would greatly ease the setup)
The first, and very high on the "hack" scale involves just modifying some defines in make.conf:
Code: Select all
FETCHCOMMAND="ssh distfiles@nada 'umask 022; /usr/bin/wget -nc -t 5 --passive-ftp \${URI} -P /home/distfiles/public_html/distfiles/' && echo \${URI} | /bin/sed -r 's/.*\\//http:\\/\\/nada\\/~distfiles\\/distfiles\\//' | /usr/bin/wget -t 5 --passive-ftp -P \${DISTDIR} -i -"
RESUMECOMMAND="ssh distfiles@nada 'umask 022; /usr/bin/wget -c -t 5 --passive-ftp \${URI} -P /home/distfiles/public_html/distfiles/' && echo \${URI} | /bin/sed -r 's/.*\\//http:\\/\\/nada\\/~distfiles\\/distfiles\\//' | /usr/bin/wget -t 5 --passive-ftp -P \${DISTDIR} -i -"
GENTOO_MIRRORS="http://nada/~distfiles <other mirrors>"
distfiles is a user on nada (my portage server) that has write permission to /home/distfiles/public_html/distfiles (my distfiles directory).
As I was going to work in auto keychain initilization and latching I decided on another tact, but this is still a very usable option. (assuming that I actually cp/pasted correctly)
My current method:
This is not yet secure enough for public network usage, I am running everything on its own locked out subnet. The security aspect is something I am still grapling with, so if anyone has any suggestions they would be welcome.
In addition to hacking the make.conf settings on your "client" systems, it is necessary to have php enabled on the webserver of the serving system.
first the client make.conf
Code: Select all
FETCHCOMMAND="sudo -H -u distfiles /usr/bin/wget -t 5 --timeout=2700 http://nada/~distfiles/getdistfile2.php?url=\${URI} -P \${DISTDIR}"
RESUMECOMMAND="sudo -H -u distfiles /usr/bin/wget -c -t 5 --timeout=2700 http://nada/~distfiles/getdistfile2.php?url=\${URI} -P \${DISTDIR}"
GENTOO_MIRRORS="http://nada/~distfiles <other mirrors>"
I will get to the purpose of the sudo in a little bit. The purpose is for security, however it is not required, you could leave it out.
Onto that php page that is getting called on nada
Code: Select all
<?
$url = $_GET['url'];
if(substr_count($_SERVER["REMOTE_ADDR"], "192.168.1.") != 1)
{
echo "Invalid Remote Address!";
exit;
}
$exec_string = "/usr/local/phpbin/getdistfiles ";
$exec_arg = escapeshellcmd($url);
$output = exec("$exec_string $exec_arg");
header("Location: $output");
?>
And the file that php calls. (Exists in the only php executable directory because I have php safe mode on, if you don't, backticks or shell_exec would probably be easier)
The reason I put it in a tempfile rather than pass it directly to wget is to utilize wget's url parsing engine to hopefully strip out any command arguments that might be thrown in the requesting url from a rouge client system. This could be alot more robust.
Code: Select all
#!/bin/bash
umask 022 &>/dev/null
echo "$1" > /tmp/wgetfile 2>/dev/null
/usr/bin/wget -nc -c -t 5 --passive-ftp -i /tmp/wgetfile -P /home/distfiles/public_html/distfiles &>/dev/null
/bin/rm /tmp/wgetfile 2>/dev/null
echo $1 | /bin/sed -r 's/.*\//http:\/\/nada\/~distfiles\/distfiles\//'
Ok, so I think that covers the base of it. Onto the security.
The safe mode setting in php forced the external script, that really isn't a huge deal, as that bin directory is rather protected.
Apache security. The entire distfiles directory on the webserver is protected by a very strict .htaccess file restricted by IP and digested user/pass.
The user/pass combo is the reason I am using the sudo command in the client's make.conf. That user's home directory exists as a locked down read only directory with a .wgetrc file specifying the username and password needed to access nada's distfile directory.
What bothers me the most is that I needed to give apache the permissions to read/write into a directory that is not /tmp. There are a few solutions to this, but I haven't come accross something that I am very comfortable with yet.
I think that covers it. A few closing notes. I can think of a few better ways to do this if I was willing to hack the emerge scripts, however, I don't know python and do not forsee learning it this week. Actually, with seeming minor modification to emerge the entire portage proxy would become rather simple.
A side note to a dev or someone knowledgable in the ways of emerge. Why does emerge -f need to have root permissions? Shouldn't it be happy as long as the user running it has permission to write to the distfiles directory? What am I missing?
Any input or questions are welcome, as I am sure I forgot something.