Network UPS Tools User Manual
Network UPS Tools User Manual
Network UPS Tools User Manual
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>Network</strong> <strong>UPS</strong> <strong>Tools</strong> <strong>User</strong> <strong>Manual</strong> 46 / 84<br />
9.5.7 Conclusion<br />
SSL support should be considered stable but purposely under-documented since various bits of the implementation or configuration<br />
may change in the future. In other words, if you use this and it stops working after an upgrade, come back to this file to find<br />
out what changed.<br />
This is why the other documentation doesn’t mention any of these directives yet. SSL support is a treat for those of you that<br />
RTFM.<br />
There are also potential licensing issues for people who ship binary packages since NUT is GPL and OpenSSL is not compatible<br />
with it. You can still build and use it yourself, but you can’t distribute the results of it. Or maybe you can. It depends on what<br />
you consider "essential system software", and some other legal junk that we’re not going to touch.<br />
Other packages have solved this by explicitly stating that an exception has been granted. That is (purposely) impossible here,<br />
since NUT is the combined effort of many people, and all of them would have to agree to a license change. This is actually a<br />
feature, since it means nobody can unilaterally run off with the source - not even the NUT team.<br />
Note that the replacement of OpenSSL by Mozilla <strong>Network</strong> Security Services (NSS) should avoid the above licensing issues.<br />
9.6 chrooting and other forms of paranoia<br />
It has been possible to run the drivers and upsd in a chrooted jail for some time, but it involved a number of evil hacks. From the<br />
1.3 series, a much saner chroot behavior exists, using BIND 9 as an inspiration.<br />
The old way involved creating an entire tree, complete with libraries, a shell (!), and many auxiliary files. This was hard to<br />
maintain and could have become an interesting playground for an intruder. The new way is minimal, and leaves little in the way<br />
of usable materials within the jail.<br />
This document assumes that you already have created at least one user account for the software to use. If you’re still letting it<br />
fall back on "nobody", stop right here and go figure that out first. It also assumes that you have everything else configured and<br />
running happily all by itself.<br />
9.6.1 Generalities<br />
Essentially, you need to create your configuration directory and state path in their own little world, plus a special device or two.<br />
For the purposes of this example, the chroot jail is /chroot/nut. The programs have been built with the default prefix, so they are<br />
using /usr/local/ups. First, create the confpath and bring over a few files.<br />
mkdir -p /chroot/nut/usr/local/ups/etc<br />
cd /chroot/nut/usr/local/ups/etc<br />
cp -a /usr/local/ups/etc/upsd.users .<br />
cp -a /usr/local/ups/etc/upsd.conf .<br />
cp -a /usr/local/ups/etc/ups.conf .<br />
We’re using cp -a to maintain the permissions on those files.<br />
Now bring over your state path, maintaining the same permissions as before.<br />
mkdir -p /chroot/nut/var/state<br />
cp -a /var/state/ups /chroot/nut/var/state<br />
Next we must put /etc/localtime inside the jail, or you may get very strange readings in your syslog. You’ll know you have this<br />
problem if upsd shows up as UTC in the syslog while the rest of the system doesn’t.<br />
mkdir -p /chroot/nut/etc<br />
cp /etc/localtime /chroot/nut/etc<br />
Note that this is not "cp -a", since we want to copy the content, not the symlink that it may be on some systems.<br />
Finally, create a tiny bit of /dev so the programs can enter the background properly - they redirect fds into the bit bucket to make<br />
sure nothing else grabs 0-2.