#!/usr/local/cpanel/3rdparty/bin/perl
# cpanel - scripts/fixrndc Copyright 2022 cPanel, L.L.C.
# All rights reserved.
# copyright@cpanel.net http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited
######[ This script will rebuild the rndc.key and rndc.conf files unless ]######
######[ an existing, working config is found ]######
use strict;
use Cpanel::Config::LoadCpConf ();
use Cpanel::StringFunc::Count ();
use Cpanel::CommentKiller ();
use Cpanel::SafetyBits ();
use Cpanel::PwCache ();
use Cpanel::SafeRun::Errors ();
use Cpanel::SafeRun::Simple ();
use Cpanel::FileUtils::TouchFile ();
use Cpanel::FindBin ();
use Getopt::Long ();
umask 0022;
######[ declare globals ]##########################################################################
# default location of zone files used for rebuilding named.conf
my $def_basedir = '/var/named';
# default location of named.conf
my $def_namedconf = '/etc/named.conf';
my $needrndckey = 0;
my $options = {};
Getopt::Long::Configure("bundling");
Getopt::Long::GetOptions(
'force|f' => \$options->{force},
'verbose|v' => \$options->{verbose},
# If -s is passed as an arg, it's saying that fixrndc was started by rebuilddnsconfig and should not reinvoke its parent.
'rebuilddnsconfig|s' => \$options->{rebuilddnsconfig},
'html|h' => \$options->{html},
);
# Verbose variable, if set to "1" actions are reported to STDOUT.
my $cpverbose = $options->{verbose} || 0;
my $called_from_rebuilddnsconfig = $options->{rebuilddnsconfig} || 0;
if ( !-e $def_namedconf || -z _ ) {
if ( !$called_from_rebuilddnsconfig ) {
print "The named configuration file is missing, running /usr/local/cpanel/scripts/rebuilddnsconfig to repair it.\n" if $cpverbose;
my $opts = $cpverbose ? '-fv' : '-f';
exec( '/usr/local/cpanel/scripts/rebuilddnsconfig', $opts );
exit 0; #unreached
}
else {
print "WARNING: $def_namedconf appears to be invalid but the problem could not be corrected automatically!\n";
exit 1;
}
}
my $local_nameserver_type = Cpanel::Config::LoadCpConf::loadcpconf_not_copy()->{'local_nameserver_type'};
if ( $local_nameserver_type ne 'bind' ) {
print "$local_nameserver_type is configured as the local nameserver. RNDC key is not in use.\n" if $cpverbose;
exit;
}
require Cpanel::Services::Enabled;
unless ( Cpanel::Services::Enabled::is_enabled('dns') ) {
print "Named is currently disabled.\n" if $cpverbose;
exit;
}
require Cpanel::DNSLib;
my $dnslib = Cpanel::DNSLib->new( 'force' => ( $options->{'force'} ? 1 : 0 ) );
######[ try to ensure named is actually running, fixrndc will always fail if not. ]######
######[ try starting named, but always allow it to continue and try to force new keys even if we can't test ]######
######[ this all does basically the same thing, but gives a little more information about problem so techs ]######
######[ can know where to start ]##################################################################################
my @html_args = $options->{html} ? ('--html') : ();
my $check_output = Cpanel::SafeRun::Errors::saferunallerrors( '/usr/local/cpanel/scripts/restartsrv_named', '--check', @html_args );
my $status_code = $?;
# Try to restart
if ( $status_code != 0 ) {
print "Named looks down but should be up. Attempting restart...\n" if $cpverbose;
$check_output = Cpanel::SafeRun::Errors::saferunallerrors( '/usr/local/cpanel/scripts/restartsrv_named', @html_args );
print $check_output if $cpverbose;
for ( 1 .. 10 ) {
$check_output = Cpanel::SafeRun::Errors::saferunallerrors( '/usr/local/cpanel/scripts/restartsrv_named', '--check', @html_args );
$status_code = $?;
last if $status_code == 0;
print "Waiting 5 seconds for named to start ($_/10)\n" if $cpverbose;
sleep(5);
}
if ( $status_code != 0 ) {
print "Named could not be restarted, any obvious config errors should show up below this line. \n";
my ( $ret_status, $status_info ) = $dnslib->checknamedconf($def_namedconf);
my $found_error = 0;
if ( $ret_status == 1 || $status_info =~ /rndc\.key/ ) {
# No error was detected, needs manual inspection
my $rndckey_file = $def_namedconf;
my $rndcconf_file = $def_namedconf;
$rndckey_file =~ s/\/named\.conf$/\/rndc.key/;
$rndcconf_file =~ s/\/named\.conf$/\/rndc.conf/;
foreach my $key_loc_file ( $rndckey_file, $def_namedconf ) {
if ( -s $key_loc_file == 0 ) {
print "Detected empty file at $key_loc_file \n";
$needrndckey = 1;
$found_error = 1;
last;
}
if ( open( my $keyf, '<', $key_loc_file ) ) {
while ( my $line = readline($keyf) ) {
if ( $line =~ m/secret\s+\"(.*)\"/i ) {
my $base64ok = is_base64($1);
if ( $base64ok != 1 ) {
print "There appears to be a problem with the base64 encoding of the rndckey in $key_loc_file .\n";
print "Will try to rebuild those files, \"connection refused\" errors are to be expected. \n";
$needrndckey = 1;
$found_error = 1;
last;
}
}
}
close($keyf);
}
else {
print "Could not open $key_loc_file : $! \n";
$needrndckey = 1;
}
}
if ( $found_error != 1 ) {
print "No critical problems found, will attempt to regenerate keys regardless.\n";
$needrndckey = 1;
}
}
elsif ( !$called_from_rebuilddnsconfig ) {
print "The named configuration appears to have errors:\n\t$status_info\n\nRunning /usr/local/cpanel/scripts/rebuilddnsconfig to repair it..\n";
# some config problem.. let's force a rebuild of named.conf and let it try again
my $opts = $cpverbose ? '-fv' : '-f';
exec( '/usr/local/cpanel/scripts/rebuilddnsconfig', $opts );
exit 0; # unreached
}
else {
print "WARNING: $def_namedconf appears to contain errors which could not be corrected automatically!\n";
print $status_info . "\n";
print "Please correct these errors manually and rerun /usr/local/cpanel/scripts/fixrndc\n";
exit 1;
}
}
}
######[ fix rndc info if needed ]##################################################################
# check if `rndc status` reports ok, fix if not or if -f flag is given to force it
if ( !defined( $options->{'force'} ) ) {
if ($cpverbose) {
print "Checking rndc by querying status\n";
}
# If "rndc status" does not report a failed connection, exit
if ( $dnslib->checkrndc() ) {
if ($cpverbose) {
print '!' x 50 . "\n";
print "rndc reported success. No changes will be made.\nUse the \"-f\" flag to force a check.\n";
print '!' x 50 . "\n";
}
exit;
}
}
my $removenamedconfkey = 0;
my $neednamedconfcontrols = 0;
my $removenamedconfcontrols = 0;
# rndc variables from rndc.conf
my ( $r_secret, $r_keyname );
my $rndcconf = $dnslib->find_rndcconf();
my $namedconf = $dnslib->{'namedconf'};
my $rndckeyfile = $dnslib->find_rndckey();
my $chrootdir = $dnslib->{'data'}{'chrootdir'};
my $zonedir = $dnslib->{'data'}{'zonefiledir'};
my $binduser = $dnslib->{'data'}{'binduser'};
my $bindgrp = $dnslib->{'data'}{'bindgroup'};
my $binduid = ( Cpanel::PwCache::getpwnam_noshadow($binduser) )[2];
my $bindgid = ( getgrnam($bindgrp) )[2];
$dnslib->{'data'}{'cpverbose'} = 1;
if ($zonedir) {
if ( !-e $zonedir . '/named.ca' ) {
system 'cp', '-fv', '/usr/local/cpanel/etc/named.ca', $zonedir . '/named.ca';
Cpanel::SafetyBits::safe_chown( $binduser, $bindgrp, $zonedir . '/named.ca' );
Cpanel::SafetyBits::safe_chmod( oct('0644'), $binduser, $zonedir . '/named.ca' );
}
}
# rndc variables from named.conf
my $key = 0;
my $controls = 0;
my ( $keykeyname, $keysecret, $inet, $allow, $controlskeyname, $rndc_include );
my ( $confstatus, $confresult ) = $dnslib->checknamedconf($namedconf);
######[ bail out if named.conf is currently fubar ]################################################
# Only bypass this check if there's only one error line and it matches the
# regex.
if ( !$confstatus && $confresult !~ /^.*rndc[.-]key.*$/ ) {
print <<"EOM";
!! fixrndc requires a syntactically correct $namedconf.
!! No changes were made to $namedconf. Problem was:
!! $confresult
EOM
exit();
}
######[ Make sure chroot directory is created ]####################################################
if ( $chrootdir ne '' ) {
print "Setting up chroot environment in $chrootdir\n" if $cpverbose;
$dnslib->setupbindchroot();
}
######[ Check rndc.conf for necessary settings ]###################################################
if ($rndckeyfile) {
( $r_secret, $r_keyname ) = $dnslib->loadrndckey();
if ( $r_secret eq ''
|| $r_keyname eq '' ) {
$needrndckey = 1;
}
}
else {
$needrndckey = 1;
}
#my $namedconf = $def_namedconf;
######[ Cannot proceed if named.conf is not located at this point ]################################
if ( !-e $namedconf ) {
die "named.conf not found, exiting";
}
######[ Check in existing named.conf to rcs ]######################################################
print "Checking in $namedconf to rcs system\n" if $cpverbose;
######[ If rndc.key needs to be generated, remove settings from named.conf ]#######################
if ($needrndckey) {
print "Need to create rndc.conf\n" if $cpverbose;
( $key, $keykeyname, $keysecret, $controls, $inet, $allow, $controlskeyname, $rndc_include ) = $dnslib->getrndcsettings($rndckeyfile);
# include line may already exist
$removenamedconfkey = 1 unless $rndc_include;
# check for broken control section
if ( $controlskeyname ne 'rndc-key' || $inet ne '127.0.0.1' || $allow ne 'localhost' ) {
$removenamedconfcontrols = 1;
$neednamedconfcontrols = 1;
}
}
else {
# Make sure named.conf rndc settings match
( $key, $keykeyname, $keysecret, $controls, $inet, $allow, $controlskeyname, $rndc_include ) = $dnslib->getrndcsettings($rndckeyfile);
if ( $keykeyname && $keysecret ) {
# if keyname in rndc.conf does not match keyname in named.conf,
# redo key clause in named.conf
if ( $keykeyname ne $r_keyname || $keysecret ne $r_secret ) {
$removenamedconfkey = 1;
}
}
elsif ( !$rndc_include ) {
$removenamedconfkey = 1;
}
# Controls section is needed by default
if ( $controlskeyname ne $r_keyname ) {
$removenamedconfcontrols = 1;
$neednamedconfcontrols = 1;
if ( $controlskeyname eq '' ) {
print "Controls section not found, adding ...\n" if $cpverbose;
}
else {
print "Controls keyname does not match rndc.conf keyname\n" if $cpverbose;
}
}
}
######[ Create rndc.key if needed ]###############################################################
if ($needrndckey) {
print "Creating rndc.conf\n";
my $named = Cpanel::FindBin::findbin('named');
unless ($named) {
die "named not located on system, please check the Bind installation";
}
my $rndcconfgen = $dnslib->find_rndcconfgen();
if ( $rndcconfgen eq '' ) {
die "rndc-confgen not located on system, please check the Bind installation";
}
my @rndc_confgen_args = (
'-a',
'-c', $rndckeyfile,
'-k', 'rndc-key',
'-r', '/dev/urandom',
);
# Bind < 9.10 (CentOS 6) does not support alternate hashing functions for the rndc key.
if ( Cpanel::SafeRun::Simple::saferun( $named, "-v" ) =~ /^BIND\s(\d+)\.(\d+)/ ) {
if ( $1 >= 9 && $2 >= 10 ) {
push @rndc_confgen_args, ( '-A', 'hmac-sha256' );
}
}
Cpanel::SafeRun::Errors::saferunallerrors( $rndcconfgen, @rndc_confgen_args );
Cpanel::SafetyBits::safe_chown( $binduser, $bindgrp, $rndckeyfile );
Cpanel::SafetyBits::safe_chmod( oct('0660'), $binduser, $rndckeyfile );
( $r_secret, $r_keyname ) = $dnslib->loadrndckey();
}
######[ Remove rndc.conf if needed ]################################################################
unlink $rndcconf if length $rndcconf && -f $rndcconf;
if ( $removenamedconfkey || $neednamedconfcontrols || $removenamedconfcontrols ) {
# open our tmp file to populate with rndc key controls and named.conf
open( NDF, ">", $namedconf . '.fixrndc' );
Cpanel::SafetyBits::safe_chown( $binduser, $bindgrp, "$namedconf.fixrndc" );
if ($removenamedconfkey) {
print "Including rndc key file to named.conf\n";
print NDF "include \"$rndckeyfile\"\;\n";
}
if ($neednamedconfcontrols) {
print "Adding controls clause\n";
print NDF "\ncontrols {\n";
print NDF "\tinet 127.0.0.1 allow { localhost; } keys { \"$r_keyname\"\; }\;\n";
print NDF "}\;\n\n";
}
######[ append entire named.conf to tmp file ]#####################################################
open( my $cur_ndc, '<', $namedconf );
my $in_removed_section = 0;
my $numbrace = 0;
my $commentkiller = Cpanel::CommentKiller->new;
while ( readline($cur_ndc) ) {
if ( $removenamedconfcontrols || $removenamedconfkey ) {
# Remove broken controls or keys sections if necessary
my $parsed = $commentkiller->parse($_) or next;
if ($in_removed_section) {
$numbrace += Cpanel::StringFunc::Count::get_curly_brace_count($parsed);
if ( $numbrace <= 0 ) {
$in_removed_section = 0;
}
next;
}
elsif ( $numbrace == 0 && ( ( $removenamedconfcontrols && $parsed =~ /^\s*controls/ ) || ( $removenamedconfkey && $parsed =~ /^\s*key/ ) ) ) {
$numbrace += Cpanel::StringFunc::Count::get_curly_brace_count($parsed);
$in_removed_section = 1;
next;
}
$numbrace += Cpanel::StringFunc::Count::get_curly_brace_count($parsed);
}
print NDF;
}
close($cur_ndc);
close(NDF);
if ( -e $namedconf . '.cache' ) {
unlink( $namedconf . '.cache' );
unlink( $namedconf . '.zonedir.cache' );
}
######[ move the fixrndc tmp file into place now that it is complete (once verified as ok) ]#######
( $confstatus, $confresult ) = $dnslib->checknamedconf( $namedconf . '.fixrndc' );
if ($confstatus) {
rename( $namedconf . '.fixrndc', $namedconf ) || print "Failed to copy $namedconf . '.fixrndc' to $namedconf : $!\n";
}
else {
print "New named.conf file does not pass syntax check. Leaving old file in place.\n" if $cpverbose;
}
}
######[ check rndc status again, restart named if needed ]#########################################
if ( $needrndckey || !$dnslib->checkrndc() ) {
print "Restarting named\n";
system( '/usr/local/cpanel/scripts/restartsrv_named', @html_args );
my $ok;
my $suspend = '/var/run/chkservd.suspend';
my $exists = -e $suspend;
# Suspend chkservd temporarily in case this takes longer than 5 minutes so
# we don't end up in a restart-restart loop.
Cpanel::FileUtils::TouchFile::touchfile($suspend);
for ( 1 .. 300 ) {
sleep(2);
$ok = $dnslib->checkrndc();
last if $ok;
}
unlink $suspend unless $exists;
if ( !$ok ) {
print "/usr/local/cpanel/scripts/fixrndc failed to fix the rndc key (or named is otherwise broken), please investigate manually\n";
exit 1;
}
}
print "The rndc key has been fixed successfully!\n" if $cpverbose;
exit;
sub is_base64 {
my $string = shift;
# Bail out if string length isn't in mutiples of 4 ...
return if length($string) % 4;
# Or if the string contains any unpermitted characters ...
return if $string !~ /^[=\+\/a-z0-9]+$/i;
return 1;
}
Rosenblum TV: Video training, virtual workshops, classes, tutorials
RE-INVENTING THE TELEVISION NEWS BUSINESS*
A revolution in video storytelling
Creating entirely new & cost-effective production methods
From the world leaders in video production training and the creators of Character Driven Storytelling™
*and every other business that uses video
WHAT WE DO
Over the past 35 years, we have designed, built or restructured some of the most powerful news and journalism companies in the world.
We replace the traditional TV news ‘crew’ with one highly trained journalist, working alone with nothing but an iPhone.
No more TV news ‘crews’, no editors and no field producers.
This is television news done the way newspaper journalism is done – one reporter with their electronic pad and pencil.
In doing this, we can cut the cost of production by as much as 75% while increasing ratings and audience engagement.
In the place of conventional TV news ‘packages’ – ie, reporter stand up, interview, b-roll, man on the street, we marry great journalism with Netflix and Hollywood storytelling.
It’s a combination that works.
We have taken most of our clients to #1 in their respective markets.
And it’s not just for news. Any company, any profit, any NGO and anyone else who is online needs to tell their story in compelling yet cost-effective video. We can teach you to do that. Either in person or virtually.
EXAMPLES OF WHAT WE CAN TEACH YOUR STAFF TO PRODUCE
ITAY HOD
Itay Hod, MMJ with KPIX/CBS in San Francisco, took the 5-Day Intensive Video Storytelling Bootcamp in 2018.
Because he works alone, with only an iPhone, he was able to embed himself with a homeless family.
Here’s the story he produced in a one-day turn.
KIET DO
Kiet Do, an MMJ with KPIX/CBS in San Francisco, took the 5-Day Intensive Video Storytelling Bootcamp in 2021.
Here is a story he produced, all on his own, with only an iPhone and in a one-day turn.
TAYLOR SCHAUB
Taylor Schaub, an MMJ with Spectrum News 1 in LA, took the 5-Day Intensive Video Storytelling Bootcamp in 2023.
Here is a story he turned in only one day, using only an iPhone. It was the first video story he ever did and it was nominated for an Emmy.
THE BOOTCAMP
How do we convert stations and whole networks to working in this way?
Since 1988, we have run intensive 5-Day Video Storytelling Bootcamps
We have done these all over the world.
These are hands-on bootcamps, and participants learn an entirely new way of creating TV news stories.
-We shoot at a 3:1 ratio or lower, so turnaround times are fast.
-We go directly from camera to timelilne and edit – no written scripts. We work in the medium of pictures and sound.
-We are entirely character-driven.
-We are driven by pictures and real events.
-We are focused almost entirely on ’the viewer experience’.
Since 1988, more than 70,000 journalists around the world have taken our bootcamps, either in person on virtualy.
We have started to work with CBS News, bringing our ideas of character-driven storytelling to one of the most successful and biggest networks in the United States. Since beginning to work with them ratings have climbed and more importantly, audience engagement is through the ceiling.
We started New York Times Television in 1990 and it was the first paper to be brought into the world of TV. It quickly became one of the most successful non-fiction production companies in the United States. The series and documentaries we produced won many awards including multiple Emmys.
We have been working with the BBC since the year 2000 helping to convert their national news network to our visual storytelling technique. Most recently we have trained teams from their sports, documentaries, and comedy divisions to make character-driven stories using only smartphones.
For the past five years we have worked with Spectrum News to introduce and train their journalists on visual, character driven storytelling using smartphones helping to create a different kind of local news for their network of 24-Hour News Stations across the United States.
In 2006, we were approached by the United Nations. Rather than rely on news outlets, it would be much easier to train the field operatives to produce their own stories. We spent two years working with the UN, training more than 100 of their staff in bootcamps in Geneva and Nairobi.
We trained 50 print reporters at the paper to shoot and tell their own stories, in conjunction with their print work. We built a TV newsroom in their existing print newsroom – you could not ask for a better set and they began to live stream their stories in conjunction with their print work.
We spent two years with McGraw Hill, training more than 150 of their staffers, making them completely video literate. McGraw/Hill media properties we transit included Business Week, Aviation Week, (what was the name of the architecture magazine), and JD Power and Associates.
In 1990, we were approached by The Voice of America, the official broadcasting agency for the United States Government. When we met with VOA, they were only a short wave radio broadcaster, but working with them, we took them into television, launching VOA-TV.
British based Oyster Yachts makes some of the finest yachts in the world. Like every other company, they had to find a way to feed the never-ending video demands of social media – sites like Instagram and TikTok. We trained the Oyster staff to tell their own stories, using only iPhones.
We were approached by SEPA, the Scottish Environmental Protection Agency because they had to continually find a way to ‘feed the media beast’. The result was that SEPA was able to tell their own stories, whenever they wanted, and at almost no additional cost.
Michael Rosenblum has been writing about the media since 1988. His work and ideas have appeared in The Guardian, The Huffington Post, Ilkeston Life and many other publications.
He has been blogging regularly for the past 35 years on this subject. Having taught media studies at Columbia University, NYU and now the University of Oxford, he is considered an expert on this subject.
Continue reading this post or look back at previous posts.
