ce355fc235
If xrdp is running with dropped privileges it won't be able to delete the PID file it's created. Places where xrdp is stopped need to cater for this. It's prefereable to do this than make the PID file writeable by xrdp with dropped privileges, as this can still lead to DoS attacks if an attacker manages to modify the PID file from a compromised xrdp process.
175 lines
5.1 KiB
Bash
175 lines
5.1 KiB
Bash
#!/bin/sh -e
|
|
#
|
|
# start/stop xrdp and sesman daemons
|
|
#
|
|
### BEGIN INIT INFO
|
|
# Provides: xrdp
|
|
# Required-Start: $network $remote_fs
|
|
# Required-Stop: $network $remote_fs
|
|
# Default-Start: 2 3 4 5
|
|
# Default-Stop: 0 1 6
|
|
# Short-Description: Start xrdp and sesman daemons
|
|
# Description: XRDP uses the Remote Desktop Protocol to present a
|
|
# graphical login to a remote client allowing connection
|
|
# to a VNC server or another RDP server.
|
|
### END INIT INFO
|
|
|
|
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
|
|
BASE=__BASE__
|
|
DAEMON=${BASE}/sbin/xrdp
|
|
SDAEMON=${BASE}/sbin/xrdp-sesman
|
|
PIDDIR=/var/run/
|
|
SESMAN_START=yes
|
|
#USERID=xrdp
|
|
# the X11rdp backend only works as root at the moment - GH 20/03/2013
|
|
USERID=root
|
|
NAME=xrdp
|
|
DESC="Remote Desktop Protocol server"
|
|
|
|
test -x $DAEMON || exit 0
|
|
|
|
. /lib/lsb/init-functions
|
|
|
|
check_root() {
|
|
if [ "$(id -u)" != "0" ]; then
|
|
log_failure_msg "You must be root to start, stop or restart $NAME."
|
|
exit 4
|
|
fi
|
|
}
|
|
|
|
force_stop() {
|
|
|
|
DELAY=1
|
|
PROCLIST="xrdp-sesman xrdp-sessvc xrdp-chansrv X11rdp Xvnc"
|
|
|
|
for p in $PROCLIST; do
|
|
pgrep -x $p >/dev/null && pkill -x $p
|
|
sleep $DELAY
|
|
pgrep -x $p >/dev/null && pkill -9 -x $p
|
|
done
|
|
# let's not kill ourselves - the init script is called xrdp as well
|
|
pgrep -fx $DAEMON >/dev/null && pkill -fx $DAEMON
|
|
sleep $DELAY
|
|
pgrep -fx $DAEMON >/dev/null && pkill -9 -fx $DAEMON
|
|
|
|
rm -f $PIDDIR/xrdp*.pid
|
|
}
|
|
|
|
if [ -r /etc/default/$NAME ]; then
|
|
. /etc/default/$NAME
|
|
fi
|
|
|
|
# Tasks that can only be run as root
|
|
if [ "$(id -u)" = "0" ]; then
|
|
# Check for pid dir
|
|
if [ ! -d $PIDDIR ] ; then
|
|
mkdir $PIDDIR
|
|
fi
|
|
chown $USERID:$USERID $PIDDIR
|
|
fi
|
|
|
|
|
|
case "$1" in
|
|
start)
|
|
check_root
|
|
exitval=0
|
|
log_daemon_msg "Starting $DESC "
|
|
if pidofproc -p $PIDDIR/$NAME.pid $DAEMON > /dev/null; then
|
|
log_progress_msg "$NAME apparently already running"
|
|
log_end_msg 0
|
|
exit 0
|
|
fi
|
|
log_progress_msg $NAME
|
|
start-stop-daemon --start --quiet --oknodo --pidfile $PIDDIR/$NAME.pid \
|
|
--chuid $USERID:$USERID --exec $DAEMON >/dev/null
|
|
exitval=$?
|
|
if [ "$SESMAN_START" = "yes" ] ; then
|
|
log_progress_msg "sesman"
|
|
start-stop-daemon --start --quiet --oknodo --pidfile $PIDDIR/xrdp-sesman.pid \
|
|
--exec $SDAEMON >/dev/null
|
|
value=$?
|
|
[ $value -gt 0 ] && exitval=$value
|
|
fi
|
|
# Make pidfile readable for all users (for status to work)
|
|
[ -e $PIDDIR/xrdp-sesman.pid ] && chmod 0644 $PIDDIR/xrdp-sesman.pid
|
|
[ -e $PIDDIR/$NAME.pid ] && chmod 0644 $PIDDIR/$NAME.pid
|
|
# Note: Unfortunately, xrdp currently takes too long to create
|
|
# the pidfile unless properly patched
|
|
log_end_msg $exitval
|
|
;;
|
|
stop)
|
|
check_root
|
|
[ -n "$XRDP_UPGRADE" -a "$RESTART_ON_UPGRADE" = "no" ] && {
|
|
echo "Upgrade in progress, no restart of xrdp."
|
|
exit 0
|
|
}
|
|
exitval=0
|
|
log_daemon_msg "Stopping RDP Session manager "
|
|
log_progress_msg "sesman"
|
|
if pidofproc -p $PIDDIR/xrdp-sesman.pid $SDAEMON > /dev/null; then
|
|
start-stop-daemon --stop --quiet --oknodo --pidfile $PIDDIR/xrdp-sesman.pid \
|
|
--chuid $USERID:$USERID --exec $SDAEMON
|
|
exitval=$?
|
|
else
|
|
log_progress_msg "apparently not running"
|
|
fi
|
|
log_progress_msg $NAME
|
|
if pidofproc -p $PIDDIR/$NAME.pid $DAEMON > /dev/null; then
|
|
start-stop-daemon --stop --quiet --oknodo --pidfile $PIDDIR/$NAME.pid \
|
|
--remove-pidfile --exec $DAEMON
|
|
value=$?
|
|
[ $value -gt 0 ] && exitval=$value
|
|
else
|
|
log_progress_msg "apparently not running"
|
|
fi
|
|
log_end_msg $exitval
|
|
;;
|
|
force-stop)
|
|
$0 stop
|
|
# because it doesn't always die the right way
|
|
force_stop
|
|
;;
|
|
restart|force-reload)
|
|
check_root
|
|
$0 stop
|
|
# Wait for things to settle down
|
|
sleep 1
|
|
$0 start
|
|
;;
|
|
reload)
|
|
log_warning_msg "Reloading $NAME daemon: not implemented, as the daemon"
|
|
log_warning_msg "cannot re-read the config file (use restart)."
|
|
;;
|
|
status)
|
|
exitval=0
|
|
log_daemon_msg "Checking status of $DESC" "$NAME"
|
|
if pidofproc -p $PIDDIR/$NAME.pid $DAEMON > /dev/null; then
|
|
log_progress_msg "running"
|
|
log_end_msg 0
|
|
else
|
|
log_progress_msg "apparently not running"
|
|
log_end_msg 1 || true
|
|
exitval=1
|
|
fi
|
|
if [ "$SESMAN_START" = "yes" ] ; then
|
|
log_daemon_msg "Checking status of RDP Session Manager" "sesman"
|
|
if pidofproc -p $PIDDIR/xrdp-sesman.pid $SDAEMON > /dev/null; then
|
|
log_progress_msg "running"
|
|
log_end_msg 0
|
|
else
|
|
log_progress_msg "apparently not running"
|
|
log_end_msg 1 || true
|
|
exitval=1
|
|
fi
|
|
fi
|
|
exit $exitval
|
|
;;
|
|
*)
|
|
N=/etc/init.d/$NAME
|
|
echo "Usage: $N {start|stop|force-stop|restart|force-reload|status}" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
exit 0
|