Mon

2004/12/25
Mon monitors execution of httpd. If the httpd exits, mon rerun it. The mon bundled in Pegasus 2.1 does not require password even if option "-u user" is specified.

Location

	/usr/local/bin/$objtype/mon

Note: old version mon might be in /usr/web/bin/$objtype

Usage

	mon [-d] [-u user] [-r req] command argument ...

Description

Mon is a program that is designed to be used with Pegasus httpd to protect against malicious cgi programs that attempt to kill httpd.
Mon invokes httpd to run as "user" and monitors the httpd to invoke subsequent httpd if it is killed by someone.
Mon should be executed by host owner.
command is the path to Pegasus httpd, and arguments are those of httpd.

Options

-d: run as a daemon
-u user: run as user "user". usually "web". If "user" is "." mon runs as the uid who invoked mon. Without this option, mon runs as user "none".
-r req: factotum format of X.509 certificate signing request
command: path to the command
argument ...: arguments for the command

Others

Mon makes logs in /sys/log/mon. Mon terminates if the command exits in 5 seconds; this is a protection in case of error. If you want to terminate mon, send "kill note" to the mon.

Changes from previous version.

Password option for "-u user" is discarded. If mon is executed by bootes (default hostowner of cpu servers), password is not required. If you want to run mon on terminals, change /lib/ndb/auth of auth server. Mine is:

hostid=bootes
	uid=!sys  uid=!adm  uid=*
hostid=arisawa
	uid=web

Example

Security confirmation

You should confirm that mon is running as user web.

term% mon -u web me
web             123    0:00   0:00     180K Pread    ps
--rw-rw-rw- M 53 web none 0 Dec 15 22:21 /usr/none/tmp/me
term%

where "me" is a program:

#!/bin/rc
# note: chmod 777 /usr/none/tmp
f=/usr/none/tmp/me
ps|grep ' ps$'
if(test -e $f) rm $f
touch $f; ls -l $f

and locate "me" at /usr/local/bin/rc and change /lib/namespace.local to:

bind -a /usr/local/bin/386 /bin
bind -a /usr/local/bin/rc /bin

and then confirm

	. /lib/namespace.local

is included in your /lib/namespace.

Invocation

Mine is:

b=/usr/local/bin/$objtype
$b/mon -du web $b/httpd -suM

Bugs

Not known.