61 lines
2.2 KiB
Bash
Executable file
61 lines
2.2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# =====================================================================================
|
|
# Container healthcheck. Credential-free on purpose: it must never risk locking out an
|
|
# account by testing authentication. Authenticated checks live in scripts/verify.sh.
|
|
# - process alive
|
|
# - LDAP rootDSE answers (anonymous base object is allowed by design)
|
|
# - own DNS answers the AD SRV records
|
|
# - Kerberos / SMB / Global Catalog ports accept a connection
|
|
# - smb.conf still parses
|
|
# =====================================================================================
|
|
set -uo pipefail
|
|
|
|
problems=()
|
|
|
|
pgrep -x samba >/dev/null 2>&1 || problems+=("samba process not running")
|
|
|
|
# LDAP rootDSE
|
|
if ! ldapsearch -x -H ldap://127.0.0.1:389 -s base -b '' defaultNamingContext 2>/dev/null \
|
|
| grep -q '^defaultNamingContext:'; then
|
|
problems+=("LDAP rootDSE did not answer")
|
|
fi
|
|
|
|
# authoritative SRV lookup against ourselves
|
|
zone="$(sed -n 's/^[[:space:]]*search[[:space:]]\{1,\}\([^[:space:]]\{1,\}\).*/\1/p' /etc/resolv.conf 2>/dev/null | head -1)"
|
|
if [ -z "$zone" ]; then
|
|
zone="$(hostname -d 2>/dev/null || true)"
|
|
fi
|
|
if [ -n "$zone" ]; then
|
|
if ! dig +time=2 +tries=1 +short @127.0.0.1 "_ldap._tcp.dc._msdcs.${zone}" SRV 2>/dev/null | grep -q .; then
|
|
problems+=("_ldap._tcp.dc._msdcs.${zone} SRV returned nothing")
|
|
fi
|
|
else
|
|
problems+=("cannot determine DNS zone")
|
|
fi
|
|
|
|
for port in 88 135 445 3268; do
|
|
if ! timeout 3 bash -c "exec 3<>/dev/tcp/127.0.0.1/${port}" 2>/dev/null; then
|
|
problems+=("tcp/${port} refused")
|
|
fi
|
|
done
|
|
|
|
# kpasswd (464) is UDP-only for most clients; check the KDC UDP path instead
|
|
if ! timeout 3 bash -c 'exec 3<>/dev/udp/127.0.0.1/88' 2>/dev/null; then
|
|
problems+=("udp/88 unusable")
|
|
fi
|
|
|
|
testparm -s /etc/samba/smb.conf >/dev/null 2>&1 || problems+=("testparm failed")
|
|
|
|
if ((${#problems[@]} == 0)); then
|
|
echo "healthy"
|
|
exit 0
|
|
fi
|
|
printf 'UNHEALTHY:'
|
|
printf ' %s;' "${problems[@]}"
|
|
# Surface the daemon's own last words: samba writes the real reason to its log file and this
|
|
# shows up in `docker inspect --format '{{json .State.Health}}'`.
|
|
if [ -r /var/log/samba/log.samba ]; then
|
|
printf '\n log.samba tail: %s\n' "$(tail -3 /var/log/samba/log.samba | tr '\n' '|')"
|
|
fi
|
|
echo
|
|
exit 1
|