#!/usr/bin/perl -w

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

##############################################################################
# $Id: vclclientd 1954 2008-12-12 14:46:02Z arkurth $
##############################################################################

=head1 NAME

vclclientd

=head1 SYNOPSIS

 perl vclclientd

=head1 DESCRIPTION

 This is the executable module for running the VCL client daemon on Linux lab
 machines.

=cut

##############################################################################

use strict;
use Getopt::Long;
use diagnostics;
use Symbol;
use POSIX;

$|=1; # turning off autoflush

# -- DEVELOPMENT testing
#my $PIDFILE = "/var/run/vcldev.pid";
#our $LOG = "/var/log/vcldev.log";

# GLOBALS
our $HOME = "/home/vclstaff";
our $VCLFLAG = "$HOME/flag";
our $CLIENTDATA = "$HOME/clientdata";
our $PIDFILE ="/var/run/vclclientd.pid";
our %children               = ();       # keys are current child process IDs
our $children               = 0;        # current number of children
our $LOG = "/var/log/vclclientd.log";
our %ERRORS=('DEPENDENT'=>4,'UNKNOWN'=>3,'OK'=>0,'WARNING'=>1,'CRITICAL'=>2,'MAILMASTERS'=>5);
our $opt_d='';

Getopt::Long::Configure('bundling', 'no_ignore_case');
GetOptions('d|debug' => \$opt_d );
if(!$opt_d){
    #daemonize
    &daemonize;
}


sub daemonize {                                                 
   chdir '/'    or die "Can't chdir to /: $!";
   defined(my $pid = fork) or die "Can't fork $!";
   exit if $pid;
   #production
   $0 = "vclclientd";
   print "Created process $$ renamed to $0 ...\n";
   setsid  or die "Can't start a new session: $!";
   open STDIN, '/dev/null' or die "Can't read /dev/null $!";
   open STDOUT, '>>$LOG' or die "Can't write $LOG $!";
   open STDERR, '>>$LOG' or die "Can't write $LOG $!";
   umask 0;
   open(PIDFILE, ">$PIDFILE"); # so I can kill myself easily
   print PIDFILE $$;
   close(PIDFILE);

}


#------- Subroutine declarations -------
sub main();                   # main calls primary subroutines
sub flag;
sub processdata;
sub startsshd;
sub makedatestring;
sub reboot;
sub fetch;
sub store;
sub sshdstatus;
sub createnewssh_config_vcl;
sub restartsshd;

sub REAPER {                        # takes care of dead children
       $SIG{CHLD} = \&REAPER;
       my $pid = wait;
       if(exists $children{$pid}){
        $children--;
        notify($ERRORS{'OK'},"$pid -- child process exiting, deleting $pid ");
        delete $children{$pid};
       }
       else{
          notify($ERRORS{'OK'},"$pid -- sub process exiting");
       }
       
}

sub HUNTSMAN {                      # signal handler for SIGINT
   local($SIG{CHLD}) = 'IGNORE';   # we're going to kill our child processes
   kill 'INT' => keys %children;
   notify($ERRORS{'OK'},"$$ -- process exiting");
   exit;                           # clean up with dignity
}

# Install signal handlers.
$SIG{CHLD} = \&REAPER;
$SIG{INT}  = \&HUNTSMAN;
$SIG{QUIT} = \&HUNTSMAN;
$SIG{HUP} = \&HUNTSMAN;
$SIG{TERM} = \&HUNTSMAN;

main();

sub main () {
    #preplogfile;
    #my @hostinfo = hostname;
    #make sure vclstaff owns authorized_keys and log file
   if(open(AUTHFILE,"chown vclstaff:root /home/vclstaff/authorized_keys 2>&1 |")){
      notify($ERRORS{'OK'},"main: setting vclstaff ownership of /home/vclstaff/authorized_keys");
      close(AUTHFILE);
   }
   if(open(LOGFILE,"chown vclstaff:root /var/log/vclclientd.log 2>&1 |")){
      notify($ERRORS{'OK'},"main: setting vclstaff ownership of /var/log/vclclientd.log");
      close(LOGFILE);
   }     
   if(!(-r "/etc/users.local.admin")){
      notify($ERRORS{'OK'},"main: /etc/users.local.admin does not exist creating");
      if(open(COPY, "/bin/cp /etc/users.local /etc/users.local.admin |")){
         close(COPY);
         if(-r "/etc/users.local.admin"){
            notify($ERRORS{'OK'},"main: /etc/users.local.admin exist now");
         }
      }

   }
   #on startup check to see if someone has rebooted us. this is a hack
   #we just need to figure out if this a reboot or a restart
   #for now we are just going to look at the output of last -- there has
   #to be a better way
   if(open(LAST,"/usr/bin/last 2>&1 |")){
      my @last =<LAST>;
      close(LAST);
      if($last[0] =~ /reboot/ || $last[1] =~ /reboot/){
       if( -r "$CLIENTDATA"){
           if(open(CLD, "$CLIENTDATA")){
             my @file = <CLD>;
              close(CLD);
             if($file[0] =~ /new/){
                if(open(FLAG, ">$VCLFLAG")){
                   print FLAG 1;
                   close(FLAG);
                    notify($ERRORS{'OK'},"main: possibly a reboot setting flag to 1 for reinitializing");
                 }#flag
             }#new
          }#CLD
          else{
              notify($ERRORS{'OK'},"main: could not open $CLIENTDATA");
          }
       }# readable
      }# last -- reboot
   }

   
    while(1){
       if( flag ){
             notify($ERRORS{'OK'},"main: flag is set proceed to process");
             #make sure clientdata is readable
             if(-r $CLIENTDATA){
                #process data
                if(open(CLIENTDATA,"$CLIENTDATA")){
                   my %request=();
                   my @lines = <CLIENTDATA>;
                   close(CLIENTDATA);
                   $request{"state"}=$lines[0];
                   $request{"unityid"}=$lines[1];
                   $request{"remoteIP"}=$lines[2];
                   chomp($request{"state"});
                   chomp($request{"unityid"});
                   chomp($request{"remoteIP"});

                   make_new_child(%request) if($request{"state"} =~ /new|timeout|delete/);
                   reboot() if($request{"state"} =~ /reboot/);
                   fetch() if($request{"state"} =~ /fetch/);
                   store() if($request{"state"} =~ /store/);
                }
                else{
                   notify($ERRORS{'OK'},"main: could not open $CLIENTDATA: $!");
                   
                }
             }  #if -r
          } #if flag
          else{
            #check for any hung children
            #kill fork process and reset flag? does this create a race condition
            #could keep track of killed processes in children hash when number exceeds X (reboot machine?)
            #notify($ERRORS{'OK'},"main: number of children  $children");
             foreach my $p (keys %children) {
                next if($p=~ /hung/);
                notify($ERRORS{'OK'},"main: pid = $p");
                $children{"hungtries"}{"count"}+=1;
                if(open(KILL,"kill -9 $p 2>&1 |")){
                   notify($ERRORS{'OK'},"main: stopping forked process in an attempt to reset");
                   my $k = <KILL>;
                   close(KILL);
                   if($k =~ /No such process/){
                      #not found maybe I was too guick to judge
                      #let it ride
                   }
                   else{
                      if($children{"hungtries"}{"count"} > 4){
                         notify($ERRORS{'OK'},"main: hung process attempts are greater than 4 rebooting");
                         reboot();
                      }
                      if(open(ECHO,"echo 1 > /home/vclstaff/flag |")){
                        notify($ERRORS{'OK'},"main: attempt to reset initiated");
                        close(ECHO);
                      }
                   }
                }
             }

          }
          sleep 5;
      } #while
}
sub flag {
    if(!(-e $VCLFLAG)){
       # warning flag does not exist
       #create it and continue
       if(open(FLAG, ">$VCLFLAG")){
          print FLAG 0;
          notify($ERRORS{'OK'}, "had to create $VCLFLAG");
          close(FLAG);
          if(open(LOGFILE,"chown vclstaff:root /home/vclstaff/flag 2>&1 |")){
              notify($ERRORS{'OK'},"main: setting vclstaff ownership of /home/vclstaff/flag");
              close(LOGFILE);
           }
          if(open(LOGFILE,"chmod 640 /home/vclstaff/flag 2>&1 |")){
             notify($ERRORS{'OK'},"main: setting 640 perms /home/vclstaff/flag");
             close(LOGFILE);
          }
       }
       else{
          notify($ERRORS{'OK'},"could not create $VCLFLAG $! will try to delete");
          unlink $VCLFLAG;
          return 0;
       }
    }
    my @lines;
    # VCLFLAG file exists, check contents
    if(open(FLAG, "$VCLFLAG")){
       @lines = <FLAG>;
       close(FLAG);
       # clear flag
       if(open(FLAG, ">$VCLFLAG")){
          print FLAG 0;
          close(FLAG);
       }
       else{
          unlink $VCLFLAG;
       }  
       return $lines[0];
    }
    else{
       notify($ERRORS{'OK'},"flag: could not open $VCLFLAG $!");
       return 0;
    }
}
sub make_new_child {
   my (%request_data) = @_; 
   my $pid;
   my $sigset;
               
   # block signal for fork
   $sigset = POSIX::SigSet->new(SIGINT);
   sigprocmask(SIG_BLOCK, $sigset) or die "Can't block SIGINT for fork: $!\n";
   #die "fork: $!" unless defined ($pid = fork);
FORK: {       
   if ($pid = fork) {
      # Parent records the child's birth
      # and returns.
      sigprocmask(SIG_UNBLOCK, $sigset) or die "Can't unblock SIGINT for fork: $!\n";
      
      $children{$pid} = 1;
      $children++;
      notify($ERRORS{'OK'},"vclclientd current number of forked kids: $children");
      return;
   } elsif(defined $pid) {
      # Child can *not* return from this subroutine.
      $SIG{INT} = 'DEFAULT';
      # make SIGINT kill us as it did before unblock signals
      sigprocmask(SIG_UNBLOCK, $sigset) or die "Can't unblock SIGINT for fork: $!\n";

      notify($ERRORS{'OK'},"processdata: new request child process $request_data{state} $request_data{unityid},$request_data{remoteIP}   ");
     #do something that may take a long time or needs to be monitored
     #based on the case lets do something
     if($request_data{state} =~ /new/){ 
        notify($ERRORS{'OK'},"processdata: new request  $request_data{unityid},$request_data{remoteIP}   ");
         if(new_state($request_data{unityid},$request_data{remoteIP})){
            notify($ERRORS{'OK'},"processdata: connection for $request_data{unityid}\@$request_data{remoteIP} successfully opened");
         }
     }
     elsif($request_data{"state"} =~ /timeout|deleted/){
        if(timeout_state($request_data{unityid},$request_data{remoteIP})){
          notify($ERRORS{'OK'},"vclclientd: connection for $request_data{unityid}\@$request_data{remoteIP} successfully terminated");
        }
     }

     exit;
   } elsif ($! =~ /No more process/){
       sleep 5;
       redo FORK;
   }
   else {
       # strange error
      die "Can't fork: $!\n";
   }
 }
}
sub new_state {
   my ($user,$remoteIP) =@_;
   # assumuption user and IP are valid
   # add user to users.local, sshd_config_vcl
   # on acknowledgemment turn on sshd on port 22
   my @file;
   my $line;
   my ($userset,$remoteIPset) = 0;
   #test for sshd_config_vcl
   if(!(-r "$HOME/sshd_config_vcl")){
      #hrmm. were did sshd_config_vcl go
      #let try to create another from the orignal
      if(createnewssh_config_vcl){
         notify($ERRORS{'OK'},"new_state: sshd_config_vcl missing created a new one");
      }
      else{
         notify($ERRORS{'OK'},"new_state: sshd_config_vcl missing failed to create a new one");
         return 0;
      }

   }
   if(open(CONFIG,"$HOME/sshd_config_vcl")){
        @file = <CONFIG>;
       close(CONFIG);
       foreach $line (@file){
           if($line =~ /AllowUsers/){
            $line = "AllowUsers $user\n";
            $userset=1;
            notify($ERRORS{'OK'},"new_state: adding AllowUsers $user to sshd_config_vcl");
           }
        }
       if(!$userset){
          push @file, "AllowUsers $user\n";
          notify($ERRORS{'OK'},"new_state: hrmm, had to add AllowUsers $user to sshd_config_vcl");
       }
       if(open(CONFIG,">$HOME/sshd_config_vcl")){
              print CONFIG @file;
              close(CONFIG);
        }
   }                           
   # append to users.local
   if(open(USERSLOCAL,"/etc/users.local")){
      my @users = <USERSLOCAL>;
      close(USERSLOCAL);
      push @users,"\n$user\n";
      if(open(USERSLOCAL,">/etc/users.local")){
            print USERSLOCAL @users;
            notify($ERRORS{'OK'},"new_state: adding $user to users.local");
            close(USERSLOCAL);
      }
    }
   else{
      notify($ERRORS{'WARNING'},"new_state: could not open /etc/users.local $!");
      return 0;
   }
   #start sshd
   if(startsshd){
      notify($ERRORS{'OK'},"new_state: startsshd returned and successful");
      return 1;
   }
   return 0;
}
sub timeout_state{
    # time to close non-admin ssh sessions and clean up users.local,
    # sshd_config_vcl
   my ($user,$remoteIP) =@_;
   my $os = lc($^O);
   #notify($ERRORS{'OK'},"timeout_state: OSname is $os");
   my @file;
   my $l;
   my $sshd_admin_pid =0;
   my ($pgrep,$pkill);

   # get admin pid
   if($os eq "solaris"){
      $pgrep="/bin/pgrep";
      $pkill="/bin/pkill";

     if(open(SSH,"/local/openssh/etc/sshd.admin.pid")){
         @file = <SSH>; 
         close(SSH);
         $sshd_admin_pid=$file[0];
         notify($ERRORS{'OK'},"timeout_state: sshd_admin_pid set $sshd_admin_pid");
       }
       else{
          notify($ERRORS{'OK'},"timeout_state: could not open /local/openssh/etc/sshd.admin.pid $!");
       }
   }
   elsif($os eq "linux"){
      $pgrep="/usr/bin/pgrep";
      $pkill="/usr/bin/pkill";
     if(open(SSH,"ps -ef \| grep /usr/sbin/sshd |")){
         @file = <SSH>; 
         close(SSH);
         $sshd_admin_pid=$file[0];
         foreach $l (@file){
            chomp ($l);
             next if($l =~ /grep/);
             if($l =~ /(\/usr\/sbin\/sshd$)/){
                my $blah;
                ($blah,$sshd_admin_pid,$blah) = split(/\s+/,$l,3);
                  notify($ERRORS{'OK'},"timeout_state: sshd_admin_pid set $sshd_admin_pid");
             }
         }
       }
       else{
          notify($ERRORS{'OK'},"timeout_state: execute ps -ef $!");
       }
   }
   else{
          notify($ERRORS{'OK'},"timeout_state: $os not supported");
          # we'll just let this ride and get a restart
   }
   # clean up users.local
   # collect members of users.admin,users.base, and users.cluster
   my @users_admin;
   my @users_base;
   my @users_cluster;
   my $u;
   #this one should exist
   if(open(USERSLOCAL,"cat /etc/users.local.admin > /etc/users.local |")){
       close(USERSLOCAL);
       notify($ERRORS{'OK'},"timeout_state: dumped contents of /etc/users.local.admin /etc/users.local");
   }
   if(-r "/etc/users.local.base"){
      if(open(USERSLOCAL,"cat /etc/users.local.base >> /etc/users.local |")){
         close(USERSLOCAL);
         notify($ERRORS{'OK'},"timeout_state: dumped contents of /etc/users.local.base /etc/users.local");
      }
   }
   if(-r "/etc/users.local.cluster"){
      if(open(USERSLOCAL,"cat /etc/users.local.cluster >> /etc/users.local |")){
         close(USERSLOCAL);
         notify($ERRORS{'OK'},"timeout_state: dumped contents of /etc/users.local.cluster /etc/users.local");
      }
   }
   
    
    if(open(USERSLOCAL,"/etc/users.local")){
       @users_admin=<USERSLOCAL>;
       close(USERSLOCAL);
    }
    # check users.local add vclstaff if is does not exist
    my $vclstaff=0; 
    my $i;
    for $i (@users_admin){
      $vclstaff =1 if($i =~ "vclstaff");

    }
    
    if(!$vclstaff){
       push @users_admin, "\nvclstaff\n";
       if(open(USERSLOCAL,"> /etc/users.local")){
         print USERSLOCAL @users_admin;
         close(USERSLOCAL);
       }
    }
   # clean up our sshd_config_vcl
   my @SSH;
   my $s;
   if(open(SSHDCONFIG, "$HOME/sshd_config_vcl")){
      @SSH = <SSHDCONFIG>;
      close(SSHDCONFIG);
      foreach $s (@SSH){
         if($s =~ s/AllowUsers $user/AllowUsers/g){
             notify($ERRORS{'OK'},"timeout_state: $user\@$remoteIP removed from sshd_config_vcl");
         }
      }
      # write back out to sshd_config_vcl
      if(open(SSHDCONFIG, ">$HOME/sshd_config_vcl")){
         print SSHDCONFIG @SSH;
         close (SSHDCONFIG);
      }
      else{
          notify($ERRORS{'OK'},"timeout_state: could not open $HOME/sshd_config_vcl for writing");
      }
   }

   #kill off any user processes
   if(open(PKILL, "$pkill -9 -U $user 2>&1 |")){
      my @pkill=<PKILL>;
      close(PKILL);
      notify($ERRORS{'OK'},"timeout_state: stopped user processes");
      #check for user
      notify($ERRORS{'OK'},"timeout_state: confirming user processes are stopped");
      if(open(PGREP, "ps -ef \| grep $user|")){
         my @pgrep=<PGREP>;
         close(PGREP);
         foreach my $pid (@pgrep){
            next if($pid =~ /grep/);
            my($userblah,$userpid) = split(/\s+/,$pid,3);
            if($userpid){
               if(open(KILL, "kill -9 $userpid |")){
                  notify($ERRORS{'OK'},"timeout_state: killed user process $userpid");
                  close(KILL);
               }
            }
         }
      }
   }
   notify($ERRORS{'OK'},"timeout_state: checking for all sshd processes");
   # use pgrep to get all sshd pids
   if(open(PGREP,"ps -ef \|grep sshd 2>&1|")){
       my @pfile = <PGREP>;
       close(PGREP);
       foreach $l (@pfile){
         next if($l =~ /grep/);
         next if($l =~ /ps -ef/);
         notify($ERRORS{'OK'},"timeout_state: pgrep sshd = $l");

          my ($b,$sshpid);
          ($b,$b,$sshpid,$b) = split(/\s+/,$l,4) if($os eq "solaris");
          ($b,$sshpid) = split(/\s+/,$l,3) if($os eq "linux");
          next if($sshpid == $sshd_admin_pid);
          if(open(KILL, "kill -9 $sshpid |")){
             notify($ERRORS{'OK'},"timeout_state: killed sshd process $sshpid");
             close(KILL);
          }
       }
       notify($ERRORS{'OK'},"timeout_state: checking if I accidentially killed all sshd processes");
      # did we kill all sshd sessions?
       if(open(PGREP,"ps -ef \|grep sshd \|grep -v grep |")){
         notify($ERRORS{'OK'},"timeout_state: executed ps -ef \|grep sshd \|grep -v grep");
          @file = <PGREP>;
          notify($ERRORS{'OK'},"timeout_state: @file");
          close(PGREP);
          if(!($file[0])){
             notify($ERRORS{'OK'},"timeout_state: killed all sshd processes, will try to restart");
             if(open(SSHD,"/etc/inet.d/sshd start |")){
                @file = <SSHD>;
                close(SSHD);
                notify($ERRORS{'OK'},"timeout_state: sshd admin restarted @file");
             }
          }
       }
   }
   else{
       notify($ERRORS{'WARNING'},"timeout_state: could not execute /usr/bin/pgrep sshd");
       
   }
   notify($ERRORS{'OK'},"timeout_state: looking for sshd_config_vcl");
   #look for sshd_config_vcl in case we killed the sshd_admin pid
   if(open(SSH,"ps -ef \| grep /usr/sbin/sshd |")){
      my @sshfile = <SSH>;
      close(SSH);
      foreach $l (@sshfile) {
         if($l =~ /(\/home\/vclstaff\/sshd_config_vcl\/)/){
            # for some reason sshd with the vcl config file did not get stopped  
            #initiate a restart/reload  
            notify($ERRORS{'OK'},"timeout_state: sshd_config_vcl not stopped for some reason, prhaps the wrong sshd pid");
            my ($b,$sshpid) = split(/\s+/,$l,3);
            if($sshpid == $sshd_admin_pid){
               notify($ERRORS{'OK'},"timeout_state: killed the wrong sshd pid");
               #kill this pid
               if(open(KILL, "kill -9 $sshpid |")){
                  notify($ERRORS{'OK'},"timeout_state: killed sshd process $l");
                  close(KILL);
               }
            
               #stop and start sshd service.
               if(open(SSHSTOP,"/etc/inet.d/sshd stop |")){
                  @file = <SSHSTOP>;
                  close(SSHSTOP);
                  notify($ERRORS{'OK'},"timeout_state: sshd admin stopped @file");
                  if(open(SSHSTART, "/etc/inet.d/sshd start |")){
                     @file=<SSHSTART>;
                     close(SSHSTART);
                     notify($ERRORS{'OK'},"timeout_state: sshd admin started @file");
                  }
               }
            }
         }
      }
   }

   if(sshdstatus){
      notify($ERRORS{'OK'},"timeout_state: sshd core process is running");
   }
   else{
      notify($ERRORS{'CRITICAL'},"timeout_state: sshd is not running or could not be restarted");

   }
   return 1;
}
sub reboot {
   #simply reboot the client when called
   my $os = lc($^O);
   my $reboot;
   if($os eq "solaris"){
      $reboot = "/usr/sbin/shutdown -y -g 0 -i 6";
   }
   else{
      $reboot = "/sbin/shutdown -r now";
   }
   notify($ERRORS{'OK'},"reboot: starting reboot sequence");
   if(open(REBOOT,"$reboot 2>&1 |")){
      my @reboot=<REBOOT>;
      close(REBOOT);
      notify($ERRORS{'OK'},"reboot: @reboot");
      return 1;
   }

}
sub fetch {
   #collect host ssh keys and save for MN to pick up
   notify($ERRORS{'OK'},"fetch: copying ssh keys to $HOME");
   my $os = lc($^O);
   my $sshdir;
   if($os eq "solaris"){
      $sshdir = "/local/openssh/etc";
   }
   else{
      $sshdir = "/etc/ssh/";
   }

   if(open(CP, "/bin/cp $sshdir/ssh_host\* $HOME 2>&1 |")){
      my @cp=<CP>;
      close(CP);
      if(@cp){
         notify($ERRORS{'OK'},"fetch: copy problems - @cp");
      }

      if(open(CHOWN,"/bin/chown vclstaff $HOME/ssh_host\* 2>&1 |")){
         my @chown=<CHOWN>;
         close(CHOWN);
         if(@chown){
            notify($ERRORS{'OK'},"fetch: chown problems - @cp");
         }
      }
   }
   notify($ERRORS{'OK'},"fetch: fetch complete");
   return 1;
}
sub store {
   # take host ssh keys stored in my home directory and place them into the /etc/sshd directory
   #create an orig directory in $sshdir
   #copy original keys to orig dir
   #cp given keys to proper location
   #set correct ownership and premissions on keys
   #unlink/remove locally stored keys from vclstaff dir
   my $os = lc($^O);
   my $sshdir;
   if($os eq "solaris"){
      $sshdir = "/local/openssh/etc";
   }
   else{
      $sshdir = "/etc/ssh";
   }    
   notify($ERRORS{'OK'},"store: copying ssh keys to $sshdir");

   my %filelist;
   $filelist{"dsa"}="ssh_host_dsa_key";
   $filelist{"dsapub"}="ssh_host_dsa_key.pub";
   $filelist{"rsa"}="ssh_host_rsa_key"; 
   $filelist{"rsapub"}="ssh_host_rsa_key.pub";
   $filelist{"key"}="ssh_host_key";
   $filelist{"keypub"}="ssh_host_key.pub";

    if(!(-d "$sshdir/origkeys")){
       if(mkdir("$sshdir/origkeys", 755)){
         notify($ERRORS{'OK'},"store: mkdir successfully created $sshdir/origkeys");
       }
       else{
          notify($ERRORS{'OK'},"store: mkdir $sshdir/origkeys $! ");
       }
    }
    else{
     #hrmm $sshdir/origkeys already exists
    }
    #copy system generated keys to orig dir
    #copy stored keys to ssh dir
    #set perms,ownership,unlink local copy
    foreach my $f(sort keys %filelist) {
       if(!(-f "$HOME/$filelist{$f}")){
          notify($ERRORS{'OK'},"store: does not exist $HOME/$filelist{$f}");
          next;
       }
       if(open(CP,"/bin/cp $sshdir/$filelist{$f} $sshdir/origkeys 2>&1 |")){
          my @cp=<CP>;
          close(CP);
          if(@cp){
             notify($ERRORS{'OK'},"store: copy orig keys problem on $filelist{$f} - @cp");
          }
       }
       #copy given keys to ssh dir
       if(open(CP,"/bin/cp $HOME/$filelist{$f} $sshdir/$filelist{$f} 2>&1 |")){
          my @cp=<CP>;
          close(CP);
          if(@cp){
             notify($ERRORS{'OK'},"store: copy given keys problem on $filelist{$f} - @cp");
          }
          else{
            notify($ERRORS{'OK'},"store: copied $filelist{$f} to $sshdir");
            if(open(CHOWN, "/bin/chown root:root $sshdir/$filelist{$f} 2>&1 |")){
               close(CHOWN);
            }
            my $p;
            if($f =~ /pub/){
               $p = 644;
            }
            else{
               $p = 600;
            }
            if(open(CHMOD, "/bin/chmod $p $sshdir/$filelist{$f} 2>&1|")){
               my @chmod=<CHMOD>;
               close(CHMOD);
               if(@chmod){
                  notify($ERRORS{'OK'},"store: chmod problem on $filelist{$f} - @chmod");
               }
            }#chmod
          }#else no cp problems
       }#CP
       #unlink
       if(unlink "$HOME/$filelist{$f}"){
         notify($ERRORS{'OK'},"store: deleted $HOME/$filelist{$f}");
       }
       else{
         notify($ERRORS{'OK'},"store: unable to delete $HOME/$filelist{$f}");
       }
     }#foreach
     #restart sshd
     if(restartsshd){
        notify($ERRORS{'OK'},"store: sshd restarted");
        return 1;
     }
     else{
         notify($ERRORS{'OK'},"store: sshd restart failed");
         return 0;
     }
    return 1;
}

sub restartsshd {
   my $os = lc($^O);
   notify($ERRORS{'OK'},"restartsshd: attempting to restart sshd on $os");
   if($os eq "solaris"){
      if(open(STOP,"/bin/pkill -f sshd_admin.cfg  2>&1 |")){
         my @stop=<STOP>;
         close(STOP);
         foreach my $r (@stop) {
            if($r =~ /failed/i){
               notify($ERRORS{'WARNING'},"restartsshd: sshd stop failed @stop");
            }
         }
         if(open(START,"/etc/init.d/sshd start 2>&1 |")){
            my @start=<START>;
            close(START);
            foreach my $r (@start) {
               #notify($ERRORS{'OK'},"restartsshd: output $r");
               if($r =~ /failed/i){
                  notify($ERRORS{'WARNING'},"restartsshd: sshd start failed @start");
               } 
               return 1 if($r =~ /ok/i);               
            }
         }#if start
      } # pkill
   }
   elsif($os =~ /linux/){
      if(open(RESTART,"/etc/init.d/sshd restart 2>&1 |")){
         my @restart=<RESTART>;
         close(RESTART);
         foreach my $r (@restart) {
           if($r =~ /failed/i){
               notify($ERRORS{'WARNING'},"restartsshd: sshd restart failed $r @restart");
            }
            if($r =~ /Starting/){
               return 1 if($r =~ /ok/i);
            }
         }
      }
   }
  return 1; 
}
sub startsshd {                                             
   my @lines;
   #figure out OS solaris or linux
   my $os= lc($^O);
   my @output;
   my $l;
   if($os eq "solaris"){ 
       if(open(SSHD,"/local/openssh/sbin/sshd -f $HOME/sshd_config_vcl 2>&1 |")){
          notify($ERRORS{'OK'},"startsshd: starting sshd");
          @output = <SSHD>;
          close(SSHD);
         foreach $l (@output){
             notify($ERRORS{'OK'},"startsshd output: $l");
         }
         return 1;
       }
       else{
          notify($ERRORS{'OK'},"startsshd: could not execute /local/openssh/sbin/sshd -f $HOME/sshd_config_vcl $!");
          return 0;
       }
   }
   elsif($os eq "linux"){
      if(open(SSHD, "/usr/sbin/sshd -f $HOME/sshd_config_vcl |")){
          notify($ERRORS{'OK'},"startsshd: starting sshd");
          @output = <SSHD>;
          close(SSHD);
         foreach $l (@output){
             notify($ERRORS{'OK'},"startsshd output: $l");
         }
         return 1;
       }
       else{
          notify($ERRORS{'OK'},"startsshd: could not execute /usr/sbin/sshd -f $HOME/sshd_config_vcl $!");
          return 0;
       }
      }
}
sub notify {
       my ($error,$string) = @_;
       my $currenttime = makedatestring;
       if(open(LOGIT, ">>$LOG")){
          if( !$error ){
             print LOGIT "$currenttime - $$: $string\n";
             close(LOGIT);
             return;
          }
          if ($error == 2 ) {  #CRITICAL something bad happened, exiting
             print LOGIT  "\n$string\n"; 
             print LOGIT "exiting\n";
             close(LOGIT);
             exit;
          }
          elsif( $error == 1 ){
             # WARNING should prompt admin to
             # continue or exit
             # need to disable for cron
             print LOGIT "\n---- WARNING ---- \n$string\n";
             close(LOGIT);
          }
          # mail us, this is to be used for cron jobs
          elsif( $error == 5 ){
             print LOGIT "\n---- sending mail -- $currenttime - - $$ $string\n";
             my $from = "root";
             my $to = "fapeeler\@engr.ncsu.edu";
             my $subject = "PROBLEM -- $0";
             my $mailer = Mail::Mailer->new("sendmail");
             if($mailer->open({From => $from,
                           To => $to,
                           Subject => $subject,
             })){
                print $mailer "vclclientd $currenttime - - process $$ \n\n\n$string";
                $mailer->close();
              }
             return 1;
             }
          }
}
sub makedatestring {
       my($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime( );
      $year += 1900; 
      $mon++;
      my $datestring = sprintf("%04d-%02d-%02d %02d:%02d:%02d",$year,$mon,$mday,$hour,$min,$sec);
      return $datestring;
}
sub sshdstatus {
   my $os = lc($^O);
   if($os eq "solaris"){
      my $sshd_admin_pid;
      if(open(SSH,"/local/openssh/etc/sshd.admin.pid")){
         my @file = <SSH>; 
         close(SSH);
         chomp($file[0]);
         $sshd_admin_pid=$file[0];
       }
       else{
          notify($ERRORS{'OK'},"sshdstatus: could not open /local/openssh/etc/sshd.admin.pid $!");
          return 0;
       }

      if(open(STAT,"/bin/pgrep -f sshd  2>&1 |")){
         my @stat=<STAT>;
         close(STAT);
         foreach my $r (@stat) {
            if($r =~ /$sshd_admin_pid/){
               #notify($ERRORS{'OK'},"sshdstatus: sshd is running");
               return 1;
            }
         }
         notify($ERRORS{'OK'},"sshdstatus: sshd is NOT running trying to restart");
         if(open(START,"/etc/init.d/sshd start 2>&1 |")){
            my @start=<START>;
            close(START);
            foreach my $r (@start) {
               if($r =~ /failed/i){
                  notify($ERRORS{'WARNING'},"store: sshd start failed @start");
                  return 0;
               }
            }
         }#if start
      }#STAT
         return 1;
   } #os=solaris
   elsif($os =~ /linux/){
      my $sshd_admin_pid;
      if(open(SSH,"/var/run/sshd.pid")){
         my @file = <SSH>; 
         close(SSH);
         chomp($file[0]);
         $sshd_admin_pid=$file[0];
       }
       else{
          notify($ERRORS{'WARNING'},"sshdstatus: could not open /var/run/sshd.pid $!");
          return 0;
       }
      my $running=0;
      if(open(SSH,"pgrep -f sshd 2>&1|")){
         my @lines = <SSH>;
         close(SSH);
         foreach my $l (@lines){
            if($l =~ /$sshd_admin_pid/){
               #ok it's running
               $running=1; #not that this matters
               return 1;
            }
        }
      }#if pgrep
      if(!$running){
        #start sshd
        notify($ERRORS{'WARNING'},"sshdstatus: not running trying to restart");
        if(open(STAT,"/etc/init.d/sshd start 2>&1 |")){
           my @stat = <STAT>;
           close(STAT);
           foreach my $s (@stat) {
             if($s =~ /ok/i){
                notify($ERRORS{'OK'},"sshdstatus: restarted core sshd process, @stat");
                return 1;
             }
           }
           #in case I don't return in above check
           notify($ERRORS{'OK'},"sshdstatus: restart attempt may of had issues, @stat");
           return 0;
        }#if sshd start
       }#if ! running
      }#elsif linux
}
sub createnewssh_config_vcl {
   #check for .orig from /etc/ssh dir
   #if orig then just need to add port 22 and AllowUsers directive
   my ($port22,$AU,$port24)=0;
   my @file;
   if(-e "/etc/sshd/sshd_config.orig"){
         #good slurp it in
      if(open(CONFIG,"$HOME/sshd_config_vcl")){
       @file = <CONFIG>;
       close(CONFIG);
       foreach my $line (@file){
           #check for port 22 and AllowUsers
          if($line =~ /^Port 22/){
             $port22=1;
          }
          if($line =~ /^AllowUsers/){
             $AU=1;
          }
          if($line =~ s/^Port 24/Port 22/g){
             $port22=1;
          }
       }
      }
   }
   else{
    #ok /etc/sshd/sshd_config.orig does not exist
    #try to create from the /etc/sshd/sshd_config

   }
   #write out to $HOME/sshd_config_vcl
   if(open(SC,">$HOME/sshd_config_vcl")){
      print SC @file;
      close(SC);
   }
   else{
      notify($ERRORS{'CRITICAL'},"createnewssh_config_vcl: sshd_config_vcl was reported to not exists, in repairing I failed to create a new $HOME/sshd_config_vcl $!");
      return 0;
   }
}