[SOLVED] My first foray into sustemd

taylorkh · 01-29-2017, 10:21 AM

Well not exactly. I have done a couple of monkey see, monkey copy, monkey paste systemd adjustments

This time I am attempting to configure stunnel to start automatically. It is installed and works if I issue the command

Quote:

#stunnel

Using the information from this page https://duykhanh.me/stunnel-init-sys...pt-on-centos7/I created my system file stunnel.system

Code:

[Unit]
Description=SSL tunnel for network daemons
After=syslog.target

[Service]
ExecStart=/bin/stunnel /etc/stunnel/stunnel.conf
ExecStop=kill -9 $(pgrep stunnel)
ExecStatus=pgrep stunnel
Type=forking

[Install]
WantedBy=multi-user.target

I placed the file in /usr/lib/systemd/system/. Following other examples I have seen I placed a symlink "stunnel.system" in /etc/systemd/service/. I can start the service using the old service command

Code:

[root@taylor19 Desktop]# service stunnel start
Redirecting to /bin/systemctl start tunnel.service

Unfortunately stunnel does not start at bootup. If I understand the file correctly it should start stunnel AFTER the system log recording process starts and stunnel should be running before the system reaches the multi-user state. I suspect I have overlooked something simple. Can anyone point me to my error?

TIA

Ken

hazel · 01-29-2017, 10:33 AM

To start a service at boot, you must "enable" it. "start" merely starts it in the current session. The command you need is systemctl enable tunnel.service.

It is also bad practice to put your service file on /usr/lib. That location is for service files that come as part of a package and are liable to be updated without warning. Anything custom-made should go in /etc/systemd/system.

taylorkh · 01-29-2017, 12:26 PM

Thank you hazel,

I was close. I know that "start" only works in the current session. I was using it simply to see if my stunnel.service file would fire. The "enable" step was what I was missing.

Thank you for the tip on where to place the file. I noticed that all of the .system files currently reside in /usr/lib/systemd/service/ and are linked from /etc/systemd/system/ I will remember to place home made .system files in the /etc/ side of the house.

I removed the link, put the file in /etc/systemd/system and issued the enable command. After a reboot I observed that stunnel was still not running. In examining the logs I found

Code:

Jan 29 10:08:50 taylor19 systemd: [/usr/lib/systemd/system/stunnel.service:10] Executable path is not absolute, ignoring: kill -9 $(pgrep stunnel)
Jan 29 10:08:50 taylor19 systemd: [/usr/lib/systemd/system/stunnel.service:11] Unknown lvalue 'ExecStatus' in section 'Service'

I commented out those two lines in the .service file, leaving only the start line, ran the enable command again and rebooted. Still no stunnel.

I found another example stunnel.service file. Let me try it and see what happens.

Thanks again,

Ken

taylorkh · 01-29-2017, 12:34 PM

Page 2 as Paul Harvey used to say - and now for the rest of the story...

It appears that my first sample .service file was missing the [Install] section. I replaced my file with this

Code:

[Unit]
Description=SSL tunnel for network daemons
After=network.target
After=syslog.target

[Install]
WantedBy=multi-user.target
Alias=stunnel.target

[Service]
Type=forking
ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf
ExecStop=/usr/bin/killall -9 stunnel

Restart=always
PrivateTmp=falsereboot

and when I ran the enable command I saw

Code:

[root@taylor19 system]# systemctl enable stunnel.service
Created symlink from /etc/systemd/system/stunnel.target to /etc/systemd/system/stunnel.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/stunnel.service to /etc/systemd/system/stunnel.service.

That is stating to make sense. I see now that my .service file got "plugged in" to the systemd "thing". I am starting to understand how all of this works. Scary

Thank you again for your assistance.

Ken

p.s. Looking at it again, the original was NOT missing the [Install] section, but it was different. At least I now have a working and non working example. I will do some investigation line by line and see what I can learn.

ondoho · 01-30-2017, 02:11 AM

after installing/starting/enabling a new service, i always check with

Code:

systemctl status *****.service

if everything went ok.

taylorkh · 01-30-2017, 05:03 AM

Thanks ondoho,

In this case I tested stunnel by running the program which needed it. I will keep that more generic approach in mind.

Ken