root/fwknop/tags/fwknop-1.8/install.pl

#!/usr/bin/perl -w
#
#############################################################################
#
# File: install.pl
#
# URL: http://www.cipherdyne.org/fwknop
#
# Purpose: Installer for fwknop
#
# Credits:  (see the CREDITS file)
#
# Copyright (C) 2004-2007 Michael Rash (mbr@cipherdyne.org)
#
# License (GNU Public License):
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program; if not, write to the Free Software
#    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
#    USA
#
#############################################################################
#
# $Id$
#

use Cwd;
use File::Copy;
use File::Path;
use Getopt::Long;
use Sys::Hostname;
use strict;

#========================== config ===========================
my $INIT_DIR    = '/etc/init.d';
my $USRBIN_DIR  = '/usr/bin';
my $URRSBIN_DIR = '/usr/sbin';

my $RUNLEVEL;    ### This should only be set if install.pl
                 ### cannot determine the correct runlevel

### only used it $ENV{'HOME'} is not set for some reason
my $config_homedir = '';

my $fwknop_conf_file = 'fwknop.conf';

### system binaries
my $chkconfigCmd = '/sbin/chkconfig';
my $rcupdateCmd  = '/sbin/rc-update';  ### Gentoo
my $makeCmd      = '/usr/bin/make';
my $perlCmd      = '/usr/bin/perl';
my $gzipCmd      = '/bin/gzip';
my $killallCmd   = '/usr/bin/killall';
my $mknodCmd     = '/bin/mknod';
my $ifconfigCmd  = '/sbin/ifconfig';
#======================== end config =========================

### main configuration hash
my %config = ();

my $client_install  = 0;
my $bsd_install = 0;
my $homedir = '';
my $distro = '';
my $print_help = 0;
my $uninstall  = 0;
my $syslog_conf = '';
my $data_method = '';
my $runlevel;
my $force_install_re  = '';
my $force_path_update = 0;
my $cmdline_force_install = 0;
my $skip_module_install   = 0;
my $force_defaults = 0;

my %exclude_cmds = (
    'mail'        => '',
    'fwknop'      => '',
    'fwknopd'     => '',
    'fwknop_serv' => '',
    'knopmd'      => '',
    'knoptm'      => '',
    'knopwatchd'  => '',
);

### perl module directories
my %required_perl_modules = (
    'Class::MethodMaker' => {  ### GnuPG::Interface dependency
        'force-install'       => 0,
        'client-mode-install' => 1,
        'mod-dir'             => 'Class-MethodMaker'
    },
    'GnuPG::Interface' => {
        'force-install'       => 0,
        'client-mode-install' => 1,
        'mod-dir'             => 'GnuPG-Interface'
    },
    'Unix::Syslog' => {
        'force-install'       => 0,
        'client-mode-install' => 0,
        'mod-dir'             => 'Unix-Syslog'
    },
    'Net::IPv4Addr' => {
        'force-install'       => 0,
        'client-mode-install' => 1,
        'mod-dir'             => 'Net-IPv4Addr'
    },
    'List::MoreUtils' => {  ### Net::RawIP dependency
        'force-install'       => 0,
        'client-mode-install' => 0,
        'mod-dir'             => 'List-MoreUtils'
    },
    'Net::RawIP' => {
        'force-install'       => 0,
        'client-mode-install' => 1,
        'mod-dir'             => 'Net-RawIP'
    },
    'Net::Ping::External' => {
        'force-install'       => 0,
        'client-mode-install' => 1,
        'mod-dir'             => 'Net-Ping-External'
    },
    'Net::Pcap' => {
        'force-install'       => 0,
        'client-mode-install' => 0,
        'mod-dir'             => 'Net-Pcap'
    },
    'Crypt::Rijndael' => {
        'force-install'       => 0,
        'client-mode-install' => 1,
        'mod-dir'             => 'Crypt-Rijndael'
    },
    'Crypt::CBC' => {
        'force-install'       => 0,
        'client-mode-install' => 1,
        'mod-dir'             => 'Crypt-CBC'
    },
    'Term::ReadKey' => {
        'force-install'       => 0,
        'client-mode-install' => 1,
        'mod-dir'             => 'TermReadKey'
    },
    'IPTables::Parse' => {
        'force-install'       => 1,
        'client-mode-install' => 0,
        'mod-dir'             => 'IPTables-Parse'
    },
    'IPTables::ChainMgr' => {
        'force-install'       => 1,
        'client-mode-install' => 0,
        'mod-dir'             => 'IPTables-ChainMgr'
    }
);

my %cmds = (
    'make'     => $makeCmd,
    'perl'     => $perlCmd,
    'gzip'     => $gzipCmd,
    'killall'  => $killallCmd,
    'mknod'    => $mknodCmd,
    'ifconfig' => $ifconfigCmd,
);

my @cmd_search_paths = qw(
    /bin
    /sbin
    /usr/bin
    /usr/sbin
    /usr/local/bin
    /usr/local/sbin
);

### for user answers
my $ACCEPT_YES_DEFAULT = 1;
my $ACCEPT_NO_DEFAULT  = 2;
my $NO_ANS_DEFAULT     = 0;

### make Getopts case sensitive
Getopt::Long::Configure('no_ignore_case');

&usage(1) unless (GetOptions(
    'force-mod-install' => \$cmdline_force_install,  ### force install of all modules
    'Force-mod-regex=s' => \$force_install_re, ### force specific mod install with regex
    'Skip-mod-install'  => \$skip_module_install,
    'BSD-install'   => \$bsd_install,
    'Defaults'      => \$force_defaults,
    'client-only'   => \$client_install, # Force client-only installation
    'path-update'   => \$force_path_update,
    'uninstall'     => \$uninstall,      # Uninstall fwknop.
    'syslog-conf=s' => \$syslog_conf,    # Specify path to syslog config file.
    'help'          => \$print_help      # Display help.
));
&usage(0) if $print_help;

### import paths from default fwknopd.conf
&import_config();

### check to see if we are installing on an ipfw system (freebsd, etc.)
if (&is_ipfw()) {

    print
"[+] It looks like you are installing fwknop on a *BSD system. Installation\n",
"    of iptables perl modules will be skipped.\n";
    $bsd_install = 1;

} elsif (&is_cygwin()) { ### check to see if we are installing on Cygwin

    print
"[+] It looks like you are installing fwknop in a Cygwin environment, so the\n",
"    fwknop client will be installed (the fwknopd server does not yet\n",
"    function with a Windows-based firewall).\n\n";

    $client_install = 1;

}

### check to see if we are installing as a non-root user
&check_non_root_user() unless $client_install;

if ($client_install) {

    ### we are installing as a normal user instead of root, so see
    ### if it is ok to install within the user's home directory
    $homedir = '';
    if ($config_homedir) {
        $homedir = $config_homedir;
    } else {
        $homedir = $ENV{'HOME'} or die '[*] Could not get home ',
            "directory, set the $config_homedir var.";
    }

    print
"    The fwknop client will be installed at $homedir/bin/fwknop, and a few\n",
"    perl modules needed by fwknop will be installed in $homedir/lib/fwknop/.\n\n",

    $config{'FWKNOP_MOD_DIR'} = "$homedir/lib/fwknop";
    $USRBIN_DIR = "$homedir/bin";

} else {

    unless ($bsd_install) {

        $distro = &get_distro();

        if ($distro eq 'redhat' or $distro eq 'fedora') {
            ### add chkconfig only if we are runing on a redhat distro
            $cmds{'chkconfig'} = $chkconfigCmd;
        } elsif ($distro eq 'gentoo') {
            ### add rc-update if we are running on a gentoo distro
            $cmds{'rc-update'} = $rcupdateCmd;
        }
    }
}

### make sure the system binaries are where we expect
### them to be.
&check_commands();

my $hostname = hostname();

my $src_dir = getcwd() or die "[*] Could not get current working directory.";

unless ($client_install) {
    unless (-d $INIT_DIR) {
        if (-d '/etc/rc.d/init.d') {
            $INIT_DIR = '/etc/rc.d/init.d';
        } elsif (-d '/etc/rc.d') {  ### for Slackware
            $INIT_DIR = '/etc/rc.d';
        } else {
            die "[*] Cannot find the init script directory, edit ",
                "the \$INIT_DIR variable.\n";
        }
    }
}

if (not $uninstall) {
    &install();
} else {
    &uninstall();
}
exit 0;
#======================= end main ==========================

sub install() {
    print "[+] Installing fwknop on $hostname\n";

    my $preserve_rv = 0;
    unless ($client_install) {
        if (&ask_to_stop_fwknop()) {
            &stop_fwknop();
        }

        for my $dir qw| /usr/lib /var/run /var/log /var/lib | {
            unless (-d $dir) {
                mkdir $dir or die "[*] Could not mkdir $dir: $!";
            }
        }
        unless (-d $URRSBIN_DIR) {
            mkdir $URRSBIN_DIR or die "[*] Could not mkdir $URRSBIN_DIR: $!";
        }
        for my $dir qw/FWKNOP_RUN_DIR FWKNOP_LIB_DIR FWKNOP_MOD_DIR/ {
            unless (-d $config{$dir}) {
                mkdir $config{$dir} or
                    die "[*] Could not mkdir $config{$dir}: $!";
            }
        }
    }
    unless (-d $USRBIN_DIR) {
        print "[+] Creating: $USRBIN_DIR\n";
        mkdir $USRBIN_DIR or die "[*] Could not mkdir $USRBIN_DIR: $!";
    }

    ### config directory
    unless ($client_install) {
        if (-d $config{'FWKNOP_CONF_DIR'}) {
            print "[-] Config directory ",
                "$config{'FWKNOP_CONF_DIR'} already exists.\n";
        } else {
            ### Note that root will only be able to view files in
            ### /etc/fwknop since fwknop only needs to view fwknop.conf
            ### when being run as a daemon.
            print "[+] Creating config directory: ",
                "$config{'FWKNOP_CONF_DIR'}\n";
            mkdir $config{'FWKNOP_CONF_DIR'}, 0500
                or die "[*] Could not mkdir $config{'FWKNOP_CONF_DIR'}: $!";
        }

        if (-d $config{'FWKNOP_DIR'}) {
            print "[-] Cache directory $config{'FWKNOP_DIR'} already exists.\n";
        } else {
            print "[+] Creating cache directory: $config{'FWKNOP_DIR'}\n";
            mkdir $config{'FWKNOP_DIR'}, 0500
                or die "[*] Could not mkdir $config{'FWKNOP_DIR'}: $!";
        }

        ### archive directory for previously installed config files
        if (-d "$config{'FWKNOP_CONF_DIR'}/archive") {
            print "[-] Archive directory ",
                "$config{'FWKNOP_CONF_DIR'}/archive already exists.\n";
        } else {
            print "[+] Creating config{'FWKNOP_CONF_DIR'}/archive ",
                "directory: $config{'FWKNOP_CONF_DIR'}/archive\n";
            mkdir "$config{'FWKNOP_CONF_DIR'}/archive", 0500 or die
                "[*] Could not mkdir $config{'FWKNOP_CONF_DIR'}/archive: $!";
        }
    }

    print "[+] Several perl modules needed by fwknop will be installed in\n",
        "    $config{'FWKNOP_MOD_DIR'}. Installing them here will keep the ",
        "system perl\n    library tree clean.\n";

    ### make our library directory (for perl modules)
    if ($client_install) {
        if (-d "$homedir/lib") {
            print "[-] Directory $homedir/lib already exists.\n";
        } else {
            print "[+] Creating directory $homedir/lib\n";
            mkdir "$homedir/lib", 0755
                or die "[*] Could not mkdir $homedir/lib: $!";
        }
    }
    if (-d $config{'FWKNOP_MOD_DIR'}) {
        print "[-] Lib directory $config{'FWKNOP_MOD_DIR'} already exists.\n";
    } else {
        print "[+] Creating directory $config{'FWKNOP_MOD_DIR'}\n";
        mkdir $config{'FWKNOP_MOD_DIR'}, 0755
            or die "[*] Could not mkdir $config{'FWKNOP_MOD_DIR'}: $!";
    }

    ### install perl modules
    unless ($skip_module_install) {
        for my $module (keys %required_perl_modules) {
            &install_perl_module($module);
        }
    }

    ### special case the NetPacket::<proto> modules since the NetPacket
    ### directory is just for the base class, and we need to make sure
    ### we have each of the NetPacket::IP, NetPacket::ICMP, NetPacket::UDP,
    ### and NetPacket::TCP modules.
    unless ($skip_module_install or $client_install) {
        chdir 'NetPacket' or die "[*] Could not chdir NetPacket directory: $!";
        unless (-e 'Makefile.PL') {
            die "[*] Your NetPacket source directory appears to be incomplete!\n",
                "    Download the latest sources from ",
                "http://www.cipherdyne.org\n";
        }
        system "$cmds{'make'} clean" if -e 'Makefile';
        system "$cmds{'perl'} Makefile.PL PREFIX=$config{'FWKNOP_MOD_DIR'} " .
            "LIB=$config{'FWKNOP_MOD_DIR'}";
        system $cmds{'make'};
#        system "$cmds{'make'} test";
        system "$cmds{'make'} install";
        chdir $src_dir or die "[*] Could not chdir $src_dir: $!";
    }

    unless ($client_install) {

        ### install man pages
        &install_manpage('knopmd.8');
        &install_manpage('knopwatchd.8');
        &install_manpage('fwknop.8');
        &install_manpage('fwknopd.8');

        if (-e "$config{'FWKNOP_CONF_DIR'}/fwknop.conf") {
            $preserve_rv = &query_preserve_config();
        }

        print "[+] Compiling knopmd and knopwatchd daemons:\n";

        ### remove any previously compiled knopmd
        unlink 'knopmd' if -e 'knopmd';

        ### remove any previously compiled knopwatchd
        unlink 'knopwatchd' if -e 'knopwatchd';

        ### compile the C fwknop daemons
        system $cmds{'make'};

        unless (-e 'knopmd' and -e 'knopwatchd') {
            die "[*] Compilation failed.";
        }

        ### install fwknop server-side daemons/programs
        for my $daemon qw(fwknopd knopmd knopwatchd knoptm fwknop_serv) {
            if ($daemon eq 'fwknopd' or $daemon eq 'knoptm') {
                unless (((system "$cmds{'perl'} -c $daemon")>>8) == 0) {
                    die "[*] $daemon does not compile with \"perl -c\".  ",
                        "Download the latest sources ",
                        "from:\n\nhttp://www.cipherdyne.org/\n";
                }
            }
            print "[+] Copying $daemon -> $URRSBIN_DIR\n";
            copy $daemon, $URRSBIN_DIR or
                die "[*] Could not cp $daemon to $URRSBIN_DIR: $!";
            chmod 0500, "$URRSBIN_DIR/$daemon" or
                die "[*] Could not chmod 500 $URRSBIN_DIR/$daemon: $!";
        }
    }

    print "[+] Copying fwknop -> $USRBIN_DIR\n";
    copy 'fwknop', $USRBIN_DIR or
        die "[*] Could not cp fwknop to $USRBIN_DIR: $!";

    if ($client_install) {
        open F, "< $USRBIN_DIR/fwknop" or die "[*] Could not open ",
            "$USRBIN_DIR/fwknop: $!";
        my @lines = <F>;
        close F;
        open P, "> $USRBIN_DIR/fwknop.tmp" or die "[*] Could not open ",
            "$USRBIN_DIR/fwknop.tmp: $!";
        for my $line (@lines) {
            ### change the lib dir to new homedir path
            if ($line =~ m|^\s*use\s+lib\s+\'/usr/lib/fwknop\';|) {
                print P "use lib '", $config{'FWKNOP_MOD_DIR'}, "';\n";
            } else {
                print P $line;
            }
        }
        close P;
        move "$USRBIN_DIR/fwknop.tmp", "$USRBIN_DIR/fwknop" or die "[*] Could ",
            "not move $USRBIN_DIR/fwknop.tmp -> $USRBIN_DIR/fwknop: $!";
        chmod 0700, "$USRBIN_DIR/fwknop" or
            die "[*] Could not chmod 755 $USRBIN_DIR/fwknop: $!";
    } else {
        chmod 0755, "$USRBIN_DIR/fwknop" or
            die "[*] Could not chmod 755 $USRBIN_DIR/fwknop: $!";
    }

    unless (((system "$cmds{'perl'} -c $USRBIN_DIR/fwknop")>>8) == 0) {
        die "[*] $USRBIN_DIR/fwknop does not compile with \"perl -c\".  ",
            "Download the latest sources ",
            "from:\n\nhttp://www.cipherdyne.org/\n";
    }


    if ($client_install) {
        print
"\n[+] fwknop has been installed at $USRBIN_DIR/fwknop.  Since this is a\n",
"    client-only install, the man pages could not be installed.  For more\n",
"    information about how to use fwknop, execute \"$USRBIN_DIR/fwknop -h\" or\n",
"    refer to:\n\n",
"        http://www.cipherdyne.org/fwknop/manpage.html\n\n";

    } else {

        ### install config and access files
        for my $file qw(fwknop.conf access.conf pf.os) {
            if (-e "$config{'FWKNOP_CONF_DIR'}/$file") {
                &archive("$config{'FWKNOP_CONF_DIR'}/$file");
                if ($preserve_rv) {
                    if ($file eq 'access.conf') {
                        ### access.conf can have missing fields (i.e.
                        ### REQUIRE_OS_REGEX and REQUIRE_USERNAME),
                        ### and also it can have multiple sequences
                        ### defined.  Hence we just use the old one.
                        print "[+] Using original access.conf\n";
                    } elsif ($file ne 'pf.os') {
                        &preserve_config($file);
                    }
                } else {
                    print "[+] Copying $file -> $config{'FWKNOP_CONF_DIR'}\n";
                    copy $file, $config{'FWKNOP_CONF_DIR'} or
                        die "[*] Could not cp $file to $config{'FWKNOP_CONF_DIR'}";
                }
            } else {
                print "[+] Copying $file -> $config{'FWKNOP_CONF_DIR'}\n";
                copy $file, $config{'FWKNOP_CONF_DIR'} or
                    die "[*] Could not cp $file to $config{'FWKNOP_CONF_DIR'}";
            }

            if ($force_path_update or not $preserve_rv) {
                &update_command_paths("$config{'FWKNOP_CONF_DIR'}/$file")
                    if ($file eq 'fwknop.conf');
            }

            if ($file eq 'fwknop.conf') {
                &set_hostname("$config{'FWKNOP_CONF_DIR'}/$file");
            }
            chmod 0600, "$config{'FWKNOP_CONF_DIR'}/$file" or die
                "[*] Could not chmod(600, $config{'FWKNOP_CONF_DIR'}/$file: $!";
            chown 0, 0, "$config{'FWKNOP_CONF_DIR'}/$file" or die
                "[*] Could not chown 0,0, $config{'FWKNOP_CONF_DIR'}/$file: $!";
        }

        ### get data acquisition method (e.g. syslogd, sysylog-ng, ulogd
        ### or pcap)
        $data_method = &query_data_method();

        if ($data_method =~ /syslog/) {

            ### create the named pipe
            unless (-e $config{'KNOPMD_FIFO'} and -p $config{'KNOPMD_FIFO'}) {
                unlink $config{'KNOPMD_FIFO'} if -e $config{'KNOPMD_FIFO'};
                print "[+] Creating named pipe $config{'KNOPMD_FIFO'}\n";
                my $created_pipe = 1;
                unless (((system "$cmds{'mknod'} -m 600 $config{'KNOPMD_FIFO'} p")>>8)
                        == 0) {
                    $created_pipe = 0;
                }
                unless (-e $config{'KNOPMD_FIFO'} and -p $config{'KNOPMD_FIFO'}) {
                    $created_pipe = 0;
                }
                unless ($created_pipe) {
                    die
"[*] Could not create the named pipe \"$config{'KNOPMD_FIFO'}\"!\n",
"[*] fwknop requires this file to exist!  Aborting install.\n";
                }
            }

            unless (-e "$config{'FW_DATA_FILE'}") {
                print "[+] Creating $config{'FW_DATA_FILE'} file\n";
                open F, "> $config{'FW_DATA_FILE'}" or die "[*] Could not open ",
                    "$config{'FW_DATA_FILE'}: $!";
                close F;
                chmod 0600, "$config{'FW_DATA_FILE'}";
                &perms_ownership("$config{'FW_DATA_FILE'}", 0600);
            }

            ### we are acquiring data via syslog
            &put_string('AUTH_MODE', 'KNOCK',
                "$config{'FWKNOP_CONF_DIR'}/fwknop.conf");

            if ($bsd_install) {
                ### update to use the ipfw firewall on *BSD systems
                &put_string('FIREWALL_TYPE', 'ipfw',
                    "$config{'FWKNOP_CONF_DIR'}/fwknop.conf");
            }

            &put_string('SYSLOG_DAEMON', $data_method,
                "$config{'FWKNOP_CONF_DIR'}/fwknop.conf");

            my $restarted_syslog = 0;
            if ($data_method eq 'syslogd') {
                if (-e $syslog_conf) {
                    &append_fifo_syslog($syslog_conf);
                    if (((system "$cmds{'killall'} -HUP syslogd " .
                            "2> /dev/null")>>8) == 0) {
                        print "[+] HUP signal sent to syslogd.\n";
                        $restarted_syslog = 1;
                    }
                }
            } elsif ($data_method eq 'syslog-ng') {
                if (-e $syslog_conf) {
                    &append_fifo_syslog_ng($syslog_conf);
                    if (((system "$cmds{'killall'} -HUP syslog-ng " .
                            "2> /dev/null")>>8) == 0) {
                        print "[+] HUP signal sent to syslog-ng.\n";
                        $restarted_syslog = 1;
                    }
                }
            }

            unless ($restarted_syslog) {
                print "[-] Could not restart any syslog daemons.\n";
            }
        } elsif ($data_method =~ /pcap/i or $data_method =~ /ulog/i) {
            ### we are using a pcap method
            if ($data_method eq 'ulogd' or $data_method eq 'file_pcap') {
                print
"[+] By default, fwknop uses the file /var/log/sniff.pcap in order to\n",
"    acquire packet data logged via a sniffer (or ulogd) to a pcap file,\n",
"    but this path may be changed by altering the PCAP_PKT_FILE keyword\n",
"    in $config{'FWKNOP_CONF_DIR'}/fwknop.conf.\n\n";

                if ($data_method eq 'file_pcap') {
                    &put_string('AUTH_MODE', 'FILE_PCAP',
                        "$config{'FWKNOP_CONF_DIR'}/fwknop.conf");
                } else {
                    &put_string('AUTH_MODE', 'ULOG_PCAP',
                        "$config{'FWKNOP_CONF_DIR'}/fwknop.conf");
                }
            } else {
                my $intf = &get_pcap_intf();
                if ($intf) {
                    &put_string('PCAP_INTF', $intf,
                        "$config{'FWKNOP_CONF_DIR'}/fwknop.conf");
                } else {
print "[-] Could not get sniffing interface, need to set this manually in\n",
    "    config{'FWKNOP_CONF_DIR'}/fwknop.conf\n";
                }
            }
        } else {
            ### it is a client-only install, so don't reconfigure syslog
            ### or anything.
        }

        unless ($preserve_rv) {
            my $email_str = &query_email();
            if ($email_str) {
                for my $file qw(fwknop.conf) {
                    &put_string('EMAIL_ADDRESSES', $email_str,
                        "$config{'FWKNOP_CONF_DIR'}/$file");
                }
            }
        }

        if (-d $INIT_DIR) {
            &enable_fwknop_at_boot($distro) unless $data_method =~ /client/i;
        }

        if ($data_method =~ /client/i) {
            print "\n[+] fwknop has been installed!\n\n";
        } else {
            print
"\n[+] fwknop has been installed!  To start in server mode, run\n\n",
"    \"/etc/init.d/fwknop start\"\n\n",
"    Note: You will need to edit $config{'FWKNOP_CONF_DIR'}/access.conf for fwknop to\n",
"    function properly in server mode.  More information can be found in\n",
"    the fwknop manpage.\n\n";
            if ($bsd_install) {
                print
"    You may need to updated your /etc/syslog.conf file to log local info\n",
"    messages to a file in the /var/log/ directory in order to see syslog\n",
"    messages from the fwknop daemons.\n\n";
            }
        }

    }
    return;
}

sub uninstall() {

    print "[+] Uninstalling fwknop\n";

    ### stop any running fwknop daemons.
    &stop_fwknop();

    unlink "$USRBIN_DIR/fwknop" if -e "$USRBIN_DIR/fwknop";
    unlink "$URRSBIN_DIR/knopmd" if -e "$URRSBIN_DIR/knopmd";
    unlink "$URRSBIN_DIR/knopwatchd" if -e "$URRSBIN_DIR/knopwatchd";
    unlink "$INIT_DIR/fwknop" if -e "$INIT_DIR/fwknop";
    rmtree $config{'FWKNOP_CONF_DIR'}, 1, 1 if -d $config{'FWKNOP_CONF_DIR'};
    rmtree $config{'FWKNOP_LIB_DIR'}, 1, 1 if -d $config{'FWKNOP_LIB_DIR'};
    rmtree $config{'FWKNOP_MOD_DIR'}, 1, 1 if -d $config{'FWKNOP_MOD_DIR'};

    return;
}

### check paths to commands and attempt to correct if any are wrong.
sub check_commands() {

    return if $client_install;

    unless ($bsd_install) {
        $exclude_cmds{'ipfw'} = '';
    }

    CMD: for my $cmd (keys %cmds) {
        if ($bsd_install) {
            next CMD if $cmd eq 'iptables';
        }
        next CMD if defined $exclude_cmds{$cmd};
        unless (-x $cmds{$cmd}) {
            my $found = 0;
            PATH: for my $dir (@cmd_search_paths) {
                if (-x "${dir}/${cmd}") {
                    $cmds{$cmd} = "${dir}/${cmd}";
                    $found = 1;
                    last PATH;
                }
            }
            unless ($found) {
                die "[*] Could not find $cmd anywhere!!!  ",
                    "Please edit the config section to include the path to ",
                    "$cmd.\n";
            }
        }
        unless (-x $cmds{$cmd}) {
            die "[*] $cmd is located at ",
                "$cmds{$cmd} but is not executable by uid: $<\n";
        }
    }
    return;
}

sub archive() {
    my $file = shift;
    return unless -e $file;
    my $curr_pwd = cwd();
    chdir "$config{'FWKNOP_CONF_DIR'}/archive" or die $!;
    my ($filename) = ($file =~ m|.*/(.*)|);
    my $base = "${filename}.old";
    for (my $i = 5; $i > 1; $i--) {  ### keep five copies of old config files
        my $j = $i - 1;
        unlink "${base}${i}.gz" if -e "${base}${i}.gz";
        move "${base}${j}.gz", "${base}${i}.gz" if -e "${base}${j}.gz";
    }
    print "[+] Archiving $file -> ${base}1\n";
    unlink "${base}1.gz" if -e "${base}1.gz";
    copy $file, "${base}1";   ### move $file into the archive directory
    system "$cmds{'gzip'} ${base}1";
    chdir $curr_pwd or die $!;
    return;
}

sub preserve_config() {
    my $file = shift;
    open C, "< $file" or die "[*] Could not open $file: $!";
    my @new_lines = <C>;
    close C;

    open CO, "< $config{'FWKNOP_CONF_DIR'}/$file" or die "[*] Could not open ",
        "$config{'FWKNOP_CONF_DIR'}}/$file: $!&qu