X-Git-Url: https://git.cyclocoop.org/?p=lhc%2Fateliers.git;a=blobdiff_plain;f=vm_hosted;h=11dd8bb0a40efccc07d852b0479a6c25a4bdf4d6;hp=8d2470f2af4828c2c190657bd88f15c808cd4eac;hb=bac5cba029aebec55df758a3c18e8edcf684af1f;hpb=2466bfbab128e525965d0de5a18684cc0b438888 diff --git a/vm_hosted b/vm_hosted index 8d2470f..11dd8bb 100755 --- a/vm_hosted +++ b/vm_hosted @@ -1,8 +1,13 @@ #!/bin/sh set -e -f ${DRY_RUN:+-n} -u -tool=${0%/*} -. "$tool"/lib/functions.sh +tool=$0 +while test -L "$tool" + do tool=$(readlink "$tool") + done +tool=${tool%/*} +. "$tool"/lib/rule.sh . "$tool"/etc/vm.sh +export TRACE=1 rule_help () { # SYNTAX: [--hidden] local hidden; [ ${1:+set} ] || hidden=set @@ -22,11 +27,23 @@ rule_help () { # SYNTAX: [--hidden] EOF } -rule_git_config () { +rule_git_configure () { ( cd "$tool" git config --replace branch.master.remote . git config --replace branch.master.merge refs/remotes/master + local tool + tool=$(cd "$tool"; cd -) + install -m 770 /dev/stdin .git/hooks/post-update <<-EOF + #!/bin/sh -efux + case \$1 in + (refs/remotes/master) + cd .. + git --git-dir=\$PWD/.git checkout -f -B master remotes/master + git --git-dir=\$PWD/.git clean -f -d -x + ;; + esac + EOF ) } rule_git_reset () { @@ -37,36 +54,213 @@ rule_git_reset () { ) } -rule__chrooted_init () { # NOTE: est-ce bien utile à un moment ? +rule_adduser () { + local user="$1"; shift + getent passwd "$user" >/dev/null || + sudo adduser "$@" "$user" + } +rule_apt_get_install () { # SYNTAX: $package + sudo DEBIAN_FRONTEND=noninteractive apt-get install --yes "$@" + } +rule_dpkg_reconfigure () { # SYNTAX: $package + sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure "$@" + } + +rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ? export LANG=C export LC_CTYPE=C . /etc/profile } -rule_apt_init () { - mk_reg mod= own= /etc/apt/sources.list <<-EOF - deb http://ftp.fr.debian.org/debian $vm_lsb_name main contrib non-free +rule_apache2_configure () { # XXX: cette règle n'est pas testée/mise-à-jour + local -; set +f + rule apt_get_install \ + apache2-mpm-itk \ + libapache2-mod-php5 + # VOIR: http://serverfault.com/questions/383526/how-do-i-select-which-apache-mpm-to-use/383634#383634 + # VOIR: http://jkroon.blogs.uls.co.za/it/security/using-php-fpm-and-mod_proxy_fcgi-to-optimize-and-secure-lamp-servers + # NOTE: apache2-mpm-itk semble le plus sécurisé, + # car on est certain que tout est exécuté avec les uid/gid + # assignés au VirtualHost/Directory/Location + # néamoins il se peut qu'une combinaison du genre : + # apache2-mpm-{worker,event} + mod_proxy_fcgi + apache2-suexec-custom + php-fpm + # soit plus performante (threads et pas forks), + # cependant l'usage de suexec impose des forks il semble.. + # et mod_proxy_fcgi n'apparaît que dans apache 2.4 ; + # donc pour l'instant : apache2-mpm-itk + sudo rm -rf \ + /etc/apache2/site.d + sudo install -d -m 770 -o www -g www \ + /etc/apache2 \ + /etc/apache2/site.d \ + /etc/apache2/x509.d + cat /dev/stdin "$tool"/etc/apache2/apache2.conf <<-EOF | + ServerName "$vm_fqdn" + EOF + sudo install -m 660 -o root -g root /dev/stdin \ + /etc/apache2/apache2.conf + sudo install -m 660 -o root -g root \ + "$tool"/etc/apache2/envvars \ + /etc/apache2/envvars + sudo install -m 660 -o root -g root \ + "$tool"/etc/apache2/httpd.conf \ + /etc/apache2/httpd.conf + #sudo install -m 660 -o root -g root /dev/stdin \ + # /etc/apache2/suexec/www-data <<-EOF + # /home + # pub/www/cgi + # EOF + sudo install -m 660 -o root -g root \ + "$tool"/etc/apache2/ports.conf \ + /etc/apache2/ports.conf + sudo a2enmod actions + sudo a2enmod headers + sudo a2enmod rewrite + sudo a2enmod ssl + sudo a2enmod userdir + local conf + sudo a2dissite "*" + sudo ln -fns \ + /etc/apache2 \ + /home/www/etc/apache2 + for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf + do conf=${conf#"$tool"/etc/apache2/site.d/} + local site=${conf%/VirtualHost.conf} + case $site in + (*-tls) + local hint="run vm_remote apache2_key_send before" + assert "sudo test -f /etc/apache2/site.d/\"$site\"/x509/key.pem" hint + sudo install -d -m 770 -o www-"$site" -g www-"$site" \ + /etc/apache2 \ + /etc/apache2/site.d/"$site" \ + /etc/apache2/x509.d/"$site" \ + /etc/apache2/x509.d/"$site"/ca \ + /etc/apache2/x509.d/"$site"/empty \ + /etc/apache2/x509.d/"$site"/rvk \ + /etc/apache2/x509.d/"$site"/usr + sudo install -m 664 -o www -g www \ + "$tool"/var/pub/x509/"$site"/crt.self-signed.pem \ + /etc/apache2/x509.d/"$site"/crt.self-signed.pem + #sudo install -m 664 -o www-"$site" -g www-"$site" \ + # "$tool"/var/pub/x509/"$site"/rvk.pem \ + # /etc/apache2/x509.d/"$site"/rvk.pem + sudo install -m 664 -o www -g www \ + "$tool"/var/pub/x509/"$site"/ca/crt.self-signed.pem \ + /etc/apache2/x509.d/"$site"/ca/crt.pem + sudo install -m 664 -o www -g www \ + "$tool"/var/pub/x509/"$site"/crt.pem \ + /etc/apache2/x509.d/"$site"/crt.pem + ;; + esac + case $site in + (*-tls) + cat <<-EOF + + + AssignUserID www-$site www-$site + BrowserMatch "MSIE [2-6]" ssl-unclean-shutdown nokeepalive downgrade-1.0 force-response-1.0 + BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown + CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined + #CustomLog "/dev/null" Combined + DocumentRoot /home/www/pub/$site + ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60" + #ErrorLog "/dev/null" + LogLevel Warn + SSLCACertificateFile /etc/apache2/x509.d/$site/crt.self-signed.pem + SSLCACertificatePath /etc/apache2/x509.d/$site/usr/ + #SSLCARevocationFile /etc/apache2/x509.d/$site/rvk.pem + SSLCADNRequestFile /etc/apache2/x509.d/$site/crt.self-signed.pem + SSLCADNRequestPath /etc/apache2/x509.d/$site/empty/ + # NOTE: ne publie pas les certificats d’utilisateur-ice-s acceptés + SSLCARevocationPath /etc/apache2/x509.d/$site/rvk/ + SSLCertificateChainFile /etc/apache2/x509.d/$site/ca/crt.pem + SSLCertificateFile /etc/apache2/x509.d/$site/crt.pem + SSLCertificateKeyFile /etc/apache2/x509.d/$site/key.pem + SSLCipherSuite AES+RSA+SHA256 + SSLEngine On + SSLInsecureRenegotiation Off + SSLOptions +StrictRequire +OptRenegotiate +StdEnvVars + SSLProtocol -All +TLSv1 + #SSLRenegBufferSize 262144 + SSLSessionCacheTimeout 1200 + SSLStrictSNIVHostCheck On + SSLUserName SSL_CLIENT_S_DN_CN + SSLVerifyClient None + SSLVerifyDepth 1 + $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf) + + + EOF + ;; + (*) + cat <<-EOF + + AssignUserID www-$site www-$site + CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined + #CustomLog "/dev/null" Combined + DocumentRoot /home/www/pub/$site + ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60" + #ErrorLog "/dev/null" + LogLevel Warn + $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf) + + EOF + ;; + esac | + sudo install -m 660 -o root -g root /dev/stdin \ + /etc/apache2/site.d/"$site"/VirtualHost.conf + sudo ln -fns \ + ../site.d/"$site"/VirtualHost.conf \ + /etc/apache2/sites-available/"$site" + sudo install -d -m 770 -o www-"$site" -g www-"$site" \ + /home/www/log/"$site" \ + /home/www/log/"$site"/apache2 + sudo ln -fns \ + /etc/apache2/site.d/"$site" \ + /home/www/etc/apache2/"$site" + test -e /home/www/pub/"$site" || + sudo install -d -m 2770 -o www-"$site" -g www-"$site" \ + /home/www/pub/"$site" + rule adduser www-"$site" + --disabled-password \ + --group \ + --no-create-home \ + --home /home/www/pub/"$site" \ + --shell /bin/false \ + --system + #sudo setfacl -m u:"www-$site":--x \ + # /home/www/ \ + # /home/www/pub/ \ + # /home/www/pub/"$site"/ + #sudo setfacl -m d:u:"www-$site":rwx \ + # "$home"/pub/www/"$site"/ + test ! -r "$tool"/etc/apache2/site.d/"$site"/configure.sh || + . "$tool"/etc/apache2/site.d/"$site"/configure.sh + test -e /etc/apache2/sites-enabled/"$site" || + sudo a2ensite "$site" + done + sudo service apache2 restart + } +rule_apt_configure () { + sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF + deb http://ftp.rezopole.net/debian $vm_lsb_name main EOF - mk_reg mod= own= /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF - #deb http://backports.debian.org/debian-backports $vm_lsb_name-backports main contrib non-free + sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF + deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main EOF - mk_reg mod= own= /etc/apt/preferences <<-EOF + sudo install -m 660 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF Package: * Pin: release a=$vm_lsb_name - Pin-Priority: 170 + Pin-Priority: 200 Package: * Pin: release a=$vm_lsb_name-backports - Pin-Priority: 200 - EOF - mk_reg mod= own= /etc/apt/sources.list.d/openerp.list <<-EOF - deb http://nightly.openerp.com/trunk/nightly/deb/ ./ + Pin-Priority: 170 EOF - } -rule_apticron_init () { - sudo apt-get install --reinstall apticron - mk_reg mod=644 own=root:root /etc/apticron/apticron.conf <<-EOF - EMAIL="admin@heureux-cyclage.org" + sudo apt-get update + rule apt_get_install apticron + sudo install -m 644 -o root -g root /dev/stdin /etc/apticron/apticron.conf <<-EOF + EMAIL="admin@$vm_domainname" # DIFF_ONLY="1" # LISTCHANGES_PROFILE="apticron" # ALL_FQDNS="1" @@ -78,15 +272,18 @@ rule_apticron_init () { # NOTIFY_NO_UPDATES="0" # CUSTOM_SUBJECT="" # CUSTOM_NO_UPDATES_SUBJECT="" - # CUSTOM_FROM="root@ateliers.heureux-cyclage.org" + # CUSTOM_FROM="root@$vm_fqdn" EOF - sudo service apticron restart } -rule_boot_init () { - sudo apt-get install --reinstall grub-pc # XXX: attention à n'installer GRUB sur AUCUN disque proposé ! - mk_dir mod=644 own=root:root /boot/grub - sudo apt-get install --reinstall linux-image-$vm_arch - mk_reg mod=644 own=root:root /etc/default/grub <<-EOF +rule_boot_configure () { + #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !" + sudo debconf-set-selections <<-EOF + grub-pc grub-pc/install_devices multiselect + EOF + rule apt_get_install grub-pc + sudo install -d -m 644 -o root -g root /boot/grub + rule apt_get_install linux-image-$vm_arch + sudo install -m 644 -o root -g root /dev/stdin /etc/default/grub <<-EOF GRUB_DEFAULT=0 GRUB_TIMEOUT=5 GRUB_DISTRIBUTOR=\`lsb_release -i -s 2> /dev/null || echo Debian\` @@ -95,15 +292,103 @@ rule_boot_init () { GRUB_DISABLE_RECOVERY="true" #GRUB_PRELOAD_MODULES="lvm" EOF - mk_reg mod=644 own=root:root /boot/grub/device.map <<-EOF + sudo install -m 644 -o root -g root /dev/stdin /boot/grub/device.map <<-EOF (hd0) /dev/xvda (hd0) /dev/mapper/domU-$(printf %s $vm_fqdn-disk | sed -e 's/-/--/g') EOF sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map - rule initramfs_init + rule initramfs_configure + rule apt_get_install molly-guard + sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF + ALWAYS_QUERY_HOSTNAME=true + # NOTE: une alternative est de dire à sudo de conserver les SSH_* + # néamoins demander tout le temps n'est pas trop contraignant + # et davantage sécurisant. + EOF + } +rule_dovecot_configure () { + rule apt_get_install dovecot-imapd dovecot-managesieved dovecot-sieve + local hint="run vm_remote dovecot_key_send before" + assert "sudo test -f /etc/dovecot/\"$vm_domainname\"/imap/x509/key.pem" hint + sudo install -m 400 -o root -g root \ + "$tool"/var/pub/x509/imap."$vm_domainname"/crt+crl.self-signed.pem \ + /etc/dovecot/"$vm_domainname"/imap/x509/crt+crl.self-signed.pem + sudo install -d -m 770 -o root -g root \ + /etc/skel/etc/mail \ + /etc/skel/etc/sieve + sudo install -d -m 1777 -o root -g root \ + /var/lib/dovecot-control \ + /var/lib/dovecot-index + sudo install -m 664 -o root -g root /dev/stdin /etc/dovecot/local.conf <<-EOF + auth_ssl_username_from_cert = yes + listen = * + log_timestamp = "%Y-%m-%d %H:%M:%S " + mail_debug = yes + mail_location = maildir:~/var/mail:INDEX=/var/lib/dovecot-index/%u:CONTROL=/var/lib/dovecot-control/%u + # NOTE: INDEX et CONTROL sont sur une partition sans quota comme le demande la doc + # VOIR: http://wiki2.dovecot.org/Quota/FS + mail_plugins = \$mail_plugins quota + mail_privileged_group = mail + passdb { + args = /home/%u/etc/dovecot/passwd + driver = passwd-file + } + plugin { + quota = fs:user + recipient_delimiter = + + sieve = ~/etc/mail/filter.sieve + sieve_dir = ~/etc/mail/sieve + sieve_global_dir = /var/lib/dovecot/sieve/global/ + sieve_max_script_size = 1M + sieve_quota_max_scripts = 0 + sieve_quota_max_storage = 10M + sieve_user_log = ~/var/log/mail/sieve.log + } + protocol imap { + mail_plugins = \$mail_plugins imap_quota + } + protocol lda { + auth_socket_path = /var/run/dovecot/auth-master + hostname = $vm_domainname + info_log_path = + log_path = + mail_plugins = \$mail_plugins sieve + postmaster_address = contact+dovecot+lda@$vm_domainname + syslog_facility = mail + } + protocols = imap sieve + service auth { + user = root + unix_listener /var/spool/postfix/private/auth { + mode = 0660 + user = postfix + group = postfix + } + } + ssl_ca = LABEL=${vm_lvm_lv}_boot /boot ext2 defaults 0 0 proc /proc proc defaults 0 0 sysfs /sys sysfs defaults 0 0 - tmpfs /tmp tmpfs rw,nosuid,nodev,auto,size=200m,nr_inodes=1000k,mode=1777,noatime,nodiratime 0 0 - /dev/mapper/${vm_lvm_lv}_root_deciphered / ext4 defaults,errors=remount-ro,acl,noatime 0 1 - /dev/mapper/${vm_lvm_lv}_var_deciphered /var ext4 defaults,errors=remount-ro,acl,noatime 0 1 - /dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,noatime,usrquota,grpquota 0 0 + /dev/mapper/${vm_lvm_lv}_root_deciphered / ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1 + /dev/mapper/${vm_lvm_lv}_var_deciphered /var ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1 + /dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,barrier=1,noatime,usrquota,grpquota 0 0 + # NOTE: barrier=1 réduit drastiquement les performances d'écriture, mais garantit la cohérence du système de fichiers. /dev/mapper/${vm_lvm_lv}_swap_deciphered swap swap sw 0 0 EOF - mk_reg mod=644 own=root:root /etc/crypttab <<-EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/crypttab <<-EOF # ${vm_lvm_lv}_root_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_root none luks,lvm=$vm_lvm_vg ${vm_lvm_lv}_var_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_var ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived ${vm_lvm_lv}_home_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_home ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived ${vm_lvm_lv}_swap_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_swap ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived EOF - mk_reg mod=644 own=root:root /etc/sysctl.d/local-swap.conf <<-EOF - vm.swappiness = 10 # NOTE: n'utilise le swap qu'en cas d'absolue nécessité - vm.vfs_cache_pressure=50 - EOF + rule tmpfs_configure } -rule_initramfs_init () { - mk_reg mod=644 own=root:root /etc/initramfs-tools/initramfs.conf <<-EOF +rule_initramfs_configure () { + sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF MODULES=most BUSYBOX=y KEYMAP=y COMPRESS=gzip DEVICE=eth0 EOF - mk_reg mod=644 own=root:root /etc/modprobe.d/xen-pv.conf <<-EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/modprobe.d/xen-pv.conf <<-EOF alias eth0 xennet alias scsi_hostadapter xenblk EOF - mk_reg mod=644 own=root:root /etc/modules <<-EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/modules <<-EOF sha1_generic sha256_generic sha512_generic @@ -158,29 +444,24 @@ rule_initramfs_init () { # NOTE: pour Xen en mode HVM : #modprobe xen-platform-pci EOF - mk_reg mod=644 own=root:root /etc/initramfs-tools/modules <<-EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/modules <<-EOF EOF sudo sed -e '/^configure_networking /s/ &$//' \ -i /usr/share/initramfs-tools/scripts/init-premount/dropbear # NOTE: corrige une vermine : dropbear doit attendre que le réseau soit configuré.. - sudo rm -f \ - /etc/initramfs-tools/etc/dropbear/dropbear_dss_host_key \ - /etc/initramfs-tools/etc/dropbear/dropbear_dss_host_key.pub \ - /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key \ - /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key.pub ssh-keygen -F "init.$vm_fqdn" -f "$tool"/etc/openssh/known_hosts | ( while IFS= read -r line do case $line in (*" RSA") return 0; break;; esac done; return 1 ) || + { + sudo rm -f \ + /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key \ + /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key.pub sudo dropbearkey -t rsa -s 4096 -f \ /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key - ssh-keygen -F "init.$vm_fqdn" -f "$tool"/etc/openssh/known_hosts | - ( while IFS= read -r line - do case $line in (*" DSA") return 0; break;; esac - done; return 1 ) || - sudo dropbearkey -t dss -s 1024 -f \ - /etc/initramfs-tools/etc/dropbear/dropbear_dss_host_key - mk_dir mod=640 own=root:root \ + } + # NOTE: ne se préoccupe pas de dropbear_dss_host_key ; Debian la génère et l'utilise néamoins. + sudo install -d -m 640 -o root -g root \ /etc/initramfs-tools/root \ /etc/initramfs-tools/root/.ssh getent group sudo | @@ -189,10 +470,11 @@ rule_initramfs_init () { $users EOF do eval local home\; home="~$user" - cat "$home"/etc/ssh/authorized_keys + sudo cat "$home"/etc/ssh/authorized_keys done done | - mk_reg mod=644 own=root:root /etc/initramfs-tools/root/.ssh/authorized_keys + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/initramfs-tools/root/.ssh/authorized_keys sudo rm -f \ /etc/initramfs-tools/root/.ssh/id_rsa.dropbear \ /etc/initramfs-tools/root/.ssh/id_rsa.pub \ @@ -200,22 +482,122 @@ rule_initramfs_init () { # NOTE: clefs générées par Debian sudo update-initramfs -u } -rule_locale_init () { - mk_reg mod=644 own=root:root /etc/locale.gen <<-EOF - fr_FR.UTF-8 UTF-8 +rule_gitolite_configure () { + sudo debconf-set-selections <<-EOF + gitolite gitolite/gituser string git + gitolite gitolite/adminkey string + gitolite gitolite/gitdir string /home/git EOF - sudo update-locale - } -rule_login_init () { - grep -q '^hvc0$' /etc/securetty || - mk_reg mod= own= --append /etc/securetty <<-EOF - hvc0 + rule apt_get_install gitolite + rule adduser git \ + --disabled-password \ + --group \ + --home /home/git \ + --shell /bin/bash \ + --system + sudo chfn --full-name git git + rule adduser log-git \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/git/log \ + --shell /bin/false \ + --system + rule adduser git-data \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/git/pub \ + --shell /bin/false \ + --system + sudo adduser git git-data + sudo install -d -m 770 -o git -g git \ + /etc/gitolite \ + /home/git/etc \ + /home/git/etc/ssh + sudo install -d -m 751 -o git -g git \ + /home/git + sudo install -d -m 2770 -o git-data -g git-data \ + /home/git/pub + sudo install -d -m 1771 -o git -g git \ + /home/git/log + sudo install -d -m 2770 -o git -g log-git \ + /home/git/log/gitolite \ + /home/git/log/gitolite/perf + sudo install -d -m 3771 -o git -g git \ + /home/git/hooks + sudo ln -fns /etc/gitolite /home/git/etc/gitolite + sudo ln -fns /etc/gitweb /home/git/etc/gitweb + sudo ln -fns etc/gitolite/gitolite.rc /home/git/.gitolite.rc + sudo ln -fns etc/ssh /home/git/.ssh + sudo install -m 770 -o git -g git /dev/stdin \ + /home/git/etc/gitolite/gitolite.rc <<-EOF + #\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary"; + #\$BIG_INFO_CAP = 20; + #\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3'; + # NOTE: Please use single quotes, not double quotes. + #\$GITWEB_URI_ESCAPE = 0; + \$GIT_PATH = ""; + #\$GL_ADC_PATH = ""; + \$GL_ADMINDIR = \$ENV{HOME} . "/etc/gitolite"; + #\$GL_ALL_INCLUDES_SPECIAL = 0; + #\$GL_ALL_READ_ALL = 0; + \$GL_BIG_CONFIG = 0; + \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf"; + \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm"; + #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups" + \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*"; + #\$GL_HOSTNAME = "git.$vm_domainname"; + # NOTE: read doc/mirroring.mkd COMPLETELY before setting this. + #\$GL_HTTP_ANON_USER = "mob"; + \$GL_KEYDIR = "\$GL_ADMINDIR/keydir"; + \$GL_LOGT = \$ENV{HOME} . "/log/gitolite/%y-%m-%d.log"; + #\$GL_NICE_VALUE = 0; + \$GL_NO_CREATE_REPOS = 0; + \$GL_NO_DAEMON_NO_GITWEB = 0; + \$GL_NO_SETUP_AUTHKEYS = 0; + \$GL_PACKAGE_CONF = "/usr/share/gitolite/conf"; + \$GL_PACKAGE_HOOKS = "/usr/share/gitolite/hooks"; + #\$GL_PERFLOGT = \$ENV{HOME} . "/log/gitolite/perf/%y-%m-%d.log"; + #\$GL_REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][0-9a-zA-Z._\\@/+ :,-]*\$); + \$GL_SITE_INFO = "git.$vm_domainname"; + #\$GL_SLAVE_MODE = 0; + \$GL_WILDREPOS = 0; + #\$GL_WILDREPOS_DEFPERMS = 'R @all'; + \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS"; + \$HTPASSWD_FILE = ""; + \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list"; + \$REPO_BASE = "pub"; + \$REPO_UMASK = 0007; + \$RSYNC_BASE = ""; + \$SVNSERVE = ""; + #\$UPDATE_CHAINS_TO = "hooks/update.secondary"; + \$WEB_INTERFACE = "gitweb"; + 1; EOF - grep -q '^xvc0$' /etc/securetty || - mk_reg mod= own= --append /etc/securetty <<-EOF - xvc0 + sudo install -m 600 -o git -g git \ + "$tool"/var/pub/ssh/git.key \ + /home/git/etc/ssh/git.pub + sudo -u git \ + GL_RC=/home/git/etc/gitolite/gitolite.rc \ + GIT_AUTHOR_NAME=git \ + gl-setup -q /home/git/etc/ssh/git.pub git + local d + for d in doc logs src + do test ! -d /home/git/etc/gitolite/"$d" || + rmdir /home/git/etc/gitolite/"$d" + done + sudo service tmpfs restart + } +rule_locales_configure () { + sudo debconf-set-selections <<-EOF + locales locales/default_environment_locale select None + locales locales/locales_to_be_generated multiselect fr_FR.UTF-8 UTF-8 EOF - mk_reg mod=644 own=root:root /etc/inittab <<-EOF + rule dpkg_reconfigure locales + } +rule_login_configure () { + sudo install -m 644 -o root -g root /dev/stdin /etc/inittab <<-EOF # /etc/inittab: init(8) configuration. # The default runlevel. @@ -257,8 +639,12 @@ rule_login_init () { # Xen hypervisor console hvc:2345:respawn:/sbin/getty 38400 hvc0 #xvc:2345:respawn:/sbin/getty 38400 xvc0 + + #-- runit begin + SV:123456:respawn:/usr/sbin/runsvdir-start + #-- runit end EOF - mk_reg mod=644 own=root:root /etc/login.defs <<-EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/login.defs <<-EOF MAIL_DIR /var/mail FAILLOG_ENAB yes LOG_UNKFAIL_ENAB no @@ -296,19 +682,73 @@ rule_login_init () { ENCRYPT_METHOD SHA512 EOF grep -q '^session optional pam_umask.so\>' /etc/pam.d/common-session || - mk_reg mod= own= --append /etc/pam.d/common-session <<-EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/pam.d/common-session <<-EOF + $(cat /etc/pam.d/common-session) session optional pam_umask.so EOF + grep -q '^hvc0$' /etc/securetty || + sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF + $(cat /etc/securetty) + hvc0 + EOF + grep -q '^xvc0$' /etc/securetty || + sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF + $(cat /etc/securetty) + xvc0 + EOF + } +rule_mail_configure () { + rule postfix_configure + rule postgrey_configure + rule procmail_configure + rule dovecot_configure } -rule_network_init () { - mk_reg mod= own= /etc/hostname <<-EOF +rule_mysql_configure () { + rule apt_get_install mysql-server-5.5 + rule adduser mysql \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/mysql \ + --shell /bin/false \ + --system + rule adduser mysql-data \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/mysql/data \ + --shell /bin/false \ + --system + sudo usermod --home /home/mysql mysql + sudo adduser mysql mysql-data + sudo install -m 640 -o mysql -g mysql \ + "$tool"/etc/mysql/my.cnf \ + /etc/mysql/my.cnf + sudo install -d -m 751 -o mysql -g mysql \ + /home/mysql + sudo install -d -m 750 -o mysql-data -g mysql-data \ + /home/mysql/data + if test ! -d /home/mysql/data + then + sudo -u mysql mysql_install_db \ + --no-defaults \ + --datadir=/home/mysql/data + fi + sudo service tmpfs restart + case $(sudo sv status mysql || true) in + (run:*) sudo sv restart mysql + esac + } +rule_network_configure () { + sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF $vm EOF grep -q " $vm\$" /etc/hosts || - mk_reg mod= own= --append /etc/hosts <<-EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/hosts <<-EOF + $(cat /etc/hosts) 127.0.0.1 $vm_fqdn $vm EOF - mk_reg mod= own= /etc/network/interfaces <<-EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/network/interfaces <<-EOF auto lo iface lo inet loopback @@ -319,23 +759,407 @@ rule_network_init () { network $vm_ipv4 broadcast $vm_ipv4 netmask 255.255.255.255 - #mtu 1300 + mtu 1300 + # NOTE: il y a besoin de ça en l'état actuel du réseau de Grenode + # car la MTU des tunnels GRE/IPsec entre les routeurs de Grenode l'impose. + # + # root@ateliers:~# ping -M do -c 1 -s \$((1500-20-8-200)) soupirail.grenode.net + # PING soupirail.grenode.net (91.216.110.1) 1272(1300) bytes of data. + # 1280 bytes from soupirail.grenode.net (91.216.110.1): icmp_req=1 ttl=63 time=18.0 ms + # + # --- soupirail.grenode.net ping statistics --- + # 1 packets transmitted, 1 received, 0% packet loss, time 0ms + # rtt min/avg/max/mdev = 18.027/18.027/18.027/0.000 ms + # root@ateliers:~# ping -M do -c 1 -s \$((1500-20-8-200+1)) soupirail.grenode.net + # PING soupirail.grenode.net (91.216.110.1) 1273(1301) bytes of data. + # From estran.grenode.net (91.216.110.6) icmp_seq=1 Frag needed and DF set (mtu = 1300) + # + # --- soupirail.grenode.net ping statistics --- + # 0 packets transmitted, 0 received, +1 errors post-up ip address add $vm_ipv4/32 dev \$IFACE pre-down ip address delete $vm_ipv4/32 dev \$IFACE EOF } -rule_user_init () { - mk_dir mod=750 own="root:adm" /etc/skel/etc - mk_dir mod=770 own="root:adm" /etc/skel/etc/apache2 - mk_dir mod=770 own="root:adm" /etc/skel/etc/ssh - mk_dir mod=700 own="root:adm" /etc/skel/var - mk_dir mod=700 own="root:adm" /etc/skel/var/log - mk_dir mod=700 own="root:adm" /etc/skel/var/cache - mk_dir mod=700 own="root:adm" /etc/skel/var/cache/ssh - mk_dir mod=700 own="root:adm" /etc/skel/tmp - mk_dir mod=700 own="root:adm" /etc/skel/tmp - mk_lnk etc/ssh /etc/skel/.ssh - mk_lnk etc/gpg /etc/skel/.gnupg +rule_www_configure () { + rule adduser www \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/www \ + --shell /bin/false \ + --system + rule adduser log-www \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/www/log \ + --shell /bin/false \ + --system + #sudo adduser www www-data + sudo adduser www log-www + #sudo adduser log log-www + usermod --home /home/www/pub www-data + sudo install -d -m 751 -o www -g www \ + /home/www + sudo install -d -m 750 -o www -g www \ + /home/www/etc + sudo install -d -m 1771 -o www-data -g www-data \ + /home/www/pub + sudo install -d -m 1771 -o log-www -g log-www \ + /home/www/log + } +rule_nginx_configure () { + local -; set +f + rule apt_get_install nginx + sudo rm -rf \ + /etc/nginx/conf.d \ + /etc/nginx/site.d + sudo install -d -m 770 -o www -g www \ + /etc/nginx \ + /etc/nginx/conf.d \ + /etc/nginx/site.d \ + /etc/nginx/x509.d + sudo ln -fns \ + /etc/nginx \ + /home/www/etc/nginx + sudo install -m 660 -o www -g www \ + "$tool"/etc/nginx/nginx.conf \ + /etc/nginx/nginx.conf + local conf + for conf in "$tool"/etc/nginx/conf.d/*.conf + do conf=${conf#"$tool"/etc/nginx/conf.d/} + sudo install -m 660 -o www -g www \ + "$tool"/etc/nginx/conf.d/"$conf" \ + /etc/nginx/conf.d/"$conf" + done + for conf in "$tool"/etc/nginx/site.d/*/site.conf + do conf=${conf#"$tool"/etc/nginx/site.d/} + local site="${conf%/site.conf}" + rule adduser www-"$site" \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/www/pub/"$site" \ + --shell /bin/false \ + --system + rule adduser log-www-"$site" \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/www/log/"$site"/nginx \ + --shell /bin/false \ + --system + sudo install -d -m 771 -o log-www -g log-www \ + /home/www/log/"$site" + sudo install -d -m 770 -o www -g www \ + /etc/nginx/site.d/"$site" + sudo install -d -m 770 -o www -g www \ + /etc/nginx/x509.d/"$site" + test -L /home/www/pub/"$site" || + sudo install -d -m 2770 -o www-"$site" -g www-"$site" \ + /home/www/pub/"$site" + sudo adduser www-data www-"$site" + sudo adduser www-data log-www-"$site" + sudo install -m 660 -o www -g www \ + "$tool"/etc/nginx/site.d/"$site"/local.conf \ + /etc/nginx/site.d/"$site"/local.inc + sudo install -m 660 -o www -g www \ + "$tool"/etc/nginx/site.d/"$site"/site.conf \ + /etc/nginx/site.d/"$site"/site.inc + sudo install -m 660 -o www -g www /dev/stdin \ + /etc/nginx/site.d/"$site"/server.conf <<-EOF + server { + access_log /home/www/log/$site/nginx/access.log main; + error_log /home/www/log/$site/nginx/error.log warn; + root /home/www/pub/$site; + include /etc/nginx/site.d/$site/local.inc; + include /etc/nginx/site.d/$site/site.inc; + } + EOF + test ! -r "$tool"/etc/nginx/site.d/"$site"/configure.sh || + . "$tool"/etc/nginx/site.d/"$site"/configure.sh + done + rule apt_get_install spawn-fcgi fcgiwrap + sudo insserv --remove fcgiwrap + #sudo insserv --remove nginx + rule tmpfs_configure + sudo service php5-fpm restart + # NOTE: relance les processus du pool + # pour leur donner les droits + # de leurs groupes supplémentaires. + sudo service nginx restart + } +rule_php5_fpm_configure () { + local -; set +f + rule apt_get_install \ + php5-fpm \ + php-apc + rule adduser php5 \ + --disabled-login \ + --disabled-password \ + --group \ + --home /etc/php5/fpm \ + --shell /bin/false \ + --system + rule adduser log-php5 \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/www/log/php5/fpm \ + --shell /bin/false \ + --system + sudo ln -fns \ + /etc/php5/fpm \ + /home/www/etc/php5 + sudo rm -rf \ + /etc/php5/fpm/conf.d \ + /etc/php5/fpm/pool.d + sudo install -d -m 770 -o php5 -g php5 \ + /etc/php5/fpm/conf.d \ + /etc/php5/fpm/pool.d + sudo install -m 770 -o php5 -g php5 \ + "$tool"/etc/php5/fpm/php-fpm.conf \ + /etc/php5/fpm/php-fpm.conf + local conf + #for conf in "$tool"/etc/php5/fpm/conf.d/*.conf + # do conf=${conf#"$tool"/etc/php5/fpm/conf.d/} + # sudo install -m 660 -o php5 -g php5 \ + # "$tool"/etc/php5/fpm/conf.d/"$conf" \ + # /etc/php5/fpm/conf.d/"$conf" + # done + for conf in "$tool"/etc/php5/fpm/pool.d/*.conf + do conf=${conf#"$tool"/etc/php5/fpm/pool.d/} + IFS=. read -r pool <<-EOF + ${conf%.conf} + EOF + assert 'test "${pool:+set}"' + rule adduser php5-"$pool" \ + --disabled-login \ + --disabled-password \ + --group \ + --no-create-home \ + --home /etc/php5/fpm/pool.d \ + --shell /bin/false \ + --system + rule adduser log-php5-"$pool" \ + --disabled-login \ + --disabled-password \ + --group \ + --no-create-home \ + --home /home/www/log/php5/fpm/"$pool" \ + --shell /bin/false \ + --system + sudo install -d -m 770 -o log-php5 -g log-php5 \ + /home/www/log/php5 \ + /home/www/log/php5/fpm + sudo install -d -m 770 -o log-php5-"$pool" -g log-php5-"$pool" \ + /home/www/log/php5/fpm/"$pool" + sudo install -m 660 -o php5 -g php5 /dev/stdin \ + /etc/php5/fpm/pool.d/"$pool".conf <<-EOF + [$pool] + access.log = /home/www/log/php5/fpm/$pool/access.log + catch_workers_output = yes + chdir = / + env[HOSTNAME] = \$HOSTNAME + env[TEMP] = /tmp + env[TMPDIR] = /tmp + env[TMP] = /tmp + group = php5-$pool + #listen = 127.0.0.1:9000 + listen = /run/php5/fpm/$pool + #listen.allowed_clients = 127.0.0.1 + listen.group = www-data + listen.mode = 0660 + #listen.owner = www-data + listen.backlog = -1 + pm = dynamic + pm.max_children = 5 + pm.max_requests = 200 + pm.max_spare_servers = 4 + pm.min_spare_servers = 2 + pm.start_servers = 3 + pm.status_path = /status + request_slowlog_timeout = 5s + request_terminate_timeout = 120s + rlimit_core = unlimited + rlimit_files = 131072 + slowlog = /home/www/log/php5/fpm/$pool/slow.log + user = php5-$pool + $(cat "$tool"/etc/php5/fpm/pool.d/"$conf") + EOF + sudo install -m 664 -o php5 -g php5 \ + "$tool"/etc/php5/fpm/php.ini \ + /etc/php5/fpm/php.ini + case $(sudo sv status php5-"$pool") in + (run:*) sudo sv restart php5-"$pool" + esac + done + rule tmpfs_configure + sudo service php5-fpm restart + } +rule_postfix_configure () { + local hint="run vm_remote postfix_key_send before" + assert "test -f /etc/postfix/$vm_domainname/smtpd/x509/key.pem" hint + #warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix" + sudo debconf-set-selections <<-EOF + postfix postfix/main_mailer_type select No configuration + EOF + rule apt_get_install postfix + sudo install -m 640 -o root -g root /dev/stdin /etc/postfix/.gitignore <<-EOF + *.db + EOF + sudo install -d -m 771 -o root -g root \ + /etc/postfix/ \ + /etc/postfix/$vm_domainname/ \ + /etc/postfix/$vm_domainname/smtp \ + /etc/postfix/$vm_domainname/smtp/x509 \ + /etc/postfix/$vm_domainname/smtp/x509/ca \ + /etc/postfix/$vm_domainname/smtpd \ + /etc/postfix/$vm_domainname/smtpd/x509 \ + /etc/postfix/$vm_domainname/smtpd/x509/ca + sudo ln -fns \ + ../crt+crl.self-signed.pem \ + /etc/postfix/$vm_domainname/smtpd/x509/ca/crt.pem + sudo install -m 400 -o root -g root \ + "$tool"/var/pub/x509/smtpd.$vm_domainname/crt+crl.self-signed.pem \ + /etc/postfix/$vm_domainname/smtpd/x509/crt+crl.self-signed.pem + sudo install -m 400 -o root -g root \ + "$tool"/var/pub/x509/smtpd.$vm_domainname/crt.pem \ + /etc/postfix/$vm_domainname/smtpd/x509/crt.pem + sudo install -m 400 -o root -g root \ + "$tool"/var/pub/x509/smtpd.$vm_domainname/crt+ca.pem \ + /etc/postfix/$vm_domainname/smtpd/x509/crt+ca.pem + sudo install -m 400 -o root -g root \ + "$tool"/var/pub/x509/smtpd.$vm_domainname/crt+crl.self-signed.pem \ + /etc/postfix/$vm_domainname/smtpd/x509/crt+crl.self-signed.pem + sudo install -m 660 -o root -g root \ + "$tool"/etc/postfix/$vm_domainname/header_checks \ + /etc/postfix/$vm_domainname/header_checks + sudo install -m 664 -o root -g root /dev/stdin \ + /etc/postfix/aliases <<-EOF + # See man 5 aliases for format + abuse: root + admin: root + contact: root + mailer-daemon: root + postmaster: root + root: $(getent group sudo | cut -f 4 -d : | tr , ' ') + EOF + sudo newaliases -oA/etc/postfix/aliases + cat /dev/stdin "$tool"/etc/postfix/main.cf <<-EOF | + mydomain = $vm_domainname + myorigin = \$mydomain + myhostname = $vm_hostname.\$mydomain + mail_name = \$myhostname + mydestination = $vm_hostname \$myhostname \$myorigin + EOF + sudo install -m 664 -o root -g root /dev/stdin \ + /etc/postfix/main.cf + sudo install -m 664 -o root -g root \ + "$tool"/etc/postfix/master.cf \ + /etc/postfix/master.cf + sudo install -m 660 -o root -g root \ + "$tool"/etc/postfix/$vm_domainname/smtp/x509/policy \ + /etc/postfix/$vm_domainname/smtp/x509/policy + sudo postmap hash:/etc/postfix/$vm_domainname/smtp/x509/policy + sudo install -m 660 -o root -g root \ + "$tool"/etc/postfix/$vm_domainname/smtp/header_checks \ + /etc/postfix/$vm_domainname/smtp/header_checks + sudo install -m 660 -o root -g root \ + "$tool"/etc/postfix/$vm_domainname/smtpd/sender_access \ + /etc/postfix/$vm_domainname/smtpd/sender_access + sudo postmap hash:/etc/postfix/$vm_domainname/smtpd/sender_access + sudo install -m 660 -o root -g root \ + "$tool"/etc/postfix/$vm_domainname/smtpd/client_blacklist \ + /etc/postfix/$vm_domainname/smtpd/client_blacklist + sudo postmap hash:/etc/postfix/$vm_domainname/smtpd/client_blacklist + sudo install -m 660 -o root -g root \ + "$tool"/etc/postfix/$vm_domainname/smtpd/relay_clientcerts \ + /etc/postfix/$vm_domainname/smtpd/relay_clientcerts + sudo postmap hash:/etc/postfix/$vm_domainname/smtpd/relay_clientcerts + sudo install -m 660 -o root -g root \ + "$tool"/etc/postfix/$vm_domainname/transport \ + /etc/postfix/$vm_domainname/transport + sudo postmap hash:/etc/postfix/$vm_domainname/transport + sudo install -m 660 -o root -g root \ + "$tool"/etc/postfix/$vm_domainname/virtual_alias \ + /etc/postfix/$vm_domainname/virtual_alias + sudo postmap hash:/etc/postfix/$vm_domainname/virtual_alias + sudo service postfix restart + } +rule_postgresql_configure () { + rule apt_get_install postgresql-9.1 + if [ ! -d /var/lib/postgresql/9.1/ ]; then + pg_createcluster -u postgres --start 9.1 main + fi + sudo install -m 660 -o root -g root \ + "$tool"/etc/postgresql/9.1/main/postgresql.conf \ + /etc/postgresql/9.1/main/postgresql.conf + sudo service postgresql restart + } +rule_openerp_configure () { + sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF + deb http://nightly.openerp.com/trunk/nightly/deb/ ./ + EOF + sudo apt-get update + rule apt_get_install openerp + } +rule_postgrey_configure () { + rule apt_get_install postgrey + sudo service postgrey restart + } +rule_procmail_configure () { + rule apt_get_install procmail + sudo install -d -m 770 -o root -g root \ + /etc/skel/etc/mail \ + /etc/skel/var/cache/mail \ + /etc/skel/var/log/mail \ + /etc/skel/var/mail + sudo install -m 660 -o root -g root \ + "$tool"/etc/skel/etc/mail/delivery.procmailrc \ + /etc/skel/etc/mail/delivery.procmailrc + } +rule_runit_configure () { + rule apt_get_install runit + local -; set +f + for sv in ${1-/etc/service/*} + # NOTE: stoppe les services en retenant leur status de départ + do sv=$(basename "$sv") + local sv_hash=$(printf %s "$sv" | sha1sum | cut -f 1 -d ' ') + local sv_status + IFS= read -r sv_status_$sv_hash <<-EOF + $(sudo sv status "$sv") + EOF + sudo rm -f /etc/service/"$sv" + done + for sv in ${1-"$tool"/etc/sv/*} + # NOTE: configure et (re-)démarre les services + do sv=$(basename "$sv") + local sv_hash=$(printf %s "$sv" | sha1sum | cut -f 1 -d ' ') + sudo install -d -m 770 -o root -g root \ + /etc/sv/"$sv" + sudo install -m 770 -o root -g root \ + "$tool"/etc/sv/"$sv"/run \ + /etc/sv/"$sv"/run + if test -e "$tool"/etc/sv/"$sv"/log/run + then + sudo install -d -m 770 -o root -g root \ + /etc/sv/"$sv"/log + sudo install -m 770 -o root -g root \ + "$tool"/etc/sv/"$sv"/log/run \ + /etc/sv/"$sv"/log/run + fi + test ! -r "$tool"/etc/sv/"$sv"/configure.sh || + . "$tool"/etc/sv/"$sv"/configure.sh + sudo ln -fns ../sv/"$sv" /etc/service/"$sv" + eval local sv_status=\"\${sv_status_$sv_hash-}\" + case $sv_status in + ("") true;; + (run:*) sudo sv restart "$sv";; + esac + done + } +rule_ssh_configure () { ssh-keygen -F "$vm_fqdn" -f "$tool"/etc/openssh/known_hosts | ( while IFS= read -r line do case $line in (*" RSA") return 0; break;; esac @@ -347,54 +1171,168 @@ rule_user_init () { /etc/ssh/ssh_host_ecdsa_key \ /etc/ssh/ssh_host_ecdsa_key.pub # NOTE: clefs générées par Debian - mk_reg mod=664 own=root:root /etc/ssh/sshd_config <<-EOF - Port 22 - ListenAddress $vm_ipv4 - #ListenAddress :: - Protocol 2 + sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/sshd_config <<-EOF + AcceptEnv LANG LC_* + AuthorizedKeysFile %h/etc/ssh/authorized_keys + ChallengeResponseAuthentication no + ClientAliveInterval 0 Compression yes + DebianBanner no + GSSAPIAuthentication no HostKey /etc/ssh/ssh_host_rsa_key - UsePrivilegeSeparation yes + HostbasedAuthentication no + IgnoreRhosts yes + IgnoreUserKnownHosts no + KerberosAuthentication no KeyRegenerationInterval 3600 - ServerKeyBits 768 - SyslogFacility AUTH + Port 22 + ListenAddress 127.0.0.1 + ListenAddress $vm_ipv4 LogLevel INFO LoginGraceTime 120 + PasswordAuthentication no + PermitEmptyPasswords no PermitRootLogin yes - StrictModes yes - RSAAuthentication yes + PrintLastLog yes + PrintMotd no + Protocol 2 PubkeyAuthentication yes - AuthorizedKeysFile %h/etc/ssh/authorized_keys - IgnoreRhosts yes + RSAAuthentication yes RhostsRSAAuthentication no - HostbasedAuthentication no - IgnoreUserKnownHosts no - PermitEmptyPasswords no - ChallengeResponseAuthentication no - PasswordAuthentication no - KerberosAuthentication no - GSSAPIAuthentication no - X11Forwarding no - X11DisplayOffset 10 - PrintMotd no - DebianBanner no - PrintLastLog yes - TCPKeepAlive yes - ClientAliveInterval 0 - AcceptEnv LANG LC_* + ServerKeyBits 768 + StrictModes yes Subsystem sftp /usr/lib/openssh/sftp-server + SyslogFacility AUTH + TCPKeepAlive yes UsePAM yes + UsePrivilegeSeparation yes + X11DisplayOffset 10 + X11Forwarding no + EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/ssh_config <<-EOF + Host * + #Compression yes + #CompressionLevel 9 + #ControlMaster auto + #ControlPath ~/var/run/ssh/sock/%h-%p-%r + GSSAPIAuthentication no + GSSAPIDelegateCredentials no + HashKnownHosts yes + IdentityFile ~/etc/ssh/id_dsa + IdentityFile ~/etc/ssh/id_rsa + IdentityFile ~/etc/ssh/identity + SendEnv LANG LC_* + StrictHostKeyChecking ask + UserKnownHostsFile ~/etc/ssh/known_hosts EOF sudo service ssh restart - mk_reg mod=440 own=root:root /etc/sudoers.d/passwd-init <<-EOF + } +rule_sysctl_configure () { + local -; set +f + for conf in "$tool"/etc/sysctl.d/*.conf + do conf=${conf#"$tool"/etc/sysctl.d/} + sudo install -m 660 -o root -g root \ + "$tool"/etc/sysctl.d/"$conf" \ + /etc/sysctl.d/"$conf" + done + sudo sysctl --system + } +rule_tmpfs_configure () { + sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF + LOCK_SIZE=5242880 # NOTE: 5MiB + RAMLOCK=yes + RAMSHM=yes + RAMTMP=yes + RUN_SIZE=10% + SHM_SIZE= + TMP_MODE=1777,nr_inodes=1000k,noatime + TMP_OVERFLOW_LIMIT=1024 + # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB) + # on the root filesystem (overriding RAMTMP). + TMP_SIZE=200m + TMPFS_SIZE=20%VM + EOF + sudo install -m 775 -o root -g root \ + "$tool"/etc/init.d/tmpfs \ + /etc/init.d/tmpfs + sudo update-rc.d tmpfs defaults + sudo service tmpfs restart + } +rule_time_configure () { + sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF + Europe/Paris + EOF + sudo debconf-set-selections <<-EOF + tzdata tzdata/Areas select Europe + tzdata tzdata/Zones/Europe select Paris + EOF + rule dpkg_reconfigure tzdata + rule apt_get_install ntp + } +rule_user_add () { # SYNTAX: $user + rule user_configure + local user=$1 + rule adduser "$user" --disabled-password + # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init . + eval local home\; home="~$user" + sudo adduser "$user" users + sudo install -m 640 -o root -g root \ + "$tool"/var/pub/ssh/"$user".key \ + "$home"/etc/ssh/authorized_keys + local key; local -; set +f + for key in "$tool"/var/pub/openpgp/*.key + do sudo -u "$user" gpg --import - <"$key" + done + } +rule_user_configure () { + rule apt_get_install bash-completion + sudo install -m 660 -o root -g root /dev/stdin \ + /etc/adduser.conf <<-EOF + ADD_EXTRA_GROUPS=1 + DHOME=/home + DIR_MODE=0750 + DSHELL=/bin/bash + EXTRA_GROUPS="users" + FIRST_GID=1000 + FIRST_SYSTEM_GID=100 + FIRST_SYSTEM_UID=100 + FIRST_UID=1000 + GROUPHOMES=no + LAST_GID=29999 + LAST_SYSTEM_GID=999 + LAST_SYSTEM_UID=999 + LAST_UID=29999 + LETTERHOMES=no + NAME_REGEX="^[a-z][-a-z0-9_]*\$" + QUOTAUSER="" # TODO: init + SETGID_HOME=no + SKEL=/etc/skel + SKEL_IGNORE_REGEX="dpkg-(old|new|dist|save)" + USERGROUPS=yes + USERS_GID=100 + EOF + sudo install -d -m 750 -o root -g root \ + /etc/skel \ + /etc/skel/etc \ + /etc/skel/etc/gpg \ + /etc/skel/etc/ssh + sudo install -d -m 770 -o root -g root \ + /etc/skel/var \ + /etc/skel/var/cache \ + /etc/skel/var/log \ + /etc/skel/var/run \ + /etc/skel/var/run/ssh + sudo ln -fns etc/ssh /etc/skel/.ssh + sudo ln -fns etc/gpg /etc/skel/.gnupg + sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/passwd-init <<-EOF %sudo ALL=(ALL) NOPASSWD: /bin/sh -e -f -u -c \\ case \$(/usr/bin/passwd --status "\$SUDO_USER") in \\ ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac EOF - mk_reg mod=440 own=root:root /etc/sudoers.d/etckeeper-unclean <<-EOF - %sudo ALL=(ALL) NOPASSWD: /usr/sbin/etckeeper unclean + sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF + %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean EOF - mk_reg mod=440 own=root:root /etc/sudoers.d/env_keep <<-EOF + sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF Defaults env_keep = " \\ EDITOR \\ GIT_AUTHOR_NAME \\ @@ -403,433 +1341,87 @@ rule_user_init () { GIT_COMMITTER_EMAIL \\ " EOF - mk_reg mod=555 own=root:root /usr/local/sbin/passwd-init <<-EOF - #!/bin/sh + sudo install -m 755 -o root -g root /dev/stdin /usr/local/bin/passwd-init <<-EOF + #!/bin/sh -efu + # DESCRIPTION: permet à un-e utilisateurice d'initialiser ellui-même son mot-de-passe système. sudo /bin/sh -e -f -u -c \ 'case \$(/usr/bin/passwd --status "\$SUDO_USER") in ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac' EOF + sudo install -m 644 -o root -g root \ + "$tool"/etc/bash.bashrc \ + /etc/bash.bashrc + sudo install -m 644 -o root -g root \ + "$tool"/etc/screenrc \ + /etc/screenrc } -rule_user_root_init () { - mk_dir mod=750 own=root:root /root/etc - mk_dir mod=750 own=root:root /root/etc/ssh - mk_dir mod=750 own=root:root /root/etc/gpg - mk_lnk etc/gpg /root/.gnupg - mk_lnk etc/ssh /root/.ssh +rule_user_admin_add () { # SYNTAX: $user + rule user_configure + local user=$1 + rule adduser "$user" --disabled-password + eval local home\; home="~$user" + sudo adduser "$user" sudo + sudo install -m 640 -o root -g root \ + "$tool"/var/pub/ssh/"$user".key \ + "$home"/etc/ssh/authorized_keys + local key; local -; set +f + for key in "$tool"/var/pub/openpgp/*.key + do sudo -u "$user" gpg --import - <"$key" + done + rule user_admin_configure + } +rule_user_admin_configure () { + rule initramfs_configure + rule user_root_configure + } +rule_user_root_configure () { + sudo install -d -m 750 -o root -g root \ + /root/etc \ + /root/etc/gpg \ + /root/etc/ssh + sudo ln -fns etc/gpg /root/.gnupg + sudo ln -fns etc/ssh /root/.ssh getent group sudo | while IFS=: read -r group x x users do while test -n "$users" && IFS=, read -r user users <<-EOF $users EOF do eval local home\; home="~$user" - cat "$home"/etc/ssh/authorized_keys + sudo cat "$home"/etc/ssh/authorized_keys done done | - mk_reg mod=640 own=root:root /root/etc/ssh/authorized_keys - local key + sudo install -m 640 -o root -g root /dev/stdin /root/etc/ssh/authorized_keys + local key; local -; set +f for key in "$tool"/var/pub/openpgp/*.key do sudo gpg --import "$key" done } -rule_bin_init () { - mk_lnk "$tool"/vm_hosted /usr/local/sbin/ - } -rule_init () { - rule etckeeper_init - rule locale_init - rule network_init - rule apt_init - rule filesystem_init - rule login_init - rule user_root_init - rule boot_init - rule bin_init +rule_configure () { + rule apt_configure + rule git_configure + rule etckeeper_configure + rule locales_configure + rule time_configure + rule network_configure + rule filesystem_configure + rule login_configure + rule ssh_configure + rule user_root_configure + rule boot_configure + rule sysctl_configure + rule user_configure + rule mail_configure + rule gitolite_configure + rule www_configure + rule php5_fpm_configure + rule nginx_configure + #rule apache2_configure + rule runit_configure } -rule_disk_key_change () { +rule_luks_key_change () { sudo cryptsetup luksChangeKey /dev/$vm_lvm_vg/${vm_lvm_lv}_root } -rule_user_admin_add () { # SYNTAX: $user - local user=$1 - id "$user" >/dev/null || - sudo adduser --disabled-password "$user" - # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init . - eval local home\; home="~$user" - sudo adduser "$user" sudo - mk_reg mod=640 own=$user:$user "$home"/etc/ssh/authorized_keys \ - <"$tool"/var/pub/ssh/"$user".key - rule initramfs_init - rule user_root_init - local key; local -; set +f - for key in "$tool"/var/pub/openpgp/*.key - do sudo -u "$user" gpg --import "$key" - done - } -rule_user_mail_format () { - mk_dir mod=770 own=root:adm /etc/skel/etc/procmail - mk_dir mod=770 own=root:adm /etc/skel/var/mail - mk_dir mod=770 own=root:adm /etc/skel/var/cache/procmail - mk_reg mod=660 own=root:adm /etc/skel/etc/procmail/delivery.rc <<-EOF - # vim: ft=procmail - - # NOTE: paramètres passés par postfix - SENDER=\$1 - RECIPIENT=\$2 - USER=\$3 - EXTENSION=\$4 - DOMAIN=\$5 - ORIGINAL_RECIPIENT=\$6 - - PATH="\$HOME/bin:/usr/local/bin:/usr/bin:/bin" - MAILDIR="\$HOME/var/mail/" - DEFAULT="\$MAILDIR" - #LOGFILE=`cd="\$HOME/var/log/procmail/" d=\$(date +"%Y-%m-%d"); ln -fns "\$d.log" "\$cd/current.log"; printf %s "\$cd/\$d.log"` - LOGFILE="/dev/null" - LOGABSTRACT=all - LOGABSTRACT - VERBOSE - SHELL=/bin/sh - SHELLMETAS=&|<>~;?*%{} - - # DESCRIPTION: supprime les doublons en fonction du champ Message-Id - #:0 Wh: "\$HOME/var/cache/procmail/msgid\$LOCKEXT" - #| formail -D 8192 "\$HOME/var/cache/procmail/msgid" - - # DESCRIPTION: fait suivre à l'adresse configurée dans /etc/passwd ; on peut aussi utiliser ~/.forward - EMAIL=`sed /etc/passwd -ne "/^\$USER:/s/[^:]*:[^:]*:[^:]*:[^:]*:[^,]*,[^,]*,[^,]*,[^,]*,\([^:]*\):.*/\1/p"` - # NOTE: récupère l’adresse courriel dans le champ GECOS - FROM_=`formail -c -x "From " | sed -e 's/^\s*\([^ \t]*\).*/\1/g'` - # NOTE: récupère l’expéditeur inscrit sur l’enveloppe - :0 - | \$SENDMAIL -i -bm -f "\$FROM_" "\${EMAIL/@/\${EXTENSION:++\${EXTENSION}}@}" - - # DESCRIPTION: IMAP - #:0 - #| /usr/lib/dovecot/deliver -f "\$SENDER" -a "\$RECIPIENT" - - # DESCRIPTION: UUCP - #:0 - #| /usr/bin/uux \ - # -I "\$HOME/etc/uucp/uucp.cfg" \ - # --nouucico \ - # --notification=error \ - # --requestor "\$USER" \ - # - "\$USER!rmail" "(\$USER)" - EOF - mk_reg mod=664 own=root:root /etc/postfix/main.cf <<-EOF - # /etc/postfix/main.cf - # SEE: http://postfix.traduc.org/index.php/TLS_README.html - - parent_domain_matches_subdomains = - #debug_peer_list - #fast_flush_domains - #mynetworks - #permit_mx_backup_networks - #qmqpd_authorized_clients - #smtpd_access_maps - mydomain = $vm_domainname - myorigin = \$mydomain - myhostname = $vm_hostname.\$mydomain - mail_name = \$myhostname - mydestination = - $vm_hostname - \$myhostname - \$myorigin - mynetworks = - 127.0.0.0/8 - #[::1]/128 - inet_protocols = ipv4 - # "all" to activate IPv6 - inet_interfaces = all - permit_mx_backup_networks = - - alias_database = - hash:/etc/aliases - # NOTE: fichier de hash contenant une table d’alias mail. - # Celle-ci est éditable dans /etc/aliases, puis (indispensable) - # regénérée en hash grâce à la commande newaliases qui produit /etc/aliases.db - alias_maps = - hash:/etc/aliases - recipient_delimiter = + - # NOTE: séparateur entre le nom d’utilisateur - # et les extensions d’adresse (par défaut le signe +). - #virtual_alias_domains = - virtual_alias_maps = - hash:/etc/postfix/\$mydomain/virtual - # NOTE: do not specify virtual alias domain names in the main.cf - # mydestination or relay_domains configuration parameters. - # - # With a virtual alias domain, the Postfix SMTP server - # accepts mail for known-user@virtual-alias.domain, and - # rejects mail for unknown-user@virtual-alias.domain as - # undeliverable. - #relayhost = - relay_clientcerts = - hash:/etc/postfix/\$mydomain/smtpd/tls/relay_clientcerts - relay_domains = - \$mydestination - # NOTE: ajouter les domaines pour lesquels on est backup MX ici, - # pas dans mydestination ou virtual_alias... - - maximal_queue_lifetime = 5d - - header_checks = - regexp:/etc/postfix/\$mydomain/header_checks - mime_header_checks = - nested_header_checks = - milter_header_checks = - body_checks = - - #content_filter = amavisfeed:[127.0.0.1]:10024 - #receive_override_options = no_address_mappings - # no_unknown_recipient_checks - # Do not try to reject unknown recipients (SMTP server only). - # This is typically specified AFTER an external content filter. - # no_address_mappings - # Disable canonical address mapping, virtual alias map expansion, - # address masquerading, and automatic BCC (blind carbon-copy) recipients. - # This is typically specified BEFORE an external content filter (eg. amavis). - # no_header_body_checks - # Disable header/body_checks. This is typically specified AFTER an external content filter. - # no_milters - # Disable Milter (mail filter) applications. This is typically specified AFTER an external content filter. - #local_header_rewrite_clients = - transport_maps = - hash:/etc/postfix/\$mydomain/transport_maps - mailbox_command = - /usr/bin/procmail -t -a "\$SENDER" -a "\$RECIPIENT" -a "\$USER" -a "\$EXTENSION" -a "\$DOMAIN" -a "\$ORIGINAL_RECIPIENT" "\$HOME/etc/procmail/delivery.rc" - mailbox_size_limit = 0 - biff = no - # Activer la notification en cas de réception de nouveaux e-mails dans la console (yes / no). - append_dot_mydomain = no - # appending .domain is the MUA's job. - - #tls_random_source = - # dev:/dev/urandom - # Non-blocking - #tls_random_reseed_period = 3600s - #tls_random_exchange_name = - # \${data_directory}/prng_exch - # NOTE: à ne pas mettre dans la cage chroot - #tls_random_bytes = 32 - #tls_random_prng_update_period = 3600s - #tls_high_cipherlist = AES256-SHA - # NOTE: postconf(5) déconseille de changer ceci - - #smtp_cname_overrides_servername = no - smtp_connect_timeout = 60s - #smtp_tls_CAfile = /etc/postfix/\$mydomain/smtp/tls/ca/crt.pem - #smtp_tls_CApath = /etc/postfix/\$mydomain/smtp/tls/ca/ - #smtp_tls_cert_file = /etc/postfix/\$mydomain/smtp/tls/crt.pem - #smtp_tls_key_file = /etc/postfix/\$mydomain/smtp/tls/key.pem - #smtp_tls_per_site = hash:/etc/postfix/\$mydomain/smtp/tls/per_site - # NOTE: déprécié en faveur de smtp_tls_policy_maps - smtp_tls_policy_maps = hash:/etc/postfix/\$mydomain/smtp/tls/policy - smtp_tls_fingerprint_digest = sha1 - smtp_tls_scert_verifydepth = 5 - #smtp_tls_secure_cert_match = nexthop, dot-nexthop - #smtp_tls_verify_cert_match = hostname - #smtp_tls_note_starttls_offer = yes - smtp_tls_loglevel = 1 - smtp_tls_protocols = !SSLv2, !SSLv3 - # Only allow TLSv* - smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_tls_session_cache - #smtp_tls_session_cache_timeout = 3600s - smtp_tls_security_level = may - smtp_header_checks = regexp:/etc/postfix/\$mydomain/smtp/header_checks - smtp_body_checks = - smtp_mime_header_checks = - smtp_nested_header_checks = - - smtpd_starttls_timeout = 300s - smtpd_banner = - \$myhostname ESMTP \$mail_name (Debian/GNU) - - # Restrictions - smtpd_helo_required = yes - strict_rfc821_envelopes = yes - smtpd_authorized_xclient_hosts = 127.0.0.1 - # NOTE: utile pour tester les restrictions - - smtpd_helo_restrictions = - reject_invalid_helo_hostname - reject_non_fqdn_helo_hostname - #reject_unknown_helo_hostname - # NOTE: pourrait pourtant être utile pour lutter contre le spam - permit - - smtpd_sender_restrictions = - permit_mynetworks - permit_tls_clientcerts - permit_sasl_authenticated - check_sender_access hash:/etc/postfix/\$mydomain/smtpd/sender_access - check_sender_access hash:/etc/postfix/sender_blacklist - reject_unauth_pipelining - reject_non_fqdn_sender - #reject_unknown_sender_domain - # NOTE: temporaire - permit - - smtpd_client_new_tls_session_rate_limit = 0 - smtpd_client_event_limit_exceptions = \$mynetworks - smtpd_client_recipient_rate_limit = 0 - smtpd_client_connection_count_limit = 50 - smtpd_client_connection_rate_limit = 0 - smtpd_client_message_rate_limit = 0 - smtpd_client_port_logging = no - - smtpd_client_restrictions = - check_client_access hash:/etc/postfix/client_blacklist - - policy_time_limit = 3600 - default_extra_recipient_limit = 5000 - duplicate_filter_limit = 5000 - smtpd_recipient_limit = 5000 - smtpd_recipient_overshoot_limit = 5000 - smtpd_recipient_restrictions = - reject_non_fqdn_recipient - #reject_invalid_hostname - # NOTE: postfix < 2.3. voir reject_invalid_helo_hostname - # dans smtpd_helo_restrictions - reject_unknown_recipient_domain - #reject_non_fqdn_sender - # NOTE: dans smtpd_sender_restrictions - reject_unauth_pipelining - # NOTE: dans smtpd_client_restrictions ou smtpd_data_restrictions - permit_mynetworks - permit_tls_clientcerts - permit_sasl_authenticated - reject_unauth_destination - # NOTE: ne pas passer par SPFCheck / Postgrey si le mail n'est pas pour nous - # ou quelqu'un pour lequel on tient lieu de backup_mx - check_policy_service inet:127.0.0.1:10023 - # NOTE: Postgrey (greylisting) - check_policy_service unix:private/spfcheck - permit_auth_destination - # NOTE: une fois Postgrey passé, on accepte ce qui nous est destiné - # (voir permit_auth_destination) ; sans doute redondant - reject - #check_relay_domains <- removed from postfix - #reject_unknown_sender_domain - # aurait probablement été mieux dans smtpd_sender_restrictions - #reject_rbl_client bl.spamcop.net - #reject_rbl_client list.dsbl.org - #reject_rbl_client zen.spamhaus.org - #reject_rbl_client dnsbl.sorbs.net - - smtpd_data_restrictions = - reject_unauth_pipelining - # NOTE: obliger le serveur en face à attendre qu'on lui aie dit OK - permit - - #smtpd_end_of_data_restrictions = - - #smtpd_restriction_classes = - - smtpd_error_sleep_time = 5 - # NOTE: forcer quelqu'un qui nous embête à attendre cinq secondes. - - # SASL - smtpd_sasl_auth_enable = yes - smtpd_sasl_type = dovecot - smtpd_sasl_path = private/auth - smtpd_sasl_security_options = noanonymous - smtpd_sasl_domain = \$mydomain - - # SMTPD TLS - smtpd_discard_ehlo_keywords = starttls - # NOTE: les clients mails tentant d'utiliser le chiffrement opportuniste - # se mangent une erreur en tentant un starttls - smtpd_tls_fingerprint_digest = sha1 - # sha512 ? - smtpd_tls_mandatory_protocols = TLSv1 - smtpd_tls_mandatory_ciphers = high - smtpd_tls_ciphers = high - # restrictif. s/high/medium/ ? - smtpd_tls_CAfile = /etc/postfix/\$mydomain/smtpd/tls/ca/crt+crl.slf.pem - smtpd_tls_CApath = /etc/postfix/\$mydomain/smtpd/tls/ca/ - smtpd_tls_cert_file = /etc/postfix/\$mydomain/smtpd/tls/crt+crl.slf.pem - smtpd_tls_key_file = /etc/postfix/\$mydomain/smtpd/tls/key.pem - ## - #smtpd_tls_received_header = no - smtpd_tls_session_cache_database = - btree:/var/lib/postfix/smtpd_tls_session_cache - #smtpd_tls_session_cache_timeout = 3600s - smtpd_tls_security_level = may - # Postfix 2.3 and later - # encrypt - # Mandatory TLS encryption: announce STARTTLS support to SMTP clients, and require that clients use TLS - # encryption. According to [1720]RFC 2487 this MUST NOT be applied in case of a publicly-referenced - # SMTP server. Instead, this option should be used only on dedicated servers. - smtpd_tls_loglevel = 1 - smtpd_tls_ccert_verifydepth = 5 - smtpd_tls_auth_only = yes - # Pas d'AUTH SASL sans TLS - smtpd_tls_ask_ccert = no - smtpd_tls_req_ccert = no - #smtpd_tls_always_issue_session_ids = yes - smtpd_peername_lookup = yes - # Nécessaire pour postgrey, etc - smtpd_milters = - non_smtpd_milters = - line_length_limit = 2048 - queue_minfree = 0 - message_size_limit = 20480000 - #smtpd_enforce_tls # NOTE: obsolète - #smtpd_use_tls # NOTE: obsolète - #smtpd_tls_cipherlist # NOTE: obsolète - - readme_directory = no - #delay_warning_time = 4h - # NOTE: uncomment the previous line to generate "delayed mail" warnings - #debug_peer_level = 4 - #debug_peer_list = .\$myhostname - EOF - mk_reg mod=664 own=root:root /etc/dovecot/dovecot.conf <<-EOF - auth_ssl_username_from_cert = yes - listen = * - log_timestamp = "%Y-%m-%d %H:%M:%S " - mail_debug = yes - mail_location = maildir:~/var/mail - mail_privileged_group = mail - passdb { - args = /home/%u/etc/dovecot/passwd - driver = passwd-file - } - protocols = imap - service auth { - unix_listener /var/spool/postfix/private/auth { - group = postfix - mode = 0660 - user = postfix - } - user = root - } - ssl_ca =