X-Git-Url: https://git.cyclocoop.org/?p=lhc%2Fateliers.git;a=blobdiff_plain;f=vm_hosted;h=1ffd17654001188654ccc4cb84589633e9515b1e;hp=ebb930de6e5a5c37daa97af861853a4ea3d103e7;hb=a5a85db110bc4840b9806773b4b6e79298117ce4;hpb=5020fb59510a981bd021e5d34fee268d26eb40a0
diff --git a/vm_hosted b/vm_hosted
index ebb930d..1ffd176 100755
--- a/vm_hosted
+++ b/vm_hosted
@@ -1,87 +1,246 @@
#!/bin/sh
set -e -f ${DRY_RUN:+-n} -u
-tool=${0%/*}
-. "$tool"/lib/functions.sh
+tool=$0
+while test -L "$tool"
+ do tool=$(readlink "$tool")
+ done
+tool=${tool%/*}
+. "$tool"/lib/rule.sh
. "$tool"/etc/vm.sh
-rule_help () {
+rule_help () { # SYNTAX: [--hidden]
+ local hidden; [ ${1:+set} ] || hidden=set
cat >&2 <<-EOF
- DESCRIPTION: ce script regroupe des fonctions utilitaires
- pour gérer la VM _depuis_ la VM hébergée ;
- il sert à la fois d'outil et de documentation.
- Voir \`$tool/vm_host' pour les utilitaires côté machine hôte.
+ DESCRIPTION:
+ ce script regroupe des règles pour administrer la VM ($vm_fqdn)
+ _depuis_ la VM hébergée ($vm_fqdn) ;
+ il sert à la fois d'outil (aisément bidouillable)
+ et de documentation (préçise).
+ Voir \`$tool/vm_host' pour les règles côté machine hôte ($vm_host).
SYNTAX: $0 \$RULE \${RULE}_SYNTAX
RULES:
- $(sed -ne 's/^rule_\([^_][^ ]*\) () {\( *#.*\|\)/\t\1\2/p' "$tool"/vm.sh "$0")
+ $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/ \1\2/p" "$tool"/etc/vm.sh "$0")
ENVIRONMENT:
TRACE # affiche les commandes avant leur exécution
- $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/vm.sh "$0")
+ $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
EOF
}
+rule_git_configure () {
+ (
+ cd "$tool"
+ git config --replace branch.master.remote .
+ git config --replace branch.master.merge refs/remotes/master
+ local tool
+ tool=$(cd "$tool"; cd -)
+ sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/
+ sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/vm
+ )
+ }
rule_git_reset () {
(
cd "$tool"
- git checkout -f -B master origin
+ git checkout -f -B master remotes/master
git clean -f -d -x
)
}
-rule_chrooted () {
+rule_apt_get_install () { # SYNTAX: $package
+ sudo DEBIAN_FRONTEND=noninteractive apt-get install "$@"
+ }
+rule_dpkg_reconfigure () { # SYNTAX: $package
+ sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure "$@"
+ }
+
+rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ?
export LANG=C
export LC_CTYPE=C
. /etc/profile
}
-rule__etckeeper_init () {
- mk_reg mod=644 own=root:root /etc/etckeeper/etckeeper.conf <<-EOF
- VCS=git
- GIT_COMMIT_OPTIONS=""
- AVOID_DAILY_AUTOCOMMITS=1
- #AVOID_SPECIAL_FILE_WARNING=1
- AVOID_COMMIT_BEFORE_INSTALL=1
- HIGHLEVEL_PACKAGE_MANAGER=apt
- LOWLEVEL_PACKAGE_MANAGER=dpkg
- EOF
- }
-rule__locale_init () {
- mk_reg mod=644 own=root:root /etc/locale.gen <<-EOF
- fr_FR.UTF-8 UTF-8
- EOF
- sudo update-locale
- }
-rule__network_init () {
- mk_reg mod= own= /etc/hostname <<-EOF
- $vm
- EOF
- grep -q " $vm\$" /etc/hosts ||
- mk_reg mod= own= --append /etc/hosts <<-EOF
- 127.0.0.1 $vm_fqdn $vm
- EOF
- mk_reg mod= own= /etc/network/interfaces <<-EOF
- auto lo
- iface lo inet loopback
-
- auto eth0=grenode
- iface grenode inet static
- address $vm_ipv4
- gateway $vm_ipv4 # NOTE: proxy_arp sur la passerelle permet d'utiliser la même adresse
- network $vm_ipv4
- broadcast $vm_ipv4
- netmask 255.255.255.255
- #mtu 1300
- post-up ip address add $vm_ipv4/32 dev \$IFACE
- pre-down ip address delete $vm_ipv4/32 dev \$IFACE
+rule_apache2_configure () {
+ local -; set +f
+ rule apt_get_install \
+ apache2-mpm-itk \
+ libapache2-mod-php5
+ # VOIR: http://serverfault.com/questions/383526/how-do-i-select-which-apache-mpm-to-use/383634#383634
+ # VOIR: http://jkroon.blogs.uls.co.za/it/security/using-php-fpm-and-mod_proxy_fcgi-to-optimize-and-secure-lamp-servers
+ # NOTE: apache2-mpm-itk semble le plus sécurisé,
+ # car on est certain que tout est exécuté avec les uid/gid
+ # assignés au VirtualHost/Directory/Location
+ # néamoins il se peut qu'une combinaison du genre :
+ # apache2-mpm-{worker,event} + mod_proxy_fcgi + apache2-suexec-custom + php-fpm
+ # soit plus performante (threads et pas forks),
+ # cependant l'usage de suexec impose des forks il semble..
+ # et mod_proxy_fcgi n'apparaît que dans apache 2.4 ;
+ # donc pour l'instant : apache2-mpm-itk
+ rule www_configure
+ cat /dev/stdin "$tool"/etc/apache2/apache2.conf <<-EOF |
+ ServerName "$vm_fqdn"
EOF
+ sudo install -m 660 -o root -g root /dev/stdin \
+ /etc/apache2/apache2.conf
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/apache2/envvars \
+ /etc/apache2/envvars
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/apache2/httpd.conf \
+ /etc/apache2/httpd.conf
+ #sudo install -m 660 -o root -g root /dev/stdin \
+ # /etc/apache2/suexec/www-data <<-EOF
+ # /home
+ # pub/www/cgi
+ # EOF
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/apache2/ports.conf \
+ /etc/apache2/ports.conf
+ sudo a2enmod actions
+ sudo a2enmod headers
+ sudo a2enmod rewrite
+ sudo a2enmod ssl
+ sudo a2enmod userdir
+ local conf
+ sudo a2dissite "*"
+ sudo ln -fns \
+ /etc/apache2 \
+ /home/www/etc/apache2
+ for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf
+ do conf=${conf#"$tool"/etc/apache2/site.d/}
+ local port site
+ IFS=. read -r port site <<-EOF
+ ${conf%\/VirtualHost\.conf}
+ EOF
+ assert 'test "${site:+set}"'
+ assert 'test "${port:+set}"'
+ local site_user="$user.$port.$site"
+ local site_dir="$user.$port.$site"
+ case $port in
+ (443)
+ local hint="run vm_remote apache2_key_send before"
+ assert "sudo test -f /etc/apache2/site.d/\"$site_dir\"/x509/key.pem" hint
+ sudo install -d -m 770 -o "$user" -g "$user" \
+ /etc/apache2 \
+ /etc/apache2/site.d/"$site_dir" \
+ /etc/apache2/site.d/"$site_dir"/x509 \
+ /etc/apache2/site.d/"$site_dir"/x509/ca \
+ /etc/apache2/site.d/"$site_dir"/x509/empty \
+ /etc/apache2/site.d/"$site_dir"/x509/rvk \
+ /etc/apache2/site.d/"$site_dir"/x509/usr
+ sudo install -m 664 -o www -g www \
+ "$tool"/var/pub/x509/"$site"/crt.self-signed.pem \
+ /etc/apache2/site.d/"$site_dir"/x509/crt.self-signed.pem
+ #sudo install -m 664 -o "$user" -g "$user" \
+ # "$tool"/var/pub/x509/"$site"/rvk.pem \
+ # /etc/apache2/site.d/"$site_dir"/x509/rvk.pem
+ sudo install -m 664 -o www -g www \
+ "$tool"/var/pub/x509/"$site"/ca/crt.self-signed.pem \
+ /etc/apache2/site.d/"$site_dir"/x509/ca/crt.pem
+ sudo install -m 664 -o www -g www \
+ "$tool"/var/pub/x509/"$site"/crt.pem \
+ /etc/apache2/site.d/"$site_dir"/x509/crt.pem
+ ;;
+ esac
+ case $port in
+ (80)
+ cat <<-EOF
+
+ AssignUserID $site_user $site_user
+ CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site_dir/apache2/access/%Y-%m-%d.log 86400 60" Combined
+ #CustomLog "/dev/null" Combined
+ DocumentRoot /home/www/pub/$site_dir
+ ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site_dir/apache2/error/%Y-%m-%d.log 86400 60"
+ #ErrorLog "/dev/null"
+ ServerName $site
+ LogLevel Warn
+ $(cat "$tool"/etc/apache2/site.d/"$site_dir"/VirtualHost.conf)
+
+ EOF
+ ;;
+ (443)
+ cat <<-EOF
+
+
+ AssignUserID $site_user $site_user
+ BrowserMatch "MSIE [2-6]" ssl-unclean-shutdown nokeepalive downgrade-1.0 force-response-1.0
+ BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
+ CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site_dir/apache2/access/%Y-%m-%d.log 86400 60" Combined
+ #CustomLog "/dev/null" Combined
+ DocumentRoot /home/www/pub/$site_dir
+ ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site_dir/apache2/error/%Y-%m-%d.log 86400 60"
+ #ErrorLog "/dev/null"
+ LogLevel Warn
+ ServerName $site
+ SSLCACertificateFile /etc/apache2/site.d/$site_dir/x509/crt.self-signed.pem
+ SSLCACertificatePath /etc/apache2/site.d/$site_dir/x509/usr/
+ #SSLCARevocationFile /etc/apache2/site.d/$site_dir/x509/rvk.pem
+ SSLCADNRequestFile /etc/apache2/site.d/$site_dir/x509/crt.self-signed.pem
+ SSLCADNRequestPath /etc/apache2/site.d/$site_dir/x509/empty/
+ # NOTE: ne publie pas les certificats dâutilisateur-ice-s acceptés
+ SSLCARevocationPath /etc/apache2/site.d/$site_dir/x509/rvk/
+ SSLCertificateChainFile /etc/apache2/site.d/$site_dir/x509/ca/crt.pem
+ SSLCertificateFile /etc/apache2/site.d/$site_dir/x509/crt.pem
+ SSLCertificateKeyFile /etc/apache2/site.d/$site_dir/x509/key.pem
+ SSLCipherSuite AES+RSA+SHA256
+ SSLEngine On
+ SSLInsecureRenegotiation Off
+ SSLOptions +StrictRequire +OptRenegotiate +StdEnvVars
+ SSLProtocol -All +TLSv1
+ #SSLRenegBufferSize 262144
+ SSLSessionCacheTimeout 1200
+ SSLStrictSNIVHostCheck On
+ SSLUserName SSL_CLIENT_S_DN_CN
+ SSLVerifyClient None
+ SSLVerifyDepth 1
+ $(cat "$tool"/etc/apache2/site.d/"$site_dir"/VirtualHost.conf)
+
+
+ EOF
+ ;;
+ esac |
+ sudo install -m 660 -o root -g root /dev/stdin \
+ /etc/apache2/site.d/"$site_dir"/VirtualHost.conf
+ sudo ln -fns \
+ ../site.d/"$site_dir"/VirtualHost.conf \
+ /etc/apache2/sites-available/"$site_dir"
+ sudo install -d -m 770 -o "$user" -g "$user" \
+ /home/www/log/"$site_dir" \
+ /home/www/log/"$site_dir"/apache2
+ sudo ln -fns \
+ /etc/apache2/site.d/"$site_dir" \
+ /home/www/etc/apache2/"$site_dir"
+ test -e /home/www/pub/"$site_dir" ||
+ sudo install -d -m 770 -o "$user" -g "$user" \
+ /home/www/pub/"$site_dir"
+ getent passwd "$site_user" >/dev/null ||
+ sudo adduser \
+ --disabled-password \
+ --group \
+ --no-create-home \
+ --home /home/www/pub/"$site_dir" \
+ --shell /bin/false \
+ --system \
+ "$site_user"
+ sudo setfacl -m u:"$site_user":--x \
+ /home/www/ \
+ /home/www/pub/ \
+ /home/www/pub/"$site_dir"/
+ sudo setfacl -m d:u:"$site_user":rwx \
+ "$home"/pub/www/"$site_dir"/
+ test ! -r "$tool"/etc/apache2/site.d/"$site_dir"/configure.sh ||
+ . "$tool"/etc/apache2/site.d/"$site_dir"/configure.sh
+ test -e /etc/apache2/sites-enabled/"$site_dir" ||
+ sudo a2ensite "$site_dir"
+ done
+ sudo service apache2 restart
}
-rule__apt_init () {
- mk_reg mod= own= /etc/apt/sources.list <<-EOF
+rule_apt_configure () {
+ sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF
deb http://ftp.fr.debian.org/debian $vm_lsb_name main contrib non-free
EOF
- mk_reg mod= own= /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF
+ sudo install -m 660 -o root -g root /dev/stdin /etc/apt/$vm_lsb_name-backports.list <<-EOF
#deb http://backports.debian.org/debian-backports $vm_lsb_name-backports main contrib non-free
EOF
- mk_reg mod= own= /etc/apt/preferences <<-EOF
+ sudo install -m 660 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF
Package: *
Pin: release a=$vm_lsb_name
Pin-Priority: 170
@@ -90,44 +249,259 @@ rule__apt_init () {
Pin: release a=$vm_lsb_name-backports
Pin-Priority: 200
EOF
- mk_reg mod= own= /etc/apt/sources.list.d/openerp.list <<-EOF
+ sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF
deb http://nightly.openerp.com/trunk/nightly/deb/ ./
EOF
+ sudo apt-get update
+ rule apt_get_install apticron
+ sudo install -m 644 -o root -g root /dev/stdin /etc/apticron/apticron.conf <<-EOF
+ EMAIL="admin@$vm_domainname"
+ # DIFF_ONLY="1"
+ # LISTCHANGES_PROFILE="apticron"
+ # ALL_FQDNS="1"
+ # SYSTEM="foobar.example.com"
+ # IPADDRESSNUM="1"
+ # IPADDRESSES="192.0.2.1 2001:db8:1:2:3::1"
+ # NOTIFY_HOLDS="0"
+ # NOTIFY_NEW="0"
+ # NOTIFY_NO_UPDATES="0"
+ # CUSTOM_SUBJECT=""
+ # CUSTOM_NO_UPDATES_SUBJECT=""
+ # CUSTOM_FROM="root@$vm_fqdn"
+ EOF
+ }
+rule_boot_configure () {
+ #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
+ sudo debconf-set-selections <<-EOF
+ grub-pc grub-pc/install_devices multiselect
+ EOF
+ rule apt_get_install grub-pc
+ sudo install -d -m 644 -o root -g root /boot/grub
+ rule apt_get_install linux-image-$vm_arch
+ sudo install -m 644 -o root -g root /dev/stdin /etc/default/grub <<-EOF
+ GRUB_DEFAULT=0
+ GRUB_TIMEOUT=5
+ GRUB_DISTRIBUTOR=\`lsb_release -i -s 2> /dev/null || echo Debian\`
+ GRUB_CMDLINE_LINUX_DEFAULT="quiet"
+ GRUB_CMDLINE_LINUX="vt.default_utf8=1 rootfstype=ext4 loglevel=5 console=hvc0 ip=$vm_ipv4::$vm_ipv4:255.255.255.254:$vm:eth0:off resume=/dev/mapper/${vm}_swap_deciphered"
+ GRUB_DISABLE_RECOVERY="true"
+ #GRUB_PRELOAD_MODULES="lvm"
+ EOF
+ sudo install -m 644 -o root -g root /dev/stdin /boot/grub/device.map <<-EOF
+ (hd0) /dev/xvda
+ (hd0) /dev/mapper/domU-$(printf %s $vm_fqdn-disk | sed -e 's/-/--/g')
+ EOF
+ sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map
+ rule initramfs_configure
+ rule apt_get_install molly-guard
+ sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF
+ ALWAYS_QUERY_HOSTNAME=true
+ # NOTE: une alternative est de dire à sudo de conserver les SSH_*
+ # néamoins demander tout le temps n'est pas trop contraignant
+ # et davantage sécurisant.
+ EOF
+ }
+rule_dovecot_configure () {
+ rule apt_get_install dovecot-imapd dovecot-managesieved dovecot-sieve
+ local hint="run vm_remote dovecot_key_send before"
+ assert "sudo test -f /etc/dovecot/\"$vm_domainname\"/imap/x509/key.pem" hint
+ sudo install -m 400 -o root -g root \
+ "$tool"/var/pub/x509/$vm_domainname/imap/crt+crl.self-signed.pem \
+ /etc/dovecot/$vm_domainname/imap/x509/crt+crl.self-signed.pem
+ sudo install -d -m 770 -o root -g adm \
+ /etc/skel/etc/mail \
+ /etc/skel/etc/sieve
+ sudo install -d -m 1777 -o root -g root \
+ /var/lib/dovecot-control \
+ /var/lib/dovecot-index
+ sudo install -m 664 -o root -g root /dev/stdin /etc/dovecot/local.conf <<-EOF
+ auth_ssl_username_from_cert = yes
+ listen = *
+ log_timestamp = "%Y-%m-%d %H:%M:%S "
+ mail_debug = yes
+ mail_location = maildir:~/var/mail:INDEX=/var/lib/dovecot-index/%u:CONTROL=/var/lib/dovecot-control/%u
+ # NOTE: INDEX et CONTROL sont sur une partition sans quota comme le demande la doc
+ # VOIR: http://wiki2.dovecot.org/Quota/FS
+ mail_plugins = \$mail_plugins quota
+ mail_privileged_group = mail
+ passdb {
+ args = /home/%u/etc/dovecot/passwd
+ driver = passwd-file
+ }
+ plugin {
+ quota = fs:user
+ recipient_delimiter = +
+ sieve = ~/etc/mail/filter.sieve
+ sieve_dir = ~/etc/mail/sieve
+ sieve_global_dir = /var/lib/dovecot/sieve/global/
+ sieve_max_script_size = 1M
+ sieve_quota_max_scripts = 0
+ sieve_quota_max_storage = 10M
+ sieve_user_log = ~/var/log/mail/sieve.log
+ }
+ protocol imap {
+ mail_plugins = \$mail_plugins imap_quota
+ }
+ protocol lda {
+ auth_socket_path = /var/run/dovecot/auth-master
+ hostname = $vm_domainname
+ info_log_path =
+ log_path =
+ mail_plugins = \$mail_plugins sieve
+ postmaster_address = contact+dovecot+lda@$vm_domainname
+ syslog_facility = mail
+ }
+ protocols = imap sieve
+ service auth {
+ user = root
+ unix_listener /var/spool/postfix/private/auth {
+ mode = 0660
+ user = postfix
+ group = postfix
+ }
+ }
+ ssl_ca =
LABEL=${vm_lvm_lv}_boot /boot ext2 defaults 0 0
proc /proc proc defaults 0 0
sysfs /sys sysfs defaults 0 0
- tmpfs /tmp tmpfs rw,nosuid,nodev,auto,size=200m,nr_inodes=1000k,mode=1777,noatime,nodiratime 0 0
- /dev/mapper/${vm_lvm_lv}_root_deciphered / ext4 defaults,errors=remount-ro,acl,noatime 0 1
- /dev/mapper/${vm_lvm_lv}_var_deciphered /var ext4 defaults,errors=remount-ro,acl,noatime 0 1
- /dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,noatime,usrquota,grpquota 0 0
+ /dev/mapper/${vm_lvm_lv}_root_deciphered / ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1
+ /dev/mapper/${vm_lvm_lv}_var_deciphered /var ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1
+ /dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,barrier=1,noatime,usrquota,grpquota 0 0
+ # NOTE: barrier=1 réduit drastiquement les performances d'écriture, mais garantit la cohérence du système de fichiers.
/dev/mapper/${vm_lvm_lv}_swap_deciphered swap swap sw 0 0
EOF
- mk_reg mod=644 own=root:root /etc/crypttab <<-EOF
+ sudo install -m 644 -o root -g root /dev/stdin /etc/crypttab <<-EOF
#
${vm_lvm_lv}_root_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_root none luks,lvm=$vm_lvm_vg
${vm_lvm_lv}_var_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_var ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived
${vm_lvm_lv}_home_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_home ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived
${vm_lvm_lv}_swap_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_swap ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived
EOF
- mk_reg mod=644 own=root:root /etc/sysctl.d/local-swap.conf <<-EOF
- vm.swappiness = 10 # NOTE: n'utilise le swap qu'en cas d'absolue nécessité
- vm.vfs_cache_pressure=50
+ sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF
+ LOCK_SIZE=5242880 # NOTE: 5MiB
+ RAMLOCK=yes
+ RAMSHM=yes
+ RAMTMP=yes
+ RUN_SIZE=10%
+ SHM_SIZE=
+ TMP_MODE=1777,nr_inodes=1000k,noatime
+ TMP_OVERFLOW_LIMIT=1024
+ # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB)
+ # on the root filesystem (overriding RAMTMP).
+ TMP_SIZE=200m
+ TMPFS_SIZE=20%VM
EOF
+ sudo install -m 775 -o root -g root \
+ "$tool"/etc/init.d/tmpfs \
+ /etc/init.d/tmpfs
+ sudo update-rc.d tmpfs defaults
}
-rule__login_init () {
- grep -q hvc0 /etc/securetty ||
- mk_reg mod= own= --append /etc/securetty <<-EOF
- hvc0
+rule_initramfs_configure () {
+ sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF
+ MODULES=most
+ BUSYBOX=y
+ KEYMAP=y
+ COMPRESS=gzip
+ DEVICE=eth0
EOF
- grep -q xvc0 /etc/securetty ||
- mk_reg mod= own= --append /etc/securetty <<-EOF
- xvc0
+ sudo install -m 644 -o root -g root /dev/stdin /etc/modprobe.d/xen-pv.conf <<-EOF
+ alias eth0 xennet
+ alias scsi_hostadapter xenblk
+ EOF
+ sudo install -m 644 -o root -g root /dev/stdin /etc/modules <<-EOF
+ sha1_generic
+ sha256_generic
+ sha512_generic
+ aes-x86_64
+ xts
+ # NOTE: pour Xen en mode HVM :
+ #modprobe xen-platform-pci
+ EOF
+ sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/modules <<-EOF
+ EOF
+ sudo sed -e '/^configure_networking /s/ &$//' \
+ -i /usr/share/initramfs-tools/scripts/init-premount/dropbear
+ # NOTE: corrige une vermine : dropbear doit attendre que le réseau soit configuré..
+ ssh-keygen -F "init.$vm_fqdn" -f "$tool"/etc/openssh/known_hosts |
+ ( while IFS= read -r line
+ do case $line in (*" RSA") return 0; break;; esac
+ done; return 1 ) ||
+ {
+ sudo rm -f \
+ /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key \
+ /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key.pub
+ sudo dropbearkey -t rsa -s 4096 -f \
+ /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key
+ }
+ # NOTE: ne se préoccupe pas de dropbear_dss_host_key ; Debian la génère et l'utilise néamoins.
+ sudo install -d -m 640 -o root -g root \
+ /etc/initramfs-tools/root \
+ /etc/initramfs-tools/root/.ssh
+ getent group sudo |
+ while IFS=: read -r group x x users
+ do while test -n "$users" && IFS=, read -r user users <<-EOF
+ $users
+ EOF
+ do eval local home\; home="~$user"
+ cat "$home"/etc/ssh/authorized_keys
+ done
+ done |
+ sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/root/.ssh/authorized_keys
+ sudo rm -f \
+ /etc/initramfs-tools/root/.ssh/id_rsa.dropbear \
+ /etc/initramfs-tools/root/.ssh/id_rsa.pub \
+ /etc/initramfs-tools/root/.ssh/id_rsa
+ # NOTE: clefs générées par Debian
+ sudo update-initramfs -u
+ }
+rule_locale_configure () {
+ sudo debconf-set-selections <<-EOF
+ locales locales/default_environment_locale select None
+ locales locales/locales_to_be_generated multiselect fr_FR.UTF-8 UTF-8
EOF
- mk_reg mod=644 own=root:root /etc/inittab <<-EOF
+ rule dpkg_reconfigure locales
+ }
+rule_login_configure () {
+ sudo install -m 644 -o root -g root /dev/stdin /etc/inittab <<-EOF
# /etc/inittab: init(8) configuration.
# The default runlevel.
@@ -170,7 +544,7 @@ rule__login_init () {
hvc:2345:respawn:/sbin/getty 38400 hvc0
#xvc:2345:respawn:/sbin/getty 38400 xvc0
EOF
- mk_reg mod=644 own=root:root /etc/login.defs <<-EOF
+ sudo install -m 644 -o root -g root /dev/stdin /etc/login.defs <<-EOF
MAIL_DIR /var/mail
FAILLOG_ENAB yes
LOG_UNKFAIL_ENAB no
@@ -208,164 +582,404 @@ rule__login_init () {
ENCRYPT_METHOD SHA512
EOF
grep -q '^session optional pam_umask.so\>' /etc/pam.d/common-session ||
- mk_reg mod= own= --append /etc/pam.d/common-session <<-EOF
+ sudo install -m 644 -o root -g root /dev/stdin /etc/pam.d/common-session <<-EOF
+ $(cat /etc/pam.d/common-session)
session optional pam_umask.so
EOF
+ grep -q '^hvc0$' /etc/securetty ||
+ sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
+ $(cat /etc/securetty)
+ hvc0
+ EOF
+ grep -q '^xvc0$' /etc/securetty ||
+ sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
+ $(cat /etc/securetty)
+ xvc0
+ EOF
}
-rule__user_root_init () {
- mk_dir mod=750 own=root:root /root/etc
- mk_dir mod=750 own=root:root /root/etc/ssh
- mk_dir mod=750 own=root:root /root/etc/gpg
- mk_lnk etc/gpg /root/.gnupg
- mk_lnk etc/ssh /root/.ssh
- getent group sudo |
- while test -n "$users" && IFS=: read -r group x x users
- do while IFS=, read -r user users <<-EOF
- $users
- EOF
- do eval local home\; home="~$user"
- cat "$home"/etc/ssh/authorized_keys
- done
- done |
- mk_reg mod=640 own=root:root /root/etc/ssh/authorized_keys
- local key
- for key in "$tool"/var/pub/openpgp/*.key
- do sudo gpg --import "$key"
- done
+rule_mail_configure () {
+ rule postfix_configure
+ rule postgrey_configure
+ rule procmail_configure
+ rule dovecot_configure
}
-rule__initramfs_init () {
- mk_reg mod=644 own=root:root /etc/initramfs-tools/initramfs.conf <<-EOF
- MODULES=most
- BUSYBOX=y
- KEYMAP=y
- COMPRESS=gzip
- DEVICE=eth0
- EOF
- mk_reg mod=644 own=root:root /etc/modprobe.d/xen-pv.conf <<-EOF
- alias eth0 xennet
- alias scsi_hostadapter xenblk
+rule_network_configure () {
+ sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF
+ $vm
EOF
- mk_reg mod=644 own=root:root /etc/modules <<-EOF
- sha1_generic
- sha256_generic
- sha512_generic
- aes-x86_64
- xts
- # NOTE: pour Xen en mode HVM :
- #modprobe xen-platform-pci
+ grep -q " $vm\$" /etc/hosts ||
+ sudo install -m 644 -o root -g root /dev/stdin /etc/hosts <<-EOF
+ $(cat /etc/hosts)
+ 127.0.0.1 $vm_fqdn $vm
EOF
- mk_reg mod=644 own=root:root /etc/initramfs-tools/modules <<-EOF
+ sudo install -m 644 -o root -g root /dev/stdin /etc/network/interfaces <<-EOF
+ auto lo
+ iface lo inet loopback
+
+ auto eth0=grenode
+ iface grenode inet static
+ address $vm_ipv4
+ gateway $vm_ipv4 # NOTE: proxy_arp sur la passerelle permet d'utiliser la même adresse
+ network $vm_ipv4
+ broadcast $vm_ipv4
+ netmask 255.255.255.255
+ mtu 1300
+ # NOTE: il y a besoin de ça en l'état actuel du réseau de Grenode
+ # car la MTU des tunnels GRE/IPsec entre les routeurs de Grenode l'impose.
+ #
+ # root@ateliers:~# ping -M do -c 1 -s \$((1500-20-8-200)) soupirail.grenode.net
+ # PING soupirail.grenode.net (91.216.110.1) 1272(1300) bytes of data.
+ # 1280 bytes from soupirail.grenode.net (91.216.110.1): icmp_req=1 ttl=63 time=18.0 ms
+ #
+ # --- soupirail.grenode.net ping statistics ---
+ # 1 packets transmitted, 1 received, 0% packet loss, time 0ms
+ # rtt min/avg/max/mdev = 18.027/18.027/18.027/0.000 ms
+ # root@ateliers:~# ping -M do -c 1 -s \$((1500-20-8-200+1)) soupirail.grenode.net
+ # PING soupirail.grenode.net (91.216.110.1) 1273(1301) bytes of data.
+ # From estran.grenode.net (91.216.110.6) icmp_seq=1 Frag needed and DF set (mtu = 1300)
+ #
+ # --- soupirail.grenode.net ping statistics ---
+ # 0 packets transmitted, 0 received, +1 errors
+ post-up ip address add $vm_ipv4/32 dev \$IFACE
+ pre-down ip address delete $vm_ipv4/32 dev \$IFACE
EOF
- sudo sed -e '/^configure_networking /s/ &$//' \
- -i /usr/share/initramfs-tools/scripts/init-premount/dropbear
- # NOTE: corrige une vermine : dropbear doit attendre que le réseau soit configuré..
- sudo rm -f \
- /etc/initramfs-tools/etc/dropbear/dropbear_dss_host_key \
- /etc/initramfs-tools/etc/dropbear/dropbear_dss_host_key.pub \
- /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key \
- /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key.pub
- ssh-keygen -F "init.$vm_fqdn" -f "$tool"/etc/openssh/known_hosts |
- ( while IFS= read -r line
- do case $line in (*" RSA") return 0; break;; esac
- done; return 1 ) ||
- sudo dropbearkey -t rsa -s 4096 -f \
- /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key
- ssh-keygen -F "init.$vm_fqdn" -f "$tool"/etc/openssh/known_hosts |
- ( while IFS= read -r line
- do case $line in (*" DSA") return 0; break;; esac
- done; return 1 ) ||
- sudo dropbearkey -t dss -s 1024 -f \
- /etc/initramfs-tools/etc/dropbear/dropbear_dss_host_key
- mk_dir mod=640 own=root:root \
- /etc/initramfs-tools/root \
- /etc/initramfs-tools/root/.ssh
- getent group sudo |
- while IFS=: read -r group x x users
- do while test -n "$users" && IFS=, read -r user users <<-EOF
- $users
+ }
+rule_www_configure () {
+ getent passwd www >/dev/null ||
+ sudo adduser \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/www \
+ --shell /bin/false \
+ --system \
+ www
+ sudo adduser \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home ~www/log \
+ --shell /bin/false \
+ --system \
+ log.www
+ #sudo adduser www www-data
+ sudo adduser www log.www
+ #sudo adduser log log.www
+ usermod --home /home/www/pub www-data
+ sudo install -d -m 751 -o www -g www \
+ /home/www
+ sudo install -d -m 750 -o www -g www \
+ /home/www/etc
+ sudo install -d -m 1771 -o www-data -g www-data \
+ /home/www/pub \
+ sudo install -d -m 1771 -o log.www -g log.www \
+ /home/www/log
+ }
+rule_nginx_configure () {
+ local -; set +f
+ rule apt_get_install nginx
+ rule www_configure
+ sudo rm -rf \
+ /etc/nginx/conf.d \
+ /etc/nginx/site.d
+ sudo install -d -m 770 -o www -g www \
+ /etc/nginx \
+ /etc/nginx/conf.d \
+ /etc/nginx/site.d
+ sudo ln -fns \
+ /etc/nginx \
+ /home/www/etc/nginx
+ sudo install -m 660 -o www -g www \
+ "$tool"/etc/nginx/nginx.conf \
+ /etc/nginx/nginx.conf
+ local conf
+ for conf in "$tool"/etc/nginx/conf.d/*.conf
+ do conf=${conf#"$tool"/etc/nginx/conf.d/}
+ sudo install -m 660 -o www -g www \
+ "$tool"/etc/nginx/conf.d/"$conf" \
+ /etc/nginx/conf.d/"$conf"
+ done
+ for conf in "$tool"/etc/nginx/site.d/*/server.conf
+ do conf=${conf#"$tool"/etc/nginx/site.d/}
+ local port site
+ IFS=. read -r port site <<-EOF
+ ${conf%\/server\.conf}
EOF
- do eval local home\; home="~$user"
- cat "$home"/etc/ssh/authorized_keys
- done
- done |
- mk_reg mod=644 own=root:root /etc/initramfs-tools/root/.ssh/authorized_keys
- sudo rm -f \
- /etc/initramfs-tools/root/.ssh/id_rsa.dropbear \
- /etc/initramfs-tools/root/.ssh/id_rsa.pub \
- /etc/initramfs-tools/root/.ssh/id_rsa
- # NOTE: clefs générées par Debian
- sudo update-initramfs -u
+ assert 'test "${port:+set}"'
+ assert 'test "${site:+set}"'
+ site="$port.$site"
+ getent passwd www."$site" >/dev/null ||
+ sudo adduser \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home ~www-data/"$site" \
+ --shell /bin/false \
+ --system \
+ www."$site"
+ getent passwd log."$site" >/dev/null ||
+ sudo adduser \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --shell /bin/false \
+ --system \
+ log."$site"
+ sudo usermod --home ~www/log/"$site"/nginx log."$site"
+ sudo install -d -m 770 -o www -g www \
+ /etc/nginx/site.d/"$site"
+ case $port in
+ (443)
+ local hint="run vm_remote nginx_key_send before"
+ assert "sudo test -f /etc/nginx/\"$site\"/x509/key.pem" hint
+ sudo install -m 664 -o www -g www \
+ "$tool"/var/pub/x509/"$site"/crt+ca.pem \
+ /etc/nginx/site.d/"$site"/x509/crt.pem
+ ;;
+ esac
+ case $port in
+ (80)
+ cat <<-EOF
+ server {
+ listen $port;
+ access_log /home/www/log/$site/nginx/access.log main;
+ error_log /home/www/log/$site/nginx/error.log warn;
+ root /home/www/pub/$site;
+ server_name $site;
+ $(cat "$tool"/etc/nginx/site.d/"$site"/server.conf)
+ }
+ EOF
+ ;;
+ (443)
+ cat <<-EOF
+ server {
+ listen $port;
+ access_log /home/www/log/$site/nginx/access.log main;
+ error_log /home/www/log/$site/nginx/error.log warn;
+ keepalive_timeout 70;
+ root /home/www/pub/$site;
+ server_name $site;
+ # DOC: http://wiki.nginx.org/HttpSslModule
+ ssl on;
+ ssl_certificate /home/www/etc/nginx/site.d/$site/x509/crt.pem;
+ ssl_certificate_key /home/www/etc/nginx/site.d/$site/x509/key.pem;
+ ssl_ciphers HIGH:!ADH:!MD5;
+ ssl_prefer_server_ciphers on;
+ ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ ssl_session_cache shared:SSL:10m;
+ $(cat "$tool"/etc/nginx/site.d/"$site"/server.conf)
+ }
+ EOF
+ ;;
+ esac |
+ sudo install -m 660 -o www -g www /dev/stdin \
+ /etc/nginx/site.d/"$site"/server.conf
+ adduser www-data "$site"
+ test -e /home/www/pub/"$site" ||
+ sudo install -d -m 3770 -o "$site" -g "$site" \
+ /home/www/pub/"$site"
+ sudo install -d -m 3770 -o log."$site" -g log."$site" \
+ /home/www/log/"$site"/nginx
+ test ! -r "$tool"/etc/nginx/site.d/"$site"/configure.sh ||
+ . "$tool"/etc/nginx/site.d/"$site"/configure.sh
+ done
+ rule apt_get_install spawn-fcgi fcgiwrap
+ sudo insserv --remove fcgiwrap
+ rule tmpfs_configure
+ sudo service nginx restart
}
-rule__boot_init () {
- sudo apt-get install --reinstall grub-pc # XXX: attention à n'installer GRUB sur AUCUN disque proposé !
- mk_dir mod=644 own=root:root /boot/grub
- sudo apt-get install --reinstall linux-image-$vm_arch
- mk_reg mod=644 own=root:root /etc/default/grub <<-EOF
- GRUB_DEFAULT=0
- GRUB_TIMEOUT=5
- GRUB_DISTRIBUTOR=\`lsb_release -i -s 2> /dev/null || echo Debian\`
- GRUB_CMDLINE_LINUX_DEFAULT="quiet"
- GRUB_CMDLINE_LINUX="vt.default_utf8=1 rootfstype=ext4 loglevel=5 console=hvc0 ip=$vm_ipv4::$vm_ipv4:255.255.255.254:$vm:eth0:off resume=/dev/mapper/${vm}_swap_deciphered"
- GRUB_DISABLE_RECOVERY="true"
- #GRUB_PRELOAD_MODULES="lvm"
+rule_php5_fpm_configure () {
+ local -; set +f
+ rule apt_get_install \
+ php5-fpm \
+ php-apc
+ getent passwd php5 >/dev/null ||
+ sudo adduser \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --shell /bin/false \
+ --system \
+ php5
+ local conf
+ sudo ln -fns \
+ /etc/php5-fpm \
+ /home/www/etc/php5
+ sudo rm -f /etc/php5/fpm/pool.d/*
+ for conf in "$tool"/etc/php5/fpm/pool.d/*.conf
+ do conf=${conf#"$tool"/etc/php5/fpm/pool.d/}
+ local port site
+ IFS=. read -r port site <<-EOF
+ ${conf%\.conf}
+ EOF
+ assert 'test "${port:+set}"'
+ assert 'test "${site:+set}"'
+ site="$port.$site"
+ getent passwd php5"$site" >/dev/null ||
+ sudo adduser \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --no-create-home \
+ --home ~www/pub/"$site" \
+ --shell /bin/false \
+ --system \
+ php5."$site"
+ sudo install -d -m 770 -o php5 -g php5 \
+ /home/www/log/php5 \
+ /home/www/log/php5/fpm
+ sudo install -d -m 770 -o log."$site" -g log."$site" \
+ /home/www/log/"$site"
+ sudo adduser php5."$user" www."$site"
+ sudo install -m 660 -o root -g root /dev/stdin \
+ /etc/php5/fpm/pool.d/"$conf" <<-EOF
+ [php5.$site]
+ access.log = /home/www/log/$site/php5/fpm/access.log
+ catch_workers_output = yes
+ chdir = /
+ env[HOSTNAME] = \$HOSTNAME
+ env[TEMP] = /tmp
+ env[TMPDIR] = /tmp
+ env[TMP] = /tmp
+ group = www-data
+ listen = /run/nginx/fastcgi/php5.$site
+ #listen = 127.0.0.1:9000
+ #listen.allowed_clients = 127.0.0.1
+ listen.backlog = -1
+ pm = dynamic
+ pm.max_children = 5
+ pm.max_requests = 200
+ pm.max_spare_servers = 4
+ pm.min_spare_servers = 2
+ pm.start_servers = 3
+ pm.status_path = /status
+ request_slowlog_timeout = 5s
+ request_terminate_timeout = 120s
+ rlimit_core = unlimited
+ rlimit_files = 131072
+ slowlog = /home/www/log/$site/php5/fpm/slow.log
+ user = $php5_user
+ $(cat "$tool"/etc/php5/fpm/pool.d/"$conf")
+ EOF
+ sudo install -m 664 -o root -g root \
+ "$tool"/etc/php5/fpm/php.ini \
+ /etc/php5/fpm/php.ini
+ done
+ rule tmpfs_configure
+ sudo service php5-fpm restart
+ }
+rule_postfix_configure () {
+ local hint="run vm_remote postfix_key_send before"
+ assert "test -f /etc/postfix/$vm_domainname/smtpd/x509/key.pem" hint
+ #warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix"
+ sudo debconf-set-selections <<-EOF
+ postfix postfix/main_mailer_type select No configuration
EOF
- mk_reg mod=644 own=root:root /boot/grub/device.map <<-EOF
- (hd0) /dev/xvda
- (hd0) /dev/mapper/domU-$(printf %s $vm_fqdn-disk | sed -e 's/-/--/g')
+ rule apt_get_install postfix
+ sudo install -m 640 -o root -g root /dev/stdin /etc/postfix/.gitignore <<-EOF
+ *.db
EOF
- sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map
- rule__initramfs_init
- }
-rule_apticron_init () {
- sudo apt-get install --reinstall apticron
- mk_reg mod=644 own=root:root /etc/default/grub <<-EOF
- EMAIL="admin@heureux-cyclage.org"
- # DIFF_ONLY="1"
- # LISTCHANGES_PROFILE="apticron"
- # ALL_FQDNS="1"
- # SYSTEM="foobar.example.com"
- # IPADDRESSNUM="1"
- # IPADDRESSES="192.0.2.1 2001:db8:1:2:3::1"
- # NOTIFY_HOLDS="0"
- # NOTIFY_NEW="0"
- # NOTIFY_NO_UPDATES="0"
- # CUSTOM_SUBJECT=""
- # CUSTOM_NO_UPDATES_SUBJECT=""
- # CUSTOM_FROM="root@ateliers.heureux-cyclage.org"
+ sudo install -d -m 770 -o root -g root \
+ /etc/postfix/$vm_domainname/ \
+ /etc/postfix/$vm_domainname/smtp \
+ /etc/postfix/$vm_domainname/smtp/x509 \
+ /etc/postfix/$vm_domainname/smtp/x509/ca \
+ /etc/postfix/$vm_domainname/smtpd \
+ /etc/postfix/$vm_domainname/smtpd/x509 \
+ /etc/postfix/$vm_domainname/smtpd/x509/ca
+ sudo install -d -m 770 -o root -g root \
+ /etc/postfix/$vm_domainname/ \
+ /etc/postfix/$vm_domainname/smtp \
+ /etc/postfix/$vm_domainname/smtp/x509 \
+ /etc/postfix/$vm_domainname/smtp/x509/ca \
+ /etc/postfix/$vm_domainname/smtpd \
+ /etc/postfix/$vm_domainname/smtpd/x509 \
+ /etc/postfix/$vm_domainname/smtpd/x509/ca
+ sudo ln -fns \
+ ../crt+crl.self-signed.pem \
+ /etc/postfix/$vm_domainname/smtpd/x509/ca/crt.pem
+ sudo install -m 400 -o root -g root \
+ "$tool"/var/pub/x509/$vm_domainname/smtpd/crt+crl.self-signed.pem \
+ /etc/postfix/$vm_domainname/smtpd/x509/crt+crl.self-signed.pem
+ sudo install -m 400 -o root -g root \
+ "$tool"/var/pub/x509/$vm_domainname/smtpd/crt.pem \
+ /etc/postfix/$vm_domainname/smtpd/x509/crt.pem
+ sudo install -m 400 -o root -g root \
+ "$tool"/var/pub/x509/$vm_domainname/smtpd/crt+ca.pem \
+ /etc/postfix/$vm_domainname/smtpd/x509/crt+ca.pem
+ sudo install -m 400 -o root -g root \
+ "$tool"/var/pub/x509/$vm_domainname/smtpd/crt+crl.self-signed.pem \
+ /etc/postfix/$vm_domainname/smtpd/x509/crt+crl.self-signed.pem
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/postfix/$vm_domainname/header_checks \
+ /etc/postfix/$vm_domainname/header_checks
+ sudo install -m 664 -o root -g root /dev/stdin \
+ /etc/postfix/aliases <<-EOF
+ # See man 5 aliases for format
+ abuse: root
+ admin: root
+ contact: root
+ postmaster: root
+ root: $(getent group sudo | cut -f 4 -d : | tr , ' ')
EOF
- sudo service apticron restart
- }
-rule__bin_init () {
- mk_lnk "$tool"/vm_hosted /usr/local/sbin/
+ sudo newaliases -oA/etc/postfix/aliases
+ cat /dev/stdin "$tool"/etc/postfix/main.cf <<-EOF |
+ mydomain = $vm_domainname
+ myorigin = \$mydomain
+ myhostname = $vm_hostname.\$mydomain
+ mail_name = \$myhostname
+ mydestination = $vm_hostname \$myhostname \$myorigin
+ EOF
+ sudo install -m 664 -o root -g root /dev/stdin \
+ /etc/postfix/main.cf
+ sudo install -m 664 -o root -g root \
+ "$tool"/etc/postfix/master.cf \
+ /etc/postfix/master.cf
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/postfix/$vm_domainname/smtp/x509/policy \
+ /etc/postfix/$vm_domainname/smtp/x509/policy
+ sudo postmap hash:/etc/postfix/$vm_domainname/smtp/x509/policy
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/postfix/$vm_domainname/smtp/header_checks \
+ /etc/postfix/$vm_domainname/smtp/header_checks
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/postfix/$vm_domainname/smtpd/sender_access \
+ /etc/postfix/$vm_domainname/smtpd/sender_access
+ sudo postmap hash:/etc/postfix/$vm_domainname/smtpd/sender_access
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/postfix/$vm_domainname/smtpd/client_blacklist \
+ /etc/postfix/$vm_domainname/smtpd/client_blacklist
+ sudo postmap hash:/etc/postfix/$vm_domainname/smtpd/client_blacklist
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/postfix/$vm_domainname/smtpd/relay_clientcerts \
+ /etc/postfix/$vm_domainname/smtpd/relay_clientcerts
+ sudo postmap hash:/etc/postfix/$vm_domainname/smtpd/relay_clientcerts
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/postfix/$vm_domainname/transport \
+ /etc/postfix/$vm_domainname/transport
+ sudo postmap hash:/etc/postfix/$vm_domainname/transport
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/postfix/$vm_domainname/virtual_alias \
+ /etc/postfix/$vm_domainname/virtual_alias
+ sudo postmap hash:/etc/postfix/$vm_domainname/virtual_alias
+ sudo service postfix restart
}
-rule_init () {
- rule__etckeeper_init
- rule__locale_init
- rule__network_init
- rule__apt_init
- rule__filesystem_init
- rule__login_init
- rule__user_root_init
- rule__boot_init
- rule__bin_init
+rule_postgrey_configure () {
+ rule apt_get_install postgrey
+ sudo service postgrey restart
}
-
-rule_disk_key_change () {
- sudo cryptsetup luksChangeKey /dev/$vm_lvm_vg/${vm_lvm_lv}_root
+rule_procmail_configure () {
+ rule apt_get_install procmail
+ sudo install -d -m 770 -o root -g adm \
+ /etc/skel/etc/mail \
+ /etc/skel/var/cache/mail \
+ /etc/skel/var/log/mail \
+ /etc/skel/var/mail
+ sudo install -m 660 -o root -g adm \
+ "$tool"/etc/skel/etc/mail/delivery.procmailrc \
+ /etc/skel/etc/mail/delivery.procmailrc
}
-
-rule_user_init () {
- mk_dir mod=750 own="root:adm" /etc/skel/etc
- mk_dir mod=770 own="root:adm" /etc/skel/etc/apache2
- mk_dir mod=770 own="root:adm" /etc/skel/etc/ssh
- mk_dir mod=700 own="root:adm" /etc/skel/var
- mk_dir mod=700 own="root:adm" /etc/skel/var/log
- mk_dir mod=700 own="root:adm" /etc/skel/var/cache
- mk_dir mod=700 own="root:adm" /etc/skel/var/cache/ssh
- mk_dir mod=700 own="root:adm" /etc/skel/tmp
- mk_dir mod=700 own="root:adm" /etc/skel/tmp
- mk_lnk etc/ssh /etc/skel/.ssh
- mk_lnk etc/gpg /etc/skel/.gnupg
+rule_ssh_configure () {
ssh-keygen -F "$vm_fqdn" -f "$tool"/etc/openssh/known_hosts |
( while IFS= read -r line
do case $line in (*" RSA") return 0; break;; esac
@@ -377,7 +991,7 @@ rule_user_init () {
/etc/ssh/ssh_host_ecdsa_key \
/etc/ssh/ssh_host_ecdsa_key.pub
# NOTE: clefs générées par Debian
- mk_reg mod=664 own=root:root /etc/ssh/sshd_config <<-EOF
+ sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/sshd_config <<-EOF
Port 22
ListenAddress $vm_ipv4
#ListenAddress ::
@@ -416,15 +1030,90 @@ rule_user_init () {
UsePAM yes
EOF
sudo service ssh restart
- mk_reg mod=440 own=root:root /etc/sudoers.d/passwd-init <<-EOF
+ }
+rule_sysctl_configure () {
+ local -; set +f
+ for conf in "$tool"/etc/sysctl.d/*.conf
+ do conf=${conf#"$tool"/etc/sysctl.d/}
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/sysctl.d/"$conf" \
+ /etc/sysctl.d/"$conf"
+ done
+ sudo sysctl --system
+ }
+rule_time_configure () {
+ sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF
+ Europe/Paris
+ EOF
+ sudo debconf-set-selections <<-EOF
+ tzdata tzdata/Areas select Europe
+ tzdata tzdata/Zones/Europe select Paris
+ EOF
+ rule dpkg_reconfigure tzdata
+ rule apt_get_install ntp
+ }
+rule_user_add () { # SYNTAX: $user
+ rule user_configure
+ local user=$1
+ id "$user" >/dev/null ||
+ sudo adduser --disabled-password "$user"
+ # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init .
+ eval local home\; home="~$user"
+ sudo adduser "$user" users
+ sudo install -m 640 -o root -g root \
+ "$tool"/var/pub/ssh/"$user".key \
+ "$home"/etc/ssh/authorized_keys
+ local key; local -; set +f
+ for key in "$tool"/var/pub/openpgp/*.key
+ do sudo -u "$user" gpg --import - <"$key"
+ done
+ }
+rule_user_configure () {
+ true
+ }
+rule_user_admin_add () { # SYNTAX: $user
+ rule user_configure
+ local user=$1
+ id "$user" >/dev/null ||
+ sudo adduser --disabled-password "$user"
+ eval local home\; home="~$user"
+ sudo adduser "$user" sudo
+ sudo adduser "$user" users
+ sudo install -m 640 -o root -g root \
+ "$tool"/var/pub/ssh/"$user".key \
+ "$home"/etc/ssh/authorized_keys
+ local key; local -; set +f
+ for key in "$tool"/var/pub/openpgp/*.key
+ do sudo -u "$user" gpg --import - <"$key"
+ done
+ rule user_admin_configure
+ }
+rule_user_admin_configure () {
+ rule initramfs_configure
+ rule user_root_configure
+ }
+rule_user_configure () {
+ sudo install -d -m 750 -o root -g adm \
+ /etc/skel/etc \
+ /etc/skel/etc/gpg \
+ /etc/skel/etc/ssh
+ sudo install -d -m 770 -o root -g adm \
+ /etc/skel/var \
+ /etc/skel/var/cache \
+ /etc/skel/var/log \
+ /etc/skel/var/run \
+ /etc/skel/var/run/ssh
+ sudo ln -fns etc/ssh /etc/skel/.ssh
+ sudo ln -fns etc/gpg /etc/skel/.gnupg
+ sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/passwd-init <<-EOF
%sudo ALL=(ALL) NOPASSWD: /bin/sh -e -f -u -c \\
case \$(/usr/bin/passwd --status "\$SUDO_USER") in \\
("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac
EOF
- mk_reg mod=440 own=root:root /etc/sudoers.d/etckeeper-unclean <<-EOF
+ sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF
%sudo ALL=(ALL) NOPASSWD: /usr/sbin/etckeeper unclean
EOF
- mk_reg mod=440 own=root:root /etc/sudoers.d/env_keep <<-EOF
+ sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF
Defaults env_keep = " \\
EDITOR \\
GIT_AUTHOR_NAME \\
@@ -433,391 +1122,63 @@ rule_user_init () {
GIT_COMMITTER_EMAIL \\
"
EOF
- mk_reg mod=555 own=root:root /usr/local/sbin/passwd-init <<-EOF
- #!/bin/sh
+ sudo install -m 755 -o root -g root /dev/stdin /usr/local/bin/passwd-init <<-EOF
+ #!/bin/sh -efu
+ # DESCRIPTION: permet à un-e utilisateurice d'initialiser ellui-même son mot-de-passe système.
sudo /bin/sh -e -f -u -c \
'case \$(/usr/bin/passwd --status "\$SUDO_USER") in ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac'
EOF
+ sudo install -m 644 -o root -g root \
+ "$tool"/etc/bash.bashrc \
+ /etc/bash.bashrc
+ sudo install -m 644 -o root -g root \
+ "$tool"/etc/screenrc \
+ /etc/screenrc
}
-rule_user_admin_add () { # SYNTAX: $user
- local user=$1
- id "$user" >/dev/null ||
- sudo adduser --disabled-password "$user"
- # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init .
- eval local home\; home="~$user"
- sudo adduser "$user" sudo
- mk_reg mod=640 own=$user:$user "$home"/etc/ssh/authorized_keys \
- <"$tool"/var/pub/ssh/"$user".key
- rule__initramfs_init
- rule__user_root_init
+rule_user_root_configure () {
+ sudo install -d -m 750 -o root -g adm \
+ /root/etc \
+ /root/etc/gpg \
+ /root/etc/ssh
+ sudo ln -fns etc/gpg /root/.gnupg
+ sudo ln -fns etc/ssh /root/.ssh
+ getent group sudo |
+ while IFS=: read -r group x x users
+ do while test -n "$users" && IFS=, read -r user users <<-EOF
+ $users
+ EOF
+ do eval local home\; home="~$user"
+ cat "$home"/etc/ssh/authorized_keys
+ done
+ done |
+ sudo install -m 640 -o root -g root /dev/stdin /root/etc/ssh/authorized_keys
local key; local -; set +f
for key in "$tool"/var/pub/openpgp/*.key
- do sudo -u "$user" gpg --import "$key"
+ do sudo gpg --import "$key"
done
}
-rule_user_mail_format () {
- mk_dir mod=770 own=root:adm /etc/skel/etc/procmail
- mk_dir mod=770 own=root:adm /etc/skel/var/mail
- mk_dir mod=770 own=root:adm /etc/skel/var/cache/procmail
- mk_reg mod=660 own=root:adm /etc/skel/etc/procmail/delivery.rc <<-EOF
- # vim: ft=procmail
-
- # NOTE: paramètres passés par postfix
- SENDER=\$1
- RECIPIENT=\$2
- USER=\$3
- EXTENSION=\$4
- DOMAIN=\$5
- ORIGINAL_RECIPIENT=\$6
-
- PATH="\$HOME/bin:/usr/local/bin:/usr/bin:/bin"
- MAILDIR="\$HOME/var/mail/"
- DEFAULT="\$MAILDIR"
- #LOGFILE=`cd="\$HOME/var/log/procmail/" d=\$(date +"%Y-%m-%d"); ln -fns "\$d.log" "\$cd/current.log"; printf %s "\$cd/\$d.log"`
- LOGFILE="/dev/null"
- LOGABSTRACT=all
- LOGABSTRACT
- VERBOSE
- SHELL=/bin/sh
- SHELLMETAS=&|<>~;?*%{}
-
- # DESCRIPTION: supprime les doublons en fonction du champ Message-Id
- #:0 Wh: "\$HOME/var/cache/procmail/msgid\$LOCKEXT"
- #| formail -D 8192 "\$HOME/var/cache/procmail/msgid"
-
- # DESCRIPTION: fait suivre à l'adresse configurée dans /etc/passwd ; on peut aussi utiliser ~/.forward
- EMAIL=`sed /etc/passwd -ne "/^\$USER:/s/[^:]*:[^:]*:[^:]*:[^:]*:[^,]*,[^,]*,[^,]*,[^,]*,\([^:]*\):.*/\1/p"`
- # NOTE: récupère lâadresse courriel dans le champ GECOS
- FROM_=`formail -c -x "From " | sed -e 's/^\s*\([^ \t]*\).*/\1/g'`
- # NOTE: récupère lâexpéditeur inscrit sur lâenveloppe
- :0
- | \$SENDMAIL -i -bm -f "\$FROM_" "\${EMAIL/@/\${EXTENSION:++\${EXTENSION}}@}"
-
- # DESCRIPTION: IMAP
- #:0
- #| /usr/lib/dovecot/deliver -f "\$SENDER" -a "\$RECIPIENT"
-
- # DESCRIPTION: UUCP
- #:0
- #| /usr/bin/uux \
- # -I "\$HOME/etc/uucp/uucp.cfg" \
- # --nouucico \
- # --notification=error \
- # --requestor "\$USER" \
- # - "\$USER!rmail" "(\$USER)"
- EOF
- mk_reg mod=664 own=root:root /etc/postfix/main.cf <<-EOF
- # /etc/postfix/main.cf
- # SEE: http://postfix.traduc.org/index.php/TLS_README.html
-
- parent_domain_matches_subdomains =
- #debug_peer_list
- #fast_flush_domains
- #mynetworks
- #permit_mx_backup_networks
- #qmqpd_authorized_clients
- #smtpd_access_maps
- mydomain = $vm_domainname
- myorigin = \$mydomain
- myhostname = $vm_hostname.\$mydomain
- mail_name = \$myhostname
- mydestination =
- $vm_hostname
- \$myhostname
- \$myorigin
- mynetworks =
- 127.0.0.0/8
- #[::1]/128
- inet_protocols = ipv4
- # "all" to activate IPv6
- inet_interfaces = all
- permit_mx_backup_networks =
-
- alias_database =
- hash:/etc/aliases
- # NOTE: fichier de hash contenant une table dâalias mail.
- # Celle-ci est éditable dans /etc/aliases, puis (indispensable)
- # regénérée en hash grâce à la commande newaliases qui produit /etc/aliases.db
- alias_maps =
- hash:/etc/aliases
- recipient_delimiter = +
- # NOTE: séparateur entre le nom dâutilisateur
- # et les extensions dâadresse (par défaut le signe +).
- #virtual_alias_domains =
- virtual_alias_maps =
- hash:/etc/postfix/\$mydomain/virtual
- # NOTE: do not specify virtual alias domain names in the main.cf
- # mydestination or relay_domains configuration parameters.
- #
- # With a virtual alias domain, the Postfix SMTP server
- # accepts mail for known-user@virtual-alias.domain, and
- # rejects mail for unknown-user@virtual-alias.domain as
- # undeliverable.
- #relayhost =
- relay_clientcerts =
- hash:/etc/postfix/\$mydomain/smtpd/tls/relay_clientcerts
- relay_domains =
- \$mydestination
- # NOTE: ajouter les domaines pour lesquels on est backup MX ici,
- # pas dans mydestination ou virtual_alias...
-
- maximal_queue_lifetime = 5d
-
- header_checks =
- regexp:/etc/postfix/\$mydomain/header_checks
- mime_header_checks =
- nested_header_checks =
- milter_header_checks =
- body_checks =
-
- #content_filter = amavisfeed:[127.0.0.1]:10024
- #receive_override_options = no_address_mappings
- # no_unknown_recipient_checks
- # Do not try to reject unknown recipients (SMTP server only).
- # This is typically specified AFTER an external content filter.
- # no_address_mappings
- # Disable canonical address mapping, virtual alias map expansion,
- # address masquerading, and automatic BCC (blind carbon-copy) recipients.
- # This is typically specified BEFORE an external content filter (eg. amavis).
- # no_header_body_checks
- # Disable header/body_checks. This is typically specified AFTER an external content filter.
- # no_milters
- # Disable Milter (mail filter) applications. This is typically specified AFTER an external content filter.
- #local_header_rewrite_clients =
- transport_maps =
- hash:/etc/postfix/\$mydomain/transport_maps
- mailbox_command =
- /usr/bin/procmail -t -a "\$SENDER" -a "\$RECIPIENT" -a "\$USER" -a "\$EXTENSION" -a "\$DOMAIN" -a "\$ORIGINAL_RECIPIENT" "\$HOME/etc/procmail/delivery.rc"
- mailbox_size_limit = 0
- biff = no
- # Activer la notification en cas de réception de nouveaux e-mails dans la console (yes / no).
- append_dot_mydomain = no
- # appending .domain is the MUA's job.
-
- #tls_random_source =
- # dev:/dev/urandom
- # Non-blocking
- #tls_random_reseed_period = 3600s
- #tls_random_exchange_name =
- # \${data_directory}/prng_exch
- # NOTE: Ã ne pas mettre dans la cage chroot
- #tls_random_bytes = 32
- #tls_random_prng_update_period = 3600s
- #tls_high_cipherlist = AES256-SHA
- # NOTE: postconf(5) déconseille de changer ceci
-
- #smtp_cname_overrides_servername = no
- smtp_connect_timeout = 60s
- #smtp_tls_CAfile = /etc/postfix/\$mydomain/smtp/tls/ca/crt.pem
- #smtp_tls_CApath = /etc/postfix/\$mydomain/smtp/tls/ca/
- #smtp_tls_cert_file = /etc/postfix/\$mydomain/smtp/tls/crt.pem
- #smtp_tls_key_file = /etc/postfix/\$mydomain/smtp/tls/key.pem
- #smtp_tls_per_site = hash:/etc/postfix/\$mydomain/smtp/tls/per_site
- # NOTE: déprécié en faveur de smtp_tls_policy_maps
- smtp_tls_policy_maps = hash:/etc/postfix/\$mydomain/smtp/tls/policy
- smtp_tls_fingerprint_digest = sha1
- smtp_tls_scert_verifydepth = 5
- #smtp_tls_secure_cert_match = nexthop, dot-nexthop
- #smtp_tls_verify_cert_match = hostname
- #smtp_tls_note_starttls_offer = yes
- smtp_tls_loglevel = 1
- smtp_tls_protocols = !SSLv2, !SSLv3
- # Only allow TLSv*
- smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_tls_session_cache
- #smtp_tls_session_cache_timeout = 3600s
- smtp_tls_security_level = may
- smtp_header_checks = regexp:/etc/postfix/\$mydomain/smtp/header_checks
- smtp_body_checks =
- smtp_mime_header_checks =
- smtp_nested_header_checks =
-
- smtpd_starttls_timeout = 300s
- smtpd_banner =
- \$myhostname ESMTP \$mail_name (Debian/GNU)
-
- # Restrictions
- smtpd_helo_required = yes
- strict_rfc821_envelopes = yes
- smtpd_authorized_xclient_hosts = 127.0.0.1
- # NOTE: utile pour tester les restrictions
-
- smtpd_helo_restrictions =
- reject_invalid_helo_hostname
- reject_non_fqdn_helo_hostname
- #reject_unknown_helo_hostname
- # NOTE: pourrait pourtant être utile pour lutter contre le spam
- permit
-
- smtpd_sender_restrictions =
- permit_mynetworks
- permit_tls_clientcerts
- permit_sasl_authenticated
- check_sender_access hash:/etc/postfix/\$mydomain/smtpd/sender_access
- check_sender_access hash:/etc/postfix/sender_blacklist
- reject_unauth_pipelining
- reject_non_fqdn_sender
- #reject_unknown_sender_domain
- # NOTE: temporaire
- permit
-
- smtpd_client_new_tls_session_rate_limit = 0
- smtpd_client_event_limit_exceptions = \$mynetworks
- smtpd_client_recipient_rate_limit = 0
- smtpd_client_connection_count_limit = 50
- smtpd_client_connection_rate_limit = 0
- smtpd_client_message_rate_limit = 0
- smtpd_client_port_logging = no
-
- smtpd_client_restrictions =
- check_client_access hash:/etc/postfix/client_blacklist
-
- policy_time_limit = 3600
- default_extra_recipient_limit = 5000
- duplicate_filter_limit = 5000
- smtpd_recipient_limit = 5000
- smtpd_recipient_overshoot_limit = 5000
- smtpd_recipient_restrictions =
- reject_non_fqdn_recipient
- #reject_invalid_hostname
- # NOTE: postfix < 2.3. voir reject_invalid_helo_hostname
- # dans smtpd_helo_restrictions
- reject_unknown_recipient_domain
- #reject_non_fqdn_sender
- # NOTE: dans smtpd_sender_restrictions
- reject_unauth_pipelining
- # NOTE: dans smtpd_client_restrictions ou smtpd_data_restrictions
- permit_mynetworks
- permit_tls_clientcerts
- permit_sasl_authenticated
- reject_unauth_destination
- # NOTE: ne pas passer par SPFCheck / Postgrey si le mail n'est pas pour nous
- # ou quelqu'un pour lequel on tient lieu de backup_mx
- check_policy_service inet:127.0.0.1:10023
- # NOTE: Postgrey (greylisting)
- check_policy_service unix:private/spfcheck
- permit_auth_destination
- # NOTE: une fois Postgrey passé, on accepte ce qui nous est destiné
- # (voir permit_auth_destination) ; sans doute redondant
- reject
- #check_relay_domains <- removed from postfix
- #reject_unknown_sender_domain
- # aurait probablement été mieux dans smtpd_sender_restrictions
- #reject_rbl_client bl.spamcop.net
- #reject_rbl_client list.dsbl.org
- #reject_rbl_client zen.spamhaus.org
- #reject_rbl_client dnsbl.sorbs.net
-
- smtpd_data_restrictions =
- reject_unauth_pipelining
- # NOTE: obliger le serveur en face à attendre qu'on lui aie dit OK
- permit
-
- #smtpd_end_of_data_restrictions =
-
- #smtpd_restriction_classes =
-
- smtpd_error_sleep_time = 5
- # NOTE: forcer quelqu'un qui nous embête à attendre cinq secondes.
-
- # SASL
- smtpd_sasl_auth_enable = yes
- smtpd_sasl_type = dovecot
- smtpd_sasl_path = private/auth
- smtpd_sasl_security_options = noanonymous
- smtpd_sasl_domain = \$mydomain
-
- # SMTPD TLS
- smtpd_discard_ehlo_keywords = starttls
- # NOTE: les clients mails tentant d'utiliser le chiffrement opportuniste
- # se mangent une erreur en tentant un starttls
- smtpd_tls_fingerprint_digest = sha1
- # sha512 ?
- smtpd_tls_mandatory_protocols = TLSv1
- smtpd_tls_mandatory_ciphers = high
- smtpd_tls_ciphers = high
- # restrictif. s/high/medium/ ?
- smtpd_tls_CAfile = /etc/postfix/\$mydomain/smtpd/tls/ca/crt+crl.slf.pem
- smtpd_tls_CApath = /etc/postfix/\$mydomain/smtpd/tls/ca/
- smtpd_tls_cert_file = /etc/postfix/\$mydomain/smtpd/tls/crt+crl.slf.pem
- smtpd_tls_key_file = /etc/postfix/\$mydomain/smtpd/tls/key.pem
- ##
- #smtpd_tls_received_header = no
- smtpd_tls_session_cache_database =
- btree:/var/lib/postfix/smtpd_tls_session_cache
- #smtpd_tls_session_cache_timeout = 3600s
- smtpd_tls_security_level = may
- # Postfix 2.3 and later
- # encrypt
- # Mandatory TLS encryption: announce STARTTLS support to SMTP clients, and require that clients use TLS
- # encryption. According to [1720]RFC 2487 this MUST NOT be applied in case of a publicly-referenced
- # SMTP server. Instead, this option should be used only on dedicated servers.
- smtpd_tls_loglevel = 1
- smtpd_tls_ccert_verifydepth = 5
- smtpd_tls_auth_only = yes
- # Pas d'AUTH SASL sans TLS
- smtpd_tls_ask_ccert = no
- smtpd_tls_req_ccert = no
- #smtpd_tls_always_issue_session_ids = yes
- smtpd_peername_lookup = yes
- # Nécessaire pour postgrey, etc
- smtpd_milters =
- non_smtpd_milters =
- line_length_limit = 2048
- queue_minfree = 0
- message_size_limit = 20480000
- #smtpd_enforce_tls # NOTE: obsolète
- #smtpd_use_tls # NOTE: obsolète
- #smtpd_tls_cipherlist # NOTE: obsolète
-
- readme_directory = no
- #delay_warning_time = 4h
- # NOTE: uncomment the previous line to generate "delayed mail" warnings
- #debug_peer_level = 4
- #debug_peer_list = .\$myhostname
- EOF
- mk_reg mod=664 own=root:root /etc/dovecot/dovecot.conf <<-EOF
- auth_ssl_username_from_cert = yes
- listen = *
- log_timestamp = "%Y-%m-%d %H:%M:%S "
- mail_debug = yes
- mail_location = maildir:~/var/mail
- mail_privileged_group = mail
- passdb {
- args = /home/%u/etc/dovecot/passwd
- driver = passwd-file
- }
- protocols = imap
- service auth {
- unix_listener /var/spool/postfix/private/auth {
- group = postfix
- mode = 0660
- user = postfix
- }
- user = root
- }
- ssl_ca =