X-Git-Url: https://git.cyclocoop.org/?p=lhc%2Fateliers.git;a=blobdiff_plain;f=vm_hosted;h=4cf4b9d14c113463ad1c6fac846fa05870a890ca;hp=f6107016c3afb686403f486dca06122ff8718218;hb=22f04b9fac14adc3d3fc98273ba126c3a51792c3;hpb=a7d0fb2448e129747fce8e108ce80e4ce3c17845 diff --git a/vm_hosted b/vm_hosted index f610701..4cf4b9d 100755 --- a/vm_hosted +++ b/vm_hosted @@ -7,6 +7,7 @@ while test -L "$tool" tool=${tool%/*} . "$tool"/lib/rule.sh . "$tool"/etc/vm.sh +export TRACE=1 rule_help () { # SYNTAX: [--hidden] local hidden; [ ${1:+set} ] || hidden=set @@ -33,8 +34,16 @@ rule_git_configure () { git config --replace branch.master.merge refs/remotes/master local tool tool=$(cd "$tool"; cd -) - sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/ - sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/vm + install -m 770 /dev/stdin .git/hooks/post-update <<-EOF + #!/bin/sh -efux + case \$1 in + (refs/remotes/master) + cd .. + git --git-dir=\$PWD/.git checkout -f -B master remotes/master + git --git-dir=\$PWD/.git clean -f -d -x + ;; + esac + EOF ) } rule_git_reset () { @@ -45,8 +54,22 @@ rule_git_reset () { ) } +rule_adduser () { + local user="$1"; shift + getent passwd "$user" >/dev/null || + sudo adduser "$@" "$user" + } rule_apt_get_install () { # SYNTAX: $package - sudo apt-get install "$@" + sudo \ + DEBIAN_FRONTEND=noninteractive \ + DEBIAN_PRIORITY=low \ + apt-get install --yes "$@" + } +rule_dpkg_reconfigure () { # SYNTAX: $package + sudo \ + DEBIAN_FRONTEND=noninteractive \ + DEBIAN_PRIORITY=low \ + dpkg-reconfigure "$@" } rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ? @@ -55,45 +78,207 @@ rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ? . /etc/profile } +rule_apache2_configure () { # XXX: cette règle n'est pas testée/mise-à-jour + local -; set +f + rule apt_get_install \ + apache2-mpm-itk \ + libapache2-mod-php5 + # VOIR: http://serverfault.com/questions/383526/how-do-i-select-which-apache-mpm-to-use/383634#383634 + # VOIR: http://jkroon.blogs.uls.co.za/it/security/using-php-fpm-and-mod_proxy_fcgi-to-optimize-and-secure-lamp-servers + # NOTE: apache2-mpm-itk semble le plus sécurisé, + # car on est certain que tout est exécuté avec les uid/gid + # assignés au VirtualHost/Directory/Location + # néamoins il se peut qu'une combinaison du genre : + # apache2-mpm-{worker,event} + mod_proxy_fcgi + apache2-suexec-custom + php-fpm + # soit plus performante (threads et pas forks), + # cependant l'usage de suexec impose des forks il semble.. + # et mod_proxy_fcgi n'apparaît que dans apache 2.4 ; + # donc pour l'instant : apache2-mpm-itk + sudo rm -rf \ + /etc/apache2/site.d + sudo install -d -m 770 -o www -g www \ + /etc/apache2 \ + /etc/apache2/site.d \ + /etc/apache2/x509.d + cat /dev/stdin "$tool"/etc/apache2/apache2.conf <<-EOF | + ServerName "$vm_fqdn" + EOF + sudo install -m 660 -o root -g root /dev/stdin \ + /etc/apache2/apache2.conf + sudo install -m 660 -o root -g root \ + "$tool"/etc/apache2/envvars \ + /etc/apache2/envvars + sudo install -m 660 -o root -g root \ + "$tool"/etc/apache2/httpd.conf \ + /etc/apache2/httpd.conf + #sudo install -m 660 -o root -g root /dev/stdin \ + # /etc/apache2/suexec/www-data <<-EOF + # /home + # pub/www/cgi + # EOF + sudo install -m 660 -o root -g root \ + "$tool"/etc/apache2/ports.conf \ + /etc/apache2/ports.conf + sudo a2enmod actions + sudo a2enmod headers + sudo a2enmod rewrite + sudo a2enmod ssl + sudo a2enmod userdir + local conf + sudo a2dissite "*" + sudo ln -fns \ + /etc/apache2 \ + /home/www/etc/apache2 + for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf + do conf=${conf#"$tool"/etc/apache2/site.d/} + local site=${conf%/VirtualHost.conf} + case $site in + (*-tls) + local hint="run vm_remote apache2_key_send before" + assert "sudo test -f /etc/apache2/site.d/\"$site\"/x509/key.pem" hint + sudo install -d -m 770 -o www-"$site" -g www-"$site" \ + /etc/apache2 \ + /etc/apache2/site.d/"$site" \ + /etc/apache2/x509.d/"$site" \ + /etc/apache2/x509.d/"$site"/ca \ + /etc/apache2/x509.d/"$site"/empty \ + /etc/apache2/x509.d/"$site"/rvk \ + /etc/apache2/x509.d/"$site"/usr + sudo install -m 664 -o www -g www \ + "$tool"/var/pub/x509/"$site"/crt.self-signed.pem \ + /etc/apache2/x509.d/"$site"/crt.self-signed.pem + #sudo install -m 664 -o www-"$site" -g www-"$site" \ + # "$tool"/var/pub/x509/"$site"/rvk.pem \ + # /etc/apache2/x509.d/"$site"/rvk.pem + sudo install -m 664 -o www -g www \ + "$tool"/var/pub/x509/"$site"/ca/crt.self-signed.pem \ + /etc/apache2/x509.d/"$site"/ca/crt.pem + sudo install -m 664 -o www -g www \ + "$tool"/var/pub/x509/"$site"/crt.pem \ + /etc/apache2/x509.d/"$site"/crt.pem + ;; + esac + case $site in + (*-tls) + cat <<-EOF + + + AssignUserID www-$site www-$site + BrowserMatch "MSIE [2-6]" ssl-unclean-shutdown nokeepalive downgrade-1.0 force-response-1.0 + BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown + CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined + #CustomLog "/dev/null" Combined + DocumentRoot /home/www/pub/$site + ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60" + #ErrorLog "/dev/null" + LogLevel Warn + SSLCACertificateFile /etc/apache2/x509.d/$site/crt.self-signed.pem + SSLCACertificatePath /etc/apache2/x509.d/$site/usr/ + #SSLCARevocationFile /etc/apache2/x509.d/$site/rvk.pem + SSLCADNRequestFile /etc/apache2/x509.d/$site/crt.self-signed.pem + SSLCADNRequestPath /etc/apache2/x509.d/$site/empty/ + # NOTE: ne publie pas les certificats d’utilisateur-ice-s acceptés + SSLCARevocationPath /etc/apache2/x509.d/$site/rvk/ + SSLCertificateChainFile /etc/apache2/x509.d/$site/ca/crt.pem + SSLCertificateFile /etc/apache2/x509.d/$site/crt.pem + SSLCertificateKeyFile /etc/apache2/x509.d/$site/key.pem + SSLCipherSuite AES+RSA+SHA256 + SSLEngine On + SSLInsecureRenegotiation Off + SSLOptions +StrictRequire +OptRenegotiate +StdEnvVars + SSLProtocol -All +TLSv1 + #SSLRenegBufferSize 262144 + SSLSessionCacheTimeout 1200 + SSLStrictSNIVHostCheck On + SSLUserName SSL_CLIENT_S_DN_CN + SSLVerifyClient None + SSLVerifyDepth 1 + $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf) + + + EOF + ;; + (*) + cat <<-EOF + + AssignUserID www-$site www-$site + CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined + #CustomLog "/dev/null" Combined + DocumentRoot /home/www/pub/$site + ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60" + #ErrorLog "/dev/null" + LogLevel Warn + $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf) + + EOF + ;; + esac | + sudo install -m 660 -o root -g root /dev/stdin \ + /etc/apache2/site.d/"$site"/VirtualHost.conf + sudo ln -fns \ + ../site.d/"$site"/VirtualHost.conf \ + /etc/apache2/sites-available/"$site" + sudo install -d -m 770 -o www-"$site" -g www-"$site" \ + /home/www/log/"$site" \ + /home/www/log/"$site"/apache2 + sudo ln -fns \ + /etc/apache2/site.d/"$site" \ + /home/www/etc/apache2/"$site" + test -e /home/www/pub/"$site" || + sudo install -d -m 2770 -o www-"$site" -g www-"$site" \ + /home/www/pub/"$site" + rule adduser www-"$site" + --disabled-password \ + --group \ + --no-create-home \ + --home /home/www/pub/"$site" \ + --shell /bin/false \ + --system + #sudo setfacl -m u:"www-$site":--x \ + # /home/www/ \ + # /home/www/pub/ \ + # /home/www/pub/"$site"/ + #sudo setfacl -m d:u:"www-$site":rwx \ + # "$home"/pub/www/"$site"/ + test ! -r "$tool"/etc/apache2/site.d/"$site"/configure.sh || + . "$tool"/etc/apache2/site.d/"$site"/configure.sh + test -e /etc/apache2/sites-enabled/"$site" || + sudo a2ensite "$site" + done + sudo service apache2 restart + } rule_apt_configure () { - sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF - deb http://ftp.fr.debian.org/debian $vm_lsb_name main contrib non-free + sudo install -m 664 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF + deb http://ftp.rezopole.net/debian $vm_lsb_name main + EOF + sudo install -m 664 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF + deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main EOF - sudo install -m 660 -o root -g root /dev/stdin /etc/apt/$vm_lsb_name-backports.list <<-EOF - #deb http://backports.debian.org/debian-backports $vm_lsb_name-backports main contrib non-free + sudo install -m 664 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF + deb http://nightly.openerp.com/7.0/nightly/deb/ ./ EOF - sudo install -m 660 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF + sudo install -m 664 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF Package: * Pin: release a=$vm_lsb_name - Pin-Priority: 170 + Pin-Priority: 200 Package: * Pin: release a=$vm_lsb_name-backports - Pin-Priority: 200 - EOF - sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF - deb http://nightly.openerp.com/trunk/nightly/deb/ ./ + Pin-Priority: 170 EOF sudo apt-get update rule apt_get_install apticron - sudo install -m 644 -o root -g root /dev/stdin /etc/apticron/apticron.conf <<-EOF - EMAIL="admin@$vm_domainname" - # DIFF_ONLY="1" - # LISTCHANGES_PROFILE="apticron" - # ALL_FQDNS="1" - # SYSTEM="foobar.example.com" - # IPADDRESSNUM="1" - # IPADDRESSES="192.0.2.1 2001:db8:1:2:3::1" - # NOTIFY_HOLDS="0" - # NOTIFY_NEW="0" - # NOTIFY_NO_UPDATES="0" - # CUSTOM_SUBJECT="" - # CUSTOM_NO_UPDATES_SUBJECT="" - # CUSTOM_FROM="root@$vm_fqdn" - EOF + m4 \ + --define=VM_DOMAINNAME=$vm_domainname \ + <"$tool"/etc/apticron/apticron.conf.m4 | + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/apticron/apticron.conf } rule_boot_configure () { - warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !" + #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !" + sudo debconf-set-selections <<-EOF + grub-pc grub-pc/install_devices multiselect + EOF rule apt_get_install grub-pc sudo install -d -m 644 -o root -g root /boot/grub rule apt_get_install linux-image-$vm_arch @@ -112,87 +297,46 @@ rule_boot_configure () { EOF sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map rule initramfs_configure - } -rule_dovecot_configure () { - rule apt_get_install dovecot-imapd dovecot-managesieved dovecot-sieve - local hint="run vm_remote dovecot_key_send before" - assert "test -f /etc/dovecot/$vm_domainname/imap/x509/key.pem" hint - sudo install -m 400 -o root -g root \ - "$tool"/var/pub/x509/service/imap/crt+crl.self-signed.pem \ - /etc/dovecot/$vm_domainname/imap/x509/crt+crl.self-signed.pem - sudo install -d -m 770 -o root -g adm \ - /etc/skel/etc/mail \ - /etc/skel/etc/sieve - sudo install -d -m 1777 -o root -g root \ - /var/lib/dovecot-control \ - /var/lib/dovecot-index - sudo install -m 664 -o root -g root /dev/stdin /etc/dovecot/local.conf <<-EOF - auth_ssl_username_from_cert = yes - listen = * - log_timestamp = "%Y-%m-%d %H:%M:%S " - mail_debug = yes - mail_location = maildir:~/var/mail:INDEX=/var/lib/dovecot-index/%u:CONTROL=/var/lib/dovecot-control/%u - # NOTE: INDEX et CONTROL sont sur une partition sans quota comme le demande la doc - # VOIR: http://wiki2.dovecot.org/Quota/FS - mail_plugins = \$mail_plugins quota - mail_privileged_group = mail - passdb { - args = /home/%u/etc/dovecot/passwd - driver = passwd-file - } - plugin { - quota = fs:user - recipient_delimiter = + - sieve = ~/etc/mail/filter.sieve - sieve_dir = ~/etc/mail/sieve - sieve_global_dir = /var/lib/dovecot/sieve/global/ - sieve_max_script_size = 1M - sieve_quota_max_scripts = 0 - sieve_quota_max_storage = 10M - sieve_user_log = ~/var/log/mail/sieve.log - } - protocol imap { - mail_plugins = \$mail_plugins imap_quota - } - protocol lda { - auth_socket_path = /var/run/dovecot/auth-master - hostname = $vm_domainname - info_log_path = - log_path = - mail_plugins = \$mail_plugins sieve - postmaster_address = contact+dovecot+lda@$vm_domainname - syslog_facility = mail - } - protocols = imap sieve - service auth { - user = root - unix_listener /var/spool/postfix/private/auth { - mode = 0660 - user = postfix - group = postfix - } - } - ssl_ca = - LABEL=${vm_lvm_lv}_boot /boot ext2 defaults 0 0 - proc /proc proc defaults 0 0 - sysfs /sys sysfs defaults 0 0 - tmpfs /tmp tmpfs rw,nosuid,nodev,auto,size=200m,nr_inodes=1000k,mode=1777,noatime,nodiratime 0 0 - /dev/mapper/${vm_lvm_lv}_root_deciphered / ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1 - /dev/mapper/${vm_lvm_lv}_var_deciphered /var ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1 - /dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,barrier=1,noatime,usrquota,grpquota 0 0 - # NOTE: barrier=1 réduit drastiquement les performances d'écriture, mais garantit la cohérence du système de fichiers. - /dev/mapper/${vm_lvm_lv}_swap_deciphered swap swap sw 0 0 - EOF - sudo install -m 644 -o root -g root /dev/stdin /etc/crypttab <<-EOF - # - ${vm_lvm_lv}_root_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_root none luks,lvm=$vm_lvm_vg - ${vm_lvm_lv}_var_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_var ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived - ${vm_lvm_lv}_home_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_home ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived - ${vm_lvm_lv}_swap_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_swap ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived - EOF - sudo install -m 644 -o root -g root /dev/stdin /etc/sysctl.d/local-swap.conf <<-EOF - vm.swappiness = 10 # NOTE: n'utilise le swap qu'en cas d'absolue nécessité - vm.vfs_cache_pressure=50 - EOF + m4 \ + --define=VM_LVM_LV=$vm_lvm_lv \ + --define=VM_LVM_VG=$vm_lvm_vg \ + <"$tool"/etc/fstab.m4 | + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/fstab + m4 \ + --define=VM_LVM_LV=$vm_lvm_lv \ + --define=VM_LVM_VG=$vm_lvm_vg \ + <"$tool"/etc/crypttab.m4 | + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/crypttab + rule tmpfs_configure } rule_initramfs_configure () { sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF @@ -281,10 +415,11 @@ rule_initramfs_configure () { $users EOF do eval local home\; home="~$user" - cat "$home"/etc/ssh/authorized_keys + sudo cat "$home"/etc/ssh/authorized_keys done done | - sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/root/.ssh/authorized_keys + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/initramfs-tools/root/.ssh/authorized_keys sudo rm -f \ /etc/initramfs-tools/root/.ssh/id_rsa.dropbear \ /etc/initramfs-tools/root/.ssh/id_rsa.pub \ @@ -292,13 +427,139 @@ rule_initramfs_configure () { # NOTE: clefs générées par Debian sudo update-initramfs -u } -rule_locale_configure () { - sudo install -m 644 -o root -g root /dev/stdin /etc/locale.gen <<-EOF - fr_FR.UTF-8 UTF-8 +rule_insserv_remove () { # SYNTAX: $sv + local sv="$1" + #sudo chmod u+x /etc/init.d/"$sv" + sudo insserv --force --remove "$sv" + sudo test ! -x /etc/init.d/"$sv" || + sudo /etc/init.d/"$sv" stop + sudo chmod ugo-x /etc/init.d/"$sv" + } +rule_gitolite_configure () { + sudo debconf-set-selections <<-EOF + gitolite gitolite/gituser string git + gitolite gitolite/adminkey string + gitolite gitolite/gitdir string /home/git + EOF + rule apt_get_install gitolite + rule adduser git \ + --disabled-password \ + --group \ + --home /home/git \ + --shell /bin/bash \ + --system + sudo chfn --full-name git git + rule adduser log-git \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/git/log \ + --shell /bin/false \ + --system + rule adduser git-data \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/git/pub \ + --shell /bin/false \ + --system + sudo adduser git git-data + sudo install -d -m 750 -o git -g git \ + /etc/gitolite \ + /home/git/etc \ + /home/git/etc/ssh + sudo install -d -m 751 -o git -g git \ + /home/git + sudo install -d -m 2770 -o git-data -g git-data \ + /home/git/pub + sudo install -d -m 1771 -o git -g git \ + /home/git/log + sudo install -d -m 2770 -o git -g log-git \ + /home/git/log/gitolite \ + /home/git/log/gitolite/perf + sudo install -d -m 3771 -o git -g git \ + /home/git/hooks + sudo ln -fns /etc/gitolite /home/git/etc/gitolite + sudo ln -fns /etc/gitweb /home/git/etc/gitweb + sudo ln -fns etc/gitolite/gitolite.rc /home/git/.gitolite.rc + sudo ln -fns etc/ssh /home/git/.ssh + sudo install -m 770 -o git -g git /dev/stdin \ + /home/git/etc/gitolite/gitolite.rc <<-EOF + #\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary"; + #\$BIG_INFO_CAP = 20; + #\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3'; + # NOTE: Please use single quotes, not double quotes. + #\$GITWEB_URI_ESCAPE = 0; + \$GIT_PATH = ""; + #\$GL_ADC_PATH = ""; + \$GL_ADMINDIR = \$ENV{HOME} . "/etc/gitolite"; + #\$GL_ALL_INCLUDES_SPECIAL = 0; + #\$GL_ALL_READ_ALL = 0; + \$GL_BIG_CONFIG = 0; + \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf"; + \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm"; + #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups" + \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*"; + #\$GL_HOSTNAME = "git.$vm_domainname"; + # NOTE: read doc/mirroring.mkd COMPLETELY before setting this. + #\$GL_HTTP_ANON_USER = "mob"; + \$GL_KEYDIR = "\$GL_ADMINDIR/keydir"; + \$GL_LOGT = \$ENV{HOME} . "/log/gitolite/%y-%m-%d.log"; + #\$GL_NICE_VALUE = 0; + \$GL_NO_CREATE_REPOS = 0; + \$GL_NO_DAEMON_NO_GITWEB = 0; + \$GL_NO_SETUP_AUTHKEYS = 0; + \$GL_PACKAGE_CONF = "/usr/share/gitolite/conf"; + \$GL_PACKAGE_HOOKS = "/usr/share/gitolite/hooks"; + #\$GL_PERFLOGT = \$ENV{HOME} . "/log/gitolite/perf/%y-%m-%d.log"; + #\$GL_REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][0-9a-zA-Z._\\@/+ :,-]*\$); + \$GL_SITE_INFO = "git.$vm_domainname"; + #\$GL_SLAVE_MODE = 0; + \$GL_WILDREPOS = 0; + #\$GL_WILDREPOS_DEFPERMS = 'R @all'; + \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS"; + \$HTPASSWD_FILE = ""; + \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list"; + \$REPO_BASE = "pub"; + \$REPO_UMASK = 0007; + \$RSYNC_BASE = ""; + \$SVNSERVE = ""; + #\$UPDATE_CHAINS_TO = "hooks/update.secondary"; + \$WEB_INTERFACE = "gitweb"; + 1; + EOF + sudo install -m 600 -o git -g git \ + "$tool"/var/pub/ssh/git.key \ + /home/git/etc/ssh/git.pub + sudo -u git \ + GL_RC=/home/git/etc/gitolite/gitolite.rc \ + GIT_AUTHOR_NAME=git \ + gl-setup -q /home/git/etc/ssh/git.pub git + local d + for d in doc logs src + do test ! -d /home/git/etc/gitolite/"$d" || + rmdir /home/git/etc/gitolite/"$d" + done + } +rule_locales_configure () { + sudo debconf-set-selections <<-EOF + locales locales/default_environment_locale select None + locales locales/locales_to_be_generated multiselect fr_FR.UTF-8 UTF-8 EOF - sudo update-locale + rule dpkg_reconfigure locales } rule_login_configure () { + sudo install -m 644 -o root -g root \ + "$tool"/etc/inittab \ + /etc/inittab + sudo install -m 644 -o root -g root \ + "$tool"/etc/login.defs \ + /etc/login.defs + grep -q '^session optional pam_umask.so\>' /etc/pam.d/common-session || + sudo install -m 644 -o root -g root /dev/stdin /etc/pam.d/common-session <<-EOF + $(cat /etc/pam.d/common-session) + session optional pam_umask.so + EOF grep -q '^hvc0$' /etc/securetty || sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF $(cat /etc/securetty) @@ -309,199 +570,6 @@ rule_login_configure () { $(cat /etc/securetty) xvc0 EOF - sudo install -m 644 -o root -g root /dev/stdin /etc/inittab <<-EOF - # /etc/inittab: init(8) configuration. - - # The default runlevel. - id:2:initdefault: - - # Boot-time system configuration/initialization script. - # This is run first except when booting in emergency (-b) mode. - si::sysinit:/etc/init.d/rcS - - # What to do in single-user mode. - ~~:S:wait:/sbin/sulogin - - # /etc/init.d executes the S and K scripts upon change - # of runlevel. - # - # Runlevel 0 is halt. - # Runlevel 1 is single-user. - # Runlevels 2-5 are multi-user. - # Runlevel 6 is reboot. - - l0:0:wait:/etc/init.d/rc 0 - l1:1:wait:/etc/init.d/rc 1 - l2:2:wait:/etc/init.d/rc 2 - l3:3:wait:/etc/init.d/rc 3 - l4:4:wait:/etc/init.d/rc 4 - l5:5:wait:/etc/init.d/rc 5 - l6:6:wait:/etc/init.d/rc 6 - # Normally not reached, but fallthrough in case of emergency. - z6:6:respawn:/sbin/sulogin - - # What to do when CTRL-ALT-DEL is pressed. - ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now - - # What to do when the power fails/returns. - pf::powerwait:/etc/init.d/powerfail start - pn::powerfailnow:/etc/init.d/powerfail now - po::powerokwait:/etc/init.d/powerfail stop - - # Xen hypervisor console - hvc:2345:respawn:/sbin/getty 38400 hvc0 - #xvc:2345:respawn:/sbin/getty 38400 xvc0 - EOF - sudo install -m 644 -o root -g root /dev/stdin /etc/login.defs <<-EOF - MAIL_DIR /var/mail - FAILLOG_ENAB yes - LOG_UNKFAIL_ENAB no - LOG_OK_LOGINS no - SYSLOG_SU_ENAB yes - SYSLOG_SG_ENAB yes - FTMP_FILE /var/log/btmp - SU_NAME su - HUSHLOGIN_FILE .hushlogin - ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin - ENV_PATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin - # NOTE: met les sbin/ dans ENV_PATH ; - # - ça n'apporte aucune protection de ne pas les mettre ; - # - ça frustre de ne pas les trouver. - TTYGROUP tty - TTYPERM 0600 - ERASECHAR 0177 - KILLCHAR 025 - UMASK 007 - # NOTE: rwxrwx--- ; - # - donne une même confiance au groupe propriétaire qu'au propriétaire ; - # - facilite l'utilisation des ACL, qui sont dépendantes des droits du groupe propriétaire. - PASS_MAX_DAYS 99999 - PASS_MIN_DAYS 0 - PASS_WARN_AGE 7 - UID_MIN 1000 - UID_MAX 60000 - GID_MIN 1000 - GID_MAX 60000 - LOGIN_RETRIES 3 - LOGIN_TIMEOUT 60 - CHFN_RESTRICT rwh - DEFAULT_HOME yes - USERGROUPS_ENAB yes - ENCRYPT_METHOD SHA512 - EOF - grep -q '^session optional pam_umask.so\>' /etc/pam.d/common-session || - sudo install -m 644 -o root -g root /dev/stdin /etc/pam.d/common-session <<-EOF - $(cat /etc/pam.d/common-session) - session optional pam_umask.so - EOF - } -rule_procmail_configure () { - rule apt_get_install procmail - sudo install -d -m 770 -o root -g adm \ - /etc/skel/etc/mail \ - /etc/skel/var/cache/mail \ - /etc/skel/var/log/mail \ - /etc/skel/var/mail - sudo install -m 660 -o root -g adm \ - "$tool"/etc/skel/etc/mail/delivery.procmailrc \ - /etc/skel/etc/mail/delivery.procmailrc - } -rule_postgrey_configure () { - rule apt_get_install postgrey - sudo service postgrey restart - } -rule_postfix_configure () { - local hint="run vm_remote postfix_key_send before" - assert "test -f /etc/postfix/$vm_domainname/smtpd/x509/key.pem" hint - warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix" - rule apt_get_install postfix - sudo install -m 640 -o root -g root /dev/stdin /etc/postfix/.gitignore <<-EOF - *.db - EOF - sudo install -d -m 770 -o root -g root \ - /etc/postfix/$vm_domainname/ \ - /etc/postfix/$vm_domainname/smtp \ - /etc/postfix/$vm_domainname/smtp/x509 \ - /etc/postfix/$vm_domainname/smtp/x509/ca \ - /etc/postfix/$vm_domainname/smtpd \ - /etc/postfix/$vm_domainname/smtpd/x509 \ - /etc/postfix/$vm_domainname/smtpd/x509/ca - sudo install -d -m 770 -o root -g root \ - /etc/postfix/$vm_domainname/ \ - /etc/postfix/$vm_domainname/smtp \ - /etc/postfix/$vm_domainname/smtp/x509 \ - /etc/postfix/$vm_domainname/smtp/x509/ca \ - /etc/postfix/$vm_domainname/smtpd \ - /etc/postfix/$vm_domainname/smtpd/x509 \ - /etc/postfix/$vm_domainname/smtpd/x509/ca - sudo ln -fns \ - ../crt+crl.self-signed.pem \ - /etc/postfix/$vm_domainname/smtpd/x509/ca/crt.pem - sudo install -m 400 -o root -g root \ - var/pub/x509/service/smtpd/crt+crl.self-signed.pem \ - /etc/postfix/$vm_domainname/smtpd/x509/crt+crl.self-signed.pem - sudo install -m 400 -o root -g root \ - var/pub/x509/service/smtpd/crt.pem \ - /etc/postfix/$vm_domainname/smtpd/x509/crt.pem - sudo install -m 400 -o root -g root \ - var/pub/x509/service/smtpd/crt+root.pem \ - /etc/postfix/$vm_domainname/smtpd/x509/crt+root.pem - sudo install -m 400 -o root -g root \ - var/pub/x509/service/smtpd/crt+crl.self-signed.pem \ - /etc/postfix/$vm_domainname/smtpd/x509/crt+crl.self-signed.pem - sudo install -m 660 -o root -g root \ - etc/postfix/$vm_domainname/header_checks \ - /etc/postfix/$vm_domainname/header_checks - sudo install -m 664 -o root -g root \ - etc/postfix/aliases \ - /etc/postfix/aliases - sudo newaliases -oA/etc/postfix/aliases - cat /dev/stdin etc/postfix/main.cf <<-EOF | - mydomain = $vm_domainname - myorigin = \$mydomain - myhostname = $vm_hostname.\$mydomain - mail_name = \$myhostname - mydestination = $vm_hostname \$myhostname \$myorigin - EOF - sudo install -m 664 -o root -g root /dev/stdin \ - /etc/postfix/main.cf - sudo install -m 664 -o root -g root \ - etc/postfix/master.cf \ - /etc/postfix/master.cf - sudo install -m 660 -o root -g root \ - etc/postfix/$vm_domainname/smtp/x509/policy \ - /etc/postfix/$vm_domainname/smtp/x509/policy - sudo postmap hash:/etc/postfix/$vm_domainname/smtp/x509/policy - sudo install -m 660 -o root -g root \ - etc/postfix/$vm_domainname/smtp/header_checks \ - /etc/postfix/$vm_domainname/smtp/header_checks - sudo install -m 660 -o root -g root \ - etc/postfix/$vm_domainname/smtpd/sender_access \ - /etc/postfix/$vm_domainname/smtpd/sender_access - sudo postmap hash:/etc/postfix/$vm_domainname/smtpd/sender_access - sudo install -m 660 -o root -g root \ - etc/postfix/$vm_domainname/smtpd/client_blacklist \ - /etc/postfix/$vm_domainname/smtpd/client_blacklist - sudo postmap hash:/etc/postfix/$vm_domainname/smtpd/client_blacklist - sudo install -m 660 -o root -g root \ - etc/postfix/$vm_domainname/smtpd/relay_clientcerts \ - /etc/postfix/$vm_domainname/smtpd/relay_clientcerts - sudo postmap hash:/etc/postfix/$vm_domainname/smtpd/relay_clientcerts - sudo install -m 660 -o root -g root \ - etc/postfix/$vm_domainname/transport \ - /etc/postfix/$vm_domainname/transport - sudo postmap hash:/etc/postfix/$vm_domainname/transport - sudo install -m 660 -o root -g root \ - etc/postfix/$vm_domainname/virtual_alias \ - /etc/postfix/$vm_domainname/virtual_alias - sudo postmap hash:/etc/postfix/$vm_domainname/virtual_alias - sudo service postfix restart - } -rule_mail_configure () { - rule postfix_configure - rule postgrey_configure - rule procmail_configure - rule dovecot_configure } rule_network_configure () { sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF @@ -512,120 +580,208 @@ rule_network_configure () { $(cat /etc/hosts) 127.0.0.1 $vm_fqdn $vm EOF - sudo install -m 644 -o root -g root /dev/stdin /etc/network/interfaces <<-EOF - auto lo - iface lo inet loopback - - auto eth0=grenode - iface grenode inet static - address $vm_ipv4 - gateway $vm_ipv4 # NOTE: proxy_arp sur la passerelle permet d'utiliser la même adresse - network $vm_ipv4 - broadcast $vm_ipv4 - netmask 255.255.255.255 - mtu 1300 - # NOTE: il y a besoin de ça en l'état actuel du réseau de Grenode - # car la MTU des tunnels GRE/IPsec entre les routeurs de Grenode l'impose. - # - # root@ateliers:~# ping -M do -c 1 -s \$((1500-20-8-200)) soupirail.grenode.net - # PING soupirail.grenode.net (91.216.110.1) 1272(1300) bytes of data. - # 1280 bytes from soupirail.grenode.net (91.216.110.1): icmp_req=1 ttl=63 time=18.0 ms - # - # --- soupirail.grenode.net ping statistics --- - # 1 packets transmitted, 1 received, 0% packet loss, time 0ms - # rtt min/avg/max/mdev = 18.027/18.027/18.027/0.000 ms - # root@ateliers:~# ping -M do -c 1 -s \$((1500-20-8-200+1)) soupirail.grenode.net - # PING soupirail.grenode.net (91.216.110.1) 1273(1301) bytes of data. - # From estran.grenode.net (91.216.110.6) icmp_seq=1 Frag needed and DF set (mtu = 1300) - # - # --- soupirail.grenode.net ping statistics --- - # 0 packets transmitted, 0 received, +1 errors - post-up ip address add $vm_ipv4/32 dev \$IFACE - pre-down ip address delete $vm_ipv4/32 dev \$IFACE - EOF - } -rule_ssh_configure () { - ssh-keygen -F "$vm_fqdn" -f "$tool"/etc/openssh/known_hosts | - ( while IFS= read -r line - do case $line in (*" RSA") return 0; break;; esac - done; return 1 ) || - sudo ssh-keygen -t rsa -b 4096 -N '' -f /etc/ssh/ssh_host_rsa_key - sudo rm -f \ - /etc/ssh/ssh_host_dsa_key \ - /etc/ssh/ssh_host_dsa_key.pub \ - /etc/ssh/ssh_host_ecdsa_key \ - /etc/ssh/ssh_host_ecdsa_key.pub - # NOTE: clefs générées par Debian - sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/sshd_config <<-EOF - Port 22 - ListenAddress $vm_ipv4 - #ListenAddress :: - Protocol 2 - Compression yes - HostKey /etc/ssh/ssh_host_rsa_key - UsePrivilegeSeparation yes - KeyRegenerationInterval 3600 - ServerKeyBits 768 - SyslogFacility AUTH - LogLevel INFO - LoginGraceTime 120 - PermitRootLogin yes - StrictModes yes - RSAAuthentication yes - PubkeyAuthentication yes - AuthorizedKeysFile %h/etc/ssh/authorized_keys - IgnoreRhosts yes - RhostsRSAAuthentication no - HostbasedAuthentication no - IgnoreUserKnownHosts no - PermitEmptyPasswords no - ChallengeResponseAuthentication no - PasswordAuthentication no - KerberosAuthentication no - GSSAPIAuthentication no - X11Forwarding no - X11DisplayOffset 10 - PrintMotd no - DebianBanner no - PrintLastLog yes - TCPKeepAlive yes - ClientAliveInterval 0 - AcceptEnv LANG LC_* - Subsystem sftp /usr/lib/openssh/sftp-server - UsePAM yes - EOF - sudo service ssh restart + sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF + search ${vm_host#*.} + nameserver ${vm_host_nameserver} + EOF + m4 \ + --define=VM_IPV4=$vm_ipv4 \ + <"$tool"/etc/network/interfaces.m4 | + sudo install -m 640 -o root -g root /dev/stdin \ + /etc/network/interfaces } -rule_user_admin_add () { # SYNTAX: $user - local user=$1 - id "$user" >/dev/null || - sudo adduser --disabled-password "$user" +rule_runit_configure () { # SYNTAX: $sv [...] -- $configure_options + rule apt_get_install runit + if test $# = 0 + then + set +x + sudo sv status \ + $(sudo find /etc/sv \ + -mindepth 1 -maxdepth 1 -type d \ + -printf '%p\n' | sort) + else + local services= + while [ $# -gt 0 ] + do case $1 in + (--) shift; break;; + (*) services="$services $1"; shift;; + esac + done + #for sv in $(sudo find /etc/sv \ + # -mindepth 1 -maxdepth 1 -type d \ + # -false $(printf -- '-or -name %s\n' $services) \ + # -printf '%f\n') + # do + # case $(sudo sv stop "$sv" | tee /dev/stderr) in + # (*": runsv not running") true;; + # (*": unable to open supervise/ok: file does not exist") true;; + # ("ok: down:"*) true;; + # (*) false;; + # esac + # done + for sv in $(find "$tool"/etc/sv \ + -mindepth 1 -maxdepth 1 -type d \ + -false $(printf -- '-or -name %s\n' $services) \ + -printf '%f\n') + do + rule _runit_sv_configure "$sv" "$@" + rule _runit_sv_start "$sv" + done + #sleep 3 + #sudo find -L /etc/service -type l -delete + fi + } +rule__runit_sv_configure () { # SYNTAX: $sv $configure_options + local sv="$1"; shift + sudo install -d -m 770 -o root -g root \ + /etc/sv/"$sv" + sudo install -m 770 -o root -g root \ + "$tool"/etc/sv/"$sv"/run \ + /etc/sv/"$sv"/run + if test -e "$tool"/etc/sv/"$sv"/log/run + then + sudo install -d -m 770 -o root -g root \ + /etc/sv/"$sv"/log + sudo install -m 770 -o root -g root \ + "$tool"/etc/sv/"$sv"/log/run \ + /etc/sv/"$sv"/log/run + fi + ( + test ! -r "$tool"/etc/sv/"$sv"/configure.sh || + . "$tool"/etc/sv/"$sv"/configure.sh || return 1 + ) + ( + test ! -r "$tool"/etc/sv/"$sv"/log/configure.sh || + . "$tool"/etc/sv/"$sv"/log/configure.sh || return 1 + ) + sudo ln -fns \ + ../sv/"$sv" \ + /etc/service/"$sv" + } +rule__runit_sv_restart () { # SYNTAX: $sv + local sv="$1" + while true + do case $(sudo sv restart "$sv" | tee /dev/stderr) in + (*": runsv not running") sleep 1;; + (*": unable to open supervise/ok: file does not exist") sleep 1;; + (*) break;; + esac + done + } +rule__runit_sv_start () { # SYNTAX: $sv + local sv="$1" + while true + do case $(sudo sv start "$sv" | tee /dev/stderr) in + (*": runsv not running") sleep 1;; + (*": unable to open supervise/ok: file does not exist") sleep 1;; + (*) break;; + esac + done + } +rule_shorewall_configure () { + # DOC: http://shorewall.net/Introduction.html + local -; set +f + rule apt_get_install shorewall + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/default/shorewall <<-EOF + INITLOG=/dev/null + OPTIONS="" + RESTARTOPTIONS="" + SAFESTOP=0 + STARTOPTIONS="" + startup=1 + EOF + local conf + for conf in "$tool"/etc/shorewall/* + do conf=${conf#"$tool"/etc/shorewall/} + sudo test ! -f "$tool"/etc/shorewall/"$conf" || + sudo install -m 640 -o root -g root \ + "$tool"/etc/shorewall/"$conf" \ + /etc/shorewall/"$conf" + done + sudo install -d -m 750 -o root -g root \ + /etc/shorewall/macro.d + for conf in "$tool"/etc/shorewall/macro.d/* + do conf=${conf#"$tool"/etc/shorewall/macro.d/} + sudo test ! -f "$tool"/etc/shorewall/macro.d/"$conf" || + sudo install -m 640 -o root -g root \ + "$tool"/etc/shorewall/macro.d/"$conf" \ + /etc/shorewall/macro.d/"$conf" + done + sudo install -d -m 750 -o root -g root \ + /etc/shorewall/action.d + #for conf in "$tool"/etc/shorewall/action.d/* + # do conf=${conf#"$tool"/etc/shorewall/action.d/} + # sudo test ! -f "$tool"/etc/shorewall/action.d/"$conf" || + # sudo install -m 640 -o root -g root \ + # "$tool"/etc/shorewall/action.d/"$conf" \ + # /etc/shorewall/action.d/"$conf" + # done + #sudo shorewall safe-restart + } +rule_sysctl_configure () { + local -; set +f + for conf in "$tool"/etc/sysctl.d/*.conf + do conf=${conf#"$tool"/etc/sysctl.d/} + sudo install -m 660 -o root -g root \ + "$tool"/etc/sysctl.d/"$conf" \ + /etc/sysctl.d/"$conf" + done + sudo install -m 660 -o root -g root /dev/stdin \ + /etc/sysctl.d/local-kernel-name.conf <<-EOF + kernel.hostname = $vm_hostname + kernel.domainname = $vm_domainname + EOF + sudo sysctl --system + } +rule_tmpfs_configure () { + sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF + LOCK_SIZE=5242880 # NOTE: 5MiB + RAMLOCK=yes + RAMSHM=yes + RAMTMP=yes + RUN_SIZE=10% + SHM_SIZE= + TMP_MODE=1777,nr_inodes=1000k,noatime + TMP_OVERFLOW_LIMIT=1024 + # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB) + # on the root filesystem (overriding RAMTMP). + TMP_SIZE=200m + TMPFS_SIZE=20%VM + EOF + } +rule_user_add () { # SYNTAX: $user + local user="$1"; shift + rule adduser "$user" --disabled-password "$@" # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init . eval local home\; home="~$user" - sudo adduser "$user" sudo - sudo install -m 640 -o root -g root \ + sudo adduser "$user" users + sudo install -m 640 -o "$user" -g "$user" \ "$tool"/var/pub/ssh/"$user".key \ "$home"/etc/ssh/authorized_keys - local key; local -; set +f - for key in "$tool"/var/pub/openpgp/*.key - do sudo -u "$user" gpg --import "$key" - done - rule user_admin_configure - } -rule_user_admin_configure () { - rule initramfs_configure - rule user_root_configure + gpg \ + --homedir "$tool"/var/pub/openpgp/ \ + --no-default-keyring \ + --secret-keyring /dev/null \ + --export | + sudo -u "$user" gpg --import - } rule_user_configure () { - sudo install -d -m 750 -o root -g adm \ + rule apt_get_install bash-completion + sudo install -m 660 -o root -g root \ + "$tool"/etc/adduser.conf \ + /etc/adduser.conf + sudo install -d -m 750 -o root -g root \ + /etc/skel \ /etc/skel/etc \ + /etc/skel/etc/gpg \ /etc/skel/etc/ssh - sudo install -d -m 770 -o root -g adm \ - /etc/skel/etc/apache2 \ + sudo install -d -m 770 -o root -g root \ /etc/skel/var \ - /etc/skel/var/log \ /etc/skel/var/cache \ - /etc/skel/var/cache/ssh + /etc/skel/var/log \ + /etc/skel/var/run \ + /etc/skel/var/run/ssh sudo ln -fns etc/ssh /etc/skel/.ssh sudo ln -fns etc/gpg /etc/skel/.gnupg sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/passwd-init <<-EOF @@ -634,7 +790,7 @@ rule_user_configure () { ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac EOF sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF - %sudo ALL=(ALL) NOPASSWD: /usr/sbin/etckeeper unclean + %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean EOF sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF Defaults env_keep = " \\ @@ -652,17 +808,49 @@ rule_user_configure () { 'case \$(/usr/bin/passwd --status "\$SUDO_USER") in ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac' EOF sudo install -m 644 -o root -g root \ - etc/bash.bashrc \ - /etc/bash.bashrc + "$tool"/etc/bash.bashrc \ + /etc/bash.bashrc sudo install -m 644 -o root -g root \ - etc/screenrc \ - /etc/screenrc + "$tool"/etc/inputrc \ + /etc/inputrc + sudo install -m 644 -o root -g root \ + "$tool"/etc/screenrc \ + /etc/screenrc + local sh; local -; set +f + for sh in "$tool"/etc/user.d/*/configure.sh + do sh=${sh#"$tool"/etc/user.d/} + local user="${sh%/configure.sh}" + ( + . "$tool"/etc/user.d/"$sh" || return 1 + ) + done + } +rule_user_admin_add () { # SYNTAX: $user + rule user_configure + local user=$1 + rule adduser "$user" --disabled-password + eval local home\; home="~$user" + sudo adduser "$user" sudo + sudo install -m 640 -o root -g root \ + "$tool"/var/pub/ssh/"$user".key \ + "$home"/etc/ssh/authorized_keys + gpg \ + --homedir "$tool"/var/pub/openpgp/ \ + --no-default-keyring \ + --secret-keyring /dev/null \ + --export | + sudo -u "$user" gpg --import - + rule user_admin_configure + } +rule_user_admin_configure () { + rule initramfs_configure + rule user_root_configure } rule_user_root_configure () { - sudo install -d -m 750 -o root -g adm \ + sudo install -d -m 750 -o root -g root \ /root/etc \ - /root/etc/ssh \ - /root/etc/gpg + /root/etc/gpg \ + /root/etc/ssh sudo ln -fns etc/gpg /root/.gnupg sudo ln -fns etc/ssh /root/.ssh getent group sudo | @@ -671,27 +859,63 @@ rule_user_root_configure () { $users EOF do eval local home\; home="~$user" - cat "$home"/etc/ssh/authorized_keys + sudo cat "$home"/etc/ssh/authorized_keys done done | - sudo install -m 640 -o root -g root /dev/stdin /root/etc/ssh/authorized_keys - local key; local -; set +f - for key in "$tool"/var/pub/openpgp/*.key - do sudo gpg --import "$key" - done + sudo install -m 640 -o root -g root /dev/stdin \ + /root/etc/ssh/authorized_keys + gpg \ + --homedir "$tool"/var/pub/openpgp/ \ + --no-default-keyring \ + --secret-keyring /dev/null \ + --export | + sudo gpg --import - + } +rule__www_configure () { + rule adduser www \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/www \ + --shell /bin/false \ + --system + rule adduser log-www \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/www/log \ + --shell /bin/false \ + --system + #sudo adduser www www-data + sudo adduser www log-www + #sudo adduser log log-www + usermod --home /home/www/pub www-data + sudo install -d -m 751 -o www -g www \ + /home/www + sudo install -d -m 750 -o www -g www \ + /home/www/etc + sudo install -d -m 1771 -o www-data -g www-data \ + /home/www/pub + sudo install -d -m 1771 -o log-www -g log-www \ + /home/www/log } rule_configure () { rule apt_configure rule git_configure rule etckeeper_configure - rule locale_configure + rule locales_configure + rule time_configure rule network_configure rule filesystem_configure rule login_configure rule ssh_configure rule user_root_configure rule boot_configure + rule sysctl_configure rule user_configure + rule gitolite_configure + rule shorewall_configure + rule runit_configure } rule_luks_key_change () { @@ -704,6 +928,7 @@ case $rule in (help);; (*) assert 'test "$(hostname --fqdn)" = "$vm_fqdn"' vm_fqdn + cd / ;; esac rule $rule "$@"