X-Git-Url: https://git.cyclocoop.org/?p=lhc%2Fateliers.git;a=blobdiff_plain;f=vm_hosted;h=f39224a6391bfad2bad6f28d6df0ddebcd623435;hp=7d5e44451900a2c34c4ef8337011caa4062429b9;hb=122d034e4f03a17f88acd0d5c249ee4b9950537d;hpb=e61ce31922a217eafcaa2a2d05d906f9032133e9 diff --git a/vm_hosted b/vm_hosted index 7d5e444..f39224a 100755 --- a/vm_hosted +++ b/vm_hosted @@ -34,9 +34,7 @@ rule_git_configure () { git config --replace branch.master.merge refs/remotes/master local tool tool=$(cd "$tool"; cd -) - sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/ - sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/vm - sudo install -m 770 /dev/stdin .git/hooks/post-update <<-EOF + install -m 770 /dev/stdin .git/hooks/post-update <<-EOF #!/bin/sh -efux case \$1 in (refs/remotes/master) @@ -74,7 +72,7 @@ rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ? . /etc/profile } -rule_apache2_configure () { +rule_apache2_configure () { # XXX: cette règle n'est pas testée/mise-à-jour local -; set +f rule apt_get_install \ apache2-mpm-itk \ @@ -245,23 +243,20 @@ rule_apache2_configure () { } rule_apt_configure () { sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF - deb http://ftp.fr.debian.org/debian $vm_lsb_name main contrib non-free + deb http://ftp.rezopole.net/debian $vm_lsb_name main EOF - sudo install -m 660 -o root -g root /dev/stdin /etc/apt/$vm_lsb_name-backports.list <<-EOF - #deb http://backports.debian.org/debian-backports $vm_lsb_name-backports main contrib non-free + sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF + deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main EOF sudo install -m 660 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF Package: * Pin: release a=$vm_lsb_name - Pin-Priority: 170 + Pin-Priority: 200 Package: * Pin: release a=$vm_lsb_name-backports - Pin-Priority: 200 + Pin-Priority: 170 EOF - #sudo install -m 660 -o root -g root /dev/stdin /etc/apt/apt.conf.d/02proxy-grenode <<-EOF - # Acquire::http::Proxy "http://outils.grenode.net:3142"; - # EOF sudo apt-get update rule apt_get_install apticron sudo install -m 644 -o root -g root /dev/stdin /etc/apticron/apticron.conf <<-EOF @@ -475,10 +470,11 @@ rule_initramfs_configure () { $users EOF do eval local home\; home="~$user" - cat "$home"/etc/ssh/authorized_keys + sudo cat "$home"/etc/ssh/authorized_keys done done | - sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/root/.ssh/authorized_keys + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/initramfs-tools/root/.ssh/authorized_keys sudo rm -f \ /etc/initramfs-tools/root/.ssh/id_rsa.dropbear \ /etc/initramfs-tools/root/.ssh/id_rsa.pub \ @@ -507,48 +503,29 @@ rule_gitolite_configure () { --home /home/git/log \ --shell /bin/false \ --system - rule adduser git-data\ - --disabled-login \ - --disabled-password \ - --group \ - --home /home/git/pub \ - --shell /bin/false \ - --system - rule adduser git-daemon\ + rule adduser git-data \ --disabled-login \ --disabled-password \ --group \ --home /home/git/pub \ --shell /bin/false \ --system - rule adduser log-git-daemon\ - --disabled-login \ - --disabled-password \ - --group \ - --home /home/git/log/git-daemon \ - --shell /bin/false \ - --system sudo adduser git git-data - sudo adduser git-daemon git-data - sudo adduser log-git log-git-daemon sudo install -d -m 770 -o git -g git \ /etc/gitolite \ /home/git/etc \ /home/git/etc/ssh sudo install -d -m 751 -o git -g git \ /home/git - sudo install -d -m 3771 -o git-data -g git-data \ + sudo install -d -m 2770 -o git-data -g git-data \ /home/git/pub sudo install -d -m 1771 -o git -g git \ /home/git/log sudo install -d -m 2770 -o git -g log-git \ /home/git/log/gitolite \ /home/git/log/gitolite/perf - sudo install -d -m 770 -o log-git-daemon -g log-git-daemon \ - /home/git/log/git-daemon - sudo install -d -m 550 -o www-lhc-git -g www-lhc-git \ - /etc/gitweb \ - /etc/gitweb/cgi + sudo install -d -m 3771 -o git -g git \ + /home/git/hooks sudo ln -fns /etc/gitolite /home/git/etc/gitolite sudo ln -fns /etc/gitweb /home/git/etc/gitweb sudo ln -fns etc/gitolite/gitolite.rc /home/git/.gitolite.rc @@ -569,7 +546,7 @@ rule_gitolite_configure () { \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf"; \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm"; #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups" - \$GL_GITCONFIG_KEYS = "hooks\\..* repo\\..*"; + \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*"; #\$GL_HOSTNAME = "git.$vm_domainname"; # NOTE: read doc/mirroring.mkd COMPLETELY before setting this. #\$GL_HTTP_ANON_USER = "mob"; @@ -589,7 +566,7 @@ rule_gitolite_configure () { #\$GL_WILDREPOS_DEFPERMS = 'R @all'; \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS"; \$HTPASSWD_FILE = ""; - \$PROJECTS_LIST = \$ENV{HOME} . "/projects.list"; + \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list"; \$REPO_BASE = "pub"; \$REPO_UMASK = 0007; \$RSYNC_BASE = ""; @@ -598,40 +575,9 @@ rule_gitolite_configure () { \$WEB_INTERFACE = "gitweb"; 1; EOF - sudo install -m 740 -o git -g www-lhc-git /dev/stdin \ - /home/git/etc/gitweb/gitweb.conf <<-EOF - \$commit_oneline_message_width = 70; - \$default_projects_order = 'age'; - \$default_text_plain_charset = 'UTF-8'; - @diff_opts = (); - \$favicon = "img/git-favicon.png"; - \$git_temp = "/run/shm/tmp/gitweb"; - \$home_footer = "/etc/gitweb/cgi/home-footer.cgi.inc"; - \$home_header = "/etc/gitweb/cgi/home-header.cgi.inc"; - \$home_link = "/"; - \$home_link_str = 'dépôts'; - \$home_th_age = 'activité'; - \$home_th_descr = 'description'; - \$home_th_owner = 'contact'; - \$home_th_project = 'dépôt'; - \$javascript = "js/gitweb.js"; - \$logo = "img/git-logo.png"; - \$my_uri = ""; - \$projectroot = "../git"; - \$projects_list = "/etc/gitolite/projects.list"; - \$projects_list_description_width = 42; - \$projects_list_owner_width = 15; - \$search_str = "Filtre :"; - \$site_footer = "/etc/gitweb/cgi/site-footer.bin"; - \$site_header = undef; - \$site_name = "git.$vm_domainname"; - \$space_to_nbsp = 0; - @stylesheets = ("css/gitweb.css");# - \$untabify_tabstop = 2; - EOF sudo install -m 600 -o git -g git \ "$tool"/var/pub/ssh/git.key \ - /home/git/etc/ssh/git.pub + /home/git/etc/ssh/git.pub sudo -u git \ GL_RC=/home/git/etc/gitolite/gitolite.rc \ GIT_AUTHOR_NAME=git \ @@ -641,7 +587,6 @@ rule_gitolite_configure () { do test ! -d /home/git/etc/gitolite/"$d" || rmdir /home/git/etc/gitolite/"$d" done - rule apt_get_install gitweb highlight sudo service tmpfs restart } rule_locales_configure () { @@ -760,14 +705,89 @@ rule_mail_configure () { } rule_mysql_configure () { rule apt_get_install mysql-server-5.5 - sudo install -m 644 -o root -g root \ - "$tool"/etc/mysql/my.cnf \ - /etc/mysql/my.cnf - if test ! -d /home/mysql; then - sudo install -d -m 750 -o mysql -g mysql \ - /home/mysql - sudo -u mysql mysql_install_db --no-defaults --datadir=/home/mysql/ - fi + rule adduser mysql \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/mysql \ + --shell /bin/false \ + --system + rule adduser mysql-data \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/mysql/data \ + --no-create-home \ + --shell /bin/false \ + --system + sudo usermod --home /home/mysql mysql + sudo adduser mysql mysql-data + sudo install -m 644 -o mysql -g mysql \ + "$tool"/etc/mysql/my.cnf \ + /etc/mysql/my.cnf + sudo install -d -m 751 -o mysql -g mysql \ + /home/mysql + sudo rm -rf /etc/mysql + sudo install -d -m 750 -o mysql -g mysql \ + /etc/mysql \ + /home/mysql/etc + sudo ln -fns \ + /etc/mysql \ + /home/mysql/etc/mysql + if sudo test ! -d /home/mysql/data + then + sudo install -d -m 750 -o mysql -g mysql-data \ + /home/mysql/data + sudo -u mysql mysql_install_db \ + --datadir=/home/mysql/data \ + --no-defaults + fi + sudo service tmpfs restart + sudo insserv -r mysql + sudo chmod ugo-x /etc/init.d/mysql + case $(sudo sv status mysql || true) in + (''|run:*|*"s, normally up;"*) + sudo sv restart mysql + case $(sudo inotifywait -e create -- /run/mysqld/sock/) in + ("/run/mysqld/sock/ CREATE mysql") + # NOTE: + # - ajoute l'accès par socket Unix à mysql + # - ajoute les droits de super-utilisateur à mysql + # - supprime l'accès par mot-de-passe à root + # - supprime les bases de données de l'utilisateurice anonyme + # - supprime l'utilisateurice anonyme + # NOTE: mémo : + # GRANT USAGE ON *.* TO 'root'@'*' IDENTIFIED WITH auth_socket; + # CREATE USER 'root'@'localhost' IDENTIFIED WITH auth_socket; + # UPDATE mysql.user SET Password='' WHERE user='root'; + # DELETE FROM mysql.user WHERE user = 'root' AND host NOT IN ('localhost', '127.0.0.1', '::1'); + sudo mysql -u root --batch --verbose <<-EOF + DELETE FROM mysql.user WHERE user = 'root' and plugin = ''; + GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' IDENTIFIED WITH auth_socket; + UPDATE mysql.user SET grant_priv='Y',super_priv='Y' WHERE user='mysql'; + DELETE FROM mysql.db WHERE user = ''; + DELETE FROM mysql.user WHERE user = ''; + FLUSH PRIVILEGES; + EOF + ;; + esac + esac + } +rule_mysql_db_add () { # SYNTAX: $user $db + sudo -u mysql mysql --batch <<-EOF + DROP DATABASE IF EXISTS $db; + CREATE DATABASE $db CHARACTER SET utf8 COLLATE utf8_general_ci; + GRANT ALL PRIVILEGES ON $base.* TO '$user'@'localhost' IDENTIFIED WITH auth_socket; + FLUSH PRIVILEGES; + EOF + } +rule_mysql_user_add () { # SYNTAX: $user + sudo mysql -u mysql --batch <<-EOF || true + DROP USER '$user'@'localhost'; + EOF + sudo mysql -u mysql --batch <<-EOF + CREATE USER '$user'@'localhost' IDENTIFIED WITH auth_socket; + EOF } rule_network_configure () { sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF @@ -778,6 +798,10 @@ rule_network_configure () { $(cat /etc/hosts) 127.0.0.1 $vm_fqdn $vm EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF + search ${vm_host#*.} + nameserver ${vm_host_nameserver} + EOF sudo install -m 644 -o root -g root /dev/stdin /etc/network/interfaces <<-EOF auto lo iface lo inet loopback @@ -810,34 +834,6 @@ rule_network_configure () { pre-down ip address delete $vm_ipv4/32 dev \$IFACE EOF } -rule_www_configure () { - rule adduser www \ - --disabled-login \ - --disabled-password \ - --group \ - --home /home/www \ - --shell /bin/false \ - --system - rule adduser log-www \ - --disabled-login \ - --disabled-password \ - --group \ - --home /home/www/log \ - --shell /bin/false \ - --system - #sudo adduser www www-data - sudo adduser www log-www - #sudo adduser log log-www - usermod --home /home/www/pub www-data - sudo install -d -m 751 -o www -g www \ - /home/www - sudo install -d -m 750 -o www -g www \ - /home/www/etc - sudo install -d -m 1771 -o www-data -g www-data \ - /home/www/pub - sudo install -d -m 1771 -o log-www -g log-www \ - /home/www/log - } rule_nginx_configure () { local -; set +f rule apt_get_install nginx @@ -869,7 +865,7 @@ rule_nginx_configure () { --disabled-login \ --disabled-password \ --group \ - --home /home/www-data/"$site" \ + --home /home/www/pub/"$site" \ --shell /bin/false \ --system rule adduser log-www-"$site" \ @@ -879,7 +875,7 @@ rule_nginx_configure () { --home /home/www/log/"$site"/nginx \ --shell /bin/false \ --system - sudo install -d -m 2770 -o log-www-"$site" -g log-www-"$site" \ + sudo install -d -m 771 -o log-www -g log-www \ /home/www/log/"$site" sudo install -d -m 770 -o www -g www \ /etc/nginx/site.d/"$site" @@ -911,16 +907,57 @@ rule_nginx_configure () { done rule apt_get_install spawn-fcgi fcgiwrap sudo insserv --remove fcgiwrap - sudo insserv --remove nginx + sudo chmod ugo-x /etc/init.d/fcgiwrap + #sudo insserv --remove nginx + #sudo chmod ugo-x /etc/init.d/nginx rule tmpfs_configure sudo service php5-fpm restart # NOTE: relance les processus du pool # pour leur donner les droits # de leurs groupes supplémentaires. sudo service nginx restart - #case $(sv status nginx) in - # (run:*) sudo sv restart nginx - # esac + } +rule_nsd3_configure () { # NOTE: DNS autoritaire uniquement + local -; set +f + rule apt_get_install nsd m4 + sudo rm -rf \ + /etc/nsd3/zone.d + sudo install -d -m 750 -o root -g nsd \ + /etc/nsd3/zone.d + { + cat <<-EOF + server: + ip-address: $vm_ipv4 + ip4-only: yes + EOF + cat "$tool"/etc/nsd3/nsd.conf + local conf + for conf in "$tool"/etc/nsd3/zone.d/*.conf + do conf=${conf#"$tool"/etc/nsd3/zone.d/} + local domain=${conf%.conf} + if test -e "$tool"/etc/nsd3/zone.d/"$domain".zone.m4 + then m4 \ + --define=ZONE_DOMAIN=$domain \ + --define=ZONE_SERIAL=$(cd "$tool" && git log -1 --format="%ct" -- etc/nsd3/zone.d/"$domain".zone.m4) \ + --define=VM_IP4=$vm_ipv4 \ + "$tool"/etc/nsd3/zone.d/"$domain".zone.m4 + else cat "$tool"/etc/nsd3/zone.d/"$domain".zone + fi | + sudo install -m 440 -o root -g nsd /dev/stdin \ + /etc/nsd3/zone.d/"$domain".zone + sudo install -m 440 -o root -g nsd \ + "$tool"/etc/nsd3/zone.d/"$conf" \ + /etc/nsd3/zone.d/"$conf" + cat <<-EOF + zone: + name: $domain + zonefile: /etc/nsd3/zone.d/$domain.zone + EOF + done + } | + sudo install -m 640 -o root -g nsd /dev/stdin \ + /etc/nsd3/nsd.conf + sudo service nsd3 restart } rule_php5_fpm_configure () { local -; set +f @@ -1023,7 +1060,7 @@ rule_php5_fpm_configure () { sudo install -m 664 -o php5 -g php5 \ "$tool"/etc/php5/fpm/php.ini \ /etc/php5/fpm/php.ini - case $(sv status php5-"$pool") in + case $(sudo sv status php5-"$pool") in (run:*) sudo sv restart php5-"$pool" esac done @@ -1121,14 +1158,118 @@ rule_postfix_configure () { sudo service postfix restart } rule_postgresql_configure () { + # DOC: http://wiki.postgresql.org/wiki/Shared_Database_Hosting rule apt_get_install postgresql-9.1 - if [ ! -d /var/lib/postgresql/9.1/ ]; then - pg_createcluster -u postgres --start 9.1 main - fi - sudo install -m 660 -o root -g root \ - "$tool"/etc/postgresql/9.1/main/postgresql.conf \ - /etc/postgresql/9.1/main/postgresql.conf - sudo service postgresql restart + rule adduser postgres \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/postgresql \ + --shell /bin/false \ + --system + rule adduser postgres-data \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/postgresql/data \ + --no-create-home \ + --shell /bin/false \ + --system + sudo usermod --home /home/postgresql postgres + sudo adduser postgres postgres-data + sudo rm -rf \ + /etc/postgresql + sudo install -d -m 750 -o postgres -g postgres \ + /home/postgresql \ + /home/postgresql/etc \ + /etc/postgresql \ + /etc/postgresql/9.1 \ + /etc/postgresql/9.1/main + sudo ln -fns \ + /etc/postgresql \ + /home/postgresql/etc/postgresql + sudo install -d -m 751 -o postgres -g postgres \ + /home/postgresql/log \ + /home/postgresql/log/9.1 + sudo service tmpfs restart + if sudo test ! -d /home/postgresql/data + then + sudo install -d -m 750 -o postgres -g postgres \ + /home/postgresql/data + ( + cd / + sudo -u postgres pg_createcluster \ + --datadir=/home/postgresql/data \ + --logfile=/home/postgresql/log/9.1/main \ + --socketdir=/run/postgresql/sock \ + --start 9.1 main + ) + fi + sudo install -m 770 -o postgres -g postgres /dev/stdin \ + /etc/postgresql/9.1/main/pg_hba.conf <<-EOF + local all postgres peer + local all all peer + EOF + sudo install -m 660 -o postgres -g postgres \ + "$tool"/etc/postgresql/9.1/main/postgresql.conf \ + /etc/postgresql/9.1/main/postgresql.conf + sudo insserv -r postgresql + sudo chmod ugo-x /etc/init.d/postgresql + case $(sudo sv status postgres || true) in + (''|run:*|*"s, normally up;"*) + sudo sv restart postgres + ( + cd / + case $(sudo inotifywait -e create -- /run/postgresql/sock/) in + ("/run/postgresql/sock/ CREATE .s.PGSQL."*) + # NOTE: + # - supprime l'accès au schéma public depuis public, + # de sorte à ce que les différents utilisateurices + # ne voient pas leurs bases de données entre-elleux ; + # - ajoute le support de PL/PGSQL. + sudo -u postgres psql template1 -f - <<-EOF + REVOKE ALL ON DATABASE template1 FROM public; + REVOKE ALL ON SCHEMA public FROM public; + GRANT ALL ON SCHEMA public TO postgres; + CREATE LANGUAGE plpgsql; + EOF + # NOTE: + # - supprime l'accès à la liste des bases données + # et utilisateurices depuis public. + sudo -u postgres psql template1 -f - <<-EOF + REVOKE ALL ON pg_auth_members FROM public; + REVOKE ALL ON pg_authid FROM public; + REVOKE ALL ON pg_database FROM public; + REVOKE ALL ON pg_group FROM public; + REVOKE ALL ON pg_roles FROM public; + REVOKE ALL ON pg_settings FROM public; + REVOKE ALL ON pg_tablespace FROM public; + REVOKE ALL ON pg_user FROM public; + EOF + ;; + esac + ) + ;; + esac + } +rule_postgresql_db_add () { # SYNTAX: $db $db_user + local db="$1" db_user="$2" + sudo -u postgresql psql template1 -f - <<-EOF + CREATE ROLE $db NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOLOGIN; + CREATE ROLE $db_user NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT LOGIN ENCRYPTED; + GRANT $db TO $db_user; + CREATE DATABASE $db WITH OWNER=$db_user; + REVOKE ALL ON DATABASE $db FROM public; + EOF + } +rule_postgresql_db_user_add () { # SYNTAX: $db $user + local db="$1" user="$2" + sudo -u postgresql psql template1 -f - <<-EOF + CREATE ROLE $user NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT LOGIN ENCRYPTED; + GRANT USAGE ON SCHEMA public TO $user; + GRANT CONNECT,TEMPORARY ON DATABASE $db TO $user; + GRANT $db TO $user; + EOF } rule_openerp_configure () { sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF @@ -1152,7 +1293,7 @@ rule_procmail_configure () { "$tool"/etc/skel/etc/mail/delivery.procmailrc \ /etc/skel/etc/mail/delivery.procmailrc } -rule_runit_configure () { +rule_runit_configure () { # SYNTAX: $service rule apt_get_install runit local -; set +f for sv in ${1-/etc/service/*} @@ -1161,9 +1302,9 @@ rule_runit_configure () { local sv_hash=$(printf %s "$sv" | sha1sum | cut -f 1 -d ' ') local sv_status IFS= read -r sv_status_$sv_hash <<-EOF - $(sv status "$sv") + $(sudo sv status "$sv") EOF - rm -f /etc/service/"$sv" + sudo rm -f /etc/service/"$sv" done for sv in ${1-"$tool"/etc/sv/*} # NOTE: configure et (re-)démarre les services @@ -1182,13 +1323,13 @@ rule_runit_configure () { "$tool"/etc/sv/"$sv"/log/run \ /etc/sv/"$sv"/log/run fi - test ! -x "$tool"/etc/sv/"$sv"/configure || - "$tool"/etc/sv/"$sv"/configure - ln -fns ../sv/"$sv" /etc/service/"$sv" + test ! -r "$tool"/etc/sv/"$sv"/configure.sh || + . "$tool"/etc/sv/"$sv"/configure.sh + sudo ln -fns ../sv/"$sv" /etc/service/"$sv" eval local sv_status=\"\${sv_status_$sv_hash-}\" case $sv_status in - ("") sv start "$sv";; - (run:*) sv restart "$sv";; + ("") true;; + (run:*) sudo sv restart "$sv";; esac done } @@ -1204,43 +1345,59 @@ rule_ssh_configure () { /etc/ssh/ssh_host_ecdsa_key \ /etc/ssh/ssh_host_ecdsa_key.pub # NOTE: clefs générées par Debian - sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/sshd_config <<-EOF - Port 22 - ListenAddress $vm_ipv4 - #ListenAddress :: - Protocol 2 + sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/sshd_config <<-EOF + AcceptEnv LANG LC_* + AuthorizedKeysFile %h/etc/ssh/authorized_keys + ChallengeResponseAuthentication no + ClientAliveInterval 0 Compression yes + DebianBanner no + GSSAPIAuthentication no HostKey /etc/ssh/ssh_host_rsa_key - UsePrivilegeSeparation yes + HostbasedAuthentication no + IgnoreRhosts yes + IgnoreUserKnownHosts no + KerberosAuthentication no KeyRegenerationInterval 3600 - ServerKeyBits 768 - SyslogFacility AUTH + Port 22 + ListenAddress 127.0.0.1 + ListenAddress $vm_ipv4 LogLevel INFO LoginGraceTime 120 + PasswordAuthentication no + PermitEmptyPasswords no PermitRootLogin yes - StrictModes yes - RSAAuthentication yes + PrintLastLog yes + PrintMotd no + Protocol 2 PubkeyAuthentication yes - AuthorizedKeysFile %h/etc/ssh/authorized_keys - IgnoreRhosts yes + RSAAuthentication yes RhostsRSAAuthentication no - HostbasedAuthentication no - IgnoreUserKnownHosts no - PermitEmptyPasswords no - ChallengeResponseAuthentication no - PasswordAuthentication no - KerberosAuthentication no - GSSAPIAuthentication no - X11Forwarding no - X11DisplayOffset 10 - PrintMotd no - DebianBanner no - PrintLastLog yes - TCPKeepAlive yes - ClientAliveInterval 0 - AcceptEnv LANG LC_* + ServerKeyBits 768 + StrictModes yes Subsystem sftp /usr/lib/openssh/sftp-server + SyslogFacility AUTH + TCPKeepAlive yes UsePAM yes + UsePrivilegeSeparation yes + X11DisplayOffset 10 + X11Forwarding no + EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/ssh_config <<-EOF + Host * + #Compression yes + #CompressionLevel 9 + #ControlMaster auto + #ControlPath ~/var/run/ssh/sock/%h-%p-%r + GSSAPIAuthentication no + GSSAPIDelegateCredentials no + HashKnownHosts yes + IdentityFile ~/etc/ssh/id_dsa + IdentityFile ~/etc/ssh/id_rsa + IdentityFile ~/etc/ssh/identity + SendEnv LANG LC_* + StrictHostKeyChecking ask + UserKnownHostsFile ~/etc/ssh/known_hosts EOF sudo service ssh restart } @@ -1286,6 +1443,23 @@ rule_time_configure () { rule dpkg_reconfigure tzdata rule apt_get_install ntp } +rule_unbound_configure () { + sudo apt-get install unbound m4 + sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF + search ${vm_host#*.} + nameserver 127.0.0.1 + #nameserver ${vm_host_nameserver} + EOF + sudo install -m 440 -o unbound -g unbound \ + "$tool"/etc/unbound/named.cache \ + /etc/unbound/named.cache + m4 \ + --define=OUTGOING_INTERFACE=$vm_ipv4 \ + <"$tool"/etc/unbound/unbound.conf | + sudo install -m 440 -o unbound -g unbound /dev/stdin \ + /etc/unbound/unbound.conf + sudo service unbound restart + } rule_user_add () { # SYNTAX: $user rule user_configure local user=$1 @@ -1302,6 +1476,7 @@ rule_user_add () { # SYNTAX: $user done } rule_user_configure () { + rule apt_get_install bash-completion sudo install -m 660 -o root -g root /dev/stdin \ /etc/adduser.conf <<-EOF ADD_EXTRA_GROUPS=1 @@ -1346,7 +1521,7 @@ rule_user_configure () { ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac EOF sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF - %sudo ALL=(ALL) NOPASSWD: /usr/sbin/etckeeper unclean + %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean EOF sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF Defaults env_keep = " \\ @@ -1402,7 +1577,7 @@ rule_user_root_configure () { $users EOF do eval local home\; home="~$user" - cat "$home"/etc/ssh/authorized_keys + sudo cat "$home"/etc/ssh/authorized_keys done done | sudo install -m 640 -o root -g root /dev/stdin /root/etc/ssh/authorized_keys @@ -1411,6 +1586,34 @@ rule_user_root_configure () { do sudo gpg --import "$key" done } +rule_www_configure () { + rule adduser www \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/www \ + --shell /bin/false \ + --system + rule adduser log-www \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/www/log \ + --shell /bin/false \ + --system + #sudo adduser www www-data + sudo adduser www log-www + #sudo adduser log log-www + usermod --home /home/www/pub www-data + sudo install -d -m 751 -o www -g www \ + /home/www + sudo install -d -m 750 -o www -g www \ + /home/www/etc + sudo install -d -m 1771 -o www-data -g www-data \ + /home/www/pub + sudo install -d -m 1771 -o log-www -g log-www \ + /home/www/log + } rule_configure () { rule apt_configure rule git_configure @@ -1426,11 +1629,12 @@ rule_configure () { rule sysctl_configure rule user_configure rule mail_configure + rule gitolite_configure rule www_configure rule php5_fpm_configure rule nginx_configure #rule apache2_configure - rule gitolite_configure + rule nsd3_configure rule runit_configure }