freedombone-utils-setup 18KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Setup functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2016 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. if [ ! $PROJECT_NAME ]; then
  31. PROJECT_NAME='freedombone'
  32. fi
  33. DEFAULT_DOMAIN_NAME=
  34. DEFAULT_DOMAIN_CODE=
  35. MY_USERNAME=
  36. if [ ! $SYSTEM_TYPE ]; then
  37. SYSTEM_TYPE="full"
  38. fi
  39. # An optional configuration file which overrides some of these variables
  40. if [ ! $CONFIGURATION_FILE ]; then
  41. CONFIGURATION_FILE="$HOME/${PROJECT_NAME}.cfg"
  42. fi
  43. # Directory where source code is downloaded and compiled
  44. INSTALL_DIR=$HOME/build
  45. # device name for an attached usb drive
  46. USB_DRIVE=/dev/sda1
  47. # Location where the USB drive is mounted to
  48. USB_MOUNT=/mnt/usb
  49. # Number of days to keep backups for
  50. BACKUP_MAX_DAYS=30
  51. # file containing a list of remote locations to backup to
  52. # Format: [username@friendsdomain//home/username] [ssh_password]
  53. # With the only space character being between the server and the password
  54. FRIENDS_SERVERS_LIST=/home/$MY_USERNAME/backup.list
  55. export DEBIAN_FRONTEND=noninteractive
  56. # used to limit CPU usage
  57. CPULIMIT='/usr/bin/cpulimit -l 20 -e'
  58. # command to create a git repository
  59. CREATE_GIT_PROJECT_COMMAND='create-project'
  60. # File which keeps track of what has already been installed
  61. COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt
  62. # log file where details of remote backups are stored
  63. REMOTE_BACKUPS_LOG=/var/log/remotebackups.log
  64. # message if something fails to install
  65. CHECK_MESSAGE="Check your internet connection, /etc/network/interfaces and /etc/resolv.conf, then delete $COMPLETION_FILE, run 'rm -fR /var/lib/apt/lists/* && apt-get update --fix-missing' and run this script again. If hash sum mismatches persist then try setting $DEBIAN_REPO to a different mirror and also change /etc/apt/sources.list."
  66. # Default diffie-hellman key length in bits
  67. DH_KEYLENGTH=2048
  68. function detect_usb_drive {
  69. # sets to the highest available drive letter
  70. # which is likely to be the last drive connected
  71. read_config_param USB_DRIVE
  72. partition_number='1'
  73. if [[ "$1" == "nopath" ]]; then
  74. partition_number=''
  75. fi
  76. if [ -b /dev/sdb${partition_number} ]; then
  77. USB_DRIVE=/dev/sdb${partition_number}
  78. fi
  79. if [ -b /dev/sdc${partition_number} ]; then
  80. USB_DRIVE=/dev/sdc${partition_number}
  81. fi
  82. if [ -b /dev/sdd${partition_number} ]; then
  83. USB_DRIVE=/dev/sdd${partition_number}
  84. fi
  85. if [ -b /dev/sde${partition_number} ]; then
  86. USB_DRIVE=/dev/sde${partition_number}
  87. fi
  88. if [ -b /dev/sdf${partition_number} ]; then
  89. USB_DRIVE=/dev/sdf${partition_number}
  90. fi
  91. if [ -b /dev/sdg${partition_number} ]; then
  92. USB_DRIVE=/dev/sdg${partition_number}
  93. fi
  94. if [ -b /dev/sdh${partition_number} ]; then
  95. USB_DRIVE=/dev/sdh${partition_number}
  96. fi
  97. write_config_param USB_DRIVE "$USB_DRIVE"
  98. }
  99. function running_as_root {
  100. if [[ $EUID != 0 ]] ; then
  101. echo "0"
  102. else
  103. echo "1"
  104. fi
  105. }
  106. function reset_usb_devices {
  107. for xhci in /sys/bus/pci/drivers/?hci-pci ; do
  108. if ! cd $xhci ; then
  109. return
  110. fi
  111. echo "Resetting devices from $xhci..."
  112. for i in ????:??:??.? ; do
  113. echo -n "$i" > unbind
  114. echo -n "$i" > bind
  115. done
  116. done
  117. udevadm control --reload-rules
  118. }
  119. function initial_setup {
  120. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  121. return
  122. fi
  123. apt-get -yq remove --purge apache*
  124. apt-get -yq dist-upgrade
  125. apt-get -yq install ca-certificates
  126. apt-get -yq install apt-utils
  127. apt-get -yq install cryptsetup libgfshare-bin obnam sshpass wget avahi-daemon
  128. apt-get -yq install avahi-utils avahi-discover connect-proxy openssh-server
  129. apt-get -yq install sudo git dialog build-essential avahi-daemon avahi-utils
  130. apt-get -yq install avahi-discover avahi-autoipd iptables dnsutils net-tools
  131. apt-get -yq install network-manager iputils-ping libnss-mdns libnss-myhostname
  132. apt-get -yq install libnss-gw-name nano man ntp locales locales-all debconf
  133. apt-get -yq install wireless-tools wpasupplicant usbutils cryptsetup zsh
  134. apt-get -yq install pinentry-curses eatmydata iotop bc grub2 hostapd haveged
  135. apt-get -yq install cpulimit
  136. if [ ! -d $INSTALL_DIR ]; then
  137. mkdir -p $INSTALL_DIR
  138. fi
  139. mark_completed $FUNCNAME
  140. }
  141. function admin_user_sudo {
  142. if ! grep -q "$MY_USERNAME ALL=(ALL) ALL" $rootdir/etc/sudoers; then
  143. echo "$MY_USERNAME ALL=(ALL) ALL" >> $rootdir/etc/sudoers
  144. fi
  145. }
  146. function search_for_attached_usb_drive {
  147. # If a USB drive is attached then search for email,
  148. # gpg, ssh keys and emacs configuration
  149. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  150. return
  151. fi
  152. if [ -b $USB_DRIVE ]; then
  153. if [ ! -d $USB_MOUNT ]; then
  154. echo $'Mounting USB drive'
  155. mkdir $USB_MOUNT
  156. mount $USB_DRIVE $USB_MOUNT
  157. fi
  158. if [ -d $USB_MOUNT/Maildir ]; then
  159. echo $'Maildir found on USB drive'
  160. IMPORT_MAILDIR=$USB_MOUNT/Maildir
  161. fi
  162. if [ -d $USB_MOUNT/.gnupg ]; then
  163. echo $'Importing GPG keyring'
  164. cp -r $USB_MOUNT/.gnupg /home/$MY_USERNAME
  165. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.gnupg
  166. GPG_KEYS_IMPORTED="yes"
  167. if [ ! -f /home/$MY_USERNAME/.gnupg/secring.gpg ]; then
  168. echo $'GPG files did not copy'
  169. exit 73529
  170. fi
  171. fi
  172. if [ -f $USB_MOUNT/.procmailrc ]; then
  173. echo $'Importing procmail settings'
  174. cp $USB_MOUNT/.procmailrc /home/$MY_USERNAME
  175. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  176. fi
  177. if [ -f $USB_MOUNT/private_key.gpg ]; then
  178. echo $'GPG private key found on USB drive'
  179. MY_GPG_PRIVATE_KEY=$USB_MOUNT/private_key.gpg
  180. fi
  181. if [ -f $USB_MOUNT/public_key.gpg ]; then
  182. echo $'GPG public key found on USB drive'
  183. MY_GPG_PUBLIC_KEY=$USB_MOUNT/public_key.gpg
  184. fi
  185. if [ -d $USB_MOUNT/prosody ]; then
  186. if [ ! -d $XMPP_DIRECTORY ]; then
  187. mkdir $XMPP_DIRECTORY
  188. fi
  189. cp -r $USB_MOUNT/prosody/* $XMPP_DIRECTORY
  190. chown -R prosody:prosody $XMPP_DIRECTORY
  191. fi
  192. if [ -d $USB_MOUNT/.ssh ]; then
  193. echo $'Importing ssh keys'
  194. cp -r $USB_MOUNT/.ssh /home/$MY_USERNAME
  195. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
  196. # for security delete the ssh keys from the usb drive
  197. if [ ! -f /home/$MY_USERNAME/.ssh/id_rsa ]; then
  198. echo $'ssh files did not copy'
  199. exit 8
  200. fi
  201. fi
  202. if [ -f $USB_MOUNT/.emacs ]; then
  203. echo $'Importing .emacs file'
  204. cp -f $USB_MOUNT/.emacs /home/$MY_USERNAME/.emacs
  205. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.emacs
  206. fi
  207. if [ -d $USB_MOUNT/.emacs.d ]; then
  208. echo $'Importing .emacs.d directory'
  209. cp -r $USB_MOUNT/.emacs.d /home/$MY_USERNAME
  210. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.emacs.d
  211. fi
  212. if [ -d $USB_MOUNT/ssl ]; then
  213. echo $'Importing SSL certificates'
  214. cp -r $USB_MOUNT/ssl/* /etc/ssl
  215. chmod 640 /etc/ssl/certs/*
  216. chmod 400 /etc/ssl/private/*
  217. # change ownership of some certificates
  218. if [ -d /etc/prosody ]; then
  219. chown prosody:prosody /etc/ssl/private/xmpp.*
  220. chown prosody:prosody /etc/ssl/certs/xmpp.*
  221. fi
  222. if [ -d /etc/dovecot ]; then
  223. chown root:dovecot /etc/ssl/certs/dovecot.*
  224. chown root:dovecot /etc/ssl/private/dovecot.*
  225. fi
  226. if [ -f /etc/ssl/private/exim.key ]; then
  227. cp /etc/ssl/private/exim.key /etc/exim4
  228. cp /etc/ssl/certs/exim.crt /etc/exim4
  229. cp /etc/ssl/certs/exim.dhparam /etc/exim4
  230. chown root:Debian-exim /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  231. chmod 640 /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  232. fi
  233. fi
  234. if [ -d $USB_MOUNT/personal ]; then
  235. echo $'Importing personal directory'
  236. cp -r $USB_MOUNT/personal /home/$MY_USERNAME
  237. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/personal
  238. fi
  239. else
  240. if [ -d $USB_MOUNT ]; then
  241. umount $USB_MOUNT
  242. rm -rf $USB_MOUNT
  243. fi
  244. echo $'No USB drive attached'
  245. fi
  246. mark_completed $FUNCNAME
  247. }
  248. function mark_admin_user_account {
  249. set_completion_param "Admin user" "$MY_USERNAME"
  250. }
  251. function remove_instructions_from_motd {
  252. sed -i '/## /d' /etc/motd
  253. }
  254. function remove_default_user {
  255. # make sure you don't use the default user account
  256. if [[ $MY_USERNAME == "debian" ]]; then
  257. echo 'Do not use the default debian user account. Create a different user with: adduser [username]'
  258. exit 68
  259. fi
  260. # remove the default debian user to prevent it from becoming an attack vector
  261. if [ -d /home/debian ]; then
  262. userdel -r debian
  263. echo 'Default debian user account removed'
  264. fi
  265. }
  266. function create_completion_file {
  267. if [ ! -f $COMPLETION_FILE ]; then
  268. touch $COMPLETION_FILE
  269. fi
  270. }
  271. function upgrade_installation {
  272. # TODO
  273. echo ''
  274. }
  275. function setup_firewall {
  276. function_check create_completion_file
  277. create_completion_file
  278. function_check configure_firewall
  279. configure_firewall
  280. function_check configure_firewall_ping
  281. configure_firewall_ping
  282. function_check configure_firewall_for_dns
  283. configure_firewall_for_dns
  284. function_check configure_firewall_for_avahi
  285. configure_firewall_for_avahi
  286. function_check global_rate_limit
  287. global_rate_limit
  288. }
  289. function setup_utils {
  290. read_config_param "PROJECT_REPO"
  291. write_config_param "PROJECT_REPO" "$PROJECT_REPO"
  292. function_check create_completion_file
  293. create_completion_file
  294. function_check read_configuration
  295. read_configuration
  296. function_check check_system_type
  297. check_system_type
  298. function_check upgrade_installation
  299. upgrade_installation
  300. function_check set_default_onion_domains
  301. set_default_onion_domains
  302. function_check locale_setup
  303. locale_setup
  304. function_check parse_args
  305. parse_args
  306. function_check check_domains
  307. check_domains
  308. function_check install_static_network
  309. install_static_network
  310. function_check remove_default_user
  311. remove_default_user
  312. function_check setup_firewall
  313. setup_firewall
  314. function_check create_repo_sources
  315. create_repo_sources
  316. function_check configure_dns
  317. configure_dns
  318. function_check initial_setup
  319. initial_setup
  320. function_check install_tor
  321. install_tor
  322. #function_check resolve_dns_via_tor
  323. #resolve_dns_via_tor
  324. function_check install_command_line_browser
  325. install_command_line_browser
  326. function_check enable_ssh_via_onion
  327. enable_ssh_via_onion
  328. function_check check_date
  329. check_date
  330. function_check install_dynamicdns
  331. install_dynamicdns
  332. function_check randomize_cron
  333. randomize_cron
  334. function_check create_freedns_updater
  335. create_freedns_updater
  336. function_check mark_admin_user_account
  337. mark_admin_user_account
  338. function_check enforce_good_passwords
  339. enforce_good_passwords
  340. function_check change_login_message
  341. change_login_message
  342. function_check enable_zram
  343. enable_zram
  344. function_check random_number_generator
  345. random_number_generator
  346. function_check set_your_domain_name
  347. set_your_domain_name
  348. function_check configure_internet_protocol
  349. configure_internet_protocol
  350. function_check create_git_project
  351. create_git_project
  352. function_check setup_wifi
  353. setup_wifi
  354. function_check configure_ssh
  355. configure_ssh
  356. function_check configure_ssh_onion
  357. configure_ssh_onion
  358. function_check allow_ssh_to_onion_address
  359. allow_ssh_to_onion_address
  360. function_check remove_instructions_from_motd
  361. remove_instructions_from_motd
  362. function_check check_hwrng
  363. check_hwrng
  364. function_check search_for_attached_usb_drive
  365. search_for_attached_usb_drive
  366. function_check regenerate_ssh_keys
  367. regenerate_ssh_keys
  368. function_check create_mirrors
  369. create_mirrors
  370. function_check create_upgrade_script
  371. create_upgrade_script
  372. function_check letsencrypt_renewals
  373. letsencrypt_renewals
  374. function_check install_watchdog_script
  375. install_watchdog_script
  376. function_check install_avahi
  377. install_avahi
  378. function_check create_avahi_onion_domains
  379. create_avahi_onion_domains
  380. #function_check install_atheros_wifi
  381. #install_atheros_wifi
  382. function_check route_outgoing_traffic_through_tor
  383. route_outgoing_traffic_through_tor
  384. function_check upgrade_golang
  385. upgrade_golang
  386. function_check install_tomb
  387. install_tomb
  388. function_check admin_user_sudo
  389. admin_user_sudo
  390. }
  391. function setup_email {
  392. function_check create_completion_file
  393. create_completion_file
  394. function_check install_email
  395. install_email
  396. function_check create_procmail
  397. create_procmail
  398. function_check handle_admin_emails
  399. handle_admin_emails
  400. function_check spam_filtering
  401. spam_filtering
  402. function_check configure_imap
  403. configure_imap
  404. #function_check configure_imap_client_certs
  405. #configure_imap_client_certs
  406. function_check configure_gpg
  407. configure_gpg
  408. function_check refresh_gpg_keys
  409. refresh_gpg_keys
  410. function_check configure_backup_key
  411. configure_backup_key
  412. function_check install_monkeysphere
  413. install_monkeysphere
  414. function_check encrypt_incoming_email
  415. encrypt_incoming_email
  416. function_check encrypt_outgoing_email
  417. encrypt_outgoing_email
  418. function_check email_client
  419. email_client
  420. function_check email_archiving
  421. email_archiving
  422. function_check email_from_address
  423. email_from_address
  424. function_check create_public_mailing_list
  425. create_public_mailing_list
  426. #function check create_private_mailing_list
  427. #create_private_mailing_list
  428. function_check encrypt_all_email
  429. encrypt_all_email
  430. function_check import_email
  431. import_email
  432. }
  433. function setup_web {
  434. function_check create_completion_file
  435. create_completion_file
  436. function_check install_web_server
  437. install_web_server
  438. function_check install_web_server_access_control
  439. install_web_server_access_control
  440. }
  441. function upgrade_apps {
  442. function_check create_completion_file
  443. create_completion_file
  444. APPS_COMPLETED=()
  445. FILES=/usr/share/${PROJECT_NAME}/apps/${PROJECT_NAME}-app-*
  446. # for all the app scripts
  447. for filename in $FILES
  448. do
  449. app_name=$(echo "${filename}" | awk -F '-app-' '{print $2}')
  450. item_in_array "${app_name}" "${APPS_COMPLETED[@]}"
  451. if [[ $? != 0 ]]; then
  452. function_check app_is_installed
  453. if [[ "$(app_is_installed $a)" == "1" ]]; then
  454. app_load_variables ${app_name}
  455. APPS_COMPLETED+=("${app_name}")
  456. function_check upgrade_${app_name}
  457. upgrade_${app_name}
  458. fi
  459. fi
  460. done
  461. }
  462. function setup_apps {
  463. is_interactive=$1
  464. function_check create_completion_file
  465. create_completion_file
  466. function_check detect_installable_apps
  467. detect_installable_apps
  468. function_check choose_apps_for_variant
  469. choose_apps_for_variant "$SYSTEM_TYPE"
  470. echo $"System variant: $SYSTEM_TYPE"
  471. echo $'The following apps have been selected'
  472. echo ''
  473. function_check list_chosen_apps
  474. list_chosen_apps
  475. echo ''
  476. function_check upgrade_apps
  477. upgrade_apps
  478. if [[ $is_interactive == "menuconfig"* ]]; then
  479. ${PROJECT_NAME}-addremove add-all
  480. if [ ! "$?" = "0" ]; then
  481. exit 72524
  482. fi
  483. fi
  484. if [[ $is_interactive == "noninteractive" || $is_interactive == "headless" ]]; then
  485. function_check install_apps
  486. install_apps
  487. if [ ! $APP_INSTALLED_SUCCESS ]; then
  488. echo $'One or more apps failed to install'
  489. fi
  490. fi
  491. }
  492. function combine_all_scripts {
  493. combined_filename=$1
  494. # initial variables
  495. cp $PROJECT_INSTALL_DIR/${PROJECT_NAME}-vars $combined_filename
  496. # utilities
  497. UTILS_FILES=/usr/share/${PROJECT_NAME}/utils/${PROJECT_NAME}-utils-*
  498. for f in $UTILS_FILES
  499. do
  500. # this removes the first line, which is #!/bin/bash
  501. tail -n +2 "$f" >> $combined_filename
  502. done
  503. # base system
  504. BASE_SYSTEM_FILES=/usr/share/${PROJECT_NAME}/base/${PROJECT_NAME}-base-*
  505. for f in $BASE_SYSTEM_FILES
  506. do
  507. tail -n +2 "$f" >> $combined_filename
  508. done
  509. # apps
  510. APP_FILES=/usr/share/${PROJECT_NAME}/apps/${PROJECT_NAME}-app-*
  511. for f in $APP_FILES
  512. do
  513. tail -n +2 "$f" >> $combined_filename
  514. done
  515. }
  516. # NOTE: deliberately no exit 0