install-freedombone.sh 52KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184
  1. #!/bin/bash
  2. # Freedombone install script intended for use with Debian Jessie
  3. #
  4. # Note on dynamic dns
  5. # ===================
  6. #
  7. # I'm not particularly trying to promote freedns.afraid.org
  8. # as a service, it just happens to be a dynamic DNS system which
  9. # provides free (as in beer) accounts, and I'm trying to make the
  10. # process of setting up a working server as trivial as possible.
  11. # Other dynamic DNS systems are available, and if you're using
  12. # something different then comment out the section within
  13. # argument_checks and the call to dynamic_dns_freedns.
  14. #
  15. # Prerequisites
  16. # =============
  17. #
  18. # cd ~/
  19. # wget http://freedombone.uk.to/debian-jessie-console-armhf-2014-08-13.tar.xz
  20. #
  21. # Verify it.
  22. #
  23. # sha256sum debian-jessie-console-armhf-2014-08-13.tar.xz
  24. # fc225cfb3c2dfad92cccafa97e92c3cd3db9d94f4771af8da364ef59609f43de
  25. #
  26. # Uncompress it.
  27. #
  28. # tar xJf debian-jessie-console-armhf-2014-08-13.tar.xz
  29. # cd debian-jessie-console-armhf-2014-08-13
  30. #
  31. # sudo apt-get install u-boot-tools dosfstools git-core kpartx wget parted
  32. # sudo ./setup_sdcard.sh --mmc /dev/sdX --dtb beaglebone
  33. #
  34. # When finished eject the micrtoSD then reinsert it
  35. #
  36. # sudo cp /media/$USER/BOOT/bbb-uEnv.txt /media/$USER/BOOT/uEnv.txt
  37. # sync
  38. #
  39. # Eject microSD, insert into BBB, attach USB cable between BBB and laptop.
  40. # On Ubuntu wait until you see the "connected" message.
  41. #
  42. # ssh-keygen -f "/home/$USER/.ssh/known_hosts" -R 192.168.7.2
  43. # ssh debian@192.168.7.2 (password "temppwd")
  44. # su (password "root")
  45. # passwd
  46. # adduser $MY_USERNAME
  47. # sed -i '/iface eth0 inet dhcp/a\iface eth0 inet static' /etc/network/interfaces
  48. # sed -i '/iface eth0 inet static/a\ dns-nameservers 213.73.91.35 85.214.20.141' /etc/network/interfaces
  49. # sed -i "/iface eth0 inet static/a\ gateway $MY_ROUTER_IP" /etc/network/interfaces
  50. # sed -i '/iface eth0 inet static/a\ netmask 255.255.255.0' /etc/network/interfaces
  51. # sed -i "/iface eth0 inet static/a\ address $MY_BBB_STATIC_IP" /etc/network/interfaces
  52. # sed -i '/iface usb0 inet static/,/ gateway 192.168.7.1/ s/^/#/' /etc/network/interfaces
  53. # shutdown now
  54. #
  55. # Connect BBB to router
  56. #
  57. # scp install-freedombone.sh $MY_USERNAME@$MY_BBB_STATIC_IP:/home/$MY_USERNAME
  58. # ssh $MY_USERNAME@$MY_BBB_STATIC_IP
  59. # su
  60. # ./install-freedombone.sh [DOMAIN_NAME] [MY_USERNAME]
  61. DOMAIN_NAME=$1
  62. MY_USERNAME=$2
  63. FREEDNS_SUBDOMAIN_CODE=$3
  64. SSH_PORT=2222
  65. KERNEL_VERSION="v3.15.10-bone7"
  66. USE_HWRNG="yes"
  67. GPG_KEYSERVER="hkp://keys.gnupg.net"
  68. # optionally you can provide your exported GPG key pair here
  69. # Note that the private key file will be deleted after use
  70. # If these are unspecified then a new GPG key will be created
  71. MY_GPG_PUBLIC_KEY=
  72. MY_GPG_PRIVATE_KEY=
  73. # If you have existing mail within a Maildir
  74. # you can specify the directory here and the files
  75. # will be imported
  76. IMPORT_MAILDIR=
  77. # The Debian package repository to use.
  78. DEBIAN_REPO="ftp.de.debian.org"
  79. DEBIAN_VERSION="jessie"
  80. # Directory where source code is downloaded and compiled
  81. INSTALL_DIR=/root/build
  82. # device name for an attached usb drive
  83. USB_DRIVE=/dev/sda1
  84. export DEBIAN_FRONTEND=noninteractive
  85. # File which keeps track of what has already been installed
  86. COMPLETION_FILE=/root/freedombone-completed.txt
  87. if [ ! -f $COMPLETION_FILE ]; then
  88. touch $COMPLETION_FILE
  89. fi
  90. function argument_checks {
  91. SYNTAX='./install-freedombone.sh [domain] [username] [subdomain code]'
  92. if [ ! -d /home/$MY_USERNAME ]; then
  93. echo "There is no user '$MY_USERNAME' on the system. Use 'adduser $MY_USERNAME' to create the user."
  94. exit 1
  95. fi
  96. if [ ! $DOMAIN_NAME ]; then
  97. echo ''
  98. echo $SYNTAX
  99. echo 'Please specify your domain name'
  100. exit 2
  101. fi
  102. if [ ! $MY_USERNAME ]; then
  103. echo ''
  104. echo $SYNTAX
  105. echo 'Please specify your username'
  106. exit 3
  107. fi
  108. if [ ! $FREEDNS_SUBDOMAIN_CODE ]; then
  109. echo ''
  110. echo $SYNTAX
  111. echo 'Please specify the freedns subdomain code. To find it from '
  112. echo "https://freedns.afraid.org select 'Dynamic DNS', then 'quick "
  113. echo "cron example' and copy the code located between '?' and '=='."
  114. exit 4
  115. fi
  116. }
  117. function change_login_message {
  118. if grep -Fxq "change_login_message" $COMPLETION_FILE; then
  119. return
  120. fi
  121. echo '' > /etc/motd
  122. echo ".---. . . " >> /etc/motd
  123. echo "| | | " >> /etc/motd
  124. echo "|--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-. " >> /etc/motd
  125. echo "| | (.-' (.-' ( | ( )| | | | )( )| | (.-' " >> /etc/motd
  126. echo "' ' --' --' -' - -' ' ' -' -' -' ' - --'" >> /etc/motd
  127. echo '' >> /etc/motd
  128. echo ' Freedom in the Cloud' >> /etc/motd
  129. echo '' >> /etc/motd
  130. echo 'change_login_message' >> $COMPLETION_FILE
  131. }
  132. function search_for_attached_usb_drive {
  133. # If a USB drive is attached then search for email,
  134. # gpg and ssh keys and change the directories accordingly
  135. if grep -Fxq "search_for_attached_usb_drive" $COMPLETION_FILE; then
  136. return
  137. fi
  138. if [ -d $USB_DRIVE ]; then
  139. mount $USB_DRIVE /media/usb
  140. if [ -d /media/usb/Maildir ]; then
  141. IMPORT_MAILDIR=/media/usb/Maildir
  142. fi
  143. if [ -d /media/usb/.gnupg ]; then
  144. cp -r /media/usb/.gnupg /home/$MY_USERNAME/.gnupg
  145. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.gnupg
  146. shred -zu /media/usb/.gnupg/secring.gpg
  147. shred -zu /media/usb/.gnupg/random_seed
  148. shred -zu /media/usb/.gnupg/trustdb.gpg
  149. rm -rf /media/usb/.gnupg
  150. fi
  151. if [ -f /media/usb/private_key.gpg ]; then
  152. MY_GPG_PRIVATE_KEY=/media/usb/private_key.gpg
  153. fi
  154. if [ -f /media/usb/public_key.gpg ]; then
  155. MY_GPG_PUBLIC_KEY=/media/usb/public_key.gpg
  156. fi
  157. if [ -d /media/usb/.ssh ]; then
  158. cp -r /media/usb/.ssh /home/$MY_USERNAME/.ssh
  159. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
  160. # for security delete the ssh keys from the usb drive
  161. shred -zu /media/usb/.ssh/id_rsa
  162. shred -zu /media/usb/.ssh/id_rsa.pub
  163. shred -zu /media/usb/.ssh/known_hosts
  164. rm -rf /media/usb/.ssh
  165. fi
  166. fi
  167. echo 'search_for_attached_usb_drive' >> $COMPLETION_FILE
  168. }
  169. function remove_proprietary_repos {
  170. if grep -Fxq "remove_proprietary_repos" $COMPLETION_FILE; then
  171. return
  172. fi
  173. sed -i 's/ non-free//g' /etc/apt/sources.list
  174. echo 'remove_proprietary_repos' >> $COMPLETION_FILE
  175. }
  176. function change_debian_repos {
  177. if grep -Fxq "change_debian_repos" $COMPLETION_FILE; then
  178. return
  179. fi
  180. rm -rf /var/lib/apt/lists/*
  181. apt-get clean
  182. sed -i "s/ftp.us.debian.org/$DEBIAN_REPO/g" /etc/apt/sources.list
  183. # ensure that there is a security repo
  184. if ! grep -q "security" /etc/apt/sources.list; then
  185. if grep -q "jessie" /etc/apt/sources.list; then
  186. echo "deb http://security.debian.org/ jessie/updates main contrib" >> /etc/apt/sources.list
  187. echo "#deb-src http://security.debian.org/ jessie/updates main contrib" >> /etc/apt/sources.list
  188. else
  189. if grep -q "wheezy" /etc/apt/sources.list; then
  190. echo "deb http://security.debian.org/ wheezy/updates main contrib" >> /etc/apt/sources.list
  191. echo "#deb-src http://security.debian.org/ wheezy/updates main contrib" >> /etc/apt/sources.list
  192. fi
  193. fi
  194. fi
  195. apt-get update
  196. apt-get -y --force-yes install apt-transport-https
  197. echo 'change_debian_repos' >> $COMPLETION_FILE
  198. }
  199. function initial_setup {
  200. if grep -Fxq "initial_setup" $COMPLETION_FILE; then
  201. return
  202. fi
  203. apt-get -y remove --purge apache*
  204. apt-get -y dist-upgrade
  205. apt-get -y install ca-certificates emacs24
  206. echo 'initial_setup' >> $COMPLETION_FILE
  207. }
  208. function install_editor {
  209. if grep -Fxq "install_editor" $COMPLETION_FILE; then
  210. return
  211. fi
  212. update-alternatives --set editor /usr/bin/emacs24
  213. echo 'install_editor' >> $COMPLETION_FILE
  214. }
  215. function enable_backports {
  216. if grep -Fxq "enable_backports" $COMPLETION_FILE; then
  217. return
  218. fi
  219. if ! grep -Fxq "deb http://$DEBIAN_REPO/debian jessie-backports main" /etc/apt/sources.list; then
  220. echo "deb http://$DEBIAN_REPO/debian jessie-backports main" >> /etc/apt/sources.list
  221. fi
  222. echo 'enable_backports' >> $COMPLETION_FILE
  223. }
  224. function update_the_kernel {
  225. if grep -Fxq "update_the_kernel" $COMPLETION_FILE; then
  226. return
  227. fi
  228. cd /opt/scripts/tools
  229. ./update_kernel.sh --kernel $KERNEL_VERSION
  230. echo 'update_the_kernel' >> $COMPLETION_FILE
  231. }
  232. function enable_zram {
  233. if grep -Fxq "enable_zram" $COMPLETION_FILE; then
  234. return
  235. fi
  236. if ! grep -q "options zram num_devices=1" /etc/modprobe.d/zram.conf; then
  237. echo 'options zram num_devices=1' >> /etc/modprobe.d/zram.conf
  238. fi
  239. echo '#!/bin/bash' > /etc/init.d/zram
  240. echo '### BEGIN INIT INFO' >> /etc/init.d/zram
  241. echo '# Provides: zram' >> /etc/init.d/zram
  242. echo '# Required-Start:' >> /etc/init.d/zram
  243. echo '# Required-Stop:' >> /etc/init.d/zram
  244. echo '# Default-Start: 2 3 4 5' >> /etc/init.d/zram
  245. echo '# Default-Stop: 0 1 6' >> /etc/init.d/zram
  246. echo '# Short-Description: Increased Performance In Linux With zRam (Virtual Swap Compressed in RAM)' >> /etc/init.d/zram
  247. echo '# Description: Adapted from systemd scripts at https://github.com/mystilleef/FedoraZram' >> /etc/init.d/zram
  248. echo '### END INIT INFO' >> /etc/init.d/zram
  249. echo 'start() {' >> /etc/init.d/zram
  250. echo ' # get the number of CPUs' >> /etc/init.d/zram
  251. echo ' num_cpus=$(grep -c processor /proc/cpuinfo)' >> /etc/init.d/zram
  252. echo ' # if something goes wrong, assume we have 1' >> /etc/init.d/zram
  253. echo ' [ "$num_cpus" != 0 ] || num_cpus=1' >> /etc/init.d/zram
  254. echo ' # set decremented number of CPUs' >> /etc/init.d/zram
  255. echo ' decr_num_cpus=$((num_cpus - 1))' >> /etc/init.d/zram
  256. echo ' # get the amount of memory in the machine' >> /etc/init.d/zram
  257. echo ' mem_total_kb=$(grep MemTotal /proc/meminfo | grep -E --only-matching "[[:digit:]]+")' >> /etc/init.d/zram
  258. echo ' mem_total=$((mem_total_kb * 1024))' >> /etc/init.d/zram
  259. echo ' # load dependency modules' >> /etc/init.d/zram
  260. echo ' modprobe zram num_devices=$num_cpus' >> /etc/init.d/zram
  261. echo ' # initialize the devices' >> /etc/init.d/zram
  262. echo ' for i in $(seq 0 $decr_num_cpus); do' >> /etc/init.d/zram
  263. echo ' echo $((mem_total / num_cpus)) > /sys/block/zram$i/disksize' >> /etc/init.d/zram
  264. echo ' done' >> /etc/init.d/zram
  265. echo ' # Creating swap filesystems' >> /etc/init.d/zram
  266. echo ' for i in $(seq 0 $decr_num_cpus); do' >> /etc/init.d/zram
  267. echo ' mkswap /dev/zram$i' >> /etc/init.d/zram
  268. echo ' done' >> /etc/init.d/zram
  269. echo ' # Switch the swaps on' >> /etc/init.d/zram
  270. echo ' for i in $(seq 0 $decr_num_cpus); do' >> /etc/init.d/zram
  271. echo ' swapon -p 100 /dev/zram$i' >> /etc/init.d/zram
  272. echo ' done' >> /etc/init.d/zram
  273. echo '}' >> /etc/init.d/zram
  274. echo 'stop() {' >> /etc/init.d/zram
  275. echo ' # get the number of CPUs' >> /etc/init.d/zram
  276. echo ' num_cpus=$(grep -c processor /proc/cpuinfo)' >> /etc/init.d/zram
  277. echo ' # set decremented number of CPUs' >> /etc/init.d/zram
  278. echo ' decr_num_cpus=$((num_cpus - 1))' >> /etc/init.d/zram
  279. echo ' # Switching off swap' >> /etc/init.d/zram
  280. echo ' for i in $(seq 0 $decr_num_cpus); do' >> /etc/init.d/zram
  281. echo ' if [ "$(grep /dev/zram$i /proc/swaps)" != "" ]; then' >> /etc/init.d/zram
  282. echo ' swapoff /dev/zram$i' >> /etc/init.d/zram
  283. echo ' sleep 1' >> /etc/init.d/zram
  284. echo ' fi' >> /etc/init.d/zram
  285. echo ' done' >> /etc/init.d/zram
  286. echo ' sleep 1' >> /etc/init.d/zram
  287. echo ' rmmod zram' >> /etc/init.d/zram
  288. echo '}' >> /etc/init.d/zram
  289. echo 'case "$1" in' >> /etc/init.d/zram
  290. echo ' start)' >> /etc/init.d/zram
  291. echo ' start' >> /etc/init.d/zram
  292. echo ' ;;' >> /etc/init.d/zram
  293. echo ' stop)' >> /etc/init.d/zram
  294. echo ' stop' >> /etc/init.d/zram
  295. echo ' ;;' >> /etc/init.d/zram
  296. echo ' restart)' >> /etc/init.d/zram
  297. echo ' stop' >> /etc/init.d/zram
  298. echo ' sleep 3' >> /etc/init.d/zram
  299. echo ' start' >> /etc/init.d/zram
  300. echo ' ;;' >> /etc/init.d/zram
  301. echo ' *)' >> /etc/init.d/zram
  302. echo ' echo "Usage: $0 {start|stop|restart}"' >> /etc/init.d/zram
  303. echo ' RETVAL=1' >> /etc/init.d/zram
  304. echo 'esac' >> /etc/init.d/zram
  305. echo 'exit $RETVAL' >> /etc/init.d/zram
  306. chmod +x /etc/init.d/zram
  307. update-rc.d zram defaults
  308. echo 'enable_zram' >> $COMPLETION_FILE
  309. }
  310. function random_number_generator {
  311. if grep -Fxq "random_number_generator" $COMPLETION_FILE; then
  312. return
  313. fi
  314. if [ $USE_HWRNG == "yes" ]; then
  315. apt-get -y --force-yes install rng-tools
  316. sed -i 's|#HRNGDEVICE=/dev/hwrng|HRNGDEVICE=/dev/hwrng|g' /etc/default/rng-tools
  317. else
  318. apt-get -y --force-yes install haveged
  319. fi
  320. echo 'random_number_generator' >> $COMPLETION_FILE
  321. }
  322. function configure_ssh {
  323. if grep -Fxq "configure_ssh" $COMPLETION_FILE; then
  324. return
  325. fi
  326. sed -i "s/Port 22/Port $SSH_PORT/g" /etc/ssh/sshd_config
  327. sed -i 's/PermitRootLogin without-password/PermitRootLogin no/g' /etc/ssh/sshd_config
  328. sed -i 's/X11Forwarding yes/X11Forwarding no/g' /etc/ssh/sshd_config
  329. sed -i 's/ServerKeyBits 1024/ServerKeyBits 4096/g' /etc/ssh/sshd_config
  330. sed -i 's/TCPKeepAlive yes/TCPKeepAlive no/g' /etc/ssh/sshd_config
  331. sed -i 's|HostKey /etc/ssh/ssh_host_dsa_key|#HostKey /etc/ssh/ssh_host_dsa_key|g' /etc/ssh/sshd_config
  332. sed -i 's|HostKey /etc/ssh/ssh_host_ecdsa_key|#HostKey /etc/ssh/ssh_host_ecdsa_key|g' /etc/ssh/sshd_config
  333. echo 'ClientAliveInterval 60' >> /etc/ssh/sshd_config
  334. echo 'ClientAliveCountMax 3' >> /etc/ssh/sshd_config
  335. echo 'Ciphers aes256-ctr,aes128-ctr' >> /etc/ssh/sshd_config
  336. echo 'MACs hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
  337. KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1' >> /etc/ssh/sshd_config
  338. apt-get -y --force-yes install fail2ban
  339. echo 'configure_ssh' >> $COMPLETION_FILE
  340. echo ''
  341. echo ''
  342. echo ' *** Rebooting to initialise ssh settings and random number generator ***'
  343. echo ''
  344. echo " *** Reconnect via ssh on port $SSH_PORT, then run this script again ***"
  345. echo ''
  346. reboot
  347. }
  348. function regenerate_ssh_keys {
  349. if grep -Fxq "regenerate_ssh_keys" $COMPLETION_FILE; then
  350. return
  351. fi
  352. rm -f /etc/ssh/ssh_host_*
  353. dpkg-reconfigure openssh-server
  354. service ssh restart
  355. echo 'regenerate_ssh_keys' >> $COMPLETION_FILE
  356. }
  357. function configure_dns {
  358. if grep -Fxq "configure_dns" $COMPLETION_FILE; then
  359. return
  360. fi
  361. echo 'domain localdomain' > /etc/resolv.conf
  362. echo 'search localdomain' >> /etc/resolv.conf
  363. echo 'nameserver 213.73.91.35' >> /etc/resolv.conf
  364. echo 'nameserver 85.214.20.141' >> /etc/resolv.conf
  365. echo 'configure_dns' >> $COMPLETION_FILE
  366. }
  367. function set_your_domain_name {
  368. if grep -Fxq "set_your_domain_name" $COMPLETION_FILE; then
  369. return
  370. fi
  371. echo "$DOMAIN_NAME" > /etc/hostname
  372. hostname $DOMAIN_NAME
  373. sed -i "s/127.0.1.1 arm/127.0.1.1 $DOMAIN_NAME/g" /etc/hosts
  374. echo "127.0.1.1 $DOMAIN_NAME" >> /etc/hosts
  375. echo 'set_your_domain_name' >> $COMPLETION_FILE
  376. }
  377. function time_synchronisation {
  378. if grep -Fxq "time_synchronisation" $COMPLETION_FILE; then
  379. return
  380. fi
  381. apt-get -y --force-yes install tlsdate
  382. apt-get -y remove ntpdate
  383. echo '#!/bin/bash' > /usr/bin/updatedate
  384. echo 'TIMESOURCE=google.com' >> /usr/bin/updatedate
  385. echo 'TIMESOURCE2=www.ptb.de' >> /usr/bin/updatedate
  386. echo 'LOGFILE=/var/log/tlsdate.log' >> /usr/bin/updatedate
  387. echo 'TIMEOUT=5' >> /usr/bin/updatedate
  388. echo "EMAIL=$MY_USERNAME@$DOMAIN_NAME" >> /usr/bin/updatedate
  389. echo '# File which contains the previous date as a number' >> /usr/bin/updatedate
  390. echo 'BEFORE_DATE_FILE=/var/log/tlsdateprevious.txt' >> /usr/bin/updatedate
  391. echo '# File which contains the previous date as a string' >> /usr/bin/updatedate
  392. echo 'BEFORE_FULLDATE_FILE=/var/log/tlsdate.txt' >> /usr/bin/updatedate
  393. echo 'DATE_BEFORE=$(date)' >> /usr/bin/updatedate
  394. echo 'BEFORE=$(date -d "$Y-$M-$D" "+%s")' >> /usr/bin/updatedate
  395. echo 'BACKWARDS_BETWEEN=0' >> /usr/bin/updatedate
  396. echo '# If the date was previously set' >> /usr/bin/updatedate
  397. echo 'if [[ -f "$BEFORE_DATE_FILE" ]]; then' >> /usr/bin/updatedate
  398. echo ' BEFORE_FILE=$(cat $BEFORE_DATE_FILE)' >> /usr/bin/updatedate
  399. echo ' BEFORE_FULLDATE=$(cat $BEFORE_FULLDATE_FILE)' >> /usr/bin/updatedate
  400. echo ' # is the date going backwards?' >> /usr/bin/updatedate
  401. echo ' if (( BEFORE_FILE > BEFORE )); then' >> /usr/bin/updatedate
  402. echo ' echo -n "Date went backwards between tlsdate updates. " >> $LOGFILE' >> /usr/bin/updatedate
  403. echo ' echo -n "$BEFORE_FILE > $BEFORE, " >> $LOGFILE' >> /usr/bin/updatedate
  404. echo ' echo "$BEFORE_FULLDATE > $DATE_BEFORE" >> $LOGFILE' >> /usr/bin/updatedate
  405. echo ' # Send a warning email' > /usr/bin/updatedate
  406. echo ' echo $(tail $LOGFILE -n 2) | mail -s "tlsdate anomaly" $EMAIL' >> /usr/bin/updatedate
  407. echo ' # Try another time source' >> /usr/bin/updatedate
  408. echo ' TIMESOURCE=$TIMESOURCE2' >> /usr/bin/updatedate
  409. echo ' # try running without any parameters' >> /usr/bin/updatedate
  410. echo ' tlsdate >> $LOGFILE' >> /usr/bin/updatedate
  411. echo ' BACKWARDS_BETWEEN=1' >> /usr/bin/updatedate
  412. echo ' fi' >> /usr/bin/updatedate
  413. echo 'fi' >> /usr/bin/updatedate
  414. echo '# Set the date' >> /usr/bin/updatedate
  415. echo '/usr/bin/timeout $TIMEOUT tlsdate -l -t -H $TIMESOURCE -p 443 >> $LOGFILE' >> /usr/bin/updatedate
  416. echo 'DATE_AFTER=$(date)' >> /usr/bin/updatedate
  417. echo 'AFTER=$(date -d "$Y-$M-$D" '+%s')' >> /usr/bin/updatedate
  418. echo '# After setting the date did it go backwards?' >> /usr/bin/updatedate
  419. echo 'if (( AFTER < BEFORE )); then' >> /usr/bin/updatedate
  420. echo ' echo "Incorrect date: $DATE_BEFORE -> $DATE_AFTER" >> $LOGFILE' >> /usr/bin/updatedate
  421. echo ' # Send a warning email' >> /usr/bin/updatedate
  422. echo ' echo $(tail $LOGFILE -n 2) | mail -s "tlsdate anomaly" $EMAIL' >> /usr/bin/updatedate
  423. echo ' # Try resetting the date from another time source' >> /usr/bin/updatedate
  424. echo ' /usr/bin/timeout $TIMEOUT tlsdate -l -t -H $TIMESOURCE2 -p 443 >> $LOGFILE' >> /usr/bin/updatedate
  425. echo ' DATE_AFTER=$(date)' >> /usr/bin/updatedate
  426. echo ' AFTER=$(date -d "$Y-$M-$D" "+%s")' >> /usr/bin/updatedate
  427. echo 'else' >> /usr/bin/updatedate
  428. echo ' echo -n $TIMESOURCE >> $LOGFILE' >> /usr/bin/updatedate
  429. echo ' if [[ -f "$BEFORE_DATE_FILE" ]]; then' >> /usr/bin/updatedate
  430. echo ' echo -n " " >> $LOGFILE' >> /usr/bin/updatedate
  431. echo ' echo -n $BEFORE_FILE >> $LOGFILE' >> /usr/bin/updatedate
  432. echo ' fi' >> /usr/bin/updatedate
  433. echo ' echo -n " " >> $LOGFILE' >> /usr/bin/updatedate
  434. echo ' echo -n $BEFORE >> $LOGFILE' >> /usr/bin/updatedate
  435. echo ' echo -n " " >> $LOGFILE' >> /usr/bin/updatedate
  436. echo ' echo -n $AFTER >> $LOGFILE' >> /usr/bin/updatedate
  437. echo ' echo -n " " >> $LOGFILE' >> /usr/bin/updatedate
  438. echo ' echo $DATE_AFTER >> $LOGFILE' >> /usr/bin/updatedate
  439. echo 'fi' >> /usr/bin/updatedate
  440. echo '# Log the last date' >> /usr/bin/updatedate
  441. echo 'if [ BACKWARDS_BETWEEN == 0 ]; then' >> /usr/bin/updatedate
  442. echo ' echo "$AFTER" > $BEFORE_DATE_FILE' >> /usr/bin/updatedate
  443. echo ' echo "$DATE_AFTER" > $BEFORE_FULLDATE_FILE' >> /usr/bin/updatedate
  444. echo ' exit 0' >> /usr/bin/updatedate
  445. echo 'else' >> /usr/bin/updatedate
  446. echo ' exit 1' >> /usr/bin/updatedate
  447. echo 'fi' >> /usr/bin/updatedate
  448. chmod +x /usr/bin/updatedate
  449. echo '*/15 * * * * root /usr/bin/updatedate' >> /etc/crontab
  450. service cron restart
  451. echo '#!/bin/bash' > /etc/init.d/tlsdate
  452. echo '# /etc/init.d/tlsdate' >> /etc/init.d/tlsdate
  453. echo '### BEGIN INIT INFO' >> /etc/init.d/tlsdate
  454. echo '# Provides: tlsdate' >> /etc/init.d/tlsdate
  455. echo '# Required-Start: $remote_fs $syslog' >> /etc/init.d/tlsdate
  456. echo '# Required-Stop: $remote_fs $syslog' >> /etc/init.d/tlsdate
  457. echo '# Default-Start: 2 3 4 5' >> /etc/init.d/tlsdate
  458. echo '# Default-Stop: 0 1 6' >> /etc/init.d/tlsdate
  459. echo '# Short-Description: Initially calls tlsdate with the timewarp option' >> /etc/init.d/tlsdate
  460. echo '# Description: Initially calls tlsdate with the timewarp option' >> /etc/init.d/tlsdate
  461. echo '### END INIT INFO' >> /etc/init.d/tlsdate
  462. echo '# Author: Bob Mottram <bob@robotics.uk.to>' >> /etc/init.d/tlsdate
  463. echo 'PATH="/usr/local/sbin:/usr/local/bin:/usr/bin:/sbin:/usr/sbin:/bin"' >> /etc/init.d/tlsdate
  464. echo 'LOGFILE="/var/log/tlsdate.log"' >> /etc/init.d/tlsdate
  465. echo 'TLSDATECOMMAND="tlsdate --timewarp -l -H www.ptb.de -p 443 >> $LOGFILE"' >> /etc/init.d/tlsdate
  466. echo '#Start-Stop here' >> /etc/init.d/tlsdate
  467. echo 'case "$1" in' >> /etc/init.d/tlsdate
  468. echo ' start)' >> /etc/init.d/tlsdate
  469. echo ' echo "tlsdate started"' >> /etc/init.d/tlsdate
  470. echo ' $TLSDATECOMMAND' >> /etc/init.d/tlsdate
  471. echo ' ;;' >> /etc/init.d/tlsdate
  472. echo ' stop)' >> /etc/init.d/tlsdate
  473. echo ' echo "tlsdate stopped"' >> /etc/init.d/tlsdate
  474. echo ' ;;' >> /etc/init.d/tlsdate
  475. echo ' restart)' >> /etc/init.d/tlsdate
  476. echo ' echo "tlsdate restarted"' >> /etc/init.d/tlsdate
  477. echo ' $TLSDATECOMMAND' >> /etc/init.d/tlsdate
  478. echo ' ;;' >> /etc/init.d/tlsdate
  479. echo ' *)' >> /etc/init.d/tlsdate
  480. echo ' echo "Usage: $0 {start|stop|restart}"' >> /etc/init.d/tlsdate
  481. echo ' exit 1' >> /etc/init.d/tlsdate
  482. echo ' ;;' >> /etc/init.d/tlsdate
  483. echo 'esac' >> /etc/init.d/tlsdate
  484. echo 'exit 0' >> /etc/init.d/tlsdate
  485. chmod +x /etc/init.d/tlsdate
  486. update-rc.d tlsdate defaults
  487. echo 'time_synchronisation' >> $COMPLETION_FILE
  488. }
  489. function configure_firewall {
  490. if grep -Fxq "configure_firewall" $COMPLETION_FILE; then
  491. return
  492. fi
  493. iptables -P INPUT ACCEPT
  494. ip6tables -P INPUT ACCEPT
  495. iptables -F
  496. ip6tables -F
  497. iptables -X
  498. ip6tables -X
  499. iptables -P INPUT DROP
  500. ip6tables -P INPUT DROP
  501. iptables -A INPUT -i lo -j ACCEPT
  502. iptables -A INPUT -i eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  503. echo 'configure_firewall' >> $COMPLETION_FILE
  504. }
  505. function save_firewall_settings {
  506. iptables-save > /etc/firewall.conf
  507. ip6tables-save > /etc/firewall6.conf
  508. printf '#!/bin/sh\n' > /etc/network/if-up.d/iptables
  509. printf 'iptables-restore < /etc/firewall.conf\n' >> /etc/network/if-up.d/iptables
  510. printf 'ip6tables-restore < /etc/firewall6.conf\n' >> /etc/network/if-up.d/iptables
  511. chmod +x /etc/network/if-up.d/iptables
  512. }
  513. function configure_firewall_for_dns {
  514. if grep -Fxq "configure_firewall_for_dns" $COMPLETION_FILE; then
  515. return
  516. fi
  517. iptables -A INPUT -i eth0 -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT
  518. save_firewall_settings
  519. echo 'configure_firewall_for_dns' >> $COMPLETION_FILE
  520. }
  521. function configure_firewall_for_ftp {
  522. if grep -Fxq "configure_firewall_for_ftp" $COMPLETION_FILE; then
  523. return
  524. fi
  525. iptables -I INPUT -i eth0 -p tcp --dport 1024:65535 --sport 20:21 -j ACCEPT
  526. save_firewall_settings
  527. echo 'configure_firewall_for_ftp' >> $COMPLETION_FILE
  528. }
  529. function configure_firewall_for_web {
  530. if grep -Fxq "configure_firewall_for_web" $COMPLETION_FILE; then
  531. return
  532. fi
  533. iptables -A INPUT -i eth0 -p tcp --dport 32768:61000 --sport 80 -j ACCEPT
  534. iptables -A INPUT -i eth0 -p tcp --dport 32768:61000 --sport 443 -j ACCEPT
  535. save_firewall_settings
  536. echo 'configure_firewall_for_web' >> $COMPLETION_FILE
  537. }
  538. function configure_firewall_for_ssh {
  539. if grep -Fxq "configure_firewall_for_ssh" $COMPLETION_FILE; then
  540. return
  541. fi
  542. iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
  543. iptables -A INPUT -i eth0 -p tcp --dport $SSH_PORT -j ACCEPT
  544. save_firewall_settings
  545. echo 'configure_firewall_for_ssh' >> $COMPLETION_FILE
  546. }
  547. function configure_firewall_for_git {
  548. if grep -Fxq "configure_firewall_for_git" $COMPLETION_FILE; then
  549. return
  550. fi
  551. iptables -A INPUT -i eth0 -p tcp --dport 9418 -j ACCEPT
  552. save_firewall_settings
  553. echo 'configure_firewall_for_git' >> $COMPLETION_FILE
  554. }
  555. function configure_firewall_for_email {
  556. if grep -Fxq "configure_firewall_for_email" $COMPLETION_FILE; then
  557. return
  558. fi
  559. iptables -A INPUT -i eth0 -p tcp --dport 25 -j ACCEPT
  560. iptables -A INPUT -i eth0 -p tcp --dport 587 -j ACCEPT
  561. iptables -A INPUT -i eth0 -p tcp --dport 465 -j ACCEPT
  562. iptables -A INPUT -i eth0 -p tcp --dport 993 -j ACCEPT
  563. save_firewall_settings
  564. echo 'configure_firewall_for_email' >> $COMPLETION_FILE
  565. }
  566. function configure_internet_protocol {
  567. if grep -Fxq "configure_internet_protocol" $COMPLETION_FILE; then
  568. return
  569. fi
  570. sed -i "s/#net.ipv4.tcp_syncookies=1/net.ipv4.tcp_syncookies=1/g" /etc/sysctl.conf
  571. sed -i "s/#net.ipv4.conf.all.accept_redirects = 0/net.ipv4.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
  572. sed -i "s/#net.ipv6.conf.all.accept_redirects = 0/net.ipv6.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
  573. sed -i "s/#net.ipv4.conf.all.send_redirects = 0/net.ipv4.conf.all.send_redirects = 0/g" /etc/sysctl.conf
  574. sed -i "s/#net.ipv4.conf.all.accept_source_route = 0/net.ipv4.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
  575. sed -i "s/#net.ipv6.conf.all.accept_source_route = 0/net.ipv6.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
  576. sed -i "s/#net.ipv4.conf.default.rp_filter=1/net.ipv4.conf.default.rp_filter=1/g" /etc/sysctl.conf
  577. sed -i "s/#net.ipv4.conf.all.rp_filter=1/net.ipv4.conf.all.rp_filter=1/g" /etc/sysctl.conf
  578. sed -i "s/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=0/g" /etc/sysctl.conf
  579. sed -i "s/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=0/g" /etc/sysctl.conf
  580. echo '# ignore pings' >> /etc/sysctl.conf
  581. echo 'net.ipv4.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
  582. echo 'net.ipv6.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
  583. echo '# disable ipv6' >> /etc/sysctl.conf
  584. echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.conf
  585. echo 'net.ipv4.tcp_synack_retries = 2' >> /etc/sysctl.conf
  586. echo 'net.ipv4.tcp_syn_retries = 1' >> /etc/sysctl.conf
  587. echo '# keepalive' >> /etc/sysctl.conf
  588. echo 'net.ipv4.tcp_keepalive_probes = 9' >> /etc/sysctl.conf
  589. echo 'net.ipv4.tcp_keepalive_intvl = 75' >> /etc/sysctl.conf
  590. echo 'net.ipv4.tcp_keepalive_time = 7200' >> /etc/sysctl.conf
  591. echo 'configure_internet_protocol' >> $COMPLETION_FILE
  592. }
  593. function script_to_make_self_signed_certificates {
  594. if grep -Fxq "script_to_make_self_signed_certificates" $COMPLETION_FILE; then
  595. return
  596. fi
  597. echo '#!/bin/bash' > /usr/bin/makecert
  598. echo 'HOSTNAME=$1' >> /usr/bin/makecert
  599. echo 'COUNTRY_CODE="US"' >> /usr/bin/makecert
  600. echo 'AREA="Free Speech Zone"' >> /usr/bin/makecert
  601. echo 'LOCATION="Freedomville"' >> /usr/bin/makecert
  602. echo 'ORGANISATION="Freedombone"' >> /usr/bin/makecert
  603. echo 'UNIT="Freedombone Unit"' >> /usr/bin/makecert
  604. echo 'if ! which openssl > /dev/null ;then' >> /usr/bin/makecert
  605. echo ' echo "$0: openssl is not installed, exiting" 1>&2' >> /usr/bin/makecert
  606. echo ' exit 1' >> /usr/bin/makecert
  607. echo 'fi' >> /usr/bin/makecert
  608. echo 'openssl req -x509 -nodes -days 3650 -sha256 -subj "/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$HOSTNAME" -newkey rsa:4096 -keyout /etc/ssl/private/$HOSTNAME.key -out /etc/ssl/certs/$HOSTNAME.crt' >> /usr/bin/makecert
  609. echo 'openssl dhparam -check -text -5 1024 -out /etc/ssl/certs/$HOSTNAME.dhparam' >> /usr/bin/makecert
  610. echo 'chmod 400 /etc/ssl/private/$HOSTNAME.key' >> /usr/bin/makecert
  611. echo 'chmod 640 /etc/ssl/certs/$HOSTNAME.crt' >> /usr/bin/makecert
  612. echo 'chmod 640 /etc/ssl/certs/$HOSTNAME.dhparam' >> /usr/bin/makecert
  613. echo 'if [ -f /etc/init.d/nginx ]; then' >> /usr/bin/makecert
  614. echo ' /etc/init.d/nginx reload' >> /usr/bin/makecert
  615. echo 'fi' >> /usr/bin/makecert
  616. echo '# add the public certificate to a separate directory' >> /usr/bin/makecert
  617. echo '# so that we can redistribute it easily' >> /usr/bin/makecert
  618. echo 'if [ ! -d /etc/ssl/mycerts ]; then' >> /usr/bin/makecert
  619. echo ' mkdir /etc/ssl/mycerts' >> /usr/bin/makecert
  620. echo 'fi' >> /usr/bin/makecert
  621. echo 'cp /etc/ssl/certs/$HOSTNAME.crt /etc/ssl/mycerts' >> /usr/bin/makecert
  622. echo '# Create a bundle of your certificates' >> /usr/bin/makecert
  623. echo 'cat /etc/ssl/mycerts/*.crt > /etc/ssl/freedombone-bundle.crt' >> /usr/bin/makecert
  624. echo 'tar -czvf /etc/ssl/freedombone-certs.tar.gz /etc/ssl/mycerts/*.crt' >> /usr/bin/makecert
  625. chmod +x /usr/bin/makecert
  626. echo 'script_to_make_self_signed_certificates' >> $COMPLETION_FILE
  627. }
  628. function configure_email {
  629. if grep -Fxq "configure_email" $COMPLETION_FILE; then
  630. return
  631. fi
  632. apt-get -y remove postfix
  633. apt-get -y --force-yes install exim4 sasl2-bin swaks libnet-ssleay-perl procmail
  634. echo 'dc_eximconfig_configtype="internet"' > /etc/exim4/update-exim4.conf.conf
  635. echo "dc_other_hostnames='$DOMAIN_NAME'" >> /etc/exim4/update-exim4.conf.conf
  636. echo "dc_local_interfaces=''" >> /etc/exim4/update-exim4.conf.conf
  637. echo "dc_readhost=''" >> /etc/exim4/update-exim4.conf.conf
  638. echo "dc_relay_domains=''" >> /etc/exim4/update-exim4.conf.conf
  639. echo "dc_minimaldns='false'" >> /etc/exim4/update-exim4.conf.conf
  640. echo "dc_relay_nets='192.168.1.0/24'" >> /etc/exim4/update-exim4.conf.conf
  641. echo "dc_smarthost=''" >> /etc/exim4/update-exim4.conf.conf
  642. echo "CFILEMODE='644'" >> /etc/exim4/update-exim4.conf.conf
  643. echo "dc_use_split_config='false'" >> /etc/exim4/update-exim4.conf.conf
  644. echo "dc_hide_mailname=''" >> /etc/exim4/update-exim4.conf.conf
  645. echo "dc_mailname_in_oh='true'" >> /etc/exim4/update-exim4.conf.conf
  646. echo "dc_localdelivery='maildir_home'" >> /etc/exim4/update-exim4.conf.conf
  647. update-exim4.conf
  648. sed -i "s/START=no/START=yes/g" /etc/default/saslauthd
  649. /etc/init.d/saslauthd start
  650. # make a tls certificate for email
  651. makecert exim
  652. mv /etc/ssl/private/exim.key /etc/exim4
  653. mv /etc/ssl/certs/exim.crt /etc/exim4
  654. mv /etc/ssl/certs/exim.dhparam /etc/exim4
  655. chown root:Debian-exim /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  656. chmod 640 /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  657. sed -i '/login_saslauthd_server/,/.endif/ s/# *//' /etc/exim4/exim4.conf.template
  658. sed -i "/.ifdef MAIN_HARDCODE_PRIMARY_HOSTNAME/i\MAIN_HARDCODE_PRIMARY_HOSTNAME = $DOMAIN_NAME\nMAIN_TLS_ENABLE = true" /etc/exim4/exim4.conf.template
  659. sed -i "s|SMTPLISTENEROPTIONS=''|SMTPLISTENEROPTIONS='-oX 465:25:587 -oP /var/run/exim4/exim.pid'|g" /etc/default/exim4
  660. if ! grep -q "tls_on_connect_ports=465" /etc/exim4/exim4.conf.template; then
  661. sed -i '/SSL configuration for exim/i\tls_on_connect_ports=465' /etc/exim4/exim4.conf.template
  662. fi
  663. adduser $MY_USERNAME sasl
  664. addgroup Debian-exim sasl
  665. /etc/init.d/exim4 restart
  666. if [ ! -d /etc/skel/Maildir ]; then
  667. mkdir -m 700 /etc/skel/Maildir
  668. mkdir -m 700 /etc/skel/Maildir/Sent
  669. mkdir -m 700 /etc/skel/Maildir/Sent/tmp
  670. mkdir -m 700 /etc/skel/Maildir/Sent/cur
  671. mkdir -m 700 /etc/skel/Maildir/Sent/new
  672. mkdir -m 700 /etc/skel/Maildir/.learn-spam
  673. mkdir -m 700 /etc/skel/Maildir/.learn-spam/cur
  674. mkdir -m 700 /etc/skel/Maildir/.learn-spam/new
  675. mkdir -m 700 /etc/skel/Maildir/.learn-spam/tmp
  676. mkdir -m 700 /etc/skel/Maildir/.learn-ham
  677. mkdir -m 700 /etc/skel/Maildir/.learn-ham/cur
  678. mkdir -m 700 /etc/skel/Maildir/.learn-ham/new
  679. mkdir -m 700 /etc/skel/Maildir/.learn-ham/tmp
  680. ln -s /etc/skel/Maildir/.learn-spam /etc/skel/Maildir/spam
  681. ln -s /etc/skel/Maildir/.learn-ham /etc/skel/Maildir/ham
  682. fi
  683. if [ ! -d /home/$MY_USERNAME/Maildir ]; then
  684. mkdir -m 700 /home/$MY_USERNAME/Maildir
  685. mkdir -m 700 /home/$MY_USERNAME/Maildir/cur
  686. mkdir -m 700 /home/$MY_USERNAME/Maildir/tmp
  687. mkdir -m 700 /home/$MY_USERNAME/Maildir/new
  688. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent
  689. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent/cur
  690. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent/tmp
  691. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent/new
  692. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam
  693. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam/cur
  694. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam/new
  695. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam/tmp
  696. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham
  697. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham/cur
  698. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham/new
  699. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham/tmp
  700. ln -s /home/$MY_USERNAME/Maildir/.learn-spam /home/$MY_USERNAME/Maildir/spam
  701. ln -s /home/$MY_USERNAME/Maildir/.learn-ham /home/$MY_USERNAME/Maildir/ham
  702. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Maildir
  703. fi
  704. echo 'configure_email' >> $COMPLETION_FILE
  705. }
  706. function spam_filtering {
  707. # NOTE: spamassassin installation currently doesn't work, sa-compile fails with a make error 23/09/2014
  708. if grep -Fxq "spam_filtering" $COMPLETION_FILE; then
  709. return
  710. fi
  711. apt-get -y --force-yes install exim4-daemon-heavy
  712. apt-get -y --force-yes install spamassassin
  713. sa-update -v
  714. sed -i 's/ENABLED=0/ENABLED=1/g' /etc/default/spamassassin
  715. sed -i 's/# spamd_address = 127.0.0.1 783/spamd_address = 127.0.0.1 783/g' /etc/exim4/exim4.conf.template
  716. # This configuration is based on https://wiki.debian.org/DebianSpamAssassin
  717. sed -i 's/local_parts = postmaster/local_parts = postmaster:abuse/g' /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt
  718. sed -i '/domains = +local_domains : +relay_to_domains/a\ set acl_m0 = rfcnames' /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt
  719. sed -i 's/accept/accept condition = ${if eq{$acl_m0}{rfcnames} {1}{0}}/g' /etc/exim4/conf.d/acl/40_exim4-config_check_data
  720. echo 'warn message = X-Spam-Score: $spam_score ($spam_bar)' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  721. echo ' spam = nobody:true' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  722. echo 'warn message = X-Spam-Flag: YES' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  723. echo ' spam = nobody' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  724. echo 'warn message = X-Spam-Report: $spam_report' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  725. echo ' spam = nobody' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  726. echo '# reject spam at high scores (> 12)' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  727. echo 'deny message = This message scored $spam_score spam points.' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  728. echo ' spam = nobody:true' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  729. echo ' condition = ${if >{$spam_score_int}{120}{1}{0}}' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  730. # procmail configuration
  731. echo 'MAILDIR=$HOME/Maildir' > /home/$MY_USERNAME/.procmailrc
  732. echo 'DEFAULT=$MAILDIR/' >> /home/$MY_USERNAME/.procmailrc
  733. echo 'LOGFILE=$HOME/log/procmail.log' >> /home/$MY_USERNAME/.procmailrc
  734. echo 'LOGABSTRACT=all' >> /home/$MY_USERNAME/.procmailrc
  735. echo '# get spamassassin to check emails' >> /home/$MY_USERNAME/.procmailrc
  736. echo ':0fw: .spamassassin.lock' >> /home/$MY_USERNAME/.procmailrc
  737. echo ' * < 256000' >> /home/$MY_USERNAME/.procmailrc
  738. echo '| spamc' >> /home/$MY_USERNAME/.procmailrc
  739. echo '# strong spam are discarded' >> /home/$MY_USERNAME/.procmailrc
  740. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  741. echo ' * ^X-Spam-Level: \*\*\*\*\*\*' >> /home/$MY_USERNAME/.procmailrc
  742. echo '/dev/null' >> /home/$MY_USERNAME/.procmailrc
  743. echo '# weak spam are kept just in case - clear this out every now and then' >> /home/$MY_USERNAME/.procmailrc
  744. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  745. echo ' * ^X-Spam-Level: \*\*\*\*\*' >> /home/$MY_USERNAME/.procmailrc
  746. echo '.0-spam/' >> /home/$MY_USERNAME/.procmailrc
  747. echo '# otherwise, marginal spam goes here for revision' >> /home/$MY_USERNAME/.procmailrc
  748. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  749. echo ' * ^X-Spam-Level: \*\*' >> /home/$MY_USERNAME/.procmailrc
  750. echo '.spam/' >> /home/$MY_USERNAME/.procmailrc
  751. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  752. # filtering scripts
  753. echo '#!/bin/bash' > /usr/bin/filterspam
  754. echo 'USERNAME=$1' >> /usr/bin/filterspam
  755. echo 'MAILDIR=/home/$USERNAME/Maildir/.learn-spam' >> /usr/bin/filterspam
  756. echo 'if [ ! -d "$MAILDIR" ]; then' >> /usr/bin/filterspam
  757. echo ' exit' >> /usr/bin/filterspam
  758. echo 'fi' >> /usr/bin/filterspam
  759. echo 'for f in `ls $MAILDIR/cur`' >> /usr/bin/filterspam
  760. echo 'do' >> /usr/bin/filterspam
  761. echo ' spamc -L spam < "$MAILDIR/cur/$f" > /dev/null' >> /usr/bin/filterspam
  762. echo ' rm "$MAILDIR/cur/$f"' >> /usr/bin/filterspam
  763. echo 'done' >> /usr/bin/filterspam
  764. echo 'for f in `ls $MAILDIR/new`' >> /usr/bin/filterspam
  765. echo 'do' >> /usr/bin/filterspam
  766. echo ' spamc -L spam < "$MAILDIR/new/$f" > /dev/null' >> /usr/bin/filterspam
  767. echo ' rm "$MAILDIR/new/$f"' >> /usr/bin/filterspam
  768. echo 'done' >> /usr/bin/filterspam
  769. echo '#!/bin/bash' > /usr/bin/filterham
  770. echo 'USERNAME=$1' >> /usr/bin/filterham
  771. echo 'MAILDIR=/home/$USERNAME/Maildir/.learn-ham' >> /usr/bin/filterham
  772. echo 'if [ ! -d "$MAILDIR" ]; then' >> /usr/bin/filterham
  773. echo ' exit' >> /usr/bin/filterham
  774. echo 'fi' >> /usr/bin/filterham
  775. echo 'for f in `ls $MAILDIR/cur`' >> /usr/bin/filterham
  776. echo 'do' >> /usr/bin/filterham
  777. echo ' spamc -L ham < "$MAILDIR/cur/$f" > /dev/null' >> /usr/bin/filterham
  778. echo ' rm "$MAILDIR/cur/$f"' >> /usr/bin/filterham
  779. echo 'done' >> /usr/bin/filterham
  780. echo 'for f in `ls $MAILDIR/new`' >> /usr/bin/filterham
  781. echo 'do' >> /usr/bin/filterham
  782. echo ' spamc -L ham < "$MAILDIR/new/$f" > /dev/null' >> /usr/bin/filterham
  783. echo ' rm "$MAILDIR/new/$f"' >> /usr/bin/filterham
  784. echo 'done' >> /usr/bin/filterham
  785. if ! grep -q "filterspam" /etc/crontab; then
  786. echo "*/3 * * * * root /usr/bin/timeout 120 /usr/bin/filterspam $MY_USERNAME" >> /etc/crontab
  787. fi
  788. if ! grep -q "filterham" /etc/crontab; then
  789. echo "*/3 * * * * root /usr/bin/timeout 120 /usr/bin/filterham $MY_USERNAME" >> /etc/crontab
  790. fi
  791. chmod 655 /usr/bin/filterspam /usr/bin/filterham
  792. sed -i 's/# use_bayes 1/use_bayes 1/g' /etc/mail/spamassassin/local.cf
  793. sed -i 's/# bayes_auto_learn 1/bayes_auto_learn 1/g' /etc/mail/spamassassin/local.cf
  794. service spamassassin restart
  795. service exim4 restart
  796. service cron restart
  797. echo 'spam_filtering' >> $COMPLETION_FILE
  798. }
  799. function configure_imap {
  800. if grep -Fxq "configure_imap" $COMPLETION_FILE; then
  801. return
  802. fi
  803. apt-get -y --force-yes install dovecot-common dovecot-imapd
  804. makecert dovecot
  805. chown root:dovecot /etc/ssl/certs/dovecot.crt
  806. chown root:dovecot /etc/ssl/private/dovecot.key
  807. chown root:dovecot /etc/ssl/private/dovecot.dhparams
  808. sed -i 's|#ssl = yes|ssl = yes|g' /etc/dovecot/conf.d/10-ssl.conf
  809. sed -i 's|ssl_cert = </etc/dovecot/dovecot.pem|ssl_cert = </etc/ssl/certs/dovecot.crt|g' /etc/dovecot/conf.d/10-ssl.conf
  810. sed -i 's|ssl_key = </etc/dovecot/private/dovecot.pem|/etc/ssl/private/dovecot.key|g' /etc/dovecot/conf.d/10-ssl.conf
  811. sed -i 's|#ssl_dh_parameters_length = 1024|ssl_dh_parameters_length = 1024|g' /etc/dovecot/conf.d/10-ssl.conf
  812. sed -i 's/#ssl_prefer_server_ciphers = no/ssl_prefer_server_ciphers = yes/g' /etc/dovecot/conf.d/10-ssl.conf
  813. echo "ssl_cipher_list = 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA'" >> /etc/dovecot/conf.d/10-ssl.conf
  814. sed -i 's/#listen = *, ::/listen = */g' /etc/dovecot/dovecot.conf
  815. sed -i 's/#disable_plaintext_auth = yes/disable_plaintext_auth = no/g' /etc/dovecot/conf.d/10-auth.conf
  816. sed -i 's/auth_mechanisms = plain/auth_mechanisms = plain login/g' /etc/dovecot/conf.d/10-auth.conf
  817. sed -i 's|# mail_location = maildir:~/Maildir| mail_location = maildir:~/Maildir:LAYOUT=fs|g' /etc/dovecot/conf.d/10-mail.conf
  818. echo 'configure_imap' >> $COMPLETION_FILE
  819. }
  820. function configure_gpg {
  821. if grep -Fxq "configure_gpg" $COMPLETION_FILE; then
  822. return
  823. fi
  824. apt-get -y --force-yes install gnupg
  825. if [ ! -d /home/$MY_USERNAME/.gnupg ]; then
  826. mkdir /home/$MY_USERNAME/.gnupg
  827. echo 'keyserver hkp://keys.gnupg.net' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  828. echo 'keyserver-options auto-key-retrieve' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  829. fi
  830. sed -i "s|keyserver hkp://keys.gnupg.net|keyserver $GPG_KEYSERVER|g" /home/$MY_USERNAME/.gnupg/gpg.conf
  831. if ! grep -q "# default preferences" /home/$MY_USERNAME/.gnupg/gpg.conf; then
  832. echo '' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  833. echo '# default preferences' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  834. echo 'personal-digest-preferences SHA256' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  835. echo 'cert-digest-algo SHA256' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  836. echo 'default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  837. fi
  838. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.gnupg
  839. if [[ $MY_GPG_PUBLIC_KEY && $MY_GPG_PRIVATE_KEY ]]; then
  840. # use your existing GPG keys which were exported
  841. if [ ! -f $MY_GPG_PUBLIC_KEY ]; then
  842. echo "GPG public key file $MY_GPG_PUBLIC_KEY was not found"
  843. exit 5
  844. fi
  845. if [ ! -f $MY_GPG_PRIVATE_KEY ]; then
  846. echo "GPG private key file $MY_GPG_PRIVATE_KEY was not found"
  847. exit 6
  848. fi
  849. su -c "gpg --import $MY_GPG_PUBLIC_KEY" - $MY_USERNAME
  850. su -c "gpg --allow-secret-key-import --import $MY_GPG_PRIVATE_KEY" - $MY_USERNAME
  851. # for security ensure that the private key file doesn't linger around
  852. shred -zu $MY_GPG_PRIVATE_KEY
  853. else
  854. # Generate a GPG key
  855. echo 'Key-Type: 1' > /home/$MY_USERNAME/gpg-genkey.conf
  856. echo 'Key-Length: 4096' >> /home/$MY_USERNAME/gpg-genkey.conf
  857. echo 'Subkey-Type: 1' >> /home/$MY_USERNAME/gpg-genkey.conf
  858. echo 'Subkey-Length: 4096' >> /home/$MY_USERNAME/gpg-genkey.conf
  859. echo "Name-Real: `hostname --fqdn`" >> /home/$MY_USERNAME/gpg-genkey.conf
  860. echo "Name-Email: $MY_USERNAME@`hostname --fqdn`" >> /home/$MY_USERNAME/gpg-genkey.conf
  861. echo 'Expire-Date: 0' >> /home/$MY_USERNAME/gpg-genkey.conf
  862. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/gpg-genkey.conf
  863. su -c "gpg --batch --gen-key /home/$MY_USERNAME/gpg-genkey.conf" - $MY_USERNAME
  864. shred -zu /home/$MY_USERNAME/gpg-genkey.conf
  865. fi
  866. echo 'configure_gpg' >> $COMPLETION_FILE
  867. }
  868. function email_client {
  869. if grep -Fxq "email_client" $COMPLETION_FILE; then
  870. return
  871. fi
  872. apt-get -y --force-yes install mutt-patched lynx abook
  873. if [ ! -d /home/$MY_USERNAME/.mutt ]; then
  874. mkdir /home/$MY_USERNAME/.mutt
  875. fi
  876. echo "text/html; lynx -dump -width=78 -nolist %s | sed ‘s/^ //’; copiousoutput; needsterminal; nametemplate=%s.html" > /home/$MY_USERNAME/.mutt/mailcap
  877. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.mutt
  878. echo 'set mbox_type=Maildir' >> /etc/Muttrc
  879. echo 'set folder="~/Maildir"' >> /etc/Muttrc
  880. echo 'set mask="!^\\.[^.]"' >> /etc/Muttrc
  881. echo 'set mbox="~/Maildir"' >> /etc/Muttrc
  882. echo 'set record="+Sent"' >> /etc/Muttrc
  883. echo 'set postponed="+Drafts"' >> /etc/Muttrc
  884. echo 'set trash="+Trash"' >> /etc/Muttrc
  885. echo 'set spoolfile="~/Maildir"' >> /etc/Muttrc
  886. echo 'auto_view text/x-vcard text/html text/enriched' >> /etc/Muttrc
  887. echo 'set editor="emacs"' >> /etc/Muttrc
  888. echo 'set header_cache="+.cache"' >> /etc/Muttrc
  889. echo '' >> /etc/Muttrc
  890. echo 'macro index S "<tag-prefix><save-message>=.learn-spam<enter>" "move to learn-spam"' >> /etc/Muttrc
  891. echo 'macro pager S "<save-message>=.learn-spam<enter>" "move to learn-spam"' >> /etc/Muttrc
  892. echo 'macro index H "<tag-prefix><copy-message>=.learn-ham<enter>" "copy to learn-ham"' >> /etc/Muttrc
  893. echo 'macro pager H "<copy-message>=.learn-ham<enter>" "copy to learn-ham"' >> /etc/Muttrc
  894. echo '' >> /etc/Muttrc
  895. echo '# set up the sidebar' >> /etc/Muttrc
  896. echo 'set sidebar_width=12' >> /etc/Muttrc
  897. echo 'set sidebar_visible=yes' >> /etc/Muttrc
  898. echo "set sidebar_delim='|'" >> /etc/Muttrc
  899. echo 'set sidebar_sort=yes' >> /etc/Muttrc
  900. echo '' >> /etc/Muttrc
  901. echo 'set rfc2047_parameters' >> /etc/Muttrc
  902. echo '' >> /etc/Muttrc
  903. echo '# Show inbox and sent items' >> /etc/Muttrc
  904. echo 'mailboxes = =Sent' >> /etc/Muttrc
  905. echo '' >> /etc/Muttrc
  906. echo '# Alter these colours as needed for maximum bling' >> /etc/Muttrc
  907. echo 'color sidebar_new yellow default' >> /etc/Muttrc
  908. echo 'color normal white default' >> /etc/Muttrc
  909. echo 'color hdrdefault brightcyan default' >> /etc/Muttrc
  910. echo 'color signature green default' >> /etc/Muttrc
  911. echo 'color attachment brightyellow default' >> /etc/Muttrc
  912. echo 'color quoted green default' >> /etc/Muttrc
  913. echo 'color quoted1 white default' >> /etc/Muttrc
  914. echo 'color tilde blue default' >> /etc/Muttrc
  915. echo '' >> /etc/Muttrc
  916. echo '# ctrl-n, ctrl-p to select next, prev folder' >> /etc/Muttrc
  917. echo '# ctrl-o to open selected folder' >> /etc/Muttrc
  918. echo 'bind index \Cp sidebar-prev' >> /etc/Muttrc
  919. echo 'bind index \Cn sidebar-next' >> /etc/Muttrc
  920. echo 'bind index \Co sidebar-open' >> /etc/Muttrc
  921. echo 'bind pager \Cp sidebar-prev' >> /etc/Muttrc
  922. echo 'bind pager \Cn sidebar-next' >> /etc/Muttrc
  923. echo 'bind pager \Co sidebar-open' >> /etc/Muttrc
  924. echo '' >> /etc/Muttrc
  925. echo '# ctrl-b toggles sidebar visibility' >> /etc/Muttrc
  926. echo "macro index,pager \Cb '<enter-command>toggle sidebar_visible<enter><redraw-screen>' 'toggle sidebar'" >> /etc/Muttrc
  927. echo '' >> /etc/Muttrc
  928. echo '# esc-m Mark new messages as read' >> /etc/Muttrc
  929. echo 'macro index <esc>m "T~N<enter>;WNT~O<enter>;WO\CT~T<enter>" "mark all messages read"' >> /etc/Muttrc
  930. echo '' >> /etc/Muttrc
  931. echo '# Collapsing threads' >> /etc/Muttrc
  932. echo 'macro index [ "<collapse-thread>" "collapse/uncollapse thread"' >> /etc/Muttrc
  933. echo 'macro index ] "<collapse-all>" "collapse/uncollapse all threads"' >> /etc/Muttrc
  934. echo '' >> /etc/Muttrc
  935. echo '# threads containing new messages' >> /etc/Muttrc
  936. echo 'uncolor index "~(~N)"' >> /etc/Muttrc
  937. echo 'color index brightblue default "~(~N)"' >> /etc/Muttrc
  938. echo '' >> /etc/Muttrc
  939. echo '# new messages themselves' >> /etc/Muttrc
  940. echo 'uncolor index "~N"' >> /etc/Muttrc
  941. echo 'color index brightyellow default "~N"' >> /etc/Muttrc
  942. echo '' >> /etc/Muttrc
  943. echo '# GPG/PGP integration' >> /etc/Muttrc
  944. echo '# this set the number of seconds to keep in memory the passphrase used to encrypt/sign' >> /etc/Muttrc
  945. echo 'set pgp_timeout=60' >> /etc/Muttrc
  946. echo '' >> /etc/Muttrc
  947. echo '# automatically sign and encrypt with PGP/MIME' >> /etc/Muttrc
  948. echo 'set pgp_autosign # autosign all outgoing mails' >> /etc/Muttrc
  949. echo 'set pgp_replyencrypt # autocrypt replies to crypted' >> /etc/Muttrc
  950. echo 'set pgp_replysign # autosign replies to signed' >> /etc/Muttrc
  951. echo 'set pgp_auto_decode=yes # decode attachments' >> /etc/Muttrc
  952. echo 'unset smime_is_default' >> /etc/Muttrc
  953. echo '' >> /etc/Muttrc
  954. echo 'set alias_file=~/.mutt-alias' >> /etc/Muttrc
  955. echo 'source ~/.mutt-alias' >> /etc/Muttrc
  956. echo 'set query_command= "abook --mutt-query \"%s\""' >> /etc/Muttrc
  957. echo 'macro index,pager A "<pipe-message>abook --add-email-quiet<return>" "add the sender address to abook"' >> /etc/Muttrc
  958. cp -f /etc/Muttrc /home/$MY_USERNAME/.muttrc
  959. touch /home/$MY_USERNAME/.mutt-alias
  960. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.muttrc
  961. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.mutt-alias
  962. echo 'email_client' >> $COMPLETION_FILE
  963. }
  964. function folders_for_mailing_lists {
  965. if grep -Fxq "folders_for_mailing_lists" $COMPLETION_FILE; then
  966. return
  967. fi
  968. echo '#!/bin/bash' > /usr/bin/mailinglistrule
  969. echo 'MYUSERNAME=$1' >> /usr/bin/mailinglistrule
  970. echo 'MAILINGLIST=$2' >> /usr/bin/mailinglistrule
  971. echo 'SUBJECTTAG=$3' >> /usr/bin/mailinglistrule
  972. echo 'MUTTRC=/home/$MYUSERNAME/.muttrc' >> /usr/bin/mailinglistrule
  973. echo 'PM=/home/$MYUSERNAME/.procmailrc' >> /usr/bin/mailinglistrule
  974. echo 'LISTDIR=/home/$MYUSERNAME/Maildir/$MAILINGLIST' >> /usr/bin/mailinglistrule
  975. echo 'if [ ! -d "$LISTDIR" ]; then' >> /usr/bin/mailinglistrule
  976. echo ' mkdir -m 700 $LISTDIR' >> /usr/bin/mailinglistrule
  977. echo ' mkdir -m 700 $LISTDIR/tmp' >> /usr/bin/mailinglistrule
  978. echo ' mkdir -m 700 $LISTDIR/new' >> /usr/bin/mailinglistrule
  979. echo ' mkdir -m 700 $LISTDIR/cur' >> /usr/bin/mailinglistrule
  980. echo 'fi' >> /usr/bin/mailinglistrule
  981. echo 'chown -R $MYUSERNAME:$MYUSERNAME $LISTDIR' >> /usr/bin/mailinglistrule
  982. echo 'echo "" >> $PM' >> /usr/bin/mailinglistrule
  983. echo 'echo ":0" >> $PM' >> /usr/bin/mailinglistrule
  984. echo 'echo " * ^Subject:.*()\[$SUBJECTTAG\]" >> $PM' >> /usr/bin/mailinglistrule
  985. echo 'echo "$LISTDIR/new" >> $PM' >> /usr/bin/mailinglistrule
  986. echo 'chown $MYUSERNAME:$MYUSERNAME $PM' >> /usr/bin/mailinglistrule
  987. echo 'if [ ! -f "$MUTTRC" ]; then' >> /usr/bin/mailinglistrule
  988. echo ' cp /etc/Muttrc $MUTTRC' >> /usr/bin/mailinglistrule
  989. echo ' chown $MYUSERNAME:$MYUSERNAME $MUTTRC' >> /usr/bin/mailinglistrule
  990. echo 'fi' >> /usr/bin/mailinglistrule
  991. echo 'PROCMAILLOG=/home/$MYUSERNAME/log' >> /usr/bin/mailinglistrule
  992. echo 'if [ ! -d $PROCMAILLOG ]; then' >> /usr/bin/mailinglistrule
  993. echo ' mkdir $PROCMAILLOG' >> /usr/bin/mailinglistrule
  994. echo ' chown -R $MYUSERNAME:$MYUSERNAME $PROCMAILLOG' >> /usr/bin/mailinglistrule
  995. echo 'fi' >> /usr/bin/mailinglistrule
  996. chmod +x /usr/bin/mailinglistrule
  997. echo 'folders_for_mailing_lists' >> $COMPLETION_FILE
  998. }
  999. function folders_for_email_addresses {
  1000. if grep -Fxq "folders_for_email_addresses" $COMPLETION_FILE; then
  1001. return
  1002. fi
  1003. echo '#!/bin/bash' > /usr/bin/emailrule
  1004. echo 'MYUSERNAME=$1' >> /usr/bin/emailrule
  1005. echo 'EMAILADDRESS=$2' >> /usr/bin/emailrule
  1006. echo 'MAILINGLIST=$3' >> /usr/bin/emailrule
  1007. echo 'MUTTRC=/home/$MYUSERNAME/.muttrc' >> /usr/bin/emailrule
  1008. echo 'PM=/home/$MYUSERNAME/.procmailrc' >> /usr/bin/emailrule
  1009. echo 'LISTDIR=/home/$MYUSERNAME/Maildir/$MAILINGLIST' >> /usr/bin/emailrule
  1010. echo 'if [ ! -d "$LISTDIR" ]; then' >> /usr/bin/emailrule
  1011. echo ' mkdir -m 700 $LISTDIR' >> /usr/bin/emailrule
  1012. echo ' mkdir -m 700 $LISTDIR/tmp' >> /usr/bin/emailrule
  1013. echo ' mkdir -m 700 $LISTDIR/new' >> /usr/bin/emailrule
  1014. echo ' mkdir -m 700 $LISTDIR/cur' >> /usr/bin/emailrule
  1015. echo 'fi' >> /usr/bin/emailrule
  1016. echo 'chown -R $MYUSERNAME:$MYUSERNAME $LISTDIR' >> /usr/bin/emailrule
  1017. echo 'echo "" >> $PM' >> /usr/bin/emailrule
  1018. echo 'echo ":0" >> $PM' >> /usr/bin/emailrule
  1019. echo 'echo " * ^From: $EMAILADDRESS" >> $PM' >> /usr/bin/emailrule
  1020. echo 'echo "$LISTDIR/new" >> $PM' >> /usr/bin/emailrule
  1021. echo 'chown $MYUSERNAME:$MYUSERNAME $PM' >> /usr/bin/emailrule
  1022. echo 'if [ ! -f "$MUTTRC" ]; then' >> /usr/bin/emailrule
  1023. echo ' cp /etc/Muttrc $MUTTRC' >> /usr/bin/emailrule
  1024. echo ' chown $MYUSERNAME:$MYUSERNAME $MUTTRC' >> /usr/bin/emailrule
  1025. echo 'fi' >> /usr/bin/emailrule
  1026. echo 'PROCMAILLOG=/home/$MYUSERNAME/log' >> /usr/bin/emailrule
  1027. echo 'if [ ! -d $PROCMAILLOG ]; then' >> /usr/bin/emailrule
  1028. echo ' mkdir $PROCMAILLOG' >> /usr/bin/emailrule
  1029. echo ' chown -R $MYUSERNAME:$MYUSERNAME $PROCMAILLOG' >> /usr/bin/emailrule
  1030. echo 'fi' >> /usr/bin/emailrule
  1031. chmod +x /usr/bin/emailrule
  1032. echo 'folders_for_email_addresses' >> $COMPLETION_FILE
  1033. }
  1034. function dynamic_dns_freedns {
  1035. if grep -Fxq "dynamic_dns_freedns" $COMPLETION_FILE; then
  1036. return
  1037. fi
  1038. echo '#!/bin/bash' > /usr/bin/dynamicdns
  1039. echo '# subdomain name 1' >> /usr/bin/dynamicdns
  1040. echo "wget -O - https://freedns.afraid.org/dynamic/update.php?$FREEDNS_SUBDOMAIN_CODE== >> /dev/null 2>&1" >> /usr/bin/dynamicdns
  1041. echo '# add any other subdomains below' >> /usr/bin/dynamicdns
  1042. chmod 600 /usr/bin/dynamicdns
  1043. chmod +x /usr/bin/dynamicdns
  1044. if ! grep -q "dynamicdns" /etc/crontab; then
  1045. sed -i '/# m h dom mon dow user command/a\*/5 * * * * root /usr/bin/timeout 240 /usr/bin/dynamicdns' /etc/crontab
  1046. fi
  1047. service cron restart
  1048. echo 'dynamic_dns_freedns' >> $COMPLETION_FILE
  1049. }
  1050. function import_email {
  1051. if grep -Fxq "import_email" $COMPLETION_FILE; then
  1052. return
  1053. fi
  1054. if [ $IMPORT_MAILDIR ]; then
  1055. if [ -d $IMPORT_MAILDIR ]; then
  1056. echo 'Transfering email files'
  1057. cp -r $IMPORT_MAILDIR/* /home/$MY_USERNAME/Maildir/
  1058. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Maildir
  1059. else
  1060. echo "Email import directory $IMPORT_MAILDIR not found"
  1061. exit
  1062. fi
  1063. fi
  1064. echo 'import_email' >> $COMPLETION_FILE
  1065. }
  1066. function install_final {
  1067. if grep -Fxq "install_final" $COMPLETION_FILE; then
  1068. return
  1069. fi
  1070. echo 'install_final' >> $COMPLETION_FILE
  1071. echo ''
  1072. echo ' *** Freedombone installation is complete. Rebooting... ***'
  1073. echo ''
  1074. reboot
  1075. }
  1076. argument_checks
  1077. configure_firewall
  1078. configure_firewall_for_ssh
  1079. configure_firewall_for_dns
  1080. configure_firewall_for_ftp
  1081. configure_firewall_for_web
  1082. remove_proprietary_repos
  1083. change_debian_repos
  1084. enable_backports
  1085. configure_dns
  1086. initial_setup
  1087. install_editor
  1088. change_login_message
  1089. update_the_kernel
  1090. enable_zram
  1091. random_number_generator
  1092. set_your_domain_name
  1093. time_synchronisation
  1094. configure_internet_protocol
  1095. configure_ssh
  1096. search_for_attached_usb_drive
  1097. regenerate_ssh_keys
  1098. script_to_make_self_signed_certificates
  1099. configure_email
  1100. spam_filtering
  1101. configure_imap
  1102. configure_gpg
  1103. email_client
  1104. configure_firewall_for_email
  1105. folders_for_mailing_lists
  1106. folders_for_email_addresses
  1107. dynamic_dns_freedns
  1108. import_email
  1109. install_final
  1110. echo 'Freedombone installation is complete'