freedombone-utils-setup 16KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Setup functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2016 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. # Different system variants which may be specified within
  31. # the SYSTEM_TYPE option
  32. VARIANT_FULL="full"
  33. VARIANT_WRITER="writer"
  34. VARIANT_CLOUD="cloud"
  35. VARIANT_CHAT="chat"
  36. VARIANT_MAILBOX="mailbox"
  37. VARIANT_NONMAILBOX="nonmailbox"
  38. VARIANT_SOCIAL="social"
  39. VARIANT_MEDIA="media"
  40. VARIANT_DEVELOPER="developer"
  41. VARIANT_MESH="mesh"
  42. DEFAULT_DOMAIN_NAME=
  43. DEFAULT_DOMAIN_CODE=
  44. MY_USERNAME=
  45. SYSTEM_TYPE=$VARIANT_FULL
  46. # An optional configuration file which overrides some of these variables
  47. CONFIGURATION_FILE="${PROJECT_NAME}.cfg"
  48. # Directory where source code is downloaded and compiled
  49. INSTALL_DIR=$HOME/build
  50. # device name for an attached usb drive
  51. USB_DRIVE=/dev/sda1
  52. # Location where the USB drive is mounted to
  53. USB_MOUNT=/mnt/usb
  54. # Number of days to keep backups for
  55. BACKUP_MAX_DAYS=30
  56. # file containing a list of remote locations to backup to
  57. # Format: [username@friendsdomain//home/username] [ssh_password]
  58. # With the only space character being between the server and the password
  59. FRIENDS_SERVERS_LIST=/home/$MY_USERNAME/backup.list
  60. export DEBIAN_FRONTEND=noninteractive
  61. # used to limit CPU usage
  62. CPULIMIT='/usr/bin/cpulimit -l 20 -e'
  63. # command to create a git repository
  64. CREATE_GIT_PROJECT_COMMAND='create-project'
  65. # File which keeps track of what has already been installed
  66. COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt
  67. # log file where details of remote backups are stored
  68. REMOTE_BACKUPS_LOG=/var/log/remotebackups.log
  69. # message if something fails to install
  70. CHECK_MESSAGE="Check your internet connection, /etc/network/interfaces and /etc/resolv.conf, then delete $COMPLETION_FILE, run 'rm -fR /var/lib/apt/lists/* && apt-get update --fix-missing' and run this script again. If hash sum mismatches persist then try setting $DEBIAN_REPO to a different mirror and also change /etc/apt/sources.list."
  71. # Default diffie-hellman key length in bits
  72. DH_KEYLENGTH=2048
  73. function initial_setup {
  74. if grep -Fxq "initial_setup" $COMPLETION_FILE; then
  75. return
  76. fi
  77. apt-get -y remove --purge apache*
  78. apt-get -y dist-upgrade
  79. apt-get -y install ca-certificates emacs24 cpulimit
  80. apt-get -y install cryptsetup libgfshare-bin obnam sshpass wget
  81. apt-get -y install avahi-daemon avahi-utils avahi-discover
  82. apt-get -y install connect-proxy
  83. if [ ! -d $INSTALL_DIR ]; then
  84. mkdir -p $INSTALL_DIR
  85. fi
  86. echo 'initial_setup' >> $COMPLETION_FILE
  87. }
  88. function search_for_attached_usb_drive {
  89. # If a USB drive is attached then search for email,
  90. # gpg, ssh keys and emacs configuration
  91. if grep -Fxq "search_for_attached_usb_drive" $COMPLETION_FILE; then
  92. return
  93. fi
  94. if [ -b $USB_DRIVE ]; then
  95. if [ ! -d $USB_MOUNT ]; then
  96. echo $'Mounting USB drive'
  97. mkdir $USB_MOUNT
  98. mount $USB_DRIVE $USB_MOUNT
  99. fi
  100. if ! [[ $SYSTEM_TYPE == "$VARIANT_WRITER" || $SYSTEM_TYPE == "$VARIANT_CLOUD" || $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_SOCIAL" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_DEVELOPER" || $SYSTEM_TYPE == "$VARIANT_MESH" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" ]]; then
  101. if [ -d $USB_MOUNT/Maildir ]; then
  102. echo $'Maildir found on USB drive'
  103. IMPORT_MAILDIR=$USB_MOUNT/Maildir
  104. fi
  105. if [ -d $USB_MOUNT/.gnupg ]; then
  106. echo $'Importing GPG keyring'
  107. cp -r $USB_MOUNT/.gnupg /home/$MY_USERNAME
  108. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.gnupg
  109. GPG_KEYS_IMPORTED="yes"
  110. if [ ! -f /home/$MY_USERNAME/.gnupg/secring.gpg ]; then
  111. echo $'GPG files did not copy'
  112. exit 73529
  113. fi
  114. fi
  115. if [ -f $USB_MOUNT/.procmailrc ]; then
  116. echo $'Importing procmail settings'
  117. cp $USB_MOUNT/.procmailrc /home/$MY_USERNAME
  118. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  119. fi
  120. if [ -f $USB_MOUNT/private_key.gpg ]; then
  121. echo $'GPG private key found on USB drive'
  122. MY_GPG_PRIVATE_KEY=$USB_MOUNT/private_key.gpg
  123. fi
  124. if [ -f $USB_MOUNT/public_key.gpg ]; then
  125. echo $'GPG public key found on USB drive'
  126. MY_GPG_PUBLIC_KEY=$USB_MOUNT/public_key.gpg
  127. fi
  128. fi
  129. if [ -d $USB_MOUNT/prosody ]; then
  130. if [ ! -d $XMPP_DIRECTORY ]; then
  131. mkdir $XMPP_DIRECTORY
  132. fi
  133. cp -r $USB_MOUNT/prosody/* $XMPP_DIRECTORY
  134. chown -R prosody:prosody $XMPP_DIRECTORY
  135. fi
  136. if [ -d $USB_MOUNT/.ssh ]; then
  137. echo $'Importing ssh keys'
  138. cp -r $USB_MOUNT/.ssh /home/$MY_USERNAME
  139. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
  140. # for security delete the ssh keys from the usb drive
  141. if [ ! -f /home/$MY_USERNAME/.ssh/id_rsa ]; then
  142. echo $'ssh files did not copy'
  143. exit 8
  144. fi
  145. fi
  146. if [ -f $USB_MOUNT/.emacs ]; then
  147. echo $'Importing .emacs file'
  148. cp -f $USB_MOUNT/.emacs /home/$MY_USERNAME/.emacs
  149. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.emacs
  150. fi
  151. if [ -d $USB_MOUNT/.emacs.d ]; then
  152. echo $'Importing .emacs.d directory'
  153. cp -r $USB_MOUNT/.emacs.d /home/$MY_USERNAME
  154. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.emacs.d
  155. fi
  156. if [ -d $USB_MOUNT/ssl ]; then
  157. echo $'Importing SSL certificates'
  158. cp -r $USB_MOUNT/ssl/* /etc/ssl
  159. chmod 640 /etc/ssl/certs/*
  160. chmod 400 /etc/ssl/private/*
  161. # change ownership of some certificates
  162. if [ -d /etc/prosody ]; then
  163. chown prosody:prosody /etc/ssl/private/xmpp.*
  164. chown prosody:prosody /etc/ssl/certs/xmpp.*
  165. fi
  166. if [ -d /etc/dovecot ]; then
  167. chown root:dovecot /etc/ssl/certs/dovecot.*
  168. chown root:dovecot /etc/ssl/private/dovecot.*
  169. fi
  170. if [ -f /etc/ssl/private/exim.key ]; then
  171. cp /etc/ssl/private/exim.key /etc/exim4
  172. cp /etc/ssl/certs/exim.crt /etc/exim4
  173. cp /etc/ssl/certs/exim.dhparam /etc/exim4
  174. chown root:Debian-exim /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  175. chmod 640 /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  176. fi
  177. fi
  178. if [ -d $USB_MOUNT/personal ]; then
  179. echo $'Importing personal directory'
  180. cp -r $USB_MOUNT/personal /home/$MY_USERNAME
  181. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/personal
  182. fi
  183. else
  184. if [ -d $USB_MOUNT ]; then
  185. umount $USB_MOUNT
  186. rm -rf $USB_MOUNT
  187. fi
  188. echo $'No USB drive attached'
  189. fi
  190. echo 'search_for_attached_usb_drive' >> $COMPLETION_FILE
  191. }
  192. function mark_admin_user_account {
  193. if ! grep -q "Admin user:" $COMPLETION_FILE; then
  194. echo "Admin user:$MY_USERNAME" >> $COMPLETION_FILE
  195. fi
  196. }
  197. function remove_instructions_from_motd {
  198. sed -i '/## /d' /etc/motd
  199. }
  200. function remove_default_user {
  201. # make sure you don't use the default user account
  202. if [[ $MY_USERNAME == "debian" ]]; then
  203. echo 'Do not use the default debian user account. Create a different user with: adduser [username]'
  204. exit 68
  205. fi
  206. # remove the default debian user to prevent it from becoming an attack vector
  207. if [ -d /home/debian ]; then
  208. userdel -r debian
  209. echo 'Default debian user account removed'
  210. fi
  211. }
  212. function create_completion_file {
  213. if [ ! -f $COMPLETION_FILE ]; then
  214. touch $COMPLETION_FILE
  215. fi
  216. }
  217. function upgrade_installation {
  218. # TODO
  219. echo ''
  220. }
  221. function setup_firewall {
  222. function_check create_completion_file
  223. create_completion_file
  224. function_check configure_firewall
  225. configure_firewall
  226. function_check configure_firewall_ping
  227. configure_firewall_ping
  228. function_check configure_firewall_for_dns
  229. configure_firewall_for_dns
  230. function_check configure_firewall_for_avahi
  231. configure_firewall_for_avahi
  232. function_check global_rate_limit
  233. global_rate_limit
  234. }
  235. function setup_utils {
  236. function_check create_completion_file
  237. create_completion_file
  238. function_check read_configuration
  239. read_configuration
  240. function_check upgrade_installation
  241. upgrade_installation
  242. function_check set_default_onion_domains
  243. set_default_onion_domains
  244. function_check locale_setup
  245. locale_setup
  246. function_check parse_args
  247. parse_args
  248. function_check check_domains
  249. check_domains
  250. function_check install_static_network
  251. install_static_network
  252. function_check remove_default_user
  253. remove_default_user
  254. function_check setup_firewall
  255. setup_firewall
  256. function_check create_repo_sources
  257. create_repo_sources
  258. function_check configure_dns
  259. configure_dns
  260. function_check initial_setup
  261. initial_setup
  262. function_check install_tor
  263. install_tor
  264. #function_check resolve_dns_via_tor
  265. #resolve_dns_via_tor
  266. function_check install_command_line_browser
  267. install_command_line_browser
  268. function_check enable_ssh_via_onion
  269. enable_ssh_via_onion
  270. function_check check_date
  271. check_date
  272. function_check install_dynamicdns
  273. install_dynamicdns
  274. function_check randomize_cron
  275. randomize_cron
  276. function_check create_freedns_updater
  277. create_freedns_updater
  278. function_check mark_admin_user_account
  279. mark_admin_user_account
  280. function_check enforce_good_passwords
  281. enforce_good_passwords
  282. function_check install_emacs
  283. install_emacs
  284. function_check change_login_message
  285. change_login_message
  286. function_check enable_zram
  287. enable_zram
  288. function_check random_number_generator
  289. random_number_generator
  290. function_check set_your_domain_name
  291. set_your_domain_name
  292. function_check time_synchronisation_tlsdate
  293. time_synchronisation_tlsdate
  294. function_check configure_internet_protocol
  295. configure_internet_protocol
  296. function_check create_git_project
  297. create_git_project
  298. function_check setup_wifi
  299. setup_wifi
  300. function_check configure_ssh
  301. configure_ssh
  302. function_check configure_ssh_onion
  303. configure_ssh_onion
  304. function_check allow_ssh_to_onion_address
  305. allow_ssh_to_onion_address
  306. function_check remove_instructions_from_motd
  307. remove_instructions_from_motd
  308. function_check check_hwrng
  309. check_hwrng
  310. function_check search_for_attached_usb_drive
  311. search_for_attached_usb_drive
  312. function_check regenerate_ssh_keys
  313. regenerate_ssh_keys
  314. function_check create_mirrors
  315. create_mirrors
  316. function_check create_upgrade_script
  317. create_upgrade_script
  318. function_check letsencrypt_renewals
  319. letsencrypt_renewals
  320. function_check install_watchdog_script
  321. install_watchdog_script
  322. function_check install_avahi
  323. install_avahi
  324. function_check create_avahi_onion_domains
  325. create_avahi_onion_domains
  326. #function_check install_atheros_wifi
  327. #install_atheros_wifi
  328. function_check route_outgoing_traffic_through_tor
  329. route_outgoing_traffic_through_tor
  330. function_check upgrade_golang
  331. upgrade_golang
  332. function_check install_tomb
  333. install_tomb
  334. }
  335. function setup_email {
  336. function_check create_completion_file
  337. create_completion_file
  338. function_check install_email
  339. install_email
  340. function_check create_procmail
  341. create_procmail
  342. function_check handle_admin_emails
  343. handle_admin_emails
  344. function_check spam_filtering
  345. spam_filtering
  346. function_check configure_imap
  347. configure_imap
  348. #function_check configure_imap_client_certs
  349. #configure_imap_client_certs
  350. function_check configure_gpg
  351. configure_gpg
  352. function_check refresh_gpg_keys
  353. refresh_gpg_keys
  354. function_check configure_backup_key
  355. configure_backup_key
  356. function_check install_monkeysphere
  357. install_monkeysphere
  358. function_check encrypt_incoming_email
  359. encrypt_incoming_email
  360. function_check encrypt_outgoing_email
  361. encrypt_outgoing_email
  362. function_check email_client
  363. email_client
  364. function_check email_archiving
  365. email_archiving
  366. function_check email_from_address
  367. email_from_address
  368. function_check create_public_mailing_list
  369. create_public_mailing_list
  370. #function check create_private_mailing_list
  371. #create_private_mailing_list
  372. function_check encrypt_all_email
  373. encrypt_all_email
  374. function_check import_email
  375. import_email
  376. }
  377. function setup_web {
  378. function_check create_completion_file
  379. create_completion_file
  380. function_check install_web_server
  381. install_web_server
  382. function_check install_web_server_access_control
  383. install_web_server_access_control
  384. }
  385. function upgrade_apps {
  386. function_check create_completion_file
  387. create_completion_file
  388. APPS_COMPLETED=()
  389. FILES=/usr/share/${PROJECT_NAME}/apps/${PROJECT_NAME}-app-*
  390. # for all the app scripts
  391. for filename in $FILES
  392. do
  393. app_name=$(echo "${filename}" | awk -F '-app-' '{print $2}')
  394. if [[ $(item_in_array ${app_name} ${APPS_COMPLETED[@]}) != 0 ]]; then
  395. function_check app_is_installed
  396. if [[ "$(app_is_installed $a)" == "1" ]]; then
  397. APPS_COMPLETED+=("${app_name}")
  398. function_check upgrade_${app_name}
  399. upgrade_${app_name}
  400. fi
  401. fi
  402. done
  403. }
  404. function setup_apps {
  405. function_check create_completion_file
  406. create_completion_file
  407. function_check choose_apps_for_variant
  408. choose_apps_for_variant "$SYSTEM_TYPE"
  409. echo $"System variant: $SYSTEM_TYPE"
  410. echo $'The following apps have been selected'
  411. echo ''
  412. function_check list_chosen_apps
  413. list_chosen_apps
  414. echo ''
  415. function_check upgrade_apps
  416. upgrade_apps
  417. function_check install_apps
  418. install_apps
  419. }
  420. function combine_all_scripts {
  421. combined_filename=$1
  422. # initial variables
  423. cp $PROJECT_INSTALL_DIR/${PROJECT_NAME}-vars $combined_filename
  424. # utilities
  425. UTILS_FILES=/usr/share/${PROJECT_NAME}/utils/${PROJECT_NAME}-utils-*
  426. for f in $UTILS_FILES
  427. do
  428. # this removes the first line, which is #!/bin/bash
  429. tail -n +2 "$f" >> $combined_filename
  430. done
  431. # base system
  432. BASE_SYSTEM_FILES=/usr/share/${PROJECT_NAME}/base/${PROJECT_NAME}-base-*
  433. for f in $BASE_SYSTEM_FILES
  434. do
  435. tail -n +2 "$f" >> $combined_filename
  436. done
  437. # apps
  438. APP_FILES=/usr/share/${PROJECT_NAME}/apps/${PROJECT_NAME}-app-*
  439. for f in $APP_FILES
  440. do
  441. tail -n +2 "$f" >> $combined_filename
  442. done
  443. }
  444. # NOTE: deliberately no exit 0