freedombone-utils-setup 16KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Setup functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2016 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. if [ ! $PROJECT_NAME ]; then
  31. PROJECT_NAME='freedombone'
  32. fi
  33. DEFAULT_DOMAIN_NAME=
  34. DEFAULT_DOMAIN_CODE=
  35. MY_USERNAME=
  36. if [ ! $SYSTEM_TYPE ]; then
  37. SYSTEM_TYPE="full"
  38. fi
  39. # An optional configuration file which overrides some of these variables
  40. if [ ! $CONFIGURATION_FILE ]; then
  41. CONFIGURATION_FILE="$HOME/${PROJECT_NAME}.cfg"
  42. fi
  43. # Directory where source code is downloaded and compiled
  44. INSTALL_DIR=$HOME/build
  45. # device name for an attached usb drive
  46. USB_DRIVE=/dev/sda1
  47. # Location where the USB drive is mounted to
  48. USB_MOUNT=/mnt/usb
  49. # Number of days to keep backups for
  50. BACKUP_MAX_DAYS=30
  51. # file containing a list of remote locations to backup to
  52. # Format: [username@friendsdomain//home/username] [ssh_password]
  53. # With the only space character being between the server and the password
  54. FRIENDS_SERVERS_LIST=/home/$MY_USERNAME/backup.list
  55. export DEBIAN_FRONTEND=noninteractive
  56. # used to limit CPU usage
  57. CPULIMIT='/usr/bin/cpulimit -l 20 -e'
  58. # command to create a git repository
  59. CREATE_GIT_PROJECT_COMMAND='create-project'
  60. # File which keeps track of what has already been installed
  61. COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt
  62. # log file where details of remote backups are stored
  63. REMOTE_BACKUPS_LOG=/var/log/remotebackups.log
  64. # message if something fails to install
  65. CHECK_MESSAGE="Check your internet connection, /etc/network/interfaces and /etc/resolv.conf, then delete $COMPLETION_FILE, run 'rm -fR /var/lib/apt/lists/* && apt-get update --fix-missing' and run this script again. If hash sum mismatches persist then try setting $DEBIAN_REPO to a different mirror and also change /etc/apt/sources.list."
  66. # Default diffie-hellman key length in bits
  67. DH_KEYLENGTH=2048
  68. function initial_setup {
  69. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  70. return
  71. fi
  72. apt-get -y remove --purge apache*
  73. apt-get -y dist-upgrade
  74. apt-get -y install ca-certificates
  75. apt-get -y install apt-utils
  76. apt-get -y install cryptsetup libgfshare-bin obnam sshpass wget avahi-daemon
  77. apt-get -y install avahi-utils avahi-discover connect-proxy openssh-server
  78. apt-get -y install sudo git dialog build-essential avahi-daemon avahi-utils
  79. apt-get -y install avahi-discover avahi-autoipd iptables dnsutils net-tools
  80. apt-get -y install network-manager iputils-ping libnss-mdns libnss-myhostname
  81. apt-get -y install libnss-gw-name nano man ntp locales locales-all debconf
  82. apt-get -y install wireless-tools wpasupplicant usbutils cryptsetup zsh
  83. apt-get -y install pinentry-curses eatmydata iotop bc grub2 hostapd haveged
  84. apt-get -y install cpulimit
  85. if [ ! -d $INSTALL_DIR ]; then
  86. mkdir -p $INSTALL_DIR
  87. fi
  88. mark_completed $FUNCNAME
  89. }
  90. function search_for_attached_usb_drive {
  91. # If a USB drive is attached then search for email,
  92. # gpg, ssh keys and emacs configuration
  93. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  94. return
  95. fi
  96. if [ -b $USB_DRIVE ]; then
  97. if [ ! -d $USB_MOUNT ]; then
  98. echo $'Mounting USB drive'
  99. mkdir $USB_MOUNT
  100. mount $USB_DRIVE $USB_MOUNT
  101. fi
  102. if [ -d $USB_MOUNT/Maildir ]; then
  103. echo $'Maildir found on USB drive'
  104. IMPORT_MAILDIR=$USB_MOUNT/Maildir
  105. fi
  106. if [ -d $USB_MOUNT/.gnupg ]; then
  107. echo $'Importing GPG keyring'
  108. cp -r $USB_MOUNT/.gnupg /home/$MY_USERNAME
  109. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.gnupg
  110. GPG_KEYS_IMPORTED="yes"
  111. if [ ! -f /home/$MY_USERNAME/.gnupg/secring.gpg ]; then
  112. echo $'GPG files did not copy'
  113. exit 73529
  114. fi
  115. fi
  116. if [ -f $USB_MOUNT/.procmailrc ]; then
  117. echo $'Importing procmail settings'
  118. cp $USB_MOUNT/.procmailrc /home/$MY_USERNAME
  119. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  120. fi
  121. if [ -f $USB_MOUNT/private_key.gpg ]; then
  122. echo $'GPG private key found on USB drive'
  123. MY_GPG_PRIVATE_KEY=$USB_MOUNT/private_key.gpg
  124. fi
  125. if [ -f $USB_MOUNT/public_key.gpg ]; then
  126. echo $'GPG public key found on USB drive'
  127. MY_GPG_PUBLIC_KEY=$USB_MOUNT/public_key.gpg
  128. fi
  129. if [ -d $USB_MOUNT/prosody ]; then
  130. if [ ! -d $XMPP_DIRECTORY ]; then
  131. mkdir $XMPP_DIRECTORY
  132. fi
  133. cp -r $USB_MOUNT/prosody/* $XMPP_DIRECTORY
  134. chown -R prosody:prosody $XMPP_DIRECTORY
  135. fi
  136. if [ -d $USB_MOUNT/.ssh ]; then
  137. echo $'Importing ssh keys'
  138. cp -r $USB_MOUNT/.ssh /home/$MY_USERNAME
  139. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
  140. # for security delete the ssh keys from the usb drive
  141. if [ ! -f /home/$MY_USERNAME/.ssh/id_rsa ]; then
  142. echo $'ssh files did not copy'
  143. exit 8
  144. fi
  145. fi
  146. if [ -f $USB_MOUNT/.emacs ]; then
  147. echo $'Importing .emacs file'
  148. cp -f $USB_MOUNT/.emacs /home/$MY_USERNAME/.emacs
  149. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.emacs
  150. fi
  151. if [ -d $USB_MOUNT/.emacs.d ]; then
  152. echo $'Importing .emacs.d directory'
  153. cp -r $USB_MOUNT/.emacs.d /home/$MY_USERNAME
  154. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.emacs.d
  155. fi
  156. if [ -d $USB_MOUNT/ssl ]; then
  157. echo $'Importing SSL certificates'
  158. cp -r $USB_MOUNT/ssl/* /etc/ssl
  159. chmod 640 /etc/ssl/certs/*
  160. chmod 400 /etc/ssl/private/*
  161. # change ownership of some certificates
  162. if [ -d /etc/prosody ]; then
  163. chown prosody:prosody /etc/ssl/private/xmpp.*
  164. chown prosody:prosody /etc/ssl/certs/xmpp.*
  165. fi
  166. if [ -d /etc/dovecot ]; then
  167. chown root:dovecot /etc/ssl/certs/dovecot.*
  168. chown root:dovecot /etc/ssl/private/dovecot.*
  169. fi
  170. if [ -f /etc/ssl/private/exim.key ]; then
  171. cp /etc/ssl/private/exim.key /etc/exim4
  172. cp /etc/ssl/certs/exim.crt /etc/exim4
  173. cp /etc/ssl/certs/exim.dhparam /etc/exim4
  174. chown root:Debian-exim /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  175. chmod 640 /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  176. fi
  177. fi
  178. if [ -d $USB_MOUNT/personal ]; then
  179. echo $'Importing personal directory'
  180. cp -r $USB_MOUNT/personal /home/$MY_USERNAME
  181. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/personal
  182. fi
  183. else
  184. if [ -d $USB_MOUNT ]; then
  185. umount $USB_MOUNT
  186. rm -rf $USB_MOUNT
  187. fi
  188. echo $'No USB drive attached'
  189. fi
  190. mark_completed $FUNCNAME
  191. }
  192. function mark_admin_user_account {
  193. set_completion_param "Admin user" "$MY_USERNAME"
  194. }
  195. function remove_instructions_from_motd {
  196. sed -i '/## /d' /etc/motd
  197. }
  198. function remove_default_user {
  199. # make sure you don't use the default user account
  200. if [[ $MY_USERNAME == "debian" ]]; then
  201. echo 'Do not use the default debian user account. Create a different user with: adduser [username]'
  202. exit 68
  203. fi
  204. # remove the default debian user to prevent it from becoming an attack vector
  205. if [ -d /home/debian ]; then
  206. userdel -r debian
  207. echo 'Default debian user account removed'
  208. fi
  209. }
  210. function create_completion_file {
  211. if [ ! -f $COMPLETION_FILE ]; then
  212. touch $COMPLETION_FILE
  213. fi
  214. }
  215. function upgrade_installation {
  216. # TODO
  217. echo ''
  218. }
  219. function setup_firewall {
  220. function_check create_completion_file
  221. create_completion_file
  222. function_check configure_firewall
  223. configure_firewall
  224. function_check configure_firewall_ping
  225. configure_firewall_ping
  226. function_check configure_firewall_for_dns
  227. configure_firewall_for_dns
  228. function_check configure_firewall_for_avahi
  229. configure_firewall_for_avahi
  230. function_check global_rate_limit
  231. global_rate_limit
  232. }
  233. function setup_utils {
  234. read_config_param "PROJECT_REPO"
  235. write_config_param "PROJECT_REPO" "$PROJECT_REPO"
  236. function_check create_completion_file
  237. create_completion_file
  238. function_check read_configuration
  239. read_configuration
  240. function_check check_system_type
  241. check_system_type
  242. function_check upgrade_installation
  243. upgrade_installation
  244. function_check set_default_onion_domains
  245. set_default_onion_domains
  246. function_check locale_setup
  247. locale_setup
  248. function_check parse_args
  249. parse_args
  250. function_check check_domains
  251. check_domains
  252. function_check install_static_network
  253. install_static_network
  254. function_check remove_default_user
  255. remove_default_user
  256. function_check setup_firewall
  257. setup_firewall
  258. function_check create_repo_sources
  259. create_repo_sources
  260. function_check configure_dns
  261. configure_dns
  262. function_check initial_setup
  263. initial_setup
  264. function_check install_tor
  265. install_tor
  266. #function_check resolve_dns_via_tor
  267. #resolve_dns_via_tor
  268. function_check install_command_line_browser
  269. install_command_line_browser
  270. function_check enable_ssh_via_onion
  271. enable_ssh_via_onion
  272. function_check check_date
  273. check_date
  274. function_check install_dynamicdns
  275. install_dynamicdns
  276. function_check randomize_cron
  277. randomize_cron
  278. function_check create_freedns_updater
  279. create_freedns_updater
  280. function_check mark_admin_user_account
  281. mark_admin_user_account
  282. function_check enforce_good_passwords
  283. enforce_good_passwords
  284. function_check change_login_message
  285. change_login_message
  286. function_check enable_zram
  287. enable_zram
  288. function_check random_number_generator
  289. random_number_generator
  290. function_check set_your_domain_name
  291. set_your_domain_name
  292. function_check configure_internet_protocol
  293. configure_internet_protocol
  294. function_check create_git_project
  295. create_git_project
  296. function_check setup_wifi
  297. setup_wifi
  298. function_check configure_ssh
  299. configure_ssh
  300. function_check configure_ssh_onion
  301. configure_ssh_onion
  302. function_check allow_ssh_to_onion_address
  303. allow_ssh_to_onion_address
  304. function_check remove_instructions_from_motd
  305. remove_instructions_from_motd
  306. function_check check_hwrng
  307. check_hwrng
  308. function_check search_for_attached_usb_drive
  309. search_for_attached_usb_drive
  310. function_check regenerate_ssh_keys
  311. regenerate_ssh_keys
  312. function_check create_mirrors
  313. create_mirrors
  314. function_check create_upgrade_script
  315. create_upgrade_script
  316. function_check letsencrypt_renewals
  317. letsencrypt_renewals
  318. function_check install_watchdog_script
  319. install_watchdog_script
  320. function_check install_avahi
  321. install_avahi
  322. function_check create_avahi_onion_domains
  323. create_avahi_onion_domains
  324. #function_check install_atheros_wifi
  325. #install_atheros_wifi
  326. function_check route_outgoing_traffic_through_tor
  327. route_outgoing_traffic_through_tor
  328. function_check upgrade_golang
  329. upgrade_golang
  330. function_check install_tomb
  331. install_tomb
  332. }
  333. function setup_email {
  334. function_check create_completion_file
  335. create_completion_file
  336. function_check install_email
  337. install_email
  338. function_check create_procmail
  339. create_procmail
  340. function_check handle_admin_emails
  341. handle_admin_emails
  342. function_check spam_filtering
  343. spam_filtering
  344. function_check configure_imap
  345. configure_imap
  346. #function_check configure_imap_client_certs
  347. #configure_imap_client_certs
  348. function_check configure_gpg
  349. configure_gpg
  350. function_check refresh_gpg_keys
  351. refresh_gpg_keys
  352. function_check configure_backup_key
  353. configure_backup_key
  354. function_check install_monkeysphere
  355. install_monkeysphere
  356. function_check encrypt_incoming_email
  357. encrypt_incoming_email
  358. function_check encrypt_outgoing_email
  359. encrypt_outgoing_email
  360. function_check email_client
  361. email_client
  362. function_check email_archiving
  363. email_archiving
  364. function_check email_from_address
  365. email_from_address
  366. function_check create_public_mailing_list
  367. create_public_mailing_list
  368. #function check create_private_mailing_list
  369. #create_private_mailing_list
  370. function_check encrypt_all_email
  371. encrypt_all_email
  372. function_check import_email
  373. import_email
  374. }
  375. function setup_web {
  376. function_check create_completion_file
  377. create_completion_file
  378. function_check install_web_server
  379. install_web_server
  380. function_check install_web_server_access_control
  381. install_web_server_access_control
  382. }
  383. function upgrade_apps {
  384. function_check create_completion_file
  385. create_completion_file
  386. APPS_COMPLETED=()
  387. FILES=/usr/share/${PROJECT_NAME}/apps/${PROJECT_NAME}-app-*
  388. # for all the app scripts
  389. for filename in $FILES
  390. do
  391. app_name=$(echo "${filename}" | awk -F '-app-' '{print $2}')
  392. item_in_array "${app_name}" "${APPS_COMPLETED[@]}"
  393. if [[ $? != 0 ]]; then
  394. function_check app_is_installed
  395. if [[ "$(app_is_installed $a)" == "1" ]]; then
  396. app_load_variables ${app_name}
  397. APPS_COMPLETED+=("${app_name}")
  398. function_check upgrade_${app_name}
  399. upgrade_${app_name}
  400. fi
  401. fi
  402. done
  403. }
  404. function setup_apps {
  405. is_interactive=$1
  406. function_check create_completion_file
  407. create_completion_file
  408. function_check detect_installable_apps
  409. detect_installable_apps
  410. function_check choose_apps_for_variant
  411. choose_apps_for_variant "$SYSTEM_TYPE"
  412. echo $"System variant: $SYSTEM_TYPE"
  413. echo $'The following apps have been selected'
  414. echo ''
  415. function_check list_chosen_apps
  416. list_chosen_apps
  417. echo ''
  418. function_check upgrade_apps
  419. upgrade_apps
  420. if [[ $is_interactive == "menuconfig"* ]]; then
  421. ${PROJECT_NAME}-addremove all
  422. fi
  423. if [[ $is_interactive == "noninteractive" || $is_interactive == "headless" ]]; then
  424. function_check install_apps
  425. install_apps
  426. fi
  427. }
  428. function combine_all_scripts {
  429. combined_filename=$1
  430. # initial variables
  431. cp $PROJECT_INSTALL_DIR/${PROJECT_NAME}-vars $combined_filename
  432. # utilities
  433. UTILS_FILES=/usr/share/${PROJECT_NAME}/utils/${PROJECT_NAME}-utils-*
  434. for f in $UTILS_FILES
  435. do
  436. # this removes the first line, which is #!/bin/bash
  437. tail -n +2 "$f" >> $combined_filename
  438. done
  439. # base system
  440. BASE_SYSTEM_FILES=/usr/share/${PROJECT_NAME}/base/${PROJECT_NAME}-base-*
  441. for f in $BASE_SYSTEM_FILES
  442. do
  443. tail -n +2 "$f" >> $combined_filename
  444. done
  445. # apps
  446. APP_FILES=/usr/share/${PROJECT_NAME}/apps/${PROJECT_NAME}-app-*
  447. for f in $APP_FILES
  448. do
  449. tail -n +2 "$f" >> $combined_filename
  450. done
  451. }
  452. # NOTE: deliberately no exit 0