123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576 |
- #!/bin/bash
- #
- # .---. . .
- # | | |
- # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
- # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
- # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
- #
- # Freedom in the Cloud
- #
- # Setup functions
- #
- # License
- # =======
- #
- # Copyright (C) 2014-2016 Bob Mottram <bob@robotics.uk.to>
- #
- # This program is free software: you can redistribute it and/or modify
- # it under the terms of the GNU Affero General Public License as published by
- # the Free Software Foundation, either version 3 of the License, or
- # (at your option) any later version.
- #
- # This program is distributed in the hope that it will be useful,
- # but WITHOUT ANY WARRANTY; without even the implied warranty of
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- # GNU Affero General Public License for more details.
- #
- # You should have received a copy of the GNU Affero General Public License
- # along with this program. If not, see <http://www.gnu.org/licenses/>.
-
- if [ ! $PROJECT_NAME ]; then
- PROJECT_NAME='freedombone'
- fi
-
- DEFAULT_DOMAIN_NAME=
- DEFAULT_DOMAIN_CODE=
- MY_USERNAME=
- if [ ! $SYSTEM_TYPE ]; then
- SYSTEM_TYPE="full"
- fi
-
- # An optional configuration file which overrides some of these variables
- if [ ! $CONFIGURATION_FILE ]; then
- CONFIGURATION_FILE="$HOME/${PROJECT_NAME}.cfg"
- fi
-
- # Directory where source code is downloaded and compiled
- INSTALL_DIR=$HOME/build
-
- # device name for an attached usb drive
- USB_DRIVE=/dev/sda1
-
- # Location where the USB drive is mounted to
- USB_MOUNT=/mnt/usb
-
- # Number of days to keep backups for
- BACKUP_MAX_DAYS=30
-
- # file containing a list of remote locations to backup to
- # Format: [username@friendsdomain//home/username] [ssh_password]
- # With the only space character being between the server and the password
- FRIENDS_SERVERS_LIST=/home/$MY_USERNAME/backup.list
-
- export DEBIAN_FRONTEND=noninteractive
-
- # used to limit CPU usage
- CPULIMIT='/usr/bin/cpulimit -l 20 -e'
-
- # command to create a git repository
- CREATE_GIT_PROJECT_COMMAND='create-project'
-
- # File which keeps track of what has already been installed
- COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt
-
- # log file where details of remote backups are stored
- REMOTE_BACKUPS_LOG=/var/log/remotebackups.log
-
- # message if something fails to install
- CHECK_MESSAGE="Check your internet connection, /etc/network/interfaces and /etc/resolv.conf, then delete $COMPLETION_FILE, run 'rm -fR /var/lib/apt/lists/* && apt-get update --fix-missing' and run this script again. If hash sum mismatches persist then try setting $DEBIAN_REPO to a different mirror and also change /etc/apt/sources.list."
-
- # Default diffie-hellman key length in bits
- DH_KEYLENGTH=2048
-
- function initial_setup {
- if [[ $(is_completed $FUNCNAME) == "1" ]]; then
- return
- fi
-
- apt-get -y remove --purge apache*
- apt-get -y dist-upgrade
- apt-get -y install ca-certificates
- apt-get -y install apt-utils
- apt-get -y install cryptsetup libgfshare-bin obnam sshpass wget avahi-daemon
- apt-get -y install avahi-utils avahi-discover connect-proxy openssh-server
- apt-get -y install sudo git dialog build-essential avahi-daemon avahi-utils
- apt-get -y install avahi-discover avahi-autoipd iptables dnsutils net-tools
- apt-get -y install network-manager iputils-ping libnss-mdns libnss-myhostname
- apt-get -y install libnss-gw-name nano man ntp locales locales-all debconf
- apt-get -y install wireless-tools wpasupplicant usbutils cryptsetup zsh
- apt-get -y install pinentry-curses eatmydata iotop bc grub2 hostapd haveged
- apt-get -y install cpulimit
-
- if [ ! -d $INSTALL_DIR ]; then
- mkdir -p $INSTALL_DIR
- fi
-
- mark_completed $FUNCNAME
- }
-
- function search_for_attached_usb_drive {
- # If a USB drive is attached then search for email,
- # gpg, ssh keys and emacs configuration
- if [[ $(is_completed $FUNCNAME) == "1" ]]; then
- return
- fi
- if [ -b $USB_DRIVE ]; then
- if [ ! -d $USB_MOUNT ]; then
- echo $'Mounting USB drive'
- mkdir $USB_MOUNT
- mount $USB_DRIVE $USB_MOUNT
- fi
- if [ -d $USB_MOUNT/Maildir ]; then
- echo $'Maildir found on USB drive'
- IMPORT_MAILDIR=$USB_MOUNT/Maildir
- fi
- if [ -d $USB_MOUNT/.gnupg ]; then
- echo $'Importing GPG keyring'
- cp -r $USB_MOUNT/.gnupg /home/$MY_USERNAME
- chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.gnupg
- GPG_KEYS_IMPORTED="yes"
- if [ ! -f /home/$MY_USERNAME/.gnupg/secring.gpg ]; then
- echo $'GPG files did not copy'
- exit 73529
- fi
- fi
-
- if [ -f $USB_MOUNT/.procmailrc ]; then
- echo $'Importing procmail settings'
- cp $USB_MOUNT/.procmailrc /home/$MY_USERNAME
- chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
- fi
-
- if [ -f $USB_MOUNT/private_key.gpg ]; then
- echo $'GPG private key found on USB drive'
- MY_GPG_PRIVATE_KEY=$USB_MOUNT/private_key.gpg
- fi
- if [ -f $USB_MOUNT/public_key.gpg ]; then
- echo $'GPG public key found on USB drive'
- MY_GPG_PUBLIC_KEY=$USB_MOUNT/public_key.gpg
- fi
-
- if [ -d $USB_MOUNT/prosody ]; then
- if [ ! -d $XMPP_DIRECTORY ]; then
- mkdir $XMPP_DIRECTORY
- fi
- cp -r $USB_MOUNT/prosody/* $XMPP_DIRECTORY
- chown -R prosody:prosody $XMPP_DIRECTORY
- fi
- if [ -d $USB_MOUNT/.ssh ]; then
- echo $'Importing ssh keys'
- cp -r $USB_MOUNT/.ssh /home/$MY_USERNAME
- chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
- # for security delete the ssh keys from the usb drive
- if [ ! -f /home/$MY_USERNAME/.ssh/id_rsa ]; then
- echo $'ssh files did not copy'
- exit 8
- fi
- fi
- if [ -f $USB_MOUNT/.emacs ]; then
- echo $'Importing .emacs file'
- cp -f $USB_MOUNT/.emacs /home/$MY_USERNAME/.emacs
- chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.emacs
- fi
- if [ -d $USB_MOUNT/.emacs.d ]; then
- echo $'Importing .emacs.d directory'
- cp -r $USB_MOUNT/.emacs.d /home/$MY_USERNAME
- chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.emacs.d
- fi
- if [ -d $USB_MOUNT/ssl ]; then
- echo $'Importing SSL certificates'
- cp -r $USB_MOUNT/ssl/* /etc/ssl
- chmod 640 /etc/ssl/certs/*
- chmod 400 /etc/ssl/private/*
- # change ownership of some certificates
- if [ -d /etc/prosody ]; then
- chown prosody:prosody /etc/ssl/private/xmpp.*
- chown prosody:prosody /etc/ssl/certs/xmpp.*
- fi
- if [ -d /etc/dovecot ]; then
- chown root:dovecot /etc/ssl/certs/dovecot.*
- chown root:dovecot /etc/ssl/private/dovecot.*
- fi
- if [ -f /etc/ssl/private/exim.key ]; then
- cp /etc/ssl/private/exim.key /etc/exim4
- cp /etc/ssl/certs/exim.crt /etc/exim4
- cp /etc/ssl/certs/exim.dhparam /etc/exim4
- chown root:Debian-exim /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
- chmod 640 /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
- fi
- fi
- if [ -d $USB_MOUNT/personal ]; then
- echo $'Importing personal directory'
- cp -r $USB_MOUNT/personal /home/$MY_USERNAME
- chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/personal
- fi
- else
- if [ -d $USB_MOUNT ]; then
- umount $USB_MOUNT
- rm -rf $USB_MOUNT
- fi
- echo $'No USB drive attached'
- fi
- mark_completed $FUNCNAME
- }
-
- function mark_admin_user_account {
- set_completion_param "Admin user" "$MY_USERNAME"
- }
-
- function remove_instructions_from_motd {
- sed -i '/## /d' /etc/motd
- }
-
- function remove_default_user {
- # make sure you don't use the default user account
- if [[ $MY_USERNAME == "debian" ]]; then
- echo 'Do not use the default debian user account. Create a different user with: adduser [username]'
- exit 68
- fi
- # remove the default debian user to prevent it from becoming an attack vector
- if [ -d /home/debian ]; then
- userdel -r debian
- echo 'Default debian user account removed'
- fi
- }
-
- function create_completion_file {
- if [ ! -f $COMPLETION_FILE ]; then
- touch $COMPLETION_FILE
- fi
- }
-
- function upgrade_installation {
- # TODO
- echo ''
- }
-
- function setup_firewall {
- function_check create_completion_file
- create_completion_file
-
- function_check configure_firewall
- configure_firewall
-
- function_check configure_firewall_ping
- configure_firewall_ping
-
- function_check configure_firewall_for_dns
- configure_firewall_for_dns
-
- function_check configure_firewall_for_avahi
- configure_firewall_for_avahi
-
- function_check global_rate_limit
- global_rate_limit
- }
-
- function setup_utils {
- read_config_param "PROJECT_REPO"
- write_config_param "PROJECT_REPO" "$PROJECT_REPO"
-
- function_check create_completion_file
- create_completion_file
-
- function_check read_configuration
- read_configuration
-
- function_check check_system_type
- check_system_type
-
- function_check upgrade_installation
- upgrade_installation
-
- function_check set_default_onion_domains
- set_default_onion_domains
-
- function_check locale_setup
- locale_setup
-
- function_check parse_args
- parse_args
-
- function_check check_domains
- check_domains
-
- function_check install_static_network
- install_static_network
-
- function_check remove_default_user
- remove_default_user
-
- function_check setup_firewall
- setup_firewall
-
- function_check create_repo_sources
- create_repo_sources
-
- function_check configure_dns
- configure_dns
-
- function_check initial_setup
- initial_setup
-
- function_check install_tor
- install_tor
-
- #function_check resolve_dns_via_tor
- #resolve_dns_via_tor
-
- function_check install_command_line_browser
- install_command_line_browser
-
- function_check enable_ssh_via_onion
- enable_ssh_via_onion
-
- function_check check_date
- check_date
-
- function_check install_dynamicdns
- install_dynamicdns
-
- function_check randomize_cron
- randomize_cron
-
- function_check create_freedns_updater
- create_freedns_updater
-
- function_check mark_admin_user_account
- mark_admin_user_account
-
- function_check enforce_good_passwords
- enforce_good_passwords
-
- function_check change_login_message
- change_login_message
-
- function_check enable_zram
- enable_zram
-
- function_check random_number_generator
- random_number_generator
-
- function_check set_your_domain_name
- set_your_domain_name
-
- function_check configure_internet_protocol
- configure_internet_protocol
-
- function_check create_git_project
- create_git_project
-
- function_check setup_wifi
- setup_wifi
-
- function_check configure_ssh
- configure_ssh
-
- function_check configure_ssh_onion
- configure_ssh_onion
-
- function_check allow_ssh_to_onion_address
- allow_ssh_to_onion_address
-
- function_check remove_instructions_from_motd
- remove_instructions_from_motd
-
- function_check check_hwrng
- check_hwrng
-
- function_check search_for_attached_usb_drive
- search_for_attached_usb_drive
-
- function_check regenerate_ssh_keys
- regenerate_ssh_keys
-
- function_check create_mirrors
- create_mirrors
-
- function_check create_upgrade_script
- create_upgrade_script
-
- function_check letsencrypt_renewals
- letsencrypt_renewals
-
- function_check install_watchdog_script
- install_watchdog_script
-
- function_check install_avahi
- install_avahi
-
- function_check create_avahi_onion_domains
- create_avahi_onion_domains
-
- #function_check install_atheros_wifi
- #install_atheros_wifi
-
- function_check route_outgoing_traffic_through_tor
- route_outgoing_traffic_through_tor
-
- function_check upgrade_golang
- upgrade_golang
-
- function_check install_tomb
- install_tomb
- }
-
- function setup_email {
- function_check create_completion_file
- create_completion_file
-
- function_check install_email
- install_email
-
- function_check create_procmail
- create_procmail
-
- function_check handle_admin_emails
- handle_admin_emails
-
- function_check spam_filtering
- spam_filtering
-
- function_check configure_imap
- configure_imap
-
- #function_check configure_imap_client_certs
- #configure_imap_client_certs
-
- function_check configure_gpg
- configure_gpg
-
- function_check refresh_gpg_keys
- refresh_gpg_keys
-
- function_check configure_backup_key
- configure_backup_key
-
- function_check install_monkeysphere
- install_monkeysphere
-
- function_check encrypt_incoming_email
- encrypt_incoming_email
-
- function_check encrypt_outgoing_email
- encrypt_outgoing_email
-
- function_check email_client
- email_client
-
- function_check email_archiving
- email_archiving
-
- function_check email_from_address
- email_from_address
-
- function_check create_public_mailing_list
- create_public_mailing_list
-
- #function check create_private_mailing_list
- #create_private_mailing_list
-
- function_check encrypt_all_email
- encrypt_all_email
-
- function_check import_email
- import_email
- }
-
- function setup_web {
- function_check create_completion_file
- create_completion_file
-
- function_check install_web_server
- install_web_server
-
- function_check install_web_server_access_control
- install_web_server_access_control
- }
-
- function upgrade_apps {
- function_check create_completion_file
- create_completion_file
-
- APPS_COMPLETED=()
- FILES=/usr/share/${PROJECT_NAME}/apps/${PROJECT_NAME}-app-*
-
- # for all the app scripts
- for filename in $FILES
- do
- app_name=$(echo "${filename}" | awk -F '-app-' '{print $2}')
-
- item_in_array "${app_name}" "${APPS_COMPLETED[@]}"
- if [[ $? != 0 ]]; then
- function_check app_is_installed
- if [[ "$(app_is_installed $a)" == "1" ]]; then
- app_load_variables ${app_name}
- APPS_COMPLETED+=("${app_name}")
- function_check upgrade_${app_name}
- upgrade_${app_name}
- fi
- fi
- done
- }
-
- function setup_apps {
- is_interactive=$1
-
- function_check create_completion_file
- create_completion_file
-
- function_check detect_installable_apps
- detect_installable_apps
-
- function_check choose_apps_for_variant
- choose_apps_for_variant "$SYSTEM_TYPE"
-
- echo $"System variant: $SYSTEM_TYPE"
- echo $'The following apps have been selected'
- echo ''
- function_check list_chosen_apps
- list_chosen_apps
- echo ''
-
- function_check upgrade_apps
- upgrade_apps
-
- if [[ $is_interactive == "menuconfig"* ]]; then
- ${PROJECT_NAME}-addremove all
- fi
-
- if [[ $is_interactive == "noninteractive" || $is_interactive == "headless" ]]; then
- function_check install_apps
- install_apps
- fi
- }
-
- function combine_all_scripts {
- combined_filename=$1
-
- # initial variables
- cp $PROJECT_INSTALL_DIR/${PROJECT_NAME}-vars $combined_filename
-
- # utilities
- UTILS_FILES=/usr/share/${PROJECT_NAME}/utils/${PROJECT_NAME}-utils-*
- for f in $UTILS_FILES
- do
- # this removes the first line, which is #!/bin/bash
- tail -n +2 "$f" >> $combined_filename
- done
-
- # base system
- BASE_SYSTEM_FILES=/usr/share/${PROJECT_NAME}/base/${PROJECT_NAME}-base-*
- for f in $BASE_SYSTEM_FILES
- do
- tail -n +2 "$f" >> $combined_filename
- done
-
- # apps
- APP_FILES=/usr/share/${PROJECT_NAME}/apps/${PROJECT_NAME}-app-*
- for f in $APP_FILES
- do
- tail -n +2 "$f" >> $combined_filename
- done
- }
-
- # NOTE: deliberately no exit 0
|