freedombone-sec 18KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Alters the security settings
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. SSL_PROTOCOLS=
  31. SSL_CIPHERS=
  32. SSH_CIPHERS=
  33. SSH_MACS=
  34. SSH_KEX=
  35. SSH_HOST_KEY_ALGORITHMS=
  36. SSH_PASSWORDS=
  37. XMPP_CIPHERS=
  38. XMPP_ECC_CURVE=
  39. WEBSITES_DIRECTORY='/etc/nginx/sites-available'
  40. DOVECOT_CIPHERS='/etc/dovecot/conf.d/10-ssl.conf'
  41. SSH_CONFIG='/etc/ssh/sshd_config'
  42. XMPP_CONFIG='/etc/prosody/conf.avail/xmpp.cfg.lua'
  43. MINIMUM_LENGTH=6
  44. IMPORT_FILE=
  45. EXPORT_FILE=
  46. CURRENT_DIR=$(pwd)
  47. REGENERATE_SSH_HOST_KEYS="no"
  48. REGENERATE_DH_KEYS="no"
  49. RESET_TRIPWIRE="no"
  50. DH_KEYLENGTH=3072
  51. function get_protocols_from_website {
  52. if [ ! -f $WEBSITES_DIRECTORY/$1 ]; then
  53. return
  54. fi
  55. SSL_PROTOCOLS=$(cat $WEBSITES_DIRECTORY/$1 | grep 'ssl_protocols ' | awk -F "ssl_protocols " '{print $2}' | awk -F ';' '{print $1}')
  56. }
  57. function get_ciphers_from_website {
  58. if [ ! -f $WEBSITES_DIRECTORY/$1 ]; then
  59. return
  60. fi
  61. SSL_CIPHERS=$(cat $WEBSITES_DIRECTORY/$1 | grep 'ssl_ciphers ' | awk -F "ssl_ciphers " '{print $2}' | awk -F "'" '{print $2}')
  62. }
  63. function get_website_settings {
  64. if [ ! -d $WEBSITES_DIRECTORY ]; then
  65. return
  66. fi
  67. cd $WEBSITES_DIRECTORY
  68. for file in `dir -d *` ; do
  69. get_protocols_from_website $file
  70. if [ ${#SSL_PROTOCOLS} -gt $MINIMUM_LENGTH ]; then
  71. get_ciphers_from_website $file
  72. if [ ${#SSL_CIPHERS} -gt $MINIMUM_LENGTH ]; then
  73. break
  74. else
  75. SSL_PROTOCOLS=""
  76. fi
  77. fi
  78. done
  79. }
  80. function get_imap_settings {
  81. if [ ! -f $DOVECOT_CIPHERS ]; then
  82. return
  83. fi
  84. # clear commented out cipher list
  85. sed -i "s|#ssl_cipher_list.*||g" $DOVECOT_CIPHERS
  86. if [ $SSL_CIPHERS ]; then
  87. return
  88. fi
  89. if [ ${#SSL_CIPHERS} -gt $MINIMUM_LENGTH ]; then
  90. return
  91. fi
  92. SSL_CIPHERS=$(cat $DOVECOT_CIPHERS | grep 'ssl_cipher_list' | awk -F '=' '{print $2}' | awk -F "'" '{print $2}')
  93. }
  94. function get_xmpp_settings {
  95. if [ ! -f $XMPP_CONFIG ]; then
  96. return
  97. fi
  98. XMPP_CIPHERS=$(cat $XMPP_CONFIG | grep 'ciphers ' | awk -F '=' '{print $2}' | awk -F '"' '{print $2}')
  99. XMPP_ECC_CURVE=$(cat $XMPP_CONFIG | grep 'curve ' | awk -F '=' '{print $2}' | awk -F '"' '{print $2}')
  100. }
  101. function get_ssh_settings {
  102. if [ -f $SSH_CONFIG ]; then
  103. SSH_CIPHERS=$(cat $SSH_CONFIG | grep 'Ciphers ' | awk -F 'Ciphers ' '{print $2}')
  104. SSH_MACS=$(cat $SSH_CONFIG | grep 'MACs ' | awk -F 'MACs ' '{print $2}')
  105. SSH_KEX=$(cat $SSH_CONFIG | grep 'KexAlgorithms ' | awk -F 'KexAlgorithms ' '{print $2}')
  106. SSH_PASSWORDS=$(cat $SSH_CONFIG | grep 'PasswordAuthentication ' | awk -F 'PasswordAuthentication ' '{print $2}')
  107. fi
  108. if [ -f /etc/ssh/ssh_config ]; then
  109. SSH_HOST_KEY_ALGORITHMS=$(cat /etc/ssh/ssh_config | grep 'HostKeyAlgorithms ' | awk -F 'HostKeyAlgorithms ' '{print $2}')
  110. if [ ! $SSH_CIPHERS ]; then
  111. SSH_CIPHERS=$(cat /etc/ssh/ssh_config | grep 'Ciphers ' | awk -F 'Ciphers ' '{print $2}')
  112. fi
  113. if [ ! $SSH_MACS ]; then
  114. SSH_MACS=$(cat /etc/ssh/ssh_config | grep 'MACs ' | awk -F 'MACs ' '{print $2}')
  115. fi
  116. fi
  117. }
  118. function change_website_settings {
  119. if [ ! "$SSL_PROTOCOLS" ]; then
  120. return
  121. fi
  122. if [ ! $SSL_CIPHERS ]; then
  123. return
  124. fi
  125. if [ ${#SSL_PROTOCOLS} -lt $MINIMUM_LENGTH ]; then
  126. return
  127. fi
  128. if [ ${#SSL_CIPHERS} -lt $MINIMUM_LENGTH ]; then
  129. return
  130. fi
  131. if [ ! -d $WEBSITES_DIRECTORY ]; then
  132. return
  133. fi
  134. cd $WEBSITES_DIRECTORY
  135. for file in `dir -d *` ; do
  136. sed -i "s|ssl_protocols .*|ssl_protocols $SSL_PROTOCOLS;|g" $WEBSITES_DIRECTORY/$file
  137. sed -i "s|ssl_ciphers .*|ssl_ciphers '$SSL_CIPHERS';|g" $WEBSITES_DIRECTORY/$file
  138. done
  139. service nginx restart
  140. echo 'Web security settings changed'
  141. }
  142. function change_imap_settings {
  143. if [ ! -f $DOVECOT_CIPHERS ]; then
  144. return
  145. fi
  146. if [ ! $SSL_CIPHERS ]; then
  147. return
  148. fi
  149. if [ ${#SSL_CIPHERS} -lt $MINIMUM_LENGTH ]; then
  150. return
  151. fi
  152. sed -i "s|ssl_cipher_list.*|ssl_cipher_list = '$SSL_CIPHERS'|g" $DOVECOT_CIPHERS
  153. sed -i "s|ssl_protocols.*|ssl_protocols = '$SSL_PROTOCOLS'|g" $DOVECOT_CIPHERS
  154. service dovecot restart
  155. echo 'imap security settings changed'
  156. }
  157. function change_ssh_settings {
  158. if [ -f /etc/ssh/ssh_config ]; then
  159. if [ $SSH_HOST_KEY_ALGORITHMS ]; then
  160. sed -i "s|HostKeyAlgorithms .*|HostKeyAlgorithms $SSH_HOST_KEY_ALGORITHMS|g" /etc/ssh/ssh_config
  161. echo 'ssh client security settings changed'
  162. fi
  163. fi
  164. if [ -f $SSH_CONFIG ]; then
  165. if [ ! $SSH_CIPHERS ]; then
  166. return
  167. fi
  168. if [ ! $SSH_MACS ]; then
  169. return
  170. fi
  171. if [ ! $SSH_KEX ]; then
  172. return
  173. fi
  174. if [ ! $SSH_PASSWORDS ]; then
  175. return
  176. fi
  177. sed -i "s|Ciphers .*|Ciphers $SSH_CIPHERS|g" $SSH_CONFIG
  178. sed -i "s|MACs .*|MACs $SSH_MACS|g" $SSH_CONFIG
  179. sed -i "s|KexAlgorithms .*|KexAlgorithms $SSH_KEX|g" $SSH_CONFIG
  180. sed -i "s|PasswordAuthentication .*|PasswordAuthentication $SSH_PASSWORDS|g" $SSH_CONFIG
  181. service ssh restart
  182. echo 'ssh server security settings changed'
  183. fi
  184. }
  185. function change_xmpp_settings {
  186. if [ ! -f $XMPP_CONFIG ]; then
  187. return
  188. fi
  189. if [ ! $XMPP_CIPHERS ]; then
  190. return
  191. fi
  192. if [ ! $XMPP_ECC_CURVE ]; then
  193. return
  194. fi
  195. sed -i "s|ciphers =.*|ciphers = \"$XMPP_CIPHERS\";|g" $XMPP_CONFIG
  196. sed -i "s|curve =.*|curve = \"$XMPP_ECC_CURVE\";|g" $XMPP_CONFIG
  197. service prosody restart
  198. echo 'xmpp security settings changed'
  199. }
  200. function interactive_setup {
  201. if [ $SSL_CIPHERS ]; then
  202. data=$(tempfile 2>/dev/null)
  203. trap "rm -f $data" 0 1 2 5 15
  204. dialog --backtitle "Freedombone Security Configuration" \
  205. --form "\nWeb/IMAP Ciphers:" 10 95 2 \
  206. "Protocols:" 1 1 "$SSL_PROTOCOLS" 1 15 90 90 \
  207. "Ciphers:" 2 1 "$SSL_CIPHERS" 2 15 90 512 \
  208. 2> $data
  209. sel=$?
  210. case $sel in
  211. 1) SSL_PROTOCOLS=$(cat $data | sed -n 1p)
  212. SSL_CIPHERS=$(cat $data | sed -n 2p)
  213. ;;
  214. 255) exit 0;;
  215. esac
  216. fi
  217. data=$(tempfile 2>/dev/null)
  218. trap "rm -f $data" 0 1 2 5 15
  219. if [ $SSH_HOST_KEY_ALGORITHMS ]; then
  220. dialog --backtitle "Freedombone Security Configuration" \
  221. --form "\nSecure Shell Ciphers:" 13 95 4 \
  222. "Ciphers:" 1 1 "$SSH_CIPHERS" 1 15 90 512 \
  223. "MACs:" 2 1 "$SSH_MACS" 2 15 90 512 \
  224. "KEX:" 3 1 "$SSH_KEX" 3 15 90 512 \
  225. "Host key algorithms:" 4 1 "$SSH_HOST_KEY_ALGORITHMS" 4 15 90 512 \
  226. 2> $data
  227. sel=$?
  228. case $sel in
  229. 1) SSH_CIPHERS=$(cat $data | sed -n 1p)
  230. SSH_MACS=$(cat $data | sed -n 2p)
  231. SSH_KEX=$(cat $data | sed -n 3p)
  232. SSH_HOST_KEY_ALGORITHMS=$(cat $data | sed -n 4p)
  233. ;;
  234. 255) exit 0;;
  235. esac
  236. else
  237. dialog --backtitle "Freedombone Security Configuration" \
  238. --form "\nSecure Shell Ciphers:" 11 95 3 \
  239. "Ciphers:" 1 1 "$SSH_CIPHERS" 1 15 90 512 \
  240. "MACs:" 2 1 "$SSH_MACS" 2 15 90 512 \
  241. "KEX:" 3 1 "$SSH_KEX" 3 15 90 512 \
  242. 2> $data
  243. sel=$?
  244. case $sel in
  245. 1) SSH_CIPHERS=$(cat $data | sed -n 1p)
  246. SSH_MACS=$(cat $data | sed -n 2p)
  247. SSH_KEX=$(cat $data | sed -n 3p)
  248. ;;
  249. 255) exit 0;;
  250. esac
  251. fi
  252. if [[ $SSH_PASSWORDS == "yes" ]]; then
  253. dialog --title "SSH Passwords" \
  254. --backtitle "Freedombone Security Configuration" \
  255. --yesno "\nAllow SSH login using passwords?" 7 60
  256. else
  257. dialog --title "SSH Passwords" \
  258. --backtitle "Freedombone Security Configuration" \
  259. --defaultno \
  260. --yesno "\nAllow SSH login using passwords?" 7 60
  261. fi
  262. sel=$?
  263. case $sel in
  264. 0) SSH_PASSWORDS="yes";;
  265. 1) SSH_PASSWORDS="no";;
  266. 255) exit 0;;
  267. esac
  268. if [ $XMPP_CIPHERS ]; then
  269. data=$(tempfile 2>/dev/null)
  270. trap "rm -f $data" 0 1 2 5 15
  271. dialog --backtitle "Freedombone Security Configuration" \
  272. --form "\nXMPP Ciphers:" 10 95 2 \
  273. "Ciphers:" 1 1 "$XMPP_CIPHERS" 1 15 90 512 \
  274. "ECC Curve:" 2 1 "$XMPP_ECC_CURVE" 2 15 50 50 \
  275. 2> $data
  276. sel=$?
  277. case $sel in
  278. 1) XMPP_CIPHERS=$(cat $data | sed -n 1p)
  279. XMPP_ECC_CURVE=$(cat $data | sed -n 2p)
  280. ;;
  281. 255) exit 0;;
  282. esac
  283. fi
  284. dialog --title "Final Confirmation" \
  285. --backtitle "Freedombone Security Configuration" \
  286. --defaultno \
  287. --yesno "\nPlease confirm that you wish your security settings to be changed?\n\nWARNING: any mistakes made in the security settings could compromise your system, so be extra careful when answering 'yes'." 12 60
  288. sel=$?
  289. case $sel in
  290. 1) clear
  291. echo 'Exiting without changing security settings'
  292. exit 0;;
  293. 255) clear
  294. echo 'Exiting without changing security settings'
  295. exit 0;;
  296. esac
  297. clear
  298. }
  299. function regenerate_ssh_host_keys {
  300. if [[ $REGENERATE_SSH_HOST_KEYS == "yes" ]]; then
  301. rm -f /etc/ssh/ssh_host_*
  302. dpkg-reconfigure openssh-server
  303. echo 'ssh host keys regenerated'
  304. # remove small moduli
  305. awk '$5 > 2000' /etc/ssh/moduli > ~/moduli
  306. mv ~/moduli /etc/ssh/moduli
  307. echo 'ssh small moduli removed'
  308. systemctl restart ssh
  309. fi
  310. }
  311. function regenerate_dh_keys {
  312. if [[ $REGENERATE_DH_KEYS == "yes" ]]; then
  313. if [ ! -d /etc/ssl/mycerts ]; then
  314. echo 'No dhparam certificates were found'
  315. return
  316. fi
  317. data=$(tempfile 2>/dev/null)
  318. trap "rm -f $data" 0 1 2 5 15
  319. dialog --backtitle "Freedombone Security Configuration" \
  320. --title "Diffie-Hellman key length" \
  321. --radiolist "The smaller length is better suited to low power embedded systems:" 10 40 2 \
  322. 1 "1024 bits" off \
  323. 2 "3072 bits" on 2> $data
  324. sel=$?
  325. case $sel in
  326. 1) exit 1;;
  327. 255) exit 1;;
  328. esac
  329. case $(cat $data) in
  330. 1) DH_KEYLENGTH=1024;;
  331. 2) DH_KEYLENGTH=3072;;
  332. esac
  333. ctr=0
  334. for file in /etc/ssl/mycerts/*
  335. do
  336. if [[ -f $file ]]; then
  337. filename=/etc/ssl/certs/$(echo $file | awk -F '/etc/ssl/mycerts/' '{print $2}' | awk -F '.crt' '{print $1}').dhparam
  338. if [ -f $filename ]; then
  339. openssl dhparam -check -text -5 $DH_KEYLENGTH -out $filename
  340. ctr=$((ctr + 1))
  341. fi
  342. fi
  343. done
  344. echo "$ctr dhparam certificates were regenerated"
  345. fi
  346. }
  347. function reset_tripwire {
  348. if [[ $RESET_TRIPWIRE == "yes" ]]; then
  349. echo '
  350. ' | reset-tripwire
  351. fi
  352. }
  353. function housekeeping {
  354. cmd=(dialog --separate-output \
  355. --backtitle "Freedombone Security Configuration" \
  356. --title "Housekeeping options" \
  357. --checklist "If you don't need to do any of these things then just press Enter:" 10 76 16)
  358. options=(1 "Regenerate ssh host keys" off
  359. 2 "Regenerate Diffie-Hellman keys" off
  360. 3 "Reset tripwire" off)
  361. choices=$("${cmd[@]}" "${options[@]}" 2>&1 >/dev/tty)
  362. clear
  363. for choice in $choices
  364. do
  365. case $choice in
  366. 1)
  367. REGENERATE_SSH_HOST_KEYS="yes"
  368. ;;
  369. 2)
  370. REGENERATE_DH_KEYS="yes"
  371. ;;
  372. 3)
  373. RESET_TRIPWIRE="yes"
  374. ;;
  375. esac
  376. done
  377. }
  378. function import_settings {
  379. cd $CURRENT_DIR
  380. if [ ! $IMPORT_FILE ]; then
  381. return
  382. fi
  383. if [ ! -f $IMPORT_FILE ]; then
  384. echo "Import file $IMPORT_FILE not found"
  385. exit 6393
  386. fi
  387. if grep -q "SSL_PROTOCOLS" $IMPORT_FILE; then
  388. TEMP_VALUE=$(grep "SSL_PROTOCOLS" $IMPORT_FILE | awk -F '=' '{print $2}')
  389. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  390. SSL_PROTOCOLS=$TEMP_VALUE
  391. fi
  392. fi
  393. if grep -q "SSL_CIPHERS" $IMPORT_FILE; then
  394. TEMP_VALUE=$(grep "SSL_CIPHERS" $IMPORT_FILE | awk -F '=' '{print $2}')
  395. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  396. SSL_CIPHERS=$TEMP_VALUE
  397. fi
  398. fi
  399. if grep -q "SSH_CIPHERS" $IMPORT_FILE; then
  400. TEMP_VALUE=$(grep "SSH_CIPHERS" $IMPORT_FILE | awk -F '=' '{print $2}')
  401. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  402. SSH_CIPHERS=$TEMP_VALUE
  403. fi
  404. fi
  405. if grep -q "SSH_MACS" $IMPORT_FILE; then
  406. TEMP_VALUE=$(grep "SSH_MACS" $IMPORT_FILE | awk -F '=' '{print $2}')
  407. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  408. SSH_MACS=$TEMP_VALUE
  409. fi
  410. fi
  411. if grep -q "SSH_KEX" $IMPORT_FILE; then
  412. TEMP_VALUE=$(grep "SSH_KEX" $IMPORT_FILE | awk -F '=' '{print $2}')
  413. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  414. SSH_KEX=$TEMP_VALUE
  415. fi
  416. fi
  417. if grep -q "SSH_HOST_KEY_ALGORITHMS" $IMPORT_FILE; then
  418. TEMP_VALUE=$(grep "SSH_HOST_KEY_ALGORITHMS" $IMPORT_FILE | awk -F '=' '{print $2}')
  419. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  420. SSH_HOST_KEY_ALGORITHMS=$TEMP_VALUE
  421. fi
  422. fi
  423. if grep -q "SSH_PASSWORDS" $IMPORT_FILE; then
  424. TEMP_VALUE=$(grep "SSH_PASSWORDS" $IMPORT_FILE | awk -F '=' '{print $2}')
  425. if [[ $TEMP_VALUE == "yes" || $TEMP_VALUE == "no" ]]; then
  426. SSH_PASSWORDS=$TEMP_VALUE
  427. fi
  428. fi
  429. if grep -q "XMPP_CIPHERS" $IMPORT_FILE; then
  430. TEMP_VALUE=$(grep "XMPP_CIPHERS" $IMPORT_FILE | awk -F '=' '{print $2}')
  431. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  432. XMPP_CIPHERS=$TEMP_VALUE
  433. fi
  434. fi
  435. if grep -q "XMPP_ECC_CURVE" $IMPORT_FILE; then
  436. TEMP_VALUE=$(grep "XMPP_ECC_CURVE" $IMPORT_FILE | awk -F '=' '{print $2}')
  437. if [ ${#TEMP_VALUE} -gt 3 ]; then
  438. XMPP_ECC_CURVE=$TEMP_VALUE
  439. fi
  440. fi
  441. }
  442. function export_settings {
  443. if [ ! $EXPORT_FILE ]; then
  444. return
  445. fi
  446. cd $CURRENT_DIR
  447. if [ ! -f $EXPORT_FILE ]; then
  448. if [ "$SSL_PROTOCOLS" ]; then
  449. echo "SSL_PROTOCOLS=$SSL_PROTOCOLS" >> $EXPORT_FILE
  450. fi
  451. if [ $SSL_CIPHERS ]; then
  452. echo "SSL_CIPHERS=$SSL_CIPHERS" >> $EXPORT_FILE
  453. fi
  454. if [ $SSH_CIPHERS ]; then
  455. echo "SSH_CIPHERS=$SSH_CIPHERS" >> $EXPORT_FILE
  456. fi
  457. if [ $SSH_MACS ]; then
  458. echo "SSH_MACS=$SSH_MACS" >> $EXPORT_FILE
  459. fi
  460. if [ $SSH_KEX ]; then
  461. echo "SSH_KEX=$SSH_KEX" >> $EXPORT_FILE
  462. fi
  463. if [ $SSH_HOST_KEY_ALGORITHMS ]; then
  464. echo "SSH_HOST_KEY_ALGORITHMS=$SSH_HOST_KEY_ALGORITHMS" >> $EXPORT_FILE
  465. fi
  466. if [ $SSH_PASSWORDS ]; then
  467. echo "SSH_PASSWORDS=$SSH_PASSWORDS" >> $EXPORT_FILE
  468. fi
  469. if [ $XMPP_CIPHERS ]; then
  470. echo "XMPP_CIPHERS=$XMPP_CIPHERS" >> $EXPORT_FILE
  471. fi
  472. if [ $XMPP_ECC_CURVE ]; then
  473. echo "XMPP_ECC_CURVE=$XMPP_ECC_CURVE" >> $EXPORT_FILE
  474. fi
  475. echo "Security settings exported to $EXPORT_FILE"
  476. exit 0
  477. fi
  478. if [ "$SSL_PROTOCOLS" ]; then
  479. if grep -q "SSL_PROTOCOLS" $EXPORT_FILE; then
  480. sed -i "s|SSL_PROTOCOLS=.*|SSL_PROTOCOLS=$SSL_PROTOCOLS|g" $EXPORT_FILE
  481. else
  482. echo "SSL_PROTOCOLS=$SSL_PROTOCOLS" >> $EXPORT_FILE
  483. fi
  484. fi
  485. if [ $SSL_CIPHERS ]; then
  486. if grep -q "SSL_CIPHERS" $EXPORT_FILE; then
  487. sed -i "s|SSL_CIPHERS=.*|SSL_CIPHERS=$SSL_CIPHERS|g" $EXPORT_FILE
  488. else
  489. echo "SSL_CIPHERS=$SSL_CIPHERS" >> $EXPORT_FILE
  490. fi
  491. fi
  492. if [ $SSH_CIPHERS ]; then
  493. if grep -q "SSH_CIPHERS" $EXPORT_FILE; then
  494. sed -i "s|SSH_CIPHERS=.*|SSH_CIPHERS=$SSH_CIPHERS|g" $EXPORT_FILE
  495. else
  496. echo "SSH_CIPHERS=$SSH_CIPHERS" >> $EXPORT_FILE
  497. fi
  498. fi
  499. if [ $SSH_MACS ]; then
  500. if grep -q "SSH_MACS" $EXPORT_FILE; then
  501. sed -i "s|SSH_MACS=.*|SSH_MACS=$SSH_MACS|g" $EXPORT_FILE
  502. else
  503. echo "SSH_MACS=$SSH_MACS" >> $EXPORT_FILE
  504. fi
  505. fi
  506. if [ $SSH_KEX ]; then
  507. if grep -q "SSH_KEX" $EXPORT_FILE; then
  508. sed -i "s|SSH_KEX=.*|SSH_KEX=$SSH_KEX|g" $EXPORT_FILE
  509. else
  510. echo "SSH_KEX=$SSH_KEX" >> $EXPORT_FILE
  511. fi
  512. fi
  513. if [ $SSH_HOST_KEY_ALGORITHMS ]; then
  514. if grep -q "SSH_HOST_KEY_ALGORITHMS" $EXPORT_FILE; then
  515. sed -i "s|SSH_HOST_KEY_ALGORITHMS=.*|SSH_HOST_KEY_ALGORITHMS=$SSH_HOST_KEY_ALGORITHMS|g" $EXPORT_FILE
  516. else
  517. echo "SSH_HOST_KEY_ALGORITHMS=$SSH_HOST_KEY_ALGORITHMS" >> $EXPORT_FILE
  518. fi
  519. fi
  520. if [ $SSH_PASSWORDS ]; then
  521. if grep -q "SSH_PASSWORDS" $EXPORT_FILE; then
  522. sed -i "s|SSH_PASSWORDS=.*|SSH_PASSWORDS=$SSH_PASSWORDS|g" $EXPORT_FILE
  523. else
  524. echo "SSH_PASSWORDS=$SSH_PASSWORDS" >> $EXPORT_FILE
  525. fi
  526. fi
  527. if [ $XMPP_CIPHERS ]; then
  528. if grep -q "XMPP_CIPHERS" $EXPORT_FILE; then
  529. sed -i "s|XMPP_CIPHERS=.*|XMPP_CIPHERS=$XMPP_CIPHERS|g" $EXPORT_FILE
  530. else
  531. echo "XMPP_CIPHERS=$XMPP_CIPHERS" >> $EXPORT_FILE
  532. fi
  533. fi
  534. if [ $XMPP_ECC_CURVE ]; then
  535. if grep -q "XMPP_ECC_CURVE" $EXPORT_FILE; then
  536. sed -i "s|XMPP_ECC_CURVE=.*|XMPP_ECC_CURVE=$XMPP_ECC_CURVE|g" $EXPORT_FILE
  537. else
  538. echo "XMPP_ECC_CURVE=$XMPP_ECC_CURVE" >> $EXPORT_FILE
  539. fi
  540. fi
  541. echo "Security settings exported to $EXPORT_FILE"
  542. exit 0
  543. }
  544. function show_help {
  545. echo ''
  546. echo 'freedombone-sec'
  547. echo ''
  548. echo 'Alters the security settings'
  549. echo ''
  550. echo ''
  551. echo ' -h --help Show help'
  552. echo ' -e --export Export security settings to a file'
  553. echo ' -i --import Import security settings from a file'
  554. echo ''
  555. exit 0
  556. }
  557. # Get the commandline options
  558. while [[ $# > 1 ]]
  559. do
  560. key="$1"
  561. case $key in
  562. -h|--help)
  563. show_help
  564. ;;
  565. # Export settings
  566. -e|--export)
  567. shift
  568. EXPORT_FILE="$1"
  569. ;;
  570. # Export settings
  571. -i|--import)
  572. shift
  573. IMPORT_FILE="$1"
  574. ;;
  575. *)
  576. # unknown option
  577. ;;
  578. esac
  579. shift
  580. done
  581. housekeeping
  582. get_website_settings
  583. get_imap_settings
  584. get_ssh_settings
  585. get_xmpp_settings
  586. import_settings
  587. export_settings
  588. interactive_setup
  589. change_website_settings
  590. change_imap_settings
  591. change_ssh_settings
  592. change_xmpp_settings
  593. regenerate_ssh_host_keys
  594. regenerate_dh_keys
  595. reset_tripwire
  596. exit 0