freedombone-sec 19KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Alters the security settings
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. SSL_PROTOCOLS=
  31. SSL_CIPHERS=
  32. SSH_CIPHERS=
  33. SSH_MACS=
  34. SSH_KEX=
  35. SSH_HOST_KEY_ALGORITHMS=
  36. SSH_PASSWORDS=
  37. XMPP_CIPHERS=
  38. XMPP_ECC_CURVE=
  39. WEBSITES_DIRECTORY='/etc/nginx/sites-available'
  40. DOVECOT_CIPHERS='/etc/dovecot/conf.d/10-ssl.conf'
  41. SSH_CONFIG='/etc/ssh/sshd_config'
  42. XMPP_CONFIG='/etc/prosody/conf.avail/xmpp.cfg.lua'
  43. MINIMUM_LENGTH=6
  44. IMPORT_FILE=
  45. EXPORT_FILE=
  46. CURRENT_DIR=$(pwd)
  47. REGENERATE_SSH_HOST_KEYS="no"
  48. REGENERATE_DH_KEYS="no"
  49. RESET_TRIPWIRE="no"
  50. DH_KEYLENGTH=2048
  51. function get_protocols_from_website {
  52. if [ ! -f $WEBSITES_DIRECTORY/$1 ]; then
  53. return
  54. fi
  55. SSL_PROTOCOLS=$(cat $WEBSITES_DIRECTORY/$1 | grep 'ssl_protocols ' | awk -F "ssl_protocols " '{print $2}' | awk -F ';' '{print $1}')
  56. }
  57. function get_ciphers_from_website {
  58. if [ ! -f $WEBSITES_DIRECTORY/$1 ]; then
  59. return
  60. fi
  61. SSL_CIPHERS=$(cat $WEBSITES_DIRECTORY/$1 | grep 'ssl_ciphers ' | awk -F "ssl_ciphers " '{print $2}' | awk -F "'" '{print $2}')
  62. }
  63. function get_website_settings {
  64. if [ ! -d $WEBSITES_DIRECTORY ]; then
  65. return
  66. fi
  67. cd $WEBSITES_DIRECTORY
  68. for file in `dir -d *` ; do
  69. get_protocols_from_website $file
  70. if [ ${#SSL_PROTOCOLS} -gt $MINIMUM_LENGTH ]; then
  71. get_ciphers_from_website $file
  72. if [ ${#SSL_CIPHERS} -gt $MINIMUM_LENGTH ]; then
  73. break
  74. else
  75. SSL_PROTOCOLS=""
  76. fi
  77. fi
  78. done
  79. }
  80. function get_imap_settings {
  81. if [ ! -f $DOVECOT_CIPHERS ]; then
  82. return
  83. fi
  84. # clear commented out cipher list
  85. sed -i "s|#ssl_cipher_list.*||g" $DOVECOT_CIPHERS
  86. if [ $SSL_CIPHERS ]; then
  87. return
  88. fi
  89. if [ ${#SSL_CIPHERS} -gt $MINIMUM_LENGTH ]; then
  90. return
  91. fi
  92. SSL_CIPHERS=$(cat $DOVECOT_CIPHERS | grep 'ssl_cipher_list' | awk -F '=' '{print $2}' | awk -F "'" '{print $2}')
  93. }
  94. function get_xmpp_settings {
  95. if [ ! -f $XMPP_CONFIG ]; then
  96. return
  97. fi
  98. XMPP_CIPHERS=$(cat $XMPP_CONFIG | grep 'ciphers ' | awk -F '=' '{print $2}' | awk -F '"' '{print $2}')
  99. XMPP_ECC_CURVE=$(cat $XMPP_CONFIG | grep 'curve ' | awk -F '=' '{print $2}' | awk -F '"' '{print $2}')
  100. }
  101. function get_ssh_settings {
  102. if [ -f $SSH_CONFIG ]; then
  103. SSH_CIPHERS=$(cat $SSH_CONFIG | grep 'Ciphers ' | awk -F 'Ciphers ' '{print $2}')
  104. SSH_MACS=$(cat $SSH_CONFIG | grep 'MACs ' | awk -F 'MACs ' '{print $2}')
  105. SSH_KEX=$(cat $SSH_CONFIG | grep 'KexAlgorithms ' | awk -F 'KexAlgorithms ' '{print $2}')
  106. SSH_PASSWORDS=$(cat $SSH_CONFIG | grep 'PasswordAuthentication ' | awk -F 'PasswordAuthentication ' '{print $2}')
  107. fi
  108. if [ -f /etc/ssh/ssh_config ]; then
  109. SSH_HOST_KEY_ALGORITHMS=$(cat /etc/ssh/ssh_config | grep 'HostKeyAlgorithms ' | awk -F 'HostKeyAlgorithms ' '{print $2}')
  110. if [ ! $SSH_CIPHERS ]; then
  111. SSH_CIPHERS=$(cat /etc/ssh/ssh_config | grep 'Ciphers ' | awk -F 'Ciphers ' '{print $2}')
  112. fi
  113. if [ ! $SSH_MACS ]; then
  114. SSH_MACS=$(cat /etc/ssh/ssh_config | grep 'MACs ' | awk -F 'MACs ' '{print $2}')
  115. fi
  116. fi
  117. }
  118. function change_website_settings {
  119. if [ ! "$SSL_PROTOCOLS" ]; then
  120. return
  121. fi
  122. if [ ! $SSL_CIPHERS ]; then
  123. return
  124. fi
  125. if [ ${#SSL_PROTOCOLS} -lt $MINIMUM_LENGTH ]; then
  126. return
  127. fi
  128. if [ ${#SSL_CIPHERS} -lt $MINIMUM_LENGTH ]; then
  129. return
  130. fi
  131. if [ ! -d $WEBSITES_DIRECTORY ]; then
  132. return
  133. fi
  134. cd $WEBSITES_DIRECTORY
  135. for file in `dir -d *` ; do
  136. sed -i "s|ssl_protocols .*|ssl_protocols $SSL_PROTOCOLS;|g" $WEBSITES_DIRECTORY/$file
  137. sed -i "s|ssl_ciphers .*|ssl_ciphers '$SSL_CIPHERS';|g" $WEBSITES_DIRECTORY/$file
  138. done
  139. service nginx restart
  140. echo 'Web security settings changed'
  141. }
  142. function change_imap_settings {
  143. if [ ! -f $DOVECOT_CIPHERS ]; then
  144. return
  145. fi
  146. if [ ! $SSL_CIPHERS ]; then
  147. return
  148. fi
  149. if [ ${#SSL_CIPHERS} -lt $MINIMUM_LENGTH ]; then
  150. return
  151. fi
  152. sed -i "s|ssl_cipher_list.*|ssl_cipher_list = '$SSL_CIPHERS'|g" $DOVECOT_CIPHERS
  153. sed -i "s|ssl_protocols.*|ssl_protocols = '$SSL_PROTOCOLS'|g" $DOVECOT_CIPHERS
  154. service dovecot restart
  155. echo 'imap security settings changed'
  156. }
  157. function change_ssh_settings {
  158. if [ -f /etc/ssh/ssh_config ]; then
  159. if [ $SSH_HOST_KEY_ALGORITHMS ]; then
  160. sed -i "s|HostKeyAlgorithms .*|HostKeyAlgorithms $SSH_HOST_KEY_ALGORITHMS|g" /etc/ssh/ssh_config
  161. echo 'ssh client security settings changed'
  162. fi
  163. fi
  164. if [ -f $SSH_CONFIG ]; then
  165. if [ ! $SSH_CIPHERS ]; then
  166. return
  167. fi
  168. if [ ! $SSH_MACS ]; then
  169. return
  170. fi
  171. if [ ! $SSH_KEX ]; then
  172. return
  173. fi
  174. if [ ! $SSH_PASSWORDS ]; then
  175. return
  176. fi
  177. sed -i "s|Ciphers .*|Ciphers $SSH_CIPHERS|g" $SSH_CONFIG
  178. sed -i "s|MACs .*|MACs $SSH_MACS|g" $SSH_CONFIG
  179. sed -i "s|KexAlgorithms .*|KexAlgorithms $SSH_KEX|g" $SSH_CONFIG
  180. sed -i "s|PasswordAuthentication .*|PasswordAuthentication $SSH_PASSWORDS|g" $SSH_CONFIG
  181. service ssh restart
  182. echo 'ssh server security settings changed'
  183. fi
  184. }
  185. function change_xmpp_settings {
  186. if [ ! -f $XMPP_CONFIG ]; then
  187. return
  188. fi
  189. if [ ! $XMPP_CIPHERS ]; then
  190. return
  191. fi
  192. if [ ! $XMPP_ECC_CURVE ]; then
  193. return
  194. fi
  195. sed -i "s|ciphers =.*|ciphers = \"$XMPP_CIPHERS\";|g" $XMPP_CONFIG
  196. sed -i "s|curve =.*|curve = \"$XMPP_ECC_CURVE\";|g" $XMPP_CONFIG
  197. service prosody restart
  198. echo 'xmpp security settings changed'
  199. }
  200. function interactive_setup {
  201. if [ $SSL_CIPHERS ]; then
  202. data=$(tempfile 2>/dev/null)
  203. trap "rm -f $data" 0 1 2 5 15
  204. dialog --backtitle "Freedombone Security Configuration" \
  205. --form "\nWeb/IMAP Ciphers:" 10 95 2 \
  206. "Protocols:" 1 1 "$SSL_PROTOCOLS" 1 15 90 90 \
  207. "Ciphers:" 2 1 "$SSL_CIPHERS" 2 15 90 512 \
  208. 2> $data
  209. sel=$?
  210. case $sel in
  211. 1) SSL_PROTOCOLS=$(cat $data | sed -n 1p)
  212. SSL_CIPHERS=$(cat $data | sed -n 2p)
  213. ;;
  214. 255) exit 0;;
  215. esac
  216. fi
  217. data=$(tempfile 2>/dev/null)
  218. trap "rm -f $data" 0 1 2 5 15
  219. if [ $SSH_HOST_KEY_ALGORITHMS ]; then
  220. dialog --backtitle "Freedombone Security Configuration" \
  221. --form "\nSecure Shell Ciphers:" 13 95 4 \
  222. "Ciphers:" 1 1 "$SSH_CIPHERS" 1 15 90 512 \
  223. "MACs:" 2 1 "$SSH_MACS" 2 15 90 512 \
  224. "KEX:" 3 1 "$SSH_KEX" 3 15 90 512 \
  225. "Host key algorithms:" 4 1 "$SSH_HOST_KEY_ALGORITHMS" 4 15 90 512 \
  226. 2> $data
  227. sel=$?
  228. case $sel in
  229. 1) SSH_CIPHERS=$(cat $data | sed -n 1p)
  230. SSH_MACS=$(cat $data | sed -n 2p)
  231. SSH_KEX=$(cat $data | sed -n 3p)
  232. SSH_HOST_KEY_ALGORITHMS=$(cat $data | sed -n 4p)
  233. ;;
  234. 255) exit 0;;
  235. esac
  236. else
  237. dialog --backtitle "Freedombone Security Configuration" \
  238. --form "\nSecure Shell Ciphers:" 11 95 3 \
  239. "Ciphers:" 1 1 "$SSH_CIPHERS" 1 15 90 512 \
  240. "MACs:" 2 1 "$SSH_MACS" 2 15 90 512 \
  241. "KEX:" 3 1 "$SSH_KEX" 3 15 90 512 \
  242. 2> $data
  243. sel=$?
  244. case $sel in
  245. 1) SSH_CIPHERS=$(cat $data | sed -n 1p)
  246. SSH_MACS=$(cat $data | sed -n 2p)
  247. SSH_KEX=$(cat $data | sed -n 3p)
  248. ;;
  249. 255) exit 0;;
  250. esac
  251. fi
  252. if [[ $SSH_PASSWORDS == "yes" ]]; then
  253. dialog --title "SSH Passwords" \
  254. --backtitle "Freedombone Security Configuration" \
  255. --yesno "\nAllow SSH login using passwords?" 7 60
  256. else
  257. dialog --title "SSH Passwords" \
  258. --backtitle "Freedombone Security Configuration" \
  259. --defaultno \
  260. --yesno "\nAllow SSH login using passwords?" 7 60
  261. fi
  262. sel=$?
  263. case $sel in
  264. 0) SSH_PASSWORDS="yes";;
  265. 1) SSH_PASSWORDS="no";;
  266. 255) exit 0;;
  267. esac
  268. if [ $XMPP_CIPHERS ]; then
  269. data=$(tempfile 2>/dev/null)
  270. trap "rm -f $data" 0 1 2 5 15
  271. dialog --backtitle "Freedombone Security Configuration" \
  272. --form "\nXMPP Ciphers:" 10 95 2 \
  273. "Ciphers:" 1 1 "$XMPP_CIPHERS" 1 15 90 512 \
  274. "ECC Curve:" 2 1 "$XMPP_ECC_CURVE" 2 15 50 50 \
  275. 2> $data
  276. sel=$?
  277. case $sel in
  278. 1) XMPP_CIPHERS=$(cat $data | sed -n 1p)
  279. XMPP_ECC_CURVE=$(cat $data | sed -n 2p)
  280. ;;
  281. 255) exit 0;;
  282. esac
  283. fi
  284. dialog --title "Final Confirmation" \
  285. --backtitle "Freedombone Security Configuration" \
  286. --defaultno \
  287. --yesno "\nPlease confirm that you wish your security settings to be changed?\n\nWARNING: any mistakes made in the security settings could compromise your system, so be extra careful when answering 'yes'." 12 60
  288. sel=$?
  289. case $sel in
  290. 1) clear
  291. echo 'Exiting without changing security settings'
  292. exit 0;;
  293. 255) clear
  294. echo 'Exiting without changing security settings'
  295. exit 0;;
  296. esac
  297. clear
  298. }
  299. function regenerate_ssh_host_keys {
  300. if [[ $REGENERATE_SSH_HOST_KEYS == "yes" ]]; then
  301. rm -f /etc/ssh/ssh_host_*
  302. dpkg-reconfigure openssh-server
  303. echo 'ssh host keys regenerated'
  304. # remove small moduli
  305. awk '$5 > 2000' /etc/ssh/moduli > ~/moduli
  306. mv ~/moduli /etc/ssh/moduli
  307. echo 'ssh small moduli removed'
  308. systemctl restart ssh
  309. fi
  310. }
  311. function regenerate_dh_keys {
  312. if [[ $REGENERATE_DH_KEYS == "yes" ]]; then
  313. if [ ! -d /etc/ssl/mycerts ]; then
  314. echo 'No dhparam certificates were found'
  315. return
  316. fi
  317. data=$(tempfile 2>/dev/null)
  318. trap "rm -f $data" 0 1 2 5 15
  319. dialog --backtitle "Freedombone Security Configuration" \
  320. --title "Diffie-Hellman key length" \
  321. --radiolist "The smaller length is better suited to low power embedded systems:" 12 40 3 \
  322. 1 "1024 bits (WARNING: this may be insecure)" off \
  323. 2 "2048 bits" on \
  324. 3 "3072 bits" off 2> $data
  325. sel=$?
  326. case $sel in
  327. 1) exit 1;;
  328. 255) exit 1;;
  329. esac
  330. case $(cat $data) in
  331. 1) DH_KEYLENGTH=1024;;
  332. 2) DH_KEYLENGTH=2048;;
  333. 3) DH_KEYLENGTH=3072;;
  334. esac
  335. ctr=0
  336. for file in /etc/ssl/mycerts/*
  337. do
  338. if [[ -f $file ]]; then
  339. filename=/etc/ssl/certs/$(echo $file | awk -F '/etc/ssl/mycerts/' '{print $2}' | awk -F '.crt' '{print $1}').dhparam
  340. if [ -f $filename ]; then
  341. openssl dhparam -check -text -5 $DH_KEYLENGTH -out $filename
  342. ctr=$((ctr + 1))
  343. fi
  344. fi
  345. done
  346. echo "$ctr dhparam certificates were regenerated"
  347. fi
  348. }
  349. function reset_tripwire {
  350. if [[ $RESET_TRIPWIRE != "yes" ]]; then
  351. return
  352. fi
  353. clear
  354. echo '
  355. ' | reset-tripwire
  356. exit 0
  357. }
  358. function housekeeping {
  359. cmd=(dialog --separate-output \
  360. --backtitle "Freedombone Security Configuration" \
  361. --title "Housekeeping options" \
  362. --checklist "If you don't need to do any of these things then just press Enter:" 10 76 16)
  363. options=(1 "Regenerate ssh host keys" off
  364. 2 "Regenerate Diffie-Hellman keys" off
  365. 3 "Reset tripwire" off)
  366. choices=$("${cmd[@]}" "${options[@]}" 2>&1 >/dev/tty)
  367. clear
  368. for choice in $choices
  369. do
  370. case $choice in
  371. 1)
  372. REGENERATE_SSH_HOST_KEYS="yes"
  373. ;;
  374. 2)
  375. REGENERATE_DH_KEYS="yes"
  376. ;;
  377. 3)
  378. RESET_TRIPWIRE="yes"
  379. ;;
  380. esac
  381. done
  382. reset_tripwire
  383. }
  384. function import_settings {
  385. cd $CURRENT_DIR
  386. if [ ! $IMPORT_FILE ]; then
  387. return
  388. fi
  389. if [ ! -f $IMPORT_FILE ]; then
  390. echo "Import file $IMPORT_FILE not found"
  391. exit 6393
  392. fi
  393. if grep -q "SSL_PROTOCOLS" $IMPORT_FILE; then
  394. TEMP_VALUE=$(grep "SSL_PROTOCOLS" $IMPORT_FILE | awk -F '=' '{print $2}')
  395. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  396. SSL_PROTOCOLS=$TEMP_VALUE
  397. fi
  398. fi
  399. if grep -q "SSL_CIPHERS" $IMPORT_FILE; then
  400. TEMP_VALUE=$(grep "SSL_CIPHERS" $IMPORT_FILE | awk -F '=' '{print $2}')
  401. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  402. SSL_CIPHERS=$TEMP_VALUE
  403. fi
  404. fi
  405. if grep -q "SSH_CIPHERS" $IMPORT_FILE; then
  406. TEMP_VALUE=$(grep "SSH_CIPHERS" $IMPORT_FILE | awk -F '=' '{print $2}')
  407. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  408. SSH_CIPHERS=$TEMP_VALUE
  409. fi
  410. fi
  411. if grep -q "SSH_MACS" $IMPORT_FILE; then
  412. TEMP_VALUE=$(grep "SSH_MACS" $IMPORT_FILE | awk -F '=' '{print $2}')
  413. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  414. SSH_MACS=$TEMP_VALUE
  415. fi
  416. fi
  417. if grep -q "SSH_KEX" $IMPORT_FILE; then
  418. TEMP_VALUE=$(grep "SSH_KEX" $IMPORT_FILE | awk -F '=' '{print $2}')
  419. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  420. SSH_KEX=$TEMP_VALUE
  421. fi
  422. fi
  423. if grep -q "SSH_HOST_KEY_ALGORITHMS" $IMPORT_FILE; then
  424. TEMP_VALUE=$(grep "SSH_HOST_KEY_ALGORITHMS" $IMPORT_FILE | awk -F '=' '{print $2}')
  425. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  426. SSH_HOST_KEY_ALGORITHMS=$TEMP_VALUE
  427. fi
  428. fi
  429. if grep -q "SSH_PASSWORDS" $IMPORT_FILE; then
  430. TEMP_VALUE=$(grep "SSH_PASSWORDS" $IMPORT_FILE | awk -F '=' '{print $2}')
  431. if [[ $TEMP_VALUE == "yes" || $TEMP_VALUE == "no" ]]; then
  432. SSH_PASSWORDS=$TEMP_VALUE
  433. fi
  434. fi
  435. if grep -q "XMPP_CIPHERS" $IMPORT_FILE; then
  436. TEMP_VALUE=$(grep "XMPP_CIPHERS" $IMPORT_FILE | awk -F '=' '{print $2}')
  437. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  438. XMPP_CIPHERS=$TEMP_VALUE
  439. fi
  440. fi
  441. if grep -q "XMPP_ECC_CURVE" $IMPORT_FILE; then
  442. TEMP_VALUE=$(grep "XMPP_ECC_CURVE" $IMPORT_FILE | awk -F '=' '{print $2}')
  443. if [ ${#TEMP_VALUE} -gt 3 ]; then
  444. XMPP_ECC_CURVE=$TEMP_VALUE
  445. fi
  446. fi
  447. }
  448. function export_settings {
  449. if [ ! $EXPORT_FILE ]; then
  450. return
  451. fi
  452. cd $CURRENT_DIR
  453. if [ ! -f $EXPORT_FILE ]; then
  454. if [ "$SSL_PROTOCOLS" ]; then
  455. echo "SSL_PROTOCOLS=$SSL_PROTOCOLS" >> $EXPORT_FILE
  456. fi
  457. if [ $SSL_CIPHERS ]; then
  458. echo "SSL_CIPHERS=$SSL_CIPHERS" >> $EXPORT_FILE
  459. fi
  460. if [ $SSH_CIPHERS ]; then
  461. echo "SSH_CIPHERS=$SSH_CIPHERS" >> $EXPORT_FILE
  462. fi
  463. if [ $SSH_MACS ]; then
  464. echo "SSH_MACS=$SSH_MACS" >> $EXPORT_FILE
  465. fi
  466. if [ $SSH_KEX ]; then
  467. echo "SSH_KEX=$SSH_KEX" >> $EXPORT_FILE
  468. fi
  469. if [ $SSH_HOST_KEY_ALGORITHMS ]; then
  470. echo "SSH_HOST_KEY_ALGORITHMS=$SSH_HOST_KEY_ALGORITHMS" >> $EXPORT_FILE
  471. fi
  472. if [ $SSH_PASSWORDS ]; then
  473. echo "SSH_PASSWORDS=$SSH_PASSWORDS" >> $EXPORT_FILE
  474. fi
  475. if [ $XMPP_CIPHERS ]; then
  476. echo "XMPP_CIPHERS=$XMPP_CIPHERS" >> $EXPORT_FILE
  477. fi
  478. if [ $XMPP_ECC_CURVE ]; then
  479. echo "XMPP_ECC_CURVE=$XMPP_ECC_CURVE" >> $EXPORT_FILE
  480. fi
  481. echo "Security settings exported to $EXPORT_FILE"
  482. exit 0
  483. fi
  484. if [ "$SSL_PROTOCOLS" ]; then
  485. if grep -q "SSL_PROTOCOLS" $EXPORT_FILE; then
  486. sed -i "s|SSL_PROTOCOLS=.*|SSL_PROTOCOLS=$SSL_PROTOCOLS|g" $EXPORT_FILE
  487. else
  488. echo "SSL_PROTOCOLS=$SSL_PROTOCOLS" >> $EXPORT_FILE
  489. fi
  490. fi
  491. if [ $SSL_CIPHERS ]; then
  492. if grep -q "SSL_CIPHERS" $EXPORT_FILE; then
  493. sed -i "s|SSL_CIPHERS=.*|SSL_CIPHERS=$SSL_CIPHERS|g" $EXPORT_FILE
  494. else
  495. echo "SSL_CIPHERS=$SSL_CIPHERS" >> $EXPORT_FILE
  496. fi
  497. fi
  498. if [ $SSH_CIPHERS ]; then
  499. if grep -q "SSH_CIPHERS" $EXPORT_FILE; then
  500. sed -i "s|SSH_CIPHERS=.*|SSH_CIPHERS=$SSH_CIPHERS|g" $EXPORT_FILE
  501. else
  502. echo "SSH_CIPHERS=$SSH_CIPHERS" >> $EXPORT_FILE
  503. fi
  504. fi
  505. if [ $SSH_MACS ]; then
  506. if grep -q "SSH_MACS" $EXPORT_FILE; then
  507. sed -i "s|SSH_MACS=.*|SSH_MACS=$SSH_MACS|g" $EXPORT_FILE
  508. else
  509. echo "SSH_MACS=$SSH_MACS" >> $EXPORT_FILE
  510. fi
  511. fi
  512. if [ $SSH_KEX ]; then
  513. if grep -q "SSH_KEX" $EXPORT_FILE; then
  514. sed -i "s|SSH_KEX=.*|SSH_KEX=$SSH_KEX|g" $EXPORT_FILE
  515. else
  516. echo "SSH_KEX=$SSH_KEX" >> $EXPORT_FILE
  517. fi
  518. fi
  519. if [ $SSH_HOST_KEY_ALGORITHMS ]; then
  520. if grep -q "SSH_HOST_KEY_ALGORITHMS" $EXPORT_FILE; then
  521. sed -i "s|SSH_HOST_KEY_ALGORITHMS=.*|SSH_HOST_KEY_ALGORITHMS=$SSH_HOST_KEY_ALGORITHMS|g" $EXPORT_FILE
  522. else
  523. echo "SSH_HOST_KEY_ALGORITHMS=$SSH_HOST_KEY_ALGORITHMS" >> $EXPORT_FILE
  524. fi
  525. fi
  526. if [ $SSH_PASSWORDS ]; then
  527. if grep -q "SSH_PASSWORDS" $EXPORT_FILE; then
  528. sed -i "s|SSH_PASSWORDS=.*|SSH_PASSWORDS=$SSH_PASSWORDS|g" $EXPORT_FILE
  529. else
  530. echo "SSH_PASSWORDS=$SSH_PASSWORDS" >> $EXPORT_FILE
  531. fi
  532. fi
  533. if [ $XMPP_CIPHERS ]; then
  534. if grep -q "XMPP_CIPHERS" $EXPORT_FILE; then
  535. sed -i "s|XMPP_CIPHERS=.*|XMPP_CIPHERS=$XMPP_CIPHERS|g" $EXPORT_FILE
  536. else
  537. echo "XMPP_CIPHERS=$XMPP_CIPHERS" >> $EXPORT_FILE
  538. fi
  539. fi
  540. if [ $XMPP_ECC_CURVE ]; then
  541. if grep -q "XMPP_ECC_CURVE" $EXPORT_FILE; then
  542. sed -i "s|XMPP_ECC_CURVE=.*|XMPP_ECC_CURVE=$XMPP_ECC_CURVE|g" $EXPORT_FILE
  543. else
  544. echo "XMPP_ECC_CURVE=$XMPP_ECC_CURVE" >> $EXPORT_FILE
  545. fi
  546. fi
  547. echo "Security settings exported to $EXPORT_FILE"
  548. exit 0
  549. }
  550. function show_help {
  551. echo ''
  552. echo 'freedombone-sec'
  553. echo ''
  554. echo 'Alters the security settings'
  555. echo ''
  556. echo ''
  557. echo ' -h --help Show help'
  558. echo ' -e --export Export security settings to a file'
  559. echo ' -i --import Import security settings from a file'
  560. echo ''
  561. exit 0
  562. }
  563. # Get the commandline options
  564. while [[ $# > 1 ]]
  565. do
  566. key="$1"
  567. case $key in
  568. -h|--help)
  569. show_help
  570. ;;
  571. # Export settings
  572. -e|--export)
  573. shift
  574. EXPORT_FILE="$1"
  575. ;;
  576. # Export settings
  577. -i|--import)
  578. shift
  579. IMPORT_FILE="$1"
  580. ;;
  581. *)
  582. # unknown option
  583. ;;
  584. esac
  585. shift
  586. done
  587. housekeeping
  588. get_website_settings
  589. get_imap_settings
  590. get_ssh_settings
  591. get_xmpp_settings
  592. import_settings
  593. export_settings
  594. interactive_setup
  595. change_website_settings
  596. change_imap_settings
  597. change_ssh_settings
  598. change_xmpp_settings
  599. regenerate_ssh_host_keys
  600. regenerate_dh_keys
  601. exit 0