freedombone-sec 20KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Alters the security settings
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. PROJECT_NAME='freedombone'
  31. export TEXTDOMAIN=${PROJECT_NAME}-sec
  32. export TEXTDOMAINDIR="/usr/share/locale"
  33. SSL_PROTOCOLS=
  34. SSL_CIPHERS=
  35. SSH_CIPHERS=
  36. SSH_MACS=
  37. SSH_KEX=
  38. SSH_HOST_KEY_ALGORITHMS=
  39. SSH_PASSWORDS=
  40. XMPP_CIPHERS=
  41. XMPP_ECC_CURVE=
  42. WEBSITES_DIRECTORY='/etc/nginx/sites-available'
  43. DOVECOT_CIPHERS='/etc/dovecot/conf.d/10-ssl.conf'
  44. SSH_CONFIG='/etc/ssh/sshd_config'
  45. XMPP_CONFIG='/etc/prosody/conf.avail/xmpp.cfg.lua'
  46. MINIMUM_LENGTH=6
  47. IMPORT_FILE=
  48. EXPORT_FILE=
  49. CURRENT_DIR=$(pwd)
  50. REGENERATE_SSH_HOST_KEYS="no"
  51. REGENERATE_DH_KEYS="no"
  52. DH_KEYLENGTH=2048
  53. function get_protocols_from_website {
  54. if [ ! -f $WEBSITES_DIRECTORY/$1 ]; then
  55. return
  56. fi
  57. SSL_PROTOCOLS=$(cat $WEBSITES_DIRECTORY/$1 | grep 'ssl_protocols ' | awk -F "ssl_protocols " '{print $2}' | awk -F ';' '{print $1}')
  58. }
  59. function get_ciphers_from_website {
  60. if [ ! -f $WEBSITES_DIRECTORY/$1 ]; then
  61. return
  62. fi
  63. SSL_CIPHERS=$(cat $WEBSITES_DIRECTORY/$1 | grep 'ssl_ciphers ' | awk -F "ssl_ciphers " '{print $2}' | awk -F "'" '{print $2}')
  64. }
  65. function get_website_settings {
  66. if [ ! -d $WEBSITES_DIRECTORY ]; then
  67. return
  68. fi
  69. cd $WEBSITES_DIRECTORY
  70. for file in `dir -d *` ; do
  71. get_protocols_from_website $file
  72. if [ ${#SSL_PROTOCOLS} -gt $MINIMUM_LENGTH ]; then
  73. get_ciphers_from_website $file
  74. if [ ${#SSL_CIPHERS} -gt $MINIMUM_LENGTH ]; then
  75. break
  76. else
  77. SSL_PROTOCOLS=""
  78. fi
  79. fi
  80. done
  81. }
  82. function get_imap_settings {
  83. if [ ! -f $DOVECOT_CIPHERS ]; then
  84. return
  85. fi
  86. # clear commented out cipher list
  87. sed -i "s|#ssl_cipher_list.*||g" $DOVECOT_CIPHERS
  88. if [ $SSL_CIPHERS ]; then
  89. return
  90. fi
  91. if [ ${#SSL_CIPHERS} -gt $MINIMUM_LENGTH ]; then
  92. return
  93. fi
  94. SSL_CIPHERS=$(cat $DOVECOT_CIPHERS | grep 'ssl_cipher_list' | awk -F '=' '{print $2}' | awk -F "'" '{print $2}')
  95. }
  96. function get_xmpp_settings {
  97. if [ ! -f $XMPP_CONFIG ]; then
  98. return
  99. fi
  100. XMPP_CIPHERS=$(cat $XMPP_CONFIG | grep 'ciphers ' | awk -F '=' '{print $2}' | awk -F '"' '{print $2}')
  101. XMPP_ECC_CURVE=$(cat $XMPP_CONFIG | grep 'curve ' | awk -F '=' '{print $2}' | awk -F '"' '{print $2}')
  102. }
  103. function get_ssh_settings {
  104. if [ -f $SSH_CONFIG ]; then
  105. SSH_CIPHERS=$(cat $SSH_CONFIG | grep 'Ciphers ' | awk -F 'Ciphers ' '{print $2}')
  106. SSH_MACS=$(cat $SSH_CONFIG | grep 'MACs ' | awk -F 'MACs ' '{print $2}')
  107. SSH_KEX=$(cat $SSH_CONFIG | grep 'KexAlgorithms ' | awk -F 'KexAlgorithms ' '{print $2}')
  108. SSH_PASSWORDS=$(cat $SSH_CONFIG | grep 'PasswordAuthentication ' | awk -F 'PasswordAuthentication ' '{print $2}')
  109. fi
  110. if [ -f /etc/ssh/ssh_config ]; then
  111. SSH_HOST_KEY_ALGORITHMS=$(cat /etc/ssh/ssh_config | grep 'HostKeyAlgorithms ' | awk -F 'HostKeyAlgorithms ' '{print $2}')
  112. if [ ! $SSH_CIPHERS ]; then
  113. SSH_CIPHERS=$(cat /etc/ssh/ssh_config | grep 'Ciphers ' | awk -F 'Ciphers ' '{print $2}')
  114. fi
  115. if [ ! $SSH_MACS ]; then
  116. SSH_MACS=$(cat /etc/ssh/ssh_config | grep 'MACs ' | awk -F 'MACs ' '{print $2}')
  117. fi
  118. fi
  119. }
  120. function change_website_settings {
  121. if [ ! "$SSL_PROTOCOLS" ]; then
  122. return
  123. fi
  124. if [ ! $SSL_CIPHERS ]; then
  125. return
  126. fi
  127. if [ ${#SSL_PROTOCOLS} -lt $MINIMUM_LENGTH ]; then
  128. return
  129. fi
  130. if [ ${#SSL_CIPHERS} -lt $MINIMUM_LENGTH ]; then
  131. return
  132. fi
  133. if [ ! -d $WEBSITES_DIRECTORY ]; then
  134. return
  135. fi
  136. cd $WEBSITES_DIRECTORY
  137. for file in `dir -d *` ; do
  138. sed -i "s|ssl_protocols .*|ssl_protocols $SSL_PROTOCOLS;|g" $WEBSITES_DIRECTORY/$file
  139. sed -i "s|ssl_ciphers .*|ssl_ciphers '$SSL_CIPHERS';|g" $WEBSITES_DIRECTORY/$file
  140. done
  141. service nginx restart
  142. echo $'Web security settings changed'
  143. }
  144. function change_imap_settings {
  145. if [ ! -f $DOVECOT_CIPHERS ]; then
  146. return
  147. fi
  148. if [ ! $SSL_CIPHERS ]; then
  149. return
  150. fi
  151. if [ ${#SSL_CIPHERS} -lt $MINIMUM_LENGTH ]; then
  152. return
  153. fi
  154. sed -i "s|ssl_cipher_list.*|ssl_cipher_list = '$SSL_CIPHERS'|g" $DOVECOT_CIPHERS
  155. sed -i "s|ssl_protocols.*|ssl_protocols = '$SSL_PROTOCOLS'|g" $DOVECOT_CIPHERS
  156. service dovecot restart
  157. echo $'imap security settings changed'
  158. }
  159. function change_ssh_settings {
  160. if [ -f /etc/ssh/ssh_config ]; then
  161. if [ $SSH_HOST_KEY_ALGORITHMS ]; then
  162. sed -i "s|HostKeyAlgorithms .*|HostKeyAlgorithms $SSH_HOST_KEY_ALGORITHMS|g" /etc/ssh/ssh_config
  163. echo $'ssh client security settings changed'
  164. fi
  165. fi
  166. if [ -f $SSH_CONFIG ]; then
  167. if [ ! $SSH_CIPHERS ]; then
  168. return
  169. fi
  170. if [ ! $SSH_MACS ]; then
  171. return
  172. fi
  173. if [ ! $SSH_KEX ]; then
  174. return
  175. fi
  176. if [ ! $SSH_PASSWORDS ]; then
  177. return
  178. fi
  179. sed -i "s|Ciphers .*|Ciphers $SSH_CIPHERS|g" $SSH_CONFIG
  180. sed -i "s|MACs .*|MACs $SSH_MACS|g" $SSH_CONFIG
  181. sed -i "s|KexAlgorithms .*|KexAlgorithms $SSH_KEX|g" $SSH_CONFIG
  182. sed -i "s|PasswordAuthentication .*|PasswordAuthentication $SSH_PASSWORDS|g" $SSH_CONFIG
  183. service ssh restart
  184. echo $'ssh server security settings changed'
  185. fi
  186. }
  187. function change_xmpp_settings {
  188. if [ ! -f $XMPP_CONFIG ]; then
  189. return
  190. fi
  191. if [ ! $XMPP_CIPHERS ]; then
  192. return
  193. fi
  194. if [ ! $XMPP_ECC_CURVE ]; then
  195. return
  196. fi
  197. sed -i "s|ciphers =.*|ciphers = \"$XMPP_CIPHERS\";|g" $XMPP_CONFIG
  198. sed -i "s|curve =.*|curve = \"$XMPP_ECC_CURVE\";|g" $XMPP_CONFIG
  199. service prosody restart
  200. echo $'xmpp security settings changed'
  201. }
  202. function interactive_setup {
  203. if [ $SSL_CIPHERS ]; then
  204. data=$(tempfile 2>/dev/null)
  205. trap "rm -f $data" 0 1 2 5 15
  206. dialog --backtitle $"Freedombone Security Configuration" \
  207. --form $"\nWeb/IMAP Ciphers:" 10 95 2 \
  208. $"Protocols:" 1 1 "$SSL_PROTOCOLS" 1 15 90 90 \
  209. $"Ciphers:" 2 1 "$SSL_CIPHERS" 2 15 90 512 \
  210. 2> $data
  211. sel=$?
  212. case $sel in
  213. 1) SSL_PROTOCOLS=$(cat $data | sed -n 1p)
  214. SSL_CIPHERS=$(cat $data | sed -n 2p)
  215. ;;
  216. 255) exit 0;;
  217. esac
  218. fi
  219. data=$(tempfile 2>/dev/null)
  220. trap "rm -f $data" 0 1 2 5 15
  221. if [ $SSH_HOST_KEY_ALGORITHMS ]; then
  222. dialog --backtitle $"Freedombone Security Configuration" \
  223. --form $"\nSecure Shell Ciphers:" 13 95 4 \
  224. $"Ciphers:" 1 1 "$SSH_CIPHERS" 1 15 90 512 \
  225. $"MACs:" 2 1 "$SSH_MACS" 2 15 90 512 \
  226. $"KEX:" 3 1 "$SSH_KEX" 3 15 90 512 \
  227. $"Host key algorithms:" 4 1 "$SSH_HOST_KEY_ALGORITHMS" 4 15 90 512 \
  228. 2> $data
  229. sel=$?
  230. case $sel in
  231. 1) SSH_CIPHERS=$(cat $data | sed -n 1p)
  232. SSH_MACS=$(cat $data | sed -n 2p)
  233. SSH_KEX=$(cat $data | sed -n 3p)
  234. SSH_HOST_KEY_ALGORITHMS=$(cat $data | sed -n 4p)
  235. ;;
  236. 255) exit 0;;
  237. esac
  238. else
  239. dialog --backtitle $"Freedombone Security Configuration" \
  240. --form $"\nSecure Shell Ciphers:" 11 95 3 \
  241. $"Ciphers:" 1 1 "$SSH_CIPHERS" 1 15 90 512 \
  242. $"MACs:" 2 1 "$SSH_MACS" 2 15 90 512 \
  243. $"KEX:" 3 1 "$SSH_KEX" 3 15 90 512 \
  244. 2> $data
  245. sel=$?
  246. case $sel in
  247. 1) SSH_CIPHERS=$(cat $data | sed -n 1p)
  248. SSH_MACS=$(cat $data | sed -n 2p)
  249. SSH_KEX=$(cat $data | sed -n 3p)
  250. ;;
  251. 255) exit 0;;
  252. esac
  253. fi
  254. if [[ $SSH_PASSWORDS == "yes" ]]; then
  255. dialog --title $"SSH Passwords" \
  256. --backtitle $"Freedombone Security Configuration" \
  257. --yesno $"\nAllow SSH login using passwords?" 7 60
  258. else
  259. dialog --title $"SSH Passwords" \
  260. --backtitle $"Freedombone Security Configuration" \
  261. --defaultno \
  262. --yesno $"\nAllow SSH login using passwords?" 7 60
  263. fi
  264. sel=$?
  265. case $sel in
  266. 0) SSH_PASSWORDS="yes";;
  267. 1) SSH_PASSWORDS="no";;
  268. 255) exit 0;;
  269. esac
  270. if [ $XMPP_CIPHERS ]; then
  271. data=$(tempfile 2>/dev/null)
  272. trap "rm -f $data" 0 1 2 5 15
  273. dialog --backtitle $"Freedombone Security Configuration" \
  274. --form $"\nXMPP Ciphers:" 10 95 2 \
  275. $"Ciphers:" 1 1 "$XMPP_CIPHERS" 1 15 90 512 \
  276. $"ECC Curve:" 2 1 "$XMPP_ECC_CURVE" 2 15 50 50 \
  277. 2> $data
  278. sel=$?
  279. case $sel in
  280. 1) XMPP_CIPHERS=$(cat $data | sed -n 1p)
  281. XMPP_ECC_CURVE=$(cat $data | sed -n 2p)
  282. ;;
  283. 255) exit 0;;
  284. esac
  285. fi
  286. dialog --title $"Final Confirmation" \
  287. --backtitle $"Freedombone Security Configuration" \
  288. --defaultno \
  289. --yesno $"\nPlease confirm that you wish your security settings to be changed?\n\nWARNING: any mistakes made in the security settings could compromise your system, so be extra careful when answering 'yes'." 12 60
  290. sel=$?
  291. case $sel in
  292. 1) clear
  293. echo $'Exiting without changing security settings'
  294. exit 0;;
  295. 255) clear
  296. echo $'Exiting without changing security settings'
  297. exit 0;;
  298. esac
  299. clear
  300. }
  301. function regenerate_ssh_host_keys {
  302. if [[ $REGENERATE_SSH_HOST_KEYS == "yes" ]]; then
  303. rm -f /etc/ssh/ssh_host_*
  304. dpkg-reconfigure openssh-server
  305. echo $'ssh host keys regenerated'
  306. # remove small moduli
  307. awk '$5 > 2000' /etc/ssh/moduli > ~/moduli
  308. mv ~/moduli /etc/ssh/moduli
  309. echo $'ssh small moduli removed'
  310. systemctl restart ssh
  311. fi
  312. }
  313. function regenerate_dh_keys {
  314. if [[ $REGENERATE_DH_KEYS == "yes" ]]; then
  315. if [ ! -d /etc/ssl/mycerts ]; then
  316. echo $'No dhparam certificates were found'
  317. return
  318. fi
  319. data=$(tempfile 2>/dev/null)
  320. trap "rm -f $data" 0 1 2 5 15
  321. dialog --backtitle "Freedombone Security Configuration" \
  322. --title "Diffie-Hellman key length" \
  323. --radiolist "The smaller length is better suited to low power embedded systems:" 12 40 3 \
  324. 1 "2048 bits" off \
  325. 2 "3072 bits" on \
  326. 3 "4096 bits" off 2> $data
  327. sel=$?
  328. case $sel in
  329. 1) exit 1;;
  330. 255) exit 1;;
  331. esac
  332. case $(cat $data) in
  333. 1) DH_KEYLENGTH=2048;;
  334. 2) DH_KEYLENGTH=3072;;
  335. 3) DH_KEYLENGTH=4096;;
  336. esac
  337. ${PROJECT_NAME}-dhparam --recalc yes -l ${DH_KEYLENGTH}
  338. fi
  339. }
  340. function renew_startssl {
  341. renew_domain=
  342. data=$(tempfile 2>/dev/null)
  343. trap "rm -f $data" 0 1 2 5 15
  344. dialog --title $"Renew a StartSSL certificate" \
  345. --backtitle $"Freedombone Security Settings" \
  346. --inputbox $"Enter the domain name" 8 60 2>$data
  347. sel=$?
  348. case $sel in
  349. 0)
  350. renew_domain=$(<$data)
  351. ;;
  352. esac
  353. if [ ! $renew_domain ]; then
  354. return
  355. fi
  356. if [[ $renew_domain == "http"* ]]; then
  357. dialog --title $"Renew a StartSSL certificate" \
  358. --msgbox $"Don't include the https://" 6 40
  359. return
  360. fi
  361. if [ ! -f /etc/ssl/certs/${renew_domain}.dhparam ]; then
  362. dialog --title $"Renew a StartSSL certificate" \
  363. --msgbox $"An existing certificate for $renew_domain was not found" 6 40
  364. return
  365. fi
  366. if [[ $renew_domain != *"."* ]]; then
  367. dialog --title $"Renew a StartSSL certificate" \
  368. --msgbox $"Invalid domain name: $renew_domain" 6 40
  369. return
  370. fi
  371. ${PROJECT_NAME}-renew-cert -h $renew_domain -p startssl
  372. exit 0
  373. }
  374. function renew_letsencrypt {
  375. renew_domain=
  376. data=$(tempfile 2>/dev/null)
  377. trap "rm -f $data" 0 1 2 5 15
  378. dialog --title $"Renew a Let's Encrypt certificate" \
  379. --backtitle $"Freedombone Security Settings" \
  380. --inputbox $"Enter the domain name" 8 60 2>$data
  381. sel=$?
  382. case $sel in
  383. 0)
  384. renew_domain=$(<$data)
  385. ;;
  386. esac
  387. if [ ! $renew_domain ]; then
  388. return
  389. fi
  390. if [[ $renew_domain == "http"* ]]; then
  391. dialog --title $"Renew a Let's Encrypt certificate" \
  392. --msgbox $"Don't include the https://" 6 40
  393. return
  394. fi
  395. if [ ! -f /etc/ssl/certs/${renew_domain}.dhparam ]; then
  396. dialog --title $"Renew a Let's Encrypt certificate" \
  397. --msgbox $"An existing certificate for $renew_domain was not found" 6 40
  398. return
  399. fi
  400. if [[ $renew_domain != *"."* ]]; then
  401. dialog --title $"Renew a Let's Encrypt certificate" \
  402. --msgbox $"Invalid domain name: $renew_domain" 6 40
  403. return
  404. fi
  405. ${PROJECT_NAME}-renew-cert -h $renew_domain -p 'letsencrypt'
  406. exit 0
  407. }
  408. function housekeeping {
  409. cmd=(dialog --separate-output \
  410. --backtitle "Freedombone Security Configuration" \
  411. --title "Housekeeping options" \
  412. --checklist "If you don't need to do any of these things then just press Enter:" 10 76 16)
  413. options=(1 "Regenerate ssh host keys" off
  414. 2 "Regenerate Diffie-Hellman keys" off
  415. 3 "Renew a StartSSL certificate" off
  416. 4 "Renew Let's Encrypt certificate" off)
  417. choices=$("${cmd[@]}" "${options[@]}" 2>&1 >/dev/tty)
  418. clear
  419. for choice in $choices
  420. do
  421. case $choice in
  422. 1)
  423. REGENERATE_SSH_HOST_KEYS="yes"
  424. ;;
  425. 2)
  426. REGENERATE_DH_KEYS="yes"
  427. ;;
  428. 3)
  429. renew_startssl
  430. ;;
  431. 4)
  432. renew_letsencrypt
  433. ;;
  434. esac
  435. done
  436. }
  437. function import_settings {
  438. cd $CURRENT_DIR
  439. if [ ! $IMPORT_FILE ]; then
  440. return
  441. fi
  442. if [ ! -f $IMPORT_FILE ]; then
  443. echo $"Import file $IMPORT_FILE not found"
  444. exit 6393
  445. fi
  446. if grep -q "SSL_PROTOCOLS" $IMPORT_FILE; then
  447. TEMP_VALUE=$(grep "SSL_PROTOCOLS" $IMPORT_FILE | awk -F '=' '{print $2}')
  448. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  449. SSL_PROTOCOLS=$TEMP_VALUE
  450. fi
  451. fi
  452. if grep -q "SSL_CIPHERS" $IMPORT_FILE; then
  453. TEMP_VALUE=$(grep "SSL_CIPHERS" $IMPORT_FILE | awk -F '=' '{print $2}')
  454. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  455. SSL_CIPHERS=$TEMP_VALUE
  456. fi
  457. fi
  458. if grep -q "SSH_CIPHERS" $IMPORT_FILE; then
  459. TEMP_VALUE=$(grep "SSH_CIPHERS" $IMPORT_FILE | awk -F '=' '{print $2}')
  460. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  461. SSH_CIPHERS=$TEMP_VALUE
  462. fi
  463. fi
  464. if grep -q "SSH_MACS" $IMPORT_FILE; then
  465. TEMP_VALUE=$(grep "SSH_MACS" $IMPORT_FILE | awk -F '=' '{print $2}')
  466. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  467. SSH_MACS=$TEMP_VALUE
  468. fi
  469. fi
  470. if grep -q "SSH_KEX" $IMPORT_FILE; then
  471. TEMP_VALUE=$(grep "SSH_KEX" $IMPORT_FILE | awk -F '=' '{print $2}')
  472. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  473. SSH_KEX=$TEMP_VALUE
  474. fi
  475. fi
  476. if grep -q "SSH_HOST_KEY_ALGORITHMS" $IMPORT_FILE; then
  477. TEMP_VALUE=$(grep "SSH_HOST_KEY_ALGORITHMS" $IMPORT_FILE | awk -F '=' '{print $2}')
  478. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  479. SSH_HOST_KEY_ALGORITHMS=$TEMP_VALUE
  480. fi
  481. fi
  482. if grep -q "SSH_PASSWORDS" $IMPORT_FILE; then
  483. TEMP_VALUE=$(grep "SSH_PASSWORDS" $IMPORT_FILE | awk -F '=' '{print $2}')
  484. if [[ $TEMP_VALUE == "yes" || $TEMP_VALUE == "no" ]]; then
  485. SSH_PASSWORDS=$TEMP_VALUE
  486. fi
  487. fi
  488. if grep -q "XMPP_CIPHERS" $IMPORT_FILE; then
  489. TEMP_VALUE=$(grep "XMPP_CIPHERS" $IMPORT_FILE | awk -F '=' '{print $2}')
  490. if [ ${#TEMP_VALUE} -gt $MINIMUM_LENGTH ]; then
  491. XMPP_CIPHERS=$TEMP_VALUE
  492. fi
  493. fi
  494. if grep -q "XMPP_ECC_CURVE" $IMPORT_FILE; then
  495. TEMP_VALUE=$(grep "XMPP_ECC_CURVE" $IMPORT_FILE | awk -F '=' '{print $2}')
  496. if [ ${#TEMP_VALUE} -gt 3 ]; then
  497. XMPP_ECC_CURVE=$TEMP_VALUE
  498. fi
  499. fi
  500. }
  501. function export_settings {
  502. if [ ! $EXPORT_FILE ]; then
  503. return
  504. fi
  505. cd $CURRENT_DIR
  506. if [ ! -f $EXPORT_FILE ]; then
  507. if [ "$SSL_PROTOCOLS" ]; then
  508. echo "SSL_PROTOCOLS=$SSL_PROTOCOLS" >> $EXPORT_FILE
  509. fi
  510. if [ $SSL_CIPHERS ]; then
  511. echo "SSL_CIPHERS=$SSL_CIPHERS" >> $EXPORT_FILE
  512. fi
  513. if [ $SSH_CIPHERS ]; then
  514. echo "SSH_CIPHERS=$SSH_CIPHERS" >> $EXPORT_FILE
  515. fi
  516. if [ $SSH_MACS ]; then
  517. echo "SSH_MACS=$SSH_MACS" >> $EXPORT_FILE
  518. fi
  519. if [ $SSH_KEX ]; then
  520. echo "SSH_KEX=$SSH_KEX" >> $EXPORT_FILE
  521. fi
  522. if [ $SSH_HOST_KEY_ALGORITHMS ]; then
  523. echo "SSH_HOST_KEY_ALGORITHMS=$SSH_HOST_KEY_ALGORITHMS" >> $EXPORT_FILE
  524. fi
  525. if [ $SSH_PASSWORDS ]; then
  526. echo "SSH_PASSWORDS=$SSH_PASSWORDS" >> $EXPORT_FILE
  527. fi
  528. if [ $XMPP_CIPHERS ]; then
  529. echo "XMPP_CIPHERS=$XMPP_CIPHERS" >> $EXPORT_FILE
  530. fi
  531. if [ $XMPP_ECC_CURVE ]; then
  532. echo "XMPP_ECC_CURVE=$XMPP_ECC_CURVE" >> $EXPORT_FILE
  533. fi
  534. echo "Security settings exported to $EXPORT_FILE"
  535. exit 0
  536. fi
  537. if [ "$SSL_PROTOCOLS" ]; then
  538. if grep -q "SSL_PROTOCOLS" $EXPORT_FILE; then
  539. sed -i "s|SSL_PROTOCOLS=.*|SSL_PROTOCOLS=$SSL_PROTOCOLS|g" $EXPORT_FILE
  540. else
  541. echo "SSL_PROTOCOLS=$SSL_PROTOCOLS" >> $EXPORT_FILE
  542. fi
  543. fi
  544. if [ $SSL_CIPHERS ]; then
  545. if grep -q "SSL_CIPHERS" $EXPORT_FILE; then
  546. sed -i "s|SSL_CIPHERS=.*|SSL_CIPHERS=$SSL_CIPHERS|g" $EXPORT_FILE
  547. else
  548. echo "SSL_CIPHERS=$SSL_CIPHERS" >> $EXPORT_FILE
  549. fi
  550. fi
  551. if [ $SSH_CIPHERS ]; then
  552. if grep -q "SSH_CIPHERS" $EXPORT_FILE; then
  553. sed -i "s|SSH_CIPHERS=.*|SSH_CIPHERS=$SSH_CIPHERS|g" $EXPORT_FILE
  554. else
  555. echo "SSH_CIPHERS=$SSH_CIPHERS" >> $EXPORT_FILE
  556. fi
  557. fi
  558. if [ $SSH_MACS ]; then
  559. if grep -q "SSH_MACS" $EXPORT_FILE; then
  560. sed -i "s|SSH_MACS=.*|SSH_MACS=$SSH_MACS|g" $EXPORT_FILE
  561. else
  562. echo "SSH_MACS=$SSH_MACS" >> $EXPORT_FILE
  563. fi
  564. fi
  565. if [ $SSH_KEX ]; then
  566. if grep -q "SSH_KEX" $EXPORT_FILE; then
  567. sed -i "s|SSH_KEX=.*|SSH_KEX=$SSH_KEX|g" $EXPORT_FILE
  568. else
  569. echo "SSH_KEX=$SSH_KEX" >> $EXPORT_FILE
  570. fi
  571. fi
  572. if [ $SSH_HOST_KEY_ALGORITHMS ]; then
  573. if grep -q "SSH_HOST_KEY_ALGORITHMS" $EXPORT_FILE; then
  574. sed -i "s|SSH_HOST_KEY_ALGORITHMS=.*|SSH_HOST_KEY_ALGORITHMS=$SSH_HOST_KEY_ALGORITHMS|g" $EXPORT_FILE
  575. else
  576. echo "SSH_HOST_KEY_ALGORITHMS=$SSH_HOST_KEY_ALGORITHMS" >> $EXPORT_FILE
  577. fi
  578. fi
  579. if [ $SSH_PASSWORDS ]; then
  580. if grep -q "SSH_PASSWORDS" $EXPORT_FILE; then
  581. sed -i "s|SSH_PASSWORDS=.*|SSH_PASSWORDS=$SSH_PASSWORDS|g" $EXPORT_FILE
  582. else
  583. echo "SSH_PASSWORDS=$SSH_PASSWORDS" >> $EXPORT_FILE
  584. fi
  585. fi
  586. if [ $XMPP_CIPHERS ]; then
  587. if grep -q "XMPP_CIPHERS" $EXPORT_FILE; then
  588. sed -i "s|XMPP_CIPHERS=.*|XMPP_CIPHERS=$XMPP_CIPHERS|g" $EXPORT_FILE
  589. else
  590. echo "XMPP_CIPHERS=$XMPP_CIPHERS" >> $EXPORT_FILE
  591. fi
  592. fi
  593. if [ $XMPP_ECC_CURVE ]; then
  594. if grep -q "XMPP_ECC_CURVE" $EXPORT_FILE; then
  595. sed -i "s|XMPP_ECC_CURVE=.*|XMPP_ECC_CURVE=$XMPP_ECC_CURVE|g" $EXPORT_FILE
  596. else
  597. echo "XMPP_ECC_CURVE=$XMPP_ECC_CURVE" >> $EXPORT_FILE
  598. fi
  599. fi
  600. echo $"Security settings exported to $EXPORT_FILE"
  601. exit 0
  602. }
  603. function show_help {
  604. echo ''
  605. echo "${PROJECT_NAME}-sec"
  606. echo ''
  607. echo $'Alters the security settings'
  608. echo ''
  609. echo ''
  610. echo $' -h --help Show help'
  611. echo $' -e --export Export security settings to a file'
  612. echo $' -i --import Import security settings from a file'
  613. echo ''
  614. exit 0
  615. }
  616. # Get the commandline options
  617. while [[ $# > 1 ]]
  618. do
  619. key="$1"
  620. case $key in
  621. -h|--help)
  622. show_help
  623. ;;
  624. # Export settings
  625. -e|--export)
  626. shift
  627. EXPORT_FILE="$1"
  628. ;;
  629. # Export settings
  630. -i|--import)
  631. shift
  632. IMPORT_FILE="$1"
  633. ;;
  634. *)
  635. # unknown option
  636. ;;
  637. esac
  638. shift
  639. done
  640. housekeeping
  641. get_website_settings
  642. get_imap_settings
  643. get_ssh_settings
  644. get_xmpp_settings
  645. import_settings
  646. export_settings
  647. interactive_setup
  648. change_website_settings
  649. change_imap_settings
  650. change_ssh_settings
  651. change_xmpp_settings
  652. regenerate_ssh_host_keys
  653. regenerate_dh_keys
  654. exit 0