diff --git a/129 - monit.sh b/129 - monit.sh index ac30968..444fca0 100644 --- a/129 - monit.sh +++ b/129 - monit.sh @@ -47,25 +47,32 @@ EOT } function monit_def_rootfs { -cat </etc/monit/conf.d/rootfs.cfg - check filesystem rootfs with path / +for path in $(grep -v "^#\|none\|proc\|boot" /etc/fstab| awk '{print $2}');do + if [ "$path" == "/" ]; then + file_system=rootfs + else + file_system=$(echo "$path" | sed 's/\///')fs + fi +cat </etc/monit/conf.d/$file_system.cfg + check filesystem $file_system with path $path if space usage > 80% for 5 times within 15 cycles then alert if inode usage > 85% then alert group system EOT +done } function monit_def_cron { cat </etc/monit/conf.d/cron.cfg check process cron with pidfile /var/run/crond.pid - start program = "/sbin/start cron" - stop program = "/sbin/stop cron" + start program = "/usr/bin/service cron start" + stop program = "/usr/bin/service cron stop" if 5 restarts within 5 cycles then timeout depends on cron_rc group system check file cron_rc with path /etc/init.d/cron - if failed checksum then unmonitor + if failed sha1 checksum then unmonitor if failed permission 755 then unmonitor if failed uid root then unmonitor if failed gid root then unmonitor @@ -76,10 +83,17 @@ EOT function monit_def_sshd { cat </etc/monit/conf.d/sshd.cfg check process sshd with pidfile /var/run/sshd.pid - start program "/etc/init.d/ssh start" - stop program "/etc/init.d/ssh stop" - # if failed port 22 protocol ssh then restart - # if 3 restarts within 3 cycles then timeout + start program "/usr/bin/service ssh start" + stop program "/usr/bin/service ssh stop" + depends on ssh_rc + group secure + + check file ssh_rc with path /etc/init.d/ssh + if failed sha1 checksum then unmonitor + if failed permission 755 then unmonitor + if failed uid root then unmonitor + if failed gid root then unmonitor + group secure EOT } @@ -94,8 +108,8 @@ EOT function monit_def_postfix { cat </etc/monit/conf.d/postfix.cfg check process postfix with pidfile /var/spool/postfix/pid/master.pid - start program = "/etc/init.d/postfix start" - stop program = "/etc/init.d/postfix stop" + start program = "/usr/bin/service postfix start" + stop program = "/usr/bin/service postfix stop" if cpu > 60% for 2 cycles then alert if cpu > 80% for 5 cycles then restart if totalmem > 200.0 MB for 5 cycles then restart @@ -104,10 +118,11 @@ cat </etc/monit/conf.d/postfix.cfg if failed host localhost port 25 protocol smtp with timeout 15 seconds then alert if failed host localhost port 25 protocol smtp for 3 cycles then restart if 3 restarts within 5 cycles then timeout + depeneds on postfix_rc group mail check file postfix_rc with path /etc/init.d/postfix - if failed checksum then unmonitor + if failed sha1 checksum then unmonitor if failed permission 755 then unmonitor if failed uid root then unmonitor if failed gid root then unmonitor @@ -119,8 +134,8 @@ EOT function monit_def_postgresql { cat </etc/monit/conf.d/postgresql.cfg check process postgres with pidfile /var/run/postgresql/9.1-main.pid - start program = "/etc/init.d/postgresql start" - stop program = "/etc/init.d/postgresql stop" + start program = "/usr/bin/service postgresql start" + stop program = "/usr/bin/service postgresql stop" if failed unixsocket /var/run/postgresql/.s.PGSQL.5432 protocol pgsql then restart if failed host localhost port 5432 protocol pgsql then restart if 5 restarts within 5 cycles then timeout @@ -129,14 +144,14 @@ cat </etc/monit/conf.d/postgresql.cfg group database check file postgresql_bin with path /usr/lib/postgresql/9.1/bin/postgres - if failed checksum then unmonitor + if failed sha1 checksum then unmonitor if failed permission 755 then unmonitor if failed uid root then unmonitor if failed gid root then unmonitor group database check file postgresql_rc with path /etc/init.d/postgresql - if failed checksum then unmonitor + if failed sha1 checksum then unmonitor if failed permission 755 then unmonitor if failed uid root then unmonitor if failed gid root then unmonitor @@ -151,8 +166,8 @@ EOT function monit_def_mysql { cat < /etc/monit/conf.d/mysql.cfg check process mysqld with pidfile /var/run/mysqld/mysqld.pid - start program = "/sbin/start mysql" with timeout 20 seconds - stop program = "/sbin/stop mysql" + start program = "/usr/bin/service mysql" with timeout 20 seconds + stop program = "/usr/bin/service mysql" if failed host localhost port 3306 protocol mysql then restart if failed unixsocket /var/run/mysqld/mysqld.sock protocol mysql then restart if 5 restarts within 5 cycles then timeout @@ -161,14 +176,14 @@ cat < /etc/monit/conf.d/mysql.cfg group database check file mysql_bin with path /usr/sbin/mysqld - if failed checksum then unmonitor + if failed sha1 checksum then unmonitor if failed permission 755 then unmonitor if failed uid root then unmonitor if failed gid root then unmonitor group database check file mysql_rc with path /etc/init.d/mysql - if failed checksum then unmonitor + if failed sha1 checksum then unmonitor if failed permission 755 then unmonitor if failed uid root then unmonitor if failed gid root then unmonitor @@ -179,20 +194,28 @@ EOT function monit_def_mongodb { cat </etc/monit/conf.d/mongodb.cfg check process mongodb with pidfile /var/lib/mongodb/mongod.lock - start program = "/sbin/start mongodb" - stop program = "/sbin/stop mongodb" + start program = "/usr/bin/service mongodb start" + stop program = "/usr/bin/service mongodb stop" if failed host localhost port 28017 protocol http and request "/" with timeout 10 seconds then restart if 5 restarts within 5 cycles then timeout + depends on mongodb_rc group database + + check file mongodb_rc with path /etc/init.d/mongodb + if failed sha1 checksum then unmonitor + if failed permission 755 then unmonitor + if failed uid root then unmonitor + if failed gid root then unmonitor + group database EOT } function monit_def_memcached { cat </etc/monit/conf.d/memcached.cfg check process memcached with pidfile /var/run/memcached.pid - start program = "/etc/init.d/memcached start" - stop program = "/etc/init.d/memcached stop" + start program = "/usr/bin/service memcached start" + stop program = "/usr/bin/service memcached stop" if 5 restarts within 5 cycles then timeout group database EOT @@ -201,8 +224,8 @@ EOT function monit_def_apache { cat </etc/monit/conf.d/apache2.cfg check process apache with pidfile /var/run/apache2.pid - start program = "/etc/init.d/apache2 start" - stop program = "/etc/init.d/apache2 stop" + start program = "/usr/bin/service apache2 start" + stop program = "/usr/bin/service apache2 stop" if cpu > 60% for 2 cycles then alert if cpu > 80% for 5 cycles then alert if totalmem > 200.0 MB for 5 cycles then alert @@ -217,17 +240,36 @@ cat </etc/monit/conf.d/apache2.cfg group www check file apache_bin with path /usr/sbin/apache2 - if failed checksum then unmonitor + if failed sha1 checksum then unmonitor if failed permission 755 then unmonitor if failed uid root then unmonitor if failed gid root then unmonitor group www check file apache_rc with path /etc/init.d/apache2 - if failed checksum then unmonitor + if failed sha1 checksum then unmonitor if failed permission 755 then unmonitor if failed uid root then unmonitor if failed gid root then unmonitor group www EOT } +function monit_def_lighttpd { +cat </etc/monit/conf.d/lighttpd.conf +check process lighttpd with pidfile /var/run/lighttpd.pid + start program = "/usr/bin/service lighttpd start" + stop program = "/usr/bin/service lighttpd stop" + if failed host localhost port 80 + protocol http then restart + if 5 restarts within 5 cycles then timeout + depends on lighttpd_rc + group www + + check file lighttpd_rc with path /etc/init.d/lighttpd + if failed sha1 checksum then unmonitor + if failed permission 755 then unmonitor + if failed uid root then unmonitor + if failed gid root then unmonitor + group www +EOT +} diff --git a/132 - extras.sh b/132 - extras.sh new file mode 100755 index 0000000..e3815ae --- /dev/null +++ b/132 - extras.sh @@ -0,0 +1,316 @@ +#!/bin/bash +# +# Installing and configuring the nessary servers for the include stack scripts +# +# 2012 - David Peters - dave@daveshow.com +# Creative Commons Attribution-NonCommercial-ShareAlike 3.0 United States (CC BY-NC-SA 3.0) +# +# Link: https://github.com/daveshow/StackScripts +# +# +function urandomString { + if [ ! -n "$1" ]; + then LEN=20 + else LEN="$1" + fi + + echo $(od -c -A n /dev/urandom | tr -dc [:graph:] | head -c $LEN) # generate a truly random string +} +function install_ssh { +aptitude -y install openssh-server +} +function create_sys_backup { +mkdir -p /root/archive +cd /root/archive +for FILE_NAME in `ls /var/cache/apt/archives/*.deb`; do + BASE_NAME=`basename $FILE_NAME` + if ! grep -s $BASE_NAME exclude.txt >/dev/null 2>&1; then + cp -v -u -p $FILE_NAME . + echo $BASE_NAME >>exclude.txt + fi +done +rename -v 's/%3a/:/' *%3a* +aptitude -y install dpkg-dev +mkdir -p /root/archive/source +dpkg-scansources source /dev/null | gzip -9c > source/Sources.gz +mkdir -p /root/archive/binary +dpkg-scanpackages binary /dev/null | gzip -9c > binary/Packages.gz +} +function system_locale_en_US_UTF_8 { + locale-gen --purge en_US.UTF-8 + # dpkg-reconfigure locales + update-locale LANG=en_US.UTF-8 +} +function set_timezone { + # $1 - timezone (zoneinfo file) + ln -sf "/usr/share/zoneinfo/$1" /etc/localtime + dpkg-reconfigure --frontend noninteractive tzdata +} +function set_conf_value { + # $1 - conf file + # $2 - key + # $3 - value + sed -i "s/^\($2[ ]*=[ ]*\).*/\1$3/" $1 +} +function lock_users { +# Lock user account if not used for login +system_lock_user "irc" +system_lock_user "games" +system_lock_user "news" +system_lock_user "uucp" +system_lock_user "proxy" +system_lock_user "list" +system_lock_user "gnats" +} +function system_install_lighttpd { +# +aptitude install -y lighttpd pound +# +lighty-enable-mod fastcgi +lighty-enable-mod fastcgi-php +} +function install_secure_php { +aptitude install -y php5-fpm php5-cli php5-curl php5-gd php-pear php5-imap php5-mcrypt php5-memcache php5-ps php5-pspell php5-recode php5-snmp php5-tidy php5-xmlrpc php5-xsl php5-common php5-mysql php-apc +find /etc/php5/ ! -regex ".*[/]\.svn[/]?.*" -type f -name php.ini -exec sed -i'.origs' -e 's/memory_limit = [0-9]\+M/memory_limit = 40M/' -e 's/max_execution_time = [0-9]\+/max_execution_time = 30/' -e 's/upload_max_filesize = [0-9]\+M/upload_max_filesize = 2M/' -e 's/post_max_size = [0-9]\+M/post_max_size = 4M/' -e 's/max_input_time = [0-9]\+/max_input_time = 30/' -e 's/short_open_tag = On/short_open_tag = Off/' -e 's/disable_functions = /disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source,dl,/' -e 's/expose_php = On/expose_php = Off/' -e 's/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=1/' -e 's/;cgi.force_redirect = 1/cgi.force_redirect = 1/' -e 's/;arg_separator.output/arg_separator.output/' -e 's/;date.timezone =/date.timezone = UTC/' -e 's/session.name = PHPSESSID/session.name = SESSID/' -e 's/allow_url_fopen = On/allow_url_fopen = Off/' -e 's/sql.safe_mode = Off/sql.safe_mode = On/' -e 's@;error_log = syslog@error_log = /var/log/php/error.log@' -e 's@;open_basedir =@;open_basedir =/var/www/@' -e 's@;session.save_path = "/tmp"@session.save_path = "/var/lib/php/session"@' -e 's@;upload_tmp_dir =@upload_tmp_dir ="/var/lib/php/session"@' {} \; +# +sed -i'.origs' -e 's/;listen.owner = www-data/listen.owner = www-data/' -e 's/;listen.group = www-data/listen.group = www-data/' -e 's/;listen.mode = 0666/listen.mode = 0600/' -e 's/pm.max_children = 50/pm.max_children = 12/' -e 's/pm.start_servers = 20/pm.start_servers = 4/' -e 's/pm.min_spare_servers = 5/pm.min_spare_servers = 2/' -e 's/pm.max_spare_servers = 35/pm.max_spare_servers = 4/' -e 's/pm.max_requests = 0/pm.max_requests = 500/' /etc/php5/fpm/pool.d/www.conf +# +sed -i 's/#/;/' /etc/php5/conf.d/mcrypt.ini +# +# +echo "" >> /var/www/info.php +# +mkdir -p /var/log/php/ +chown -R www-data:www-data /var/log/php/ +mkdir -p /var/lib/php/session/ +chown -R www-data:www-data /var/lib/php/session/ +# +service php5-fpm start +chown -R www-data:www-data /var/www/ +chmod -R 0755 /var/www/ +find /var/www/ -type d -print0 | xargs -0 -I {} chmod 0445 {} +} +function install_security { +#install chrootkit rkhunter logwatch +aptitude -y install chkrootkit rkhunter logwatch libsys-cpu-perl +set +e +echo "yes" | cpan 'Sys::MemInfo' +echo "yes" | cpan 'Sys::MemInfo' +set -e +rkhunter --propupd +} +function configure_chkrootkit { + CONF=/etc/chkrootkit.conf + test -f $CONF || exit 0 + + set_conf_value $CONF "RUN_DAILY" "\"true\"" + set_conf_value $CONF "RUN_DAILY_OPTS" "-q -e '\/usr\/lib\/jvm\/.java-1.6.0-openjdk.jinfo \/usr\/lib\/byobu\/.constants \/usr\/lib\/byobu\/.dirs \/usr\/lib\/byobu\/.shutil \/usr\/lib\/byobu\/.notify_osd \/usr\/lib\/byobu\/.common \/usr\/lib\/pymodules\/python2.7\/.path'" +} + +function configure_rkhunter { + CONF=/etc/rkhunter.conf + test -f $CONF || exit 0 + + set_conf_value $CONF "MAIL-ON-WARNING" "\"root\"" + sed -i "/ALLOWHIDDENDIR=\/dev\/.initramfs$/ s/^#//" $CONF + sed -i "/ALLOWHIDDENDIR=\/dev\/.udev$/ s/^#//" $CONF + # Disabling tests for kernel modules, Linode kernel doens't have any modules loaded + sed -i "/^DISABLE_TESTS=.*/ s/\"$/ os_specific\"/" $CONF +} +function copy_logwatch { +cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/logwatch.conf +} +function configure_logwatch { + CONF=/etc/logwatch/conf/logwatch.conf + test -f $CONF || exit 0 + + set_conf_value $CONF "Output" "mail" + set_conf_value $CONF "Format" "html" + set_conf_value $CONF "Detail" "High" +} +function install_tools { +aptitude -y install vim less logrotate lynx mytop nmap screen sqlite3 cron-apt ntp curl +} +function configure_cronapt { + CONF=/etc/cron-apt/config + test -f $CONF || exit 0 + + sed -i "s/^# \(MAILON=\).*/\1\"changes\"/" $CONF +} +function config_screen { +# +cat </root/.screenrc + altscreen on # default: off enable "alternate screen" support + autodetach on # default: on automatically detach on hangup + crlf off # default: off no crlf for end-of-lines + deflogin off # default: on default setting for login + defsilence off # default: off default setting for silence + hardcopy_append on # default: off append hardcopies to hardcopy files + ignorecase on # default: off ignore case in searches + startup_message off # default: on NO startup_message - thankyou! + vbell off # default: ??? be silent on bells + termcapinfo xterm ti@:te@ + termcapinfo linux "ve=\E[?25h\E[?17;0;64c" + termcapinfo rxvt-cygwin-native ti@:te@ + defscrollback 1000 # default: 100 + nonblock 23 # default: ??? unblock display after N secs of refusing output + silencewait 15 # default: 30 + hardcopydir $HOME/.screen + shell bash + #caption always "%?%-Lw%?%n*%f %t%?(%u)%?%?%+Lw%?" + caption always "%{ck}%?%-Lw%?%{Yk}%n*%f %t%?(%u)%?%{ck}%?%+Lw%?" + #caption always "%{kG}%?%-Lw%?%{bw}%n*%f %t%?(%u)%?%{kG}%?%+Lw%?" + #caption always '%{= wb}%50=%n%f %t%{= wb}' + #hardstatus alwayslastline "%Y-%m-%d %c %H %l" + #hardstatus alwayslastline "%{= Gb}%Y-%m-%d %c %{= RY}%H %{= BW}%l" + hardstatus alwayslastline "%{kr}%l %{kg}%c %{ky}%M%d" + #hardstatus alwayslastline "%{Gb}%Y-%m-%d %c %{= RY}%H %{BW}%l%{Gb} %=" + #hardstatus alwayslastline "%{rw}%H%{wk}|%c|%M%d|%?%-Lw%?%{bw}%n*%f %t%?(%u)%?%{wk}%?%+Lw%?" + sorendition kG # black on bold green + activity "%C -> %n%f %t activity!" + bell_msg "Bell in window %n" + pow_detach_msg "BYE" + vbell_msg " *beep* " + bind . + bind ^\ + bind \\ + bind j focus down + bind k focus up + bind o only + time "%H %Y-%m-%d %c:%s" + bind t time + bind + resize +1 + bind - resize -1 + bind " " select 0 + bind R colon "source $HOME/.screenrc" + markkeys "$=^E" + markkeys "@=d=f=i=N" + bind @ windowlist -m + windowlist title "Num Title" + windowlist string "%3n %t" + windowlist title "Flag Num Title" + windowlist string "%f%04= %3n %t" +EOT +} +function system_install_node { +#install munin +aptitude -y install munin munin-node libcache-cache-perl libdbd-mysql-perl +sed -i 's/host \*/host 127.0.0.1/' /etc/munin/munin-node.conf +sed -i "s/localhost.localdomain/`hostname -f`/" /etc/munin/munin.conf +echo "munin: root" >> /etc/aliases +sed -i "s#\[mysql\*\]#[mysql*]\nenv.mysqladmin /usr/bin/mysqladmin#" /etc/munin/plugin-conf.d/munin-node +if [ -x /usr/bin/newaliases ] +then +/usr/bin/newaliases +fi +} +function configure_logcheck { + # Ignore the message flood about UFW blocking TCP SYN and UDP packets + UFW_SYN_BLOCK_REGEX="^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[UFW BLOCK\] IN=[[:alnum:]]+ OUT= MAC=[:[:xdigit:]]+ SRC=[.[:digit:]]{7,15} DST=[.[:digit:]]{7,15} LEN=[[:digit:]]+ TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+ (DF )?PROTO=TCP SPT=[[:digit:]]+ DPT=[[:digit:]]+ WINDOW=[[:digit:]]+ RES=0x[[:xdigit:]]+ SYN URGP=[[:digit:]]+$" + UFW_UDP_BLOCK_REGEX="^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[UFW BLOCK\] IN=[[:alnum:]]+ OUT= MAC=[:[:xdigit:]]+ SRC=[.[:digit:]]{7,15} DST=[.[:digit:]]{7,15} LEN=[[:digit:]]+ TOS=0x[[:xdigit:]]+ PREC=0x[[:xdigit:]]+ TTL=[[:digit:]]+ ID=[[:digit:]]+ (DF )?PROTO=UDP SPT=[[:digit:]]+ DPT=[[:digit:]]+ LEN=[[:digit:]]+$" + echo "# UFW BLOCK messages" >> /etc/logcheck/ignore.d.server/local + echo $UFW_SYN_BLOCK_REGEX >> /etc/logcheck/ignore.d.server/local + echo $UFW_UDP_BLOCK_REGEX >> /etc/logcheck/ignore.d.server/local + + # Ignore dhcpcd messages + DHCPCD_RENEWING="^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: renewing lease of [.[:digit:]]{7,15}$" + DHCPCD_LEASED="^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: leased [.[:digit:]]{7,15} for [[:digit:]]+ seconds$" + DHCPCD_ADDING_IP="^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: adding IP address [.[:digit:]]{7,15}/[[:digit:]]+$" + DHCPCD_ADDING_DEFAULT_ROUTE="^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: adding default route via [.[:digit:]]{7,15} metric [0-9]+$" + DHCPCD_INTERFACE_CONFIGURED="^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\.sh: interface [[:alnum:]]+ has been configured with old IP=[.[:digit:]]{7,15}$" + # Ignore ntpd messages + NTPD_VALIDATING_PEER="^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: peer [.[:digit:]]{7,15} now (in)?valid$" + echo "# DHCPCD messages" >> /etc/logcheck/ignore.d.server/local + echo $DHCPCD_RENEWING >> /etc/logcheck/ignore.d.server/local + echo $DHCPCD_LEASED >> /etc/logcheck/ignore.d.server/local + echo $DHCPCD_ADDING_IP >> /etc/logcheck/ignore.d.server/local + echo $DHCPCD_ADDING_DEFAULT_ROUTE >> /etc/logcheck/ignore.d.server/local + echo $DHCPCD_INTERFACE_CONFIGURED >> /etc/logcheck/ignore.d.server/local + echo "# NTPD messages" >> /etc/logcheck/ignore.d.server/local + echo $NTPD_VALIDATING_PEER >> /etc/logcheck/ignore.d.server/local +} +function system_install_utils { + aptitude -y install htop iotop bsd-mailx python-software-properties zsh +} + +function system_install_build { + aptitude -y install build-essential gcc +} +function system_install_subversion { + aptitude -y install subversion +} +function system_install_git { + aptitude -y install git-core +} +function system_install_mercurial { + aptitude -y install mercurial +} +function system_start_etc_dir_versioning { + hg init /etc + hg add /etc + hg commit -u root -m "Started versioning of /etc directory" /etc + chmod -R go-rwx /etc/.hg +} +function system_ignore_files { +cat </etc/.hgignore +syntax: regexp +(^)*.dpkg-new +(^)*.dpkg-old +(^)blkid.tab(|.old) +(^)mtab +# add other files if necessary, depends on your setup... +EOT +} +function system_apt_snapsshot { +cat </etc/apt/hg-snapshot-script +#!/bin/sh +set -e + +caller=\$(ps axww | mawk '/aptitude|apt-get/ {for (i=5; i<=NF ; i++) printf ("%s ",\$i); printf ("\\n") }' | head -1) + +hg addremove 1>/dev/null +STATUS="\$(hg st)" + +if [ -z "\$STATUS" ] ; then + echo "hg-snapshot-script: nothing to be done" +else + case "\$1" in + pre) + echo "hg-snapshot-script: found changed files:" + hg status /etc + hg commit -u root -m "snapshot from \$LOGNAME before: \$caller" /etc + ;; + post) + echo "hg-snapshot-script: found changed files:" + hg status /etc + hg commit -u root -m "snapshot from \$LOGNAME after: \$caller" /etc + ;; + *) + echo "hg-snapshot-script: found changed files:" + hg status /etc + hg commit -u root -m "snapshot from \$LOGNAME on \$(date '+%Y-%m-%d - %H:%M:%S')" /etc + ;; + esac +fi +EOT +chmod +x /etc/apt/hg-snapshot-script +cat </etc/apt/apt.conf.d/25hg-snapshot +DPkg { + Pre-Invoke {"cd /etc ; ./apt/hg-snapshot-script pre";}; + Post-Invoke {"cd /etc ; ./apt/hg-snapshot-script post";}; +} +EOT +} +function system_record_etc_dir_changes { + if [ ! -n "$1" ]; + then MESSAGE="Committed /etc changes" + else MESSAGE="$1" + fi + hg addremove /etc 1>/dev/null + STATUS="$(hg status /etc)" + if [ -z "$STATUS" ] ; then + echo "hg-snapshot-script: nothing to be done" + else + hg commit -u root -m "$MESSAGE" /etc || echo > /dev/null # catch "nothing changed" return code + fi +} diff --git a/135 - o.sh b/135 - o.sh new file mode 100755 index 0000000..d305e44 --- /dev/null +++ b/135 - o.sh @@ -0,0 +1,238 @@ +#!/bin/bash +# +# Installing and configuring the nessary servers for the include stack scripts +# +# 2012 - David Peters - dave@daveshow.com +# Creative Commons Attribution-NonCommercial-ShareAlike 3.0 United States (CC BY-NC-SA 3.0) +# +# Link: https://github.com/daveshow/StackScripts +# +# +# +# +# +# +# +# +# +# +# +# +# +# +# +# +# +# +# +# +# +set -e +set -u +# +USER_GROUPS=sudo +groupadd -r "$SSHD_GROUP" +# +exec &> /root/stackscript.log +# +source # StackScript Bash Library +source # lib-system-ubuntu +source # extras +source # lib-python +# +if [ -z $USER_PASSWORD ]; then USER_PASSWORD=$(urandomString); USER_PASSWORD_BLANK="1"; fi +if [ -z $MYSQL_DATABASE_PASSWORD ]; then MYSQL_DATABASE_PASSWORD=$(urandomString); MYSQL_DATABASE_PASSWORD_BLANK="1"; fi +if [ -z $MYSQL_PASSWORD ]; then MYSQL_PASSWORD=$(urandomString); MYSQL_PASSWORD_BLANK="1"; fi +# +system_locale_en_US_UTF_8 +set_timezone "America/New_York" +system_update +create_sys_backup +# +system_install_mercurial +system_start_etc_dir_versioning #start recording changes of /etc config files +# +system_ignore_files +system_apt_snapsshot +system_record_etc_dir_changes "adding in apt snapshot for backuping up before installing apt deb files" +# +# Configure system +system_update_hostname "$SYS_HOSTNAME" +system_record_etc_dir_changes "Updated hostname" # SS124 +# +if [ ! -f /etc/ssh/sshd_config ];then +install_ssh +system_record_etc_dir_changes "installing openssh if not installed" # SS124 +fi +# Create user account +system_add_user "$USER_NAME" "$USER_PASSWORD" "$USER_GROUPS,$SSHD_GROUP" "$USER_SHELL" +if [ "$USER_SSHKEY" ]; then + system_user_add_ssh_key "$USER_NAME" "$USER_SSHKEY" +fi +system_record_etc_dir_changes "Added unprivileged user account" # SS124 +# +# Configure sshd +system_sshd_permitrootlogin "$SSHD_PERMITROOTLOGIN" +system_sshd_edit_bool "UseDNS" "No" +if [ "$USER_SSHKEY" != "" ]; then +system_sshd_passwordauthentication "No" +fi +echo "AllowGroups `echo $SSHD_GROUP | tr '[:upper:]' '[:lower:]'`" >> /etc/ssh/sshd_config +touch /tmp/restart-ssh +system_record_etc_dir_changes "Configured sshd" # SS124 +if [ "SSHD_PERMITROOTLOGIN" == "No" ]; then + system_lock_user "root" + system_record_etc_dir_changes "Locked root account" # SS124 +fi +lock_users #SS132 +system_record_etc_dir_changes "Locked up users" +# +# Install Postfix +postfix_install_loopback_only # SS1 +system_record_etc_dir_changes "Installed postfix loopback" # SS124 +# +if [ "$SETUP_APACHE" == "Yes" ]; then +apache_install +system_record_etc_dir_changes "Installed apache" +# +apache_tune 15 +system_record_etc_dir_changes "apache tune 15% of sys mem " +# +if [ -z $(get_rdns_primary_ip) ]; then +apache_virtualhost "$SYS_HOSTNAME" +system_record_etc_dir_changes "create virtual from sysname " +else +apache_virtualhost_from_rdns +system_record_etc_dir_changes "create virtual from rdns " +fi +# +php_install_with_apache +system_record_etc_dir_changes "Installing PHP for apache" +fi +goodstuff +config_screen +system_record_etc_dir_changes "installing and configuring the good stuff " +# +if [ "$SETUP_LIGHTTPD" == "Yes" ]; then +system_install_lighttpd + +system_record_etc_dir_changes "Installed lighttpd and pound" +fi +install_secure_php +system_record_etc_dir_changes "Installed php config" +# +# +install_security +system_record_etc_dir_changes "Installing chkroot and rkhunter and logwatch utils" +configure_chkrootkit +system_record_etc_dir_changes "Configured chkrootkit" +configure_rkhunter +system_record_etc_dir_changes "Configured rkhunter" +copy_logwatch +configure_logwatch +system_record_etc_dir_changes "Configured logwatch" +# +install_tools +system_record_etc_dir_changes "Installing nessarry tools install vim less logrotate lynx mytop nmap screen sqlite3 cron-apt ntp curl" +configure_cronapt +system_record_etc_dir_changes "Configured cronapt" +# +# Setup logcheck +system_security_logcheck +system_record_etc_dir_changes "Installed logcheck" # SS124 +configure_logcheck +system_record_etc_dir_changes "Updated logcheck config" # SS124 +# +# Setup fail2ban +system_security_fail2ban +system_record_etc_dir_changes "Installed fail2ban" # SS124 +# +# Setup firewall +system_security_ufw_configure_basic +system_record_etc_dir_changes "Configured UFW" # SS124 +# +python_install +system_record_etc_dir_changes "Installed python" # SS124 +if [ "$SETUP_MYSQL" == "Yes" ]; then + set +u # ignore undefined variables in Linode's SS1 + mysql_install "$MYSQL_DATABASE_PASSWORD" && mysql_tune 20 + mysql_create_database "$MYSQL_DATABASE_PASSWORD" "$MYSQL_DATABASE" + mysql_create_user "$MYSQL_DATABASE_PASSWORD" "$MYSQL_USER" "$MYSQL_PASSWORD" + mysql_grant_user "$MYSQL_DATABASE_PASSWORD" "$MYSQL_USER" "$MYSQL_DATABASE" + set -u + system_record_etc_dir_changes "Configured MySQL" +fi +# Install MongoDB +if [ "$SETUP_MONGODB" == "Yes" ]; then + source # lib-mongodb + mongodb_install + system_record_etc_dir_changes "Installed MongoDB" +fi +# +system_install_node +system_record_etc_dir_changes "Installing remote monitoring tools" # SS124 +# lib-system - SS124 +system_install_utils +system_install_build +system_install_subversion +system_install_git +system_record_etc_dir_changes "Installed common utils" + +# +if [ "$SETUP_MONIT" == "Yes" ]; then + source # lib-monit + monit_install + system_record_etc_dir_changes "Installed Monit" +# + monit_configure_email "$NOTIFY_EMAIL" + monit_configure_web $(system_primary_ip) + system_record_etc_dir_changes "Configured Monit interfaces" +# + monit_def_system "$SYS_HOSTNAME" + monit_def_rootfs + monit_def_cron + monit_def_postfix + monit_def_ping_google + monit_def_sshd + if [ "$SETUP_MONGODB" == "Yes" ]; then monit_def_mongodb; fi + if [ "$SETUP_APACHE" == "Yes" ]; then monit_def_apache; fi + if [ "$SETUP_MYSQL" == "Yes" ]; then monit_def_mysql; fi + if [ "$SETUP_LIGHTTPD" == "Yes" ]; then monit_def_lighttpd; fi + system_record_etc_dir_changes "Created Monit rules for installed services" + monit reload +fi +# +restartServices +# +cat > ~/setup_message <> ~/setup_message <> ~/setup_message <> ~/setup_message <> ~/setup_message <> ~/setup_message <> "$USER_HOME/.ssh/authorized_keys" + chmod 0600 "$USER_HOME/.ssh/authorized_keys" +} + +function system_sshd_edit_bool { + # system_sshd_edit_bool (param_name, "Yes"|"No") + VALUE=`lower $2` + if [ "$VALUE" == "yes" ] || [ "$VALUE" == "no" ]; then + sed -i "s/^#*\($1\).*/\1 $VALUE/" /etc/ssh/sshd_config + fi +} \ No newline at end of file