Initialer Import der Synology Scripts
This commit is contained in:
root
BIN
Binary file not shown.
Executable
BIN
Binary file not shown.
Executable
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+541
@@ -0,0 +1,541 @@
|
||||
#!/bin/bash
|
||||
# Variablen
|
||||
# Konfiguration für den Zugriff auf die Synology DiskStation
|
||||
SYNOLOGY_HOST="9.99.50.10"
|
||||
SYNOLOGY_USERNAME="Madzone"
|
||||
SYNOLOGY_PASSWORD="P@ssw0rd"
|
||||
SSH_PRIVATE_KEY="$HOME/.ssh/id_rsa_synology"
|
||||
host=$(nslookup 9.99.50.10)
|
||||
# Zielpfad für das Full-Chain-Zertifikat
|
||||
FULLCHAIN_CERT="fullchain.${HOST_FQDN}.crt"
|
||||
HOST_FQDN=$(hostname -f)
|
||||
HOST_NORMAL=$(hostname -s)
|
||||
DOMAIN=$(hostname -d)
|
||||
REMOTE_DIR="/volume1/HEIMLAN/HEIMLAN"
|
||||
NFS_MOUNT="/mnt/CSR"
|
||||
SSH_PRIVATE_KEY="$HOME/.ssh/id_rsa_synology"
|
||||
TMP="/tmp"
|
||||
|
||||
# Name der Zertifikatsdateien
|
||||
ROOT_CERT="CERT_HEIMLAN_RootCA.crt"
|
||||
SUBCA_CERT="CERT_HEIMLAN_SubCA.crt"
|
||||
SERVER_CERT="CERT_${HOST_FQDN}.crt"
|
||||
|
||||
# Globale Variablen für das Betriebssystem
|
||||
OS=""
|
||||
distro=""
|
||||
version=""
|
||||
codename=""
|
||||
|
||||
# Globale Variablen für OPENSSL
|
||||
CSR_DIR="/tmp"
|
||||
KEY_DIR="/tmp"
|
||||
SSL_DIR=""
|
||||
PKI_DIR=""
|
||||
|
||||
# Extrahiere OU (Organizational Unit) und O (Organization) und wandele sie in Großbuchstaben um
|
||||
OU=$(echo "${DOMAIN%%.*}" | tr '[:lower:]' '[:upper:]')
|
||||
O=$(echo "${DOMAIN#*.}" | tr '[:lower:]' '[:upper:]')
|
||||
|
||||
# Read IP address dynamically from active network interface
|
||||
IP_ADDRESS=$(nmcli -t -f IP4.ADDRESS device show | awk -F: '{split($2,a,"/"); print a[1]; exit}')
|
||||
echo "IP Address: $IP_ADDRESS"
|
||||
|
||||
# GLobale SSH Variablen
|
||||
KEY_PATH="$HOME/.ssh/id_rsa_synology" # Pfad zum SSH-Schlüssel
|
||||
NAS_HOME="/var/services/homes/$SYNOLOGY_USERNAME" # Angepasstes Home-Verzeichnis auf der NAS
|
||||
dnf install sshpass nfs-utils -y
|
||||
|
||||
#*********************************************************************
|
||||
#echo "SSH KEY wird im System implemntiert..."
|
||||
#sudo ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_synology
|
||||
#echo "SSH KEY wurde Erfolgreich im System implemntiert"
|
||||
#echo "SSH Verbindung wird in die .ssh eingetragen...."
|
||||
#sudo ssh-copy-id -i ~/.ssh/id_rsa_synology.pub ${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}${SYNOLOGY_PASSWORD}
|
||||
#echo "SSH Verbindung wurde Erfolgreich in die .ssh eingetragen !!!"
|
||||
|
||||
|
||||
colourmsg(){
|
||||
echo -e "\033[0;36m$1\033[0m"
|
||||
}
|
||||
# Funktion zum Erstellen eines Ordners mit Unterordnern über SSH mit sshpass
|
||||
create_remote_folders() {
|
||||
|
||||
# SSH-Befehl zum Erstellen des Ordners mit Unterordnern mit sshpass
|
||||
echo sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CSR"
|
||||
sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CSR"
|
||||
echo sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CERT"
|
||||
sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CERT"
|
||||
echo sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/KEY"
|
||||
sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/KEY"
|
||||
echo "Ordner ${REMOTE_DIR}/$HOST_FQDN/ wurde auf ${host} erstellt."
|
||||
}
|
||||
|
||||
# Funktion zum Erstellen von SSH-Schlüsseln
|
||||
generate_ssh_key() {
|
||||
if [ ! -f "$KEY_PATH" ]; then
|
||||
echo "Erstelle SSH-Schlüssel..."
|
||||
ssh-keygen -t rsa -b 4096 -N "" -f "$KEY_PATH"
|
||||
else
|
||||
echo "SSH-Schlüssel existieren bereits."
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion zum Kopieren des öffentlichen Schlüssels zur NAS
|
||||
copy_ssh_key_to_nas() {
|
||||
echo "Kopiere den öffentlichen Schlüssel zur NAS..."
|
||||
#cat ${KEY_PATH}.pub | ssh -o StrictHostKeyChecking=no $SYNOLOGY_USERNAME@$SYNOLOGY_HOST "tee -a $NAS_HOME/.ssh/authorized_keys && chmod 600 $NAS_HOME/.ssh/authorized_keys"
|
||||
cat ${KEY_PATH}.pub | sshpass -p "$SYNOLOGY_PASSWORD" ssh -o StrictHostKeyChecking=no $SYNOLOGY_USERNAME@$SYNOLOGY_HOST "tee -a $NAS_HOME/.ssh/authorized_keys && chmod 600 $NAS_HOME/.ssh/authorized_keys"
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Öffentlicher Schlüssel erfolgreich zur NAS kopiert."
|
||||
else
|
||||
echo "Fehler beim Kopieren des öffentlichen Schlüssels zur NAS."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion zum Kopieren der Datei von der NAS zum lokalen Rechner
|
||||
copy_file_from_nas() {
|
||||
echo "Kopiere die Datei von der NAS zum lokalen Rechner..."
|
||||
scp -i "$KEY_PATH" $SYNOLOGY_USERNAME@SYNOLOGY_HOST:$NAS_HOME "$KEY_PATH"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Datei erfolgreich kopiert."
|
||||
else
|
||||
echo "Fehler beim Kopieren der Datei."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
# Funktion zum Ermitteln des Betriebssystems
|
||||
detect_os() {
|
||||
echo "Das installierte Derivat wird ermittelt...."
|
||||
OS=$(uname -s)
|
||||
|
||||
case $OS in
|
||||
Linux*)
|
||||
# Überprüfen, ob lsb_release verfügbar ist
|
||||
if command -v lsb_release &> /dev/null; then
|
||||
# Verwende lsb_release, wenn es verfügbar ist
|
||||
distro=$(lsb_release -si)
|
||||
version=$(lsb_release -sr)
|
||||
codename=$(lsb_release -sc)
|
||||
else
|
||||
# Überprüfe /etc/os-release
|
||||
if [ -f /etc/os-release ]; then
|
||||
. /etc/os-release
|
||||
distro=$NAME
|
||||
version=$VERSION_ID
|
||||
codename=$VERSION_CODENAME
|
||||
# Überprüfe /etc/lsb-release
|
||||
elif [ -f /etc/lsb-release ]; then
|
||||
. /etc/lsb-release
|
||||
distro=$DISTRIB_ID
|
||||
version=$DISTRIB_RELEASE
|
||||
codename=$DISTRIB_CODENAME
|
||||
# Überprüfe /etc/debian_version
|
||||
elif [ -f /etc/debian_version ]; then
|
||||
distro="Debian"
|
||||
version=$(cat /etc/debian_version)
|
||||
codename=$(uname -r)
|
||||
# Überprüfe /etc/redhat-release
|
||||
elif [ -f /etc/redhat-release ]; then
|
||||
distro=$(cat /etc/redhat-release)
|
||||
version=$(uname -r)
|
||||
codename=$(uname -r)
|
||||
else
|
||||
distro="Unbekannte Distribution"
|
||||
version="Unbekannte Version"
|
||||
codename="Unbekannter Codename"
|
||||
fi
|
||||
fi
|
||||
# Ausgabe der ermittelten Informationen
|
||||
echo "\n\n"
|
||||
echo "Distribution: $distro"
|
||||
echo "Version: $version"
|
||||
echo "Codename: $codename"
|
||||
echo "\n\n"
|
||||
;;
|
||||
*)
|
||||
echo "Unsupported OS: $OS"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "${distro} wurde ....... Ausgewählt......."
|
||||
}
|
||||
install_requierments(){
|
||||
echo "Erstellen des Zertifikatsrequests..."
|
||||
echo " Funktion create_certificate_request() wert der Variable distro: $distro"
|
||||
case $distro in
|
||||
Debian|Ubuntu)
|
||||
echo "" Alle Noetigen Kompomenten werden Installiert....
|
||||
apt install sudo sshpass nfs-common -y
|
||||
;;
|
||||
CentOS)
|
||||
echo "" Alle Noetigen Kompomenten werden Installiert....
|
||||
dnf install sudo sshpass nfs-utils -y
|
||||
;;
|
||||
"Red Hat Enterprise Linux")
|
||||
echo "" Alle Noetigen Kompomenten werden Installiert....
|
||||
dnf install sudo sshpass nfs-utils -y
|
||||
;;
|
||||
*)
|
||||
echo "Das Betriebssystem wird nicht unterstützt für Zertifikatsrequest.";;
|
||||
esac
|
||||
}
|
||||
# Funktion zum Erstellen des Zertifikatsrequests
|
||||
create_certificate_request() {
|
||||
echo "Erstellen des Zertifikatsrequests..."
|
||||
echo " Funktion create_certificate_request() wert der Variable distro: $distro"
|
||||
case $distro in
|
||||
Debian|Ubuntu)
|
||||
apt install sudo sshpass nfs-common -y
|
||||
# Debian / Ubuntu spezifische Pfade
|
||||
#KEY_DIR="/etc/ssl/private/"
|
||||
# Erstellen des privaten Schlüssels
|
||||
openssl genrsa -out "${KEY_DIR}/KEY_${HOST_FQDN}.pem" 4096
|
||||
echo "Privater Schlüssel wurde erstellt: private.key"
|
||||
# CSR erstellen
|
||||
#CSR_DIR="/tmp"
|
||||
openssl req -new -key "${KEY_DIR}/KEY_${HOST_FQDN}.pem" -out "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -subj "/C=DE/ST=TH/L=ILM/O=${O}/OU=${OU}/CN=${HOST_FQDN}/emailAddress=admin@$DOMAIN"
|
||||
echo "Zertifikatsrequest wurde erstellt: request.csr"
|
||||
# CSR anzeigen
|
||||
echo "Inhalt des erstellten Zertifikatsrequests: DEBIAN|UBUNTU......."
|
||||
openssl req -in "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -text -noout
|
||||
;;
|
||||
CentOS)
|
||||
# CentOS spezifische Pfade
|
||||
#KEY_DIR="/etc/pki/tls/private/"
|
||||
# Erstellen des privaten Schlüssels
|
||||
openssl genrsa -out "${KEY_DIR}KEY_${HOST_FQDN}.pem" 4096
|
||||
echo "Privater Schlüssel wurde erstellt und gespeichert unter: ${KEY_DIR}KEY_${HOST_FQDN}.key"
|
||||
# CSR erstellen
|
||||
#CSR_DIR="/tmp"
|
||||
openssl req -new -key "${KEY_DIR}/KEY_${HOST_FQDN}.pem" -out "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -subj "/C=DE/ST=TH/L=ILM/O=HEIMLAN/OU=HEIMLAN/CN=${HOST_FQDN}/emailAddress=admin@$DOMAIN"
|
||||
echo "Zertifikatsrequest wurde erstellt und gespeichert unter: ${CSR_DIR}/CSR_${HOST_FQDN}.csr"
|
||||
# CSR anzeigen
|
||||
echo "Inhalt des erstellten Zertifikatsrequests: CENTOS....."
|
||||
openssl req -in "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -text -noout
|
||||
;;
|
||||
"Red Hat Enterprise Linux")
|
||||
# CentOS spezifische Pfade
|
||||
#KEY_DIR="/etc/pki/tls/private/"
|
||||
# Erstellen des privaten Schlüssels
|
||||
openssl genrsa -out "${KEY_DIR}/KEY_${HOST_FQDN}.pem" 4096
|
||||
echo "Privater Schlüssel wurde erstellt und gespeichert unter: ${KEY_DIR}KEY_${HOST_FQDN}.key"
|
||||
# CSR erstellen
|
||||
#CSR_DIR="/tmp"
|
||||
openssl req -new -key "${KEY_DIR}/KEY_${HOST_FQDN}.pem" -out "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -subj "/C=DE/ST=TH/L=ILM/O=HEIMLAN/OU=HEIMLAN/CN=${HOST_FQDN}/emailAddress=admin@$DOMAIN"
|
||||
echo "Zertifikatsrequest wurde erstellt und gespeichert unter: ${CSR_DIR}/CSR_${HOST_FQDN}.csr"
|
||||
# CSR anzeigen
|
||||
echo "Inhalt des erstellten Zertifikatsrequests: RHEL ....."
|
||||
openssl req -in "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -text -noout
|
||||
;;
|
||||
*)
|
||||
echo "Das Betriebssystem wird nicht unterstützt für Zertifikatsrequest.";;
|
||||
esac
|
||||
}
|
||||
|
||||
# Funktion zum Erstellen des SSH-Schlüsselpaars und Hinzufügen zur Synology
|
||||
setup_ssh_keys() {
|
||||
echo "=== Einrichten von SSH-Schlüsseln ==="
|
||||
|
||||
# Überprüfen, ob der private Schlüssel bereits vorhanden ist
|
||||
if [ ! -f "${SSH_PRIVATE_KEY}" ]; then
|
||||
echo "Erstelle SSH-Schlüsselpaar..."
|
||||
ssh-keygen -t rsa -b 4096 -f "${SSH_PRIVATE_KEY}" -N "" -C "Synology SSH key"
|
||||
echo "SSH-Schlüsselpaar wurde erstellt: ${SSH_PRIVATE_KEY}"
|
||||
else
|
||||
echo "SSH-Schlüsselpaar ist bereits vorhanden: ${SSH_PRIVATE_KEY}"
|
||||
fi
|
||||
|
||||
# SSH-Schlüssel zur Synology hinzufügen
|
||||
echo "Füge den öffentlichen Schlüssel zur Synology hinzu..."
|
||||
ssh-copy-id -i "${SSH_PRIVATE_KEY}.pub" "${SYNOLOGY_USER}@${SYNOLOGY_HOST}"
|
||||
echo "Öffentlicher Schlüssel wurde zur Synology hinzugefügt."
|
||||
}
|
||||
|
||||
# Funktion zum Hochladen des Requests zur Synology
|
||||
upload_certificate_request() {
|
||||
echo "Hochladen des Zertifikatsrequests zur Synology..."
|
||||
# Mounten der NFS-Freigabe mit Benutzername und Passwort
|
||||
sudo mkdir -p ${NFS_MOUNT}
|
||||
echo "sudo mkdir $NFS_MOUNT"
|
||||
#sudo mkdir -p ${NFS_MOUNT}
|
||||
#sleep 10
|
||||
#ls /mnt/CSR/
|
||||
#sudo mount -t nfs -o username="${SYNOLOGY_USER}",password="${SYNOLOGY_PASSWORD}" "${SYNOLOGY_HOST}:${REMOTE_DIR}/$HOST_NORMAL/CSR" "${NFS_MOUNT}"
|
||||
sudo mount -t nfs -o nfsvers=3 "${SYNOLOGY_HOST}:${REMOTE_DIR}" "${NFS_MOUNT}"
|
||||
ls -lha /mnt/CSR/
|
||||
#echo "TEST WARTE ZEIT 30 SEKUNDEN......"
|
||||
#sleep 30
|
||||
# Überprüfen, ob das Mount erfolgreich war
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "NFS-Freigabe erfolgreich eingebunden: ${NFS_MOUNT}"
|
||||
# Kopieren der Datei auf die NFS-Freigabe
|
||||
ls -lha /mnt/CSR/
|
||||
sleep 5
|
||||
sudo cp "${CSR_DIR}/CSR_${HOST_FQDN}.csr" "${NFS_MOUNT}/${HOST_FQDN}/CSR/"
|
||||
sudo cp "${KEY_DIR}/KEY_${HOST_FQDN}.pem" "${NFS_MOUNT}/${HOST_FQDN}/KEY/"
|
||||
sleep 5
|
||||
ls -lha /mnt/CSR/
|
||||
echo "Datei erfolgreich auf die NFS-Freigabe hochgeladen."
|
||||
#echo "2. TEST WARTE ZEIT 30 SEKUNDEN......"
|
||||
#sleep 30
|
||||
else
|
||||
echo "Fehler beim Einbinden der NFS-Freigabe: ${NFS_MOUNT}"
|
||||
fi
|
||||
echo "Zertifikatsrequest wurde zur Synology hochgeladen."
|
||||
}
|
||||
umountNFS(){
|
||||
# NFS-Freigabe wieder aushängen
|
||||
sudo umount "${NFS_MOUNT}"
|
||||
cd /mnt
|
||||
rmdir CSR/
|
||||
echo "NFS-Freigabe erfolgreich ausgehängt."
|
||||
}
|
||||
# Funktion zum Herunterladen von Root-Zertifikat, Sub-CA-Zertifikat und Server-Zertifikat
|
||||
download_certificates() {
|
||||
echo "Herunterladen von Root-Zertifikat, Sub-CA-Zertifikat und Server-Zertifikat..."
|
||||
echo "=== Überprüfen und Herunterladen der Datei von der Synology ==="
|
||||
|
||||
# SSH-Befehl, um die Existenz der Datei auf der Synology zu überprüfen
|
||||
ssh -i "$KEY_PATH" "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" test -f "${REMOTE_DIR}/${HOST_FQDN}/CERT/$SERVER_CERT"
|
||||
|
||||
# Prüfen des Rückgabewerts von test (-f) und Entscheidung treffen
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Datei CERT_${HOST_FQDN}.crt auf der Synology gefunden. Beginne mit dem Download..."
|
||||
cp "${NFS_MOUNT}/${HOST_FQDN}/CERT/$SERVER_CERT" "${TMP}/$SERVER_CERT"
|
||||
cp "${NFS_MOUNT}/RootCA/$ROOT_CERT" "${TMP}/$ROOT_CERT"
|
||||
cp "${NFS_MOUNT}/SubCA/$SUBCA_CERT" "${TMP}/$SUBCA_CERT"
|
||||
echo "Datei erfolgreich heruntergeladen nach ${TMP}"
|
||||
else
|
||||
#echo "Datei $SERVER_CERT nicht auf der Synology gefunden. Warte 300 Sekunden..."
|
||||
#sleep 300
|
||||
echo "Datei $SERVER_CERT nicht auf der Synology gefunden. Warte 300 Sekunden..."
|
||||
|
||||
# Timer mit Countdown anzeigen
|
||||
for ((i=300; i>0; i--)); do
|
||||
echo -ne "Noch $i Sekunden warten...\r"
|
||||
sleep 1
|
||||
done
|
||||
echo
|
||||
download_certificates # Rekursiver Aufruf, um erneut zu prüfen
|
||||
fi
|
||||
echo "Zertifikate wurden heruntergeladen."
|
||||
}
|
||||
|
||||
# Funktion zum Erstellen des Full-Chain-Zertifikats und Umbenennen
|
||||
create_fullchain_certificate() {
|
||||
echo "Erstellen des Full-Chain-Zertifikats..."
|
||||
# Zielpfad für das Full-Chain-Zertifikat
|
||||
FULLCHAIN_CERT="/tmp/fullchain.crt"
|
||||
|
||||
# Full-Chain-Zertifikat erstellen
|
||||
cat "$TMP/$SERVER_CERT" "$TMP/$SUBCA_CERT" "$TMP/$ROOT_CERT" > "$FULLCHAIN_CERT"
|
||||
|
||||
echo "Full-Chain-Zertifikat wurde erstellt: $FULLCHAIN_CERT"
|
||||
|
||||
# Server-Zertifikat nach Hostnamen benennen
|
||||
HOSTNAME=$(hostname)
|
||||
mv "$FULLCHAIN_CERT" "$TMP/fullchain_$HOST_FQDN.crt"
|
||||
|
||||
echo "Full-Chain-Zertifikat umbenannt zu fullchain_$HOST_FQDN.crt"
|
||||
}
|
||||
|
||||
# Funktion zum Kopieren der Zertifikate in die richtigen Pfade je nach Derivat und Typ
|
||||
copy_certificates() {
|
||||
echo "Kopieren der Zertifikate in die richtigen Pfade..."
|
||||
|
||||
case $distro in
|
||||
Debian|Ubuntu)
|
||||
# Debian / Ubuntu spezifische Pfade
|
||||
SSL_DIR="/usr/local/share/ca-certificates/"
|
||||
# Root-Zertifikat kopieren
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR/$ROOT_CERT"
|
||||
# Sub-CA-Zertifikat kopieren
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR/$SUBCA_CERT"
|
||||
# Server-Zertifikat kopieren
|
||||
cp "$TMP/$SERVER_CERT" "$SSL_DIR/$SERVER_CERT"
|
||||
echo "Zertifikate wurden nach $SSL_DIR kopiert."
|
||||
update-ca-certificates
|
||||
;;
|
||||
CentOS|"Red Hat Enterprise Linux")
|
||||
# CentOS spezifische Pfade
|
||||
SSL_DIR="/etc/pki/tls/certs/"
|
||||
PKI_DIR="/etc/pki/ca-trust/source/anchors/"
|
||||
# Root-Zertifikat kopieren
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR/$ROOT_CERT"
|
||||
cp "$TMP/$ROOT_CERT" "$PKI_DIR/$ROOT_CERT"
|
||||
# Sub-CA-Zertifikat kopieren
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR/$SUBCA_CERT"
|
||||
cp "$TMP/$SUBCA_CERT" "$PKI_DIR/$SUBCA_CERT"
|
||||
# Server-Zertifikat kopieren
|
||||
cp "$TMP/$SERVER_CERT" "$SSL_DIR/$SERVER_CERT"
|
||||
cp "$TMP/$SERVER_CERT" "$PKI_DIR/$SERVER_CERT"
|
||||
echo "Zertifikate wurden nach $SSL_DIR und nach $PKI_DIR kopiert."
|
||||
update-ca-trust
|
||||
;;
|
||||
*)
|
||||
echo "Das Betriebssystem $OS wird nicht unterstützt für Zertifikate-Kopieren."
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Funktion zum Kopieren der Zertifikate in die richtigen Pfade je nach WebServer Ty
|
||||
copy_web_certificates() {
|
||||
echo "Kopieren der Zertifikate in die richtigen Pfade und Aktualisieren der Konfigurationsdateien..."
|
||||
|
||||
case $distro in
|
||||
Debian|Ubuntu)
|
||||
# Debian / Ubuntu spezifische Pfade
|
||||
SSL_DIR_APACHE="/etc/ssl/certs/"
|
||||
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||
|
||||
# Prüfen, ob Apache installiert ist und den SSL-Pfad anpassen
|
||||
if [ -f "/etc/apache2/apache2.conf" ]; then
|
||||
SSL_DIR_APACHE="/etc/apache2/ssl/"
|
||||
fi
|
||||
|
||||
# Prüfen, ob Nginx installiert ist und den SSL-Pfad anpassen
|
||||
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||
fi
|
||||
|
||||
# Root-Zertifikat kopieren
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR_APACHE/$ROOT_CERT"
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR_NGINX/$ROOT_CERT"
|
||||
# Sub-CA-Zertifikat kopieren
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_APACHE/$SUBCA_CERT"
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_NGINX/$SUBCA_CERT"
|
||||
# Server-Zertifikat kopieren
|
||||
cp "$TMP/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_CERT"
|
||||
cp "$TMP/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_CERT"
|
||||
|
||||
echo "Zertifikate wurden nach $SSL_DIR_APACHE und $SSL_DIR_NGINX kopiert."
|
||||
|
||||
# Aktualisieren der Apache-Konfiguration, falls vorhanden
|
||||
if [ -f "/etc/apache2/apache2.conf" ]; then
|
||||
update_apache_config "$SSL_DIR_APACHE/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_KEY"
|
||||
fi
|
||||
|
||||
# Aktualisieren der Nginx-Konfiguration, falls vorhanden
|
||||
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||
update_nginx_config "$SSL_DIR_NGINX/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_KEY"
|
||||
fi
|
||||
;;
|
||||
CentOS|"Red Hat Enterprise Linux")
|
||||
# CentOS spezifische Pfade
|
||||
SSL_DIR_APACHE="/etc/pki/tls/certs/"
|
||||
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||
|
||||
# Prüfen, ob Apache installiert ist und den SSL-Pfad anpassen
|
||||
if [ -f "/etc/httpd/conf/httpd.conf" ]; then
|
||||
SSL_DIR_APACHE="/etc/httpd/ssl/"
|
||||
fi
|
||||
|
||||
# Prüfen, ob Nginx installiert ist und den SSL-Pfad anpassen
|
||||
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||
fi
|
||||
|
||||
# Root-Zertifikat kopieren
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR_APACHE/$ROOT_CERT"
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR_NGINX/$ROOT_CERT"
|
||||
# Sub-CA-Zertifikat kopieren
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_APACHE/$SUBCA_CERT"
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_NGINX/$SUBCA_CERT"
|
||||
# Server-Zertifikat kopieren
|
||||
cp "$TMP/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_CERT"
|
||||
cp "$TMP/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_CERT"
|
||||
|
||||
echo "Zertifikate wurden nach $SSL_DIR_APACHE und $SSL_DIR_NGINX kopiert."
|
||||
|
||||
# Aktualisieren der Apache-Konfiguration, falls vorhanden
|
||||
if [ -f "/etc/httpd/conf/httpd.conf" ]; then
|
||||
update_apache_config "$SSL_DIR_APACHE/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_KEY"
|
||||
fi
|
||||
|
||||
# Aktualisieren der Nginx-Konfiguration, falls vorhanden
|
||||
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||
update_nginx_config "$SSL_DIR_NGINX/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_KEY"
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
echo "Es ist kein WEbServer auf diesen System Installiert"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Funktion zum Aktualisieren der Apache-Konfiguration
|
||||
update_apache_config() {
|
||||
local cert_file="$1"
|
||||
local key_file="$2"
|
||||
|
||||
echo "Aktualisiere Apache-Konfiguration für SSL-Zertifikate..."
|
||||
|
||||
# Konfigurationsdatei für SSL-Zertifikate finden und bearbeiten
|
||||
local apache_config_file=$(find /etc/apache2 -name "ssl.conf" -o -name "httpd.conf" 2>/dev/null | head -1)
|
||||
if [ -n "$apache_config_file" ]; then
|
||||
# SSLCertificateFile aktualisieren
|
||||
sed -i "s|^\( *SSLCertificateFile *\).*|\1$cert_file|" "$apache_config_file"
|
||||
# SSLCertificateKeyFile aktualisieren
|
||||
sed -i "s|^\( *SSLCertificateKeyFile *\).*|\1$key_file|" "$apache_config_file"
|
||||
echo "Apache-Konfiguration aktualisiert."
|
||||
else
|
||||
echo "Apache-Konfigurationsdatei nicht gefunden oder nicht aktualisiert."
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion zum Aktualisieren der Nginx-Konfiguration
|
||||
update_nginx_config() {
|
||||
local cert_file="$1"
|
||||
local key_file="$2"
|
||||
|
||||
echo "Aktualisiere Nginx-Konfiguration für SSL-Zertifikate..."
|
||||
|
||||
# Konfigurationsdatei für SSL-Zertifikate finden und bearbeiten
|
||||
local nginx_config_file="/etc/nginx/nginx.conf"
|
||||
if [ -f "$nginx_config_file" ]; then
|
||||
# SSL Zertifikat und Key aktualisieren
|
||||
sed -i "s|^\( *ssl_certificate *\).*|\1$cert_file;|" "$nginx_config_file"
|
||||
sed -i "s|^\( *ssl_certificate_key *\).*|\1$key_file;|" "$nginx_config_file"
|
||||
echo "Nginx-Konfiguration aktualisiert."
|
||||
else
|
||||
echo "Nginx-Konfigurationsdatei nicht gefunden oder nicht aktualisiert."
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion zum Ermitteln des installierten Webserver-Dienstes
|
||||
detect_webserver() {
|
||||
if [ -f "/etc/apache2/apache2.conf" ]; then
|
||||
echo "Apache Webserver ist installiert."
|
||||
fi
|
||||
if [ -f "/etc/httpd/conf/httpd.conf" ]; then
|
||||
echo "Apache Webserver ist installiert."
|
||||
fi
|
||||
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||
echo "Nginx Webserver ist installiert."
|
||||
fi
|
||||
}
|
||||
|
||||
echo
|
||||
# Hauptprogramm
|
||||
detect_os
|
||||
install_requierments
|
||||
generate_ssh_key
|
||||
copy_ssh_key_to_nas
|
||||
create_certificate_request
|
||||
create_remote_folders
|
||||
#Wird nicht genutz
|
||||
#setup_ssh_keys
|
||||
upload_certificate_request
|
||||
download_certificates
|
||||
create_fullchain_certificate
|
||||
copy_certificates
|
||||
|
||||
# Funktionen fue WebServer Zertifiakte
|
||||
detect_webserver
|
||||
copy_web_certificates
|
||||
#umountNFS
|
||||
echo "Prozess abgeschlossen."
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,32 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
echo "Updating package list..."
|
||||
sudo apt update
|
||||
|
||||
echo "Installing PostgreSQL..."
|
||||
sudo apt install -y postgresql postgresql-contrib
|
||||
|
||||
echo "Enable local connections"
|
||||
sudo sed -i 's/local\s\+all\s\+postgres\s\+peer/local all postgres trust/' /etc/postgresql/16/main/pg_hba.conf
|
||||
sudo sed -i 's/local\s\+all\s\+all\s\+peer/local all all md5/' /etc/postgresql/16/main/pg_hba.conf
|
||||
|
||||
echo "Stopping PostgreSQL service..."
|
||||
sudo systemctl stop postgresql
|
||||
|
||||
echo "Starting PostgreSQL service..."
|
||||
sudo systemctl start postgresql
|
||||
|
||||
echo "Configuring Alfresco database..."
|
||||
psql -U postgres -c "CREATE USER alfresco WITH PASSWORD 'alfresco';"
|
||||
psql -U postgres -c "CREATE DATABASE alfresco OWNER alfresco ENCODING 'UTF8';"
|
||||
psql -U postgres -c "GRANT ALL PRIVILEGES ON DATABASE alfresco TO alfresco;"
|
||||
|
||||
echo "Stopping PostgreSQL service..."
|
||||
sudo systemctl stop postgresql
|
||||
|
||||
echo "Enabling PostgreSQL to start on boot..."
|
||||
sudo systemctl enable postgresql
|
||||
|
||||
echo "PostgreSQL installation and setup completed successfully!"
|
||||
@@ -0,0 +1,20 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
echo "Updating package list..."
|
||||
sudo apt update
|
||||
|
||||
echo "Installing Java JDK 17..."
|
||||
sudo apt install -y openjdk-17-jdk
|
||||
|
||||
echo "Setting Java 17 as the default Java version..."
|
||||
sudo update-alternatives --install /usr/bin/java java /usr/lib/jvm/java-17-openjdk-amd64/bin/java 1
|
||||
sudo update-alternatives --install /usr/bin/javac javac /usr/lib/jvm/java-17-openjdk-amd64/bin/javac 1
|
||||
sudo update-alternatives --set java /usr/lib/jvm/java-17-openjdk-amd64/bin/java
|
||||
sudo update-alternatives --set javac /usr/lib/jvm/java-17-openjdk-amd64/bin/javac
|
||||
|
||||
echo "Checking Java version..."
|
||||
java -version
|
||||
|
||||
echo "Java JDK 17 installation and setup completed successfully!"
|
||||
@@ -0,0 +1,64 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
TOMCAT_VERSION=10.1.26
|
||||
TOMCAT_USER=ubuntu
|
||||
TOMCAT_GROUP=ubuntu
|
||||
TOMCAT_HOME=/home/ubuntu/tomcat
|
||||
|
||||
echo "Updating package list..."
|
||||
sudo apt update
|
||||
|
||||
echo "Downloading Apache Tomcat..."
|
||||
wget https://dlcdn.apache.org/tomcat/tomcat-10/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz -O /tmp/apache-tomcat-$TOMCAT_VERSION.tar.gz
|
||||
|
||||
echo "Extracting Tomcat..."
|
||||
sudo mkdir -p $TOMCAT_HOME
|
||||
sudo tar xzvf /tmp/apache-tomcat-$TOMCAT_VERSION.tar.gz -C $TOMCAT_HOME --strip-components=1
|
||||
|
||||
echo "Setting permissions for Tomcat directories..."
|
||||
sudo chown -R $TOMCAT_USER:$TOMCAT_GROUP $TOMCAT_HOME
|
||||
sudo chmod -R u+x $TOMCAT_HOME/bin
|
||||
|
||||
echo "Creating Tomcat systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/tomcat.service
|
||||
[Unit]
|
||||
Description=Apache Tomcat Web Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=$TOMCAT_USER
|
||||
Group=$TOMCAT_GROUP
|
||||
|
||||
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||
Environment="CATALINA_PID=$TOMCAT_HOME/temp/tomcat.pid"
|
||||
Environment="CATALINA_HOME=$TOMCAT_HOME"
|
||||
Environment="CATALINA_BASE=$TOMCAT_HOME"
|
||||
Environment="CATALINA_OPTS=-Xms2048M -Xmx3072M -server -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80"
|
||||
Environment="JAVA_OPTS=-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom"
|
||||
Environment="JAVA_TOOL_OPTIONS=-Dencryption.keystore.type=JCEKS -Dencryption.cipherAlgorithm=DESede/CBC/PKCS5Padding -Dencryption.keyAlgorithm=DESede -Dencryption.keystore.location=/home/ubuntu/keystore/metadata-keystore/keystore -Dmetadata-keystore.password=mp6yc0UD9e -Dmetadata-keystore.aliases=metadata -Dmetadata-keystore.metadata.password=oKIWzVdEdA -Dmetadata-keystore.metadata.algorithm=DESede"
|
||||
|
||||
ExecStart=$TOMCAT_HOME/bin/startup.sh
|
||||
ExecStop=$TOMCAT_HOME/bin/shutdown.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Tomcat service..."
|
||||
sudo systemctl start tomcat
|
||||
|
||||
echo "Stopping Tomcat service..."
|
||||
sudo systemctl stop tomcat
|
||||
|
||||
echo "Enabling Tomcat service to start on boot..."
|
||||
sudo systemctl enable tomcat
|
||||
|
||||
echo "Apache Tomcat installation and setup completed successfully!"
|
||||
@@ -0,0 +1,62 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
ACTIVEMQ_VERSION=5.18.5
|
||||
ACTIVEMQ_USER=ubuntu
|
||||
ACTIVEMQ_GROUP=ubuntu
|
||||
ACTIVEMQ_HOME=/home/ubuntu/activemq
|
||||
|
||||
echo "Updating package list..."
|
||||
sudo apt update
|
||||
|
||||
echo "Downloading ActiveMQ..."
|
||||
wget https://dlcdn.apache.org/activemq/$ACTIVEMQ_VERSION/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz -O /tmp/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz
|
||||
|
||||
echo "Extracting ActiveMQ..."
|
||||
sudo mkdir -p $ACTIVEMQ_HOME
|
||||
sudo tar xzvf /tmp/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz -C $ACTIVEMQ_HOME --strip-components=1
|
||||
|
||||
echo "Setting permissions for ActiveMQ directories..."
|
||||
sudo chown -R $ACTIVEMQ_USER:$ACTIVEMQ_GROUP $ACTIVEMQ_HOME
|
||||
sudo chmod -R 755 $ACTIVEMQ_HOME
|
||||
|
||||
echo "Creating ActiveMQ systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/activemq.service
|
||||
[Unit]
|
||||
Description=Apache ActiveMQ
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=$ACTIVEMQ_USER
|
||||
Group=$ACTIVEMQ_GROUP
|
||||
|
||||
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||
Environment="ACTIVEMQ_HOME=$ACTIVEMQ_HOME"
|
||||
Environment="ACTIVEMQ_BASE=$ACTIVEMQ_HOME"
|
||||
Environment="ACTIVEMQ_CONF=$ACTIVEMQ_HOME/conf"
|
||||
Environment="ACTIVEMQ_DATA=$ACTIVEMQ_HOME/data"
|
||||
|
||||
ExecStart=$ACTIVEMQ_HOME/bin/activemq start
|
||||
ExecStop=$ACTIVEMQ_HOME/bin/activemq stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting ActiveMQ service..."
|
||||
sudo systemctl start activemq
|
||||
|
||||
echo "Stopping ActiveMQ service..."
|
||||
sudo systemctl stop activemq
|
||||
|
||||
echo "Enabling ActiveMQ service to start on boot..."
|
||||
sudo systemctl enable activemq
|
||||
|
||||
echo "Apache ActiveMQ installation and setup completed successfully!"
|
||||
@@ -0,0 +1,44 @@
|
||||
#!/bin/bash
|
||||
|
||||
# URLs of the resources to be downloaded
|
||||
URLS=(
|
||||
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-content-services-community-distribution/23.2.1/alfresco-content-services-community-distribution-23.2.1.zip"
|
||||
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-search-services/2.0.9.1/alfresco-search-services-2.0.9.1.zip"
|
||||
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-transform-core-aio/5.1.0/alfresco-transform-core-aio-5.1.0.jar"
|
||||
)
|
||||
|
||||
|
||||
# Directory to save the downloaded files
|
||||
DOWNLOAD_DIR="./downloads"
|
||||
|
||||
# Create the download directory if it does not exist
|
||||
mkdir -p "$DOWNLOAD_DIR"
|
||||
|
||||
# Function to download a file
|
||||
download_file() {
|
||||
local url=$1
|
||||
local dest_dir=$2
|
||||
local filename=$(basename "$url")
|
||||
|
||||
echo "Downloading $filename..."
|
||||
curl -L -o "$dest_dir/$filename" -w "\nHTTP Status: %{http_code}\n" "$url"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Downloaded $filename successfully."
|
||||
else
|
||||
echo "Failed to download $filename."
|
||||
fi
|
||||
|
||||
# Check if the file size is greater than 0 bytes
|
||||
if [ ! -s "$dest_dir/$filename" ]; then
|
||||
echo "Warning: Downloaded file $filename is empty."
|
||||
fi
|
||||
}
|
||||
|
||||
# Loop through each URL and download the file
|
||||
for url in "${URLS[@]}"; do
|
||||
download_file "$url" "$DOWNLOAD_DIR"
|
||||
done
|
||||
|
||||
echo "All downloads are complete."
|
||||
|
||||
@@ -0,0 +1,90 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
echo "Install unzip command"
|
||||
sudo apt -y install unzip
|
||||
|
||||
echo "Create support folders and configuration in Tomcat"
|
||||
mkdir -p /home/ubuntu/tomcat/shared/classes && mkdir -p /home/ubuntu/tomcat/shared/lib
|
||||
sed -i 's|^shared.loader=$|shared.loader=${catalina.base}/shared/classes,${catalina.base}/shared/lib/*.jar|' /home/ubuntu/tomcat/conf/catalina.properties
|
||||
|
||||
echo "Unzip Alfresco ZIP Distribution File"
|
||||
mkdir /tmp/alfresco
|
||||
unzip downloads/alfresco-content-services-community-distribution-23.2.1.zip -d /tmp/alfresco
|
||||
|
||||
echo "Copy JDBC driver"
|
||||
cp /tmp/alfresco/web-server/lib/postgresql-42.6.0.jar /home/ubuntu/tomcat/shared/lib/
|
||||
|
||||
echo "Configure JAR Addons deployment"
|
||||
mkdir -p /home/ubuntu/modules/platform && mkdir -p /home/ubuntu/modules/share && mkdir -p /home/ubuntu/tomcat/conf/Catalina/localhost
|
||||
cp /tmp/alfresco/web-server/conf/Catalina/localhost/* /home/ubuntu/tomcat/conf/Catalina/localhost/
|
||||
|
||||
echo "Install Web Applications"
|
||||
cp /tmp/alfresco/web-server/webapps/* /home/ubuntu/tomcat/webapps/
|
||||
|
||||
echo "Apply configuration"
|
||||
cp -r /tmp/alfresco/web-server/shared/classes/* /home/ubuntu/tomcat/shared/classes/
|
||||
mkdir /home/ubuntu/keystore && cp -r /tmp/alfresco/keystore/* /home/ubuntu/keystore/
|
||||
mkdir /home/ubuntu/alf_data
|
||||
cat <<EOL | tee /home/ubuntu/tomcat/shared/classes/alfresco-global.properties
|
||||
#
|
||||
# Custom content and index data location
|
||||
#
|
||||
dir.root=/home/ubuntu/alf_data
|
||||
dir.keystore=/home/ubuntu/keystore/
|
||||
|
||||
#
|
||||
# Database connection properties
|
||||
#
|
||||
db.username=alfresco
|
||||
db.password=alfresco
|
||||
db.driver=org.postgresql.Driver
|
||||
db.url=jdbc:postgresql://localhost:5432/alfresco
|
||||
|
||||
#
|
||||
# Solr Configuration
|
||||
#
|
||||
solr.secureComms=secret
|
||||
solr.sharedSecret=secret
|
||||
solr.host=localhost
|
||||
solr.port=8983
|
||||
index.subsystem.name=solr6
|
||||
|
||||
#
|
||||
# Transform Configuration
|
||||
#
|
||||
localTransform.core-aio.url=http://localhost:8090/
|
||||
|
||||
#
|
||||
# Events Configuration
|
||||
#
|
||||
messaging.broker.url=failover:(nio://localhost:61616)?timeout=3000&jms.useCompression=true
|
||||
|
||||
#
|
||||
# URL Generation Parameters
|
||||
#-------------
|
||||
alfresco.context=alfresco
|
||||
alfresco.host=localhost
|
||||
alfresco.port=8080
|
||||
alfresco.protocol=http
|
||||
share.context=share
|
||||
share.host=localhost
|
||||
share.port=8080
|
||||
share.protocol=http
|
||||
EOL
|
||||
|
||||
echo "Apply AMPs"
|
||||
mkdir /home/ubuntu/amps && cp -r /tmp/alfresco/amps/* /home/ubuntu/amps/
|
||||
mkdir /home/ubuntu/bin && cp -r /tmp/alfresco/bin/* /home/ubuntu/bin/
|
||||
java -jar /home/ubuntu/bin/alfresco-mmt.jar install /home/ubuntu/amps /home/ubuntu/tomcat/webapps/alfresco.war -directory
|
||||
java -jar /home/ubuntu/bin/alfresco-mmt.jar list /home/ubuntu/tomcat/webapps/alfresco.war
|
||||
|
||||
echo "Modify alfresco and share logs directory"
|
||||
mkdir /home/ubuntu/tomcat/webapps/alfresco && unzip /home/ubuntu/tomcat/webapps/alfresco.war -d /home/ubuntu/tomcat/webapps/alfresco
|
||||
mkdir /home/ubuntu/tomcat/webapps/share && unzip /home/ubuntu/tomcat/webapps/share.war -d /home/ubuntu/tomcat/webapps/share
|
||||
sed -i 's|^appender\.rolling\.fileName=alfresco\.log|appender.rolling.fileName=/home/ubuntu/tomcat/logs/alfresco.log|' /home/ubuntu/tomcat/webapps/alfresco/WEB-INF/classes/log4j2.properties
|
||||
sed -i 's|^appender\.rolling\.fileName=share\.log|appender.rolling.fileName=/home/ubuntu/tomcat/logs/share.log|' /home/ubuntu/tomcat/webapps/share/WEB-INF/classes/log4j2.properties
|
||||
|
||||
|
||||
echo "Alfresco has been configured"
|
||||
@@ -0,0 +1,48 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
echo "Unzip SOLR ZIP Distribution File"
|
||||
mkdir /tmp/solr
|
||||
unzip downloads/alfresco-search-services-2.0.9.1.zip -d /tmp/solr
|
||||
mv /tmp/solr/alfresco-search-services /home/ubuntu
|
||||
|
||||
# Variables
|
||||
SOLR_USER=ubuntu
|
||||
SOLR_GROUP=ubuntu
|
||||
SOLR_HOME=/home/ubuntu/alfresco-search-services
|
||||
|
||||
echo "Creating SOLR systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/solr.service
|
||||
[Unit]
|
||||
Description=Apache SOLR Web Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=$SOLR_USER
|
||||
Group=$SOLR_GROUP
|
||||
|
||||
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||
|
||||
ExecStart=/home/ubuntu/alfresco-search-services/solr/bin/solr start -a "-Dcreate.alfresco.defaults=alfresco,archive -Dalfresco.secureComms=secret -Dalfresco.secureComms.secret=secret"
|
||||
ExecStop=/home/ubuntu/alfresco-search-services/solr/bin/solr stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Solr service..."
|
||||
sudo systemctl start solr
|
||||
|
||||
echo "Stopping Solr service..."
|
||||
sudo systemctl stop solr
|
||||
|
||||
echo "Enabling Solr service to start on boot..."
|
||||
sudo systemctl enable solr
|
||||
|
||||
echo "SOLR has been configured"
|
||||
@@ -0,0 +1,57 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
echo "Install Transform dependencies"
|
||||
sudo apt-get update &&
|
||||
sudo apt install -y imagemagick &&
|
||||
sudo apt install -y libreoffice &&
|
||||
sudo apt install -y exiftool
|
||||
|
||||
curl -L -o /tmp/alfresco-pdf-renderer-1.2-linux.tgz https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-pdf-renderer/1.2/alfresco-pdf-renderer-1.2-linux.tgz &&
|
||||
sudo tar xf /tmp/alfresco-pdf-renderer-1.2-linux.tgz -C /usr/bin
|
||||
|
||||
echo "Configure Transform server"
|
||||
mkdir /home/ubuntu/transform
|
||||
cp downloads/alfresco-transform-core-aio-5.1.0.jar /home/ubuntu/transform
|
||||
|
||||
# Variables
|
||||
TRANSFORM_USER=ubuntu
|
||||
TRANSFORM_GROUP=ubuntu
|
||||
TRANSFORM_HOME=/home/ubuntu/transform
|
||||
|
||||
echo "Creating Transform systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/transform.service
|
||||
[Unit]
|
||||
Description=Transform Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
|
||||
User=$TRANSFORM_USER
|
||||
Group=$TRANSFORM_GROUP
|
||||
|
||||
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||
Environment="LIBREOFFICE_HOME=/usr/lib/libreoffice"
|
||||
|
||||
ExecStart=java -jar /home/ubuntu/transform/alfresco-transform-core-aio-5.1.0.jar
|
||||
ExecStop=/bin/kill -15 $MAINPID
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Transform service..."
|
||||
sudo systemctl start transform
|
||||
|
||||
echo "Stopping Transform service..."
|
||||
sudo systemctl stop transform
|
||||
|
||||
echo "Enabling Transform service to start on boot..."
|
||||
sudo systemctl enable transform
|
||||
|
||||
echo "Transform has been configured"
|
||||
@@ -0,0 +1,26 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
# Install Node.js and npm (LTS version)
|
||||
echo "Installing Node.js and npm..."
|
||||
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
|
||||
sudo apt install -y nodejs
|
||||
|
||||
# Verify Node.js and npm installation
|
||||
echo "Verifying Node.js and npm installation..."
|
||||
node -v
|
||||
npm -v
|
||||
|
||||
# Clone the Alfresco Content App repository
|
||||
git clone https://github.com/Alfresco/alfresco-content-app.git
|
||||
cd alfresco-content-app
|
||||
|
||||
# Checkout to the specific version 4.4.1
|
||||
git checkout tags/4.4.1 -b 4.4.1
|
||||
|
||||
# Install project dependencies
|
||||
npm install
|
||||
|
||||
# Build the application for production
|
||||
npm run build
|
||||
@@ -0,0 +1,93 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit script on any error
|
||||
set -e
|
||||
|
||||
# Update and upgrade the system
|
||||
echo "Updating system..."
|
||||
sudo apt update && sudo apt upgrade -y
|
||||
|
||||
# Install Nginx
|
||||
echo "Installing Nginx..."
|
||||
sudo apt install -y nginx
|
||||
|
||||
# Create directory for the Alfresco Content App
|
||||
echo "Creating directory for Alfresco Content App..."
|
||||
sudo mkdir -p /var/www/alfresco-content-app
|
||||
sudo cp -r /home/ubuntu/alfresco-content-app/dist/content-ce/* /var/www/alfresco-content-app
|
||||
|
||||
echo "Creating nginx systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/nginx.service
|
||||
[Unit]
|
||||
Description=A high performance web server and a reverse proxy server
|
||||
Documentation=man:nginx(8)
|
||||
After=network.target remote-fs.target nss-lookup.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
PIDFile=/run/nginx.pid
|
||||
ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
|
||||
ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
|
||||
ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
|
||||
ExecStop=/bin/kill -s QUIT $MAINPID
|
||||
PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Enabling nginx service to start on boot..."
|
||||
sudo systemctl enable nginx
|
||||
|
||||
# Configure Nginx to serve the Alfresco Content App
|
||||
echo "Configuring Nginx..."
|
||||
cat <<EOL | sudo tee /etc/nginx/sites-available/alfresco-content-app
|
||||
server {
|
||||
listen 80;
|
||||
server_name localhost;
|
||||
|
||||
client_max_body_size 0;
|
||||
|
||||
set \$allowOriginSite *;
|
||||
proxy_pass_request_headers on;
|
||||
proxy_pass_header Set-Cookie;
|
||||
|
||||
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
|
||||
proxy_redirect off;
|
||||
proxy_buffering off;
|
||||
proxy_set_header Host \$host:\$server_port;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_pass_header Set-Cookie;
|
||||
|
||||
root /var/www/alfresco-content-app;
|
||||
index index.html;
|
||||
|
||||
location / {
|
||||
try_files \$uri \$uri/ /index.html;
|
||||
}
|
||||
|
||||
location /alfresco/ {
|
||||
proxy_pass http://localhost:8080;
|
||||
}
|
||||
|
||||
location /share/ {
|
||||
proxy_pass http://localhost:8080;
|
||||
}
|
||||
}
|
||||
EOL
|
||||
|
||||
|
||||
# Enable the new Nginx configuration
|
||||
echo "Enabling Nginx configuration..."
|
||||
sudo ln -s /etc/nginx/sites-available/alfresco-content-app /etc/nginx/sites-enabled/
|
||||
sudo nginx -t
|
||||
sudo systemctl restart nginx
|
||||
|
||||
sudo systemctl stop nginx
|
||||
|
||||
# Instructions to transfer the built files
|
||||
echo "Nginx setup complete."
|
||||
@@ -0,0 +1,26 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
## RECOMMENDATION: run this sequence of commands manually, waiting between one command and the next one to ensure service dependencies are met.
|
||||
|
||||
echo "Starting postgresql"
|
||||
sudo systemctl start postgresql
|
||||
|
||||
echo "Starting activemq"
|
||||
sudo systemctl start activemq
|
||||
|
||||
echo "Starting transform"
|
||||
sudo systemctl start transform
|
||||
|
||||
echo "Starting tomcat"
|
||||
sudo systemctl start tomcat
|
||||
|
||||
echo "Starting solr"
|
||||
sudo systemctl start solr
|
||||
|
||||
echo "Starting nginx"
|
||||
sudo systemctl start nginx
|
||||
|
||||
|
||||
echo "Services have been started successfully!"
|
||||
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
Executable
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
+109
@@ -0,0 +1,109 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Überprüfung des Betriebssystems
|
||||
function check_os() {
|
||||
if [ -f /etc/redhat-release ]; then
|
||||
echo "Red Hat Derivat erkannt"
|
||||
OS="redhat"
|
||||
elif [ -f /etc/debian_version ]; then
|
||||
echo "Debian/Ubuntu erkannt"
|
||||
OS="debian"
|
||||
else
|
||||
echo "Betriebssystem nicht unterstützt"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Automatische Ermittlung von Systeminformationen
|
||||
function get_system_info() {
|
||||
HOSTNAME=$(hostname)
|
||||
IP_ADDR=$(hostname -I | awk '{print $1}')
|
||||
CPU_CORES=$(nproc)
|
||||
TOTAL_MEM=$(grep MemTotal /proc/meminfo | awk '{print $2}')
|
||||
echo "Systeminformationen:"
|
||||
echo "Hostname: $HOSTNAME"
|
||||
echo "IP-Adresse: $IP_ADDR"
|
||||
echo "CPU-Kerne: $CPU_CORES"
|
||||
echo "Speicher (kB): $TOTAL_MEM"
|
||||
}
|
||||
|
||||
# Installation der notwendigen Pakete auf Debian/Ubuntu
|
||||
function install_debian_dependencies() {
|
||||
echo "Installiere Abhängigkeiten auf Debian/Ubuntu..."
|
||||
sudo apt update
|
||||
sudo apt install -y openjdk-11-jdk postgresql postgresql-contrib libreoffice curl wget unzip
|
||||
}
|
||||
|
||||
# Installation der notwendigen Pakete auf Red Hat Derivaten
|
||||
function install_redhat_dependencies() {
|
||||
echo "Installiere Abhängigkeiten auf Red Hat..."
|
||||
sudo yum update -y
|
||||
sudo yum install -y java-11-openjdk postgresql-server postgresql-contrib libreoffice curl wget unzip
|
||||
}
|
||||
|
||||
# Alfresco herunterladen
|
||||
function download_alfresco() {
|
||||
echo "Lade Alfresco herunter..."
|
||||
wget https://download.alfresco.com/cloudfront/release/community/202210-GA-build-411/alfresco-content-services-community-distribution-202210.zip -O alfresco.zip
|
||||
#wget https://nexus.alfresco.com/nexus/service/local/repositories/releases/content/org/alfresco/alfresco-content-services-community-distribution/23.1.0/alfresco-content-services-community-distribution-23.1.0.zip -O alfresco.zip
|
||||
unzip alfresco.zip -d /opt/alfresco
|
||||
chmod -R 755 /opt/alfresco
|
||||
}
|
||||
|
||||
# Datenbank konfigurieren (PostgreSQL)
|
||||
function configure_database() {
|
||||
echo "Konfiguriere PostgreSQL..."
|
||||
sudo postgresql-setup initdb
|
||||
sudo systemctl start postgresql
|
||||
sudo systemctl enable postgresql
|
||||
sudo -u postgres psql -c "CREATE USER alfresco WITH PASSWORD 'alfresco';"
|
||||
sudo -u postgres psql -c "CREATE DATABASE alfresco WITH OWNER alfresco;"
|
||||
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE alfresco TO alfresco;"
|
||||
}
|
||||
|
||||
# Alfresco konfigurieren
|
||||
function configure_alfresco() {
|
||||
echo "Konfiguriere Alfresco..."
|
||||
ALFRESCO_GLOBAL_PROPERTIES="/opt/alfresco/web-server/shared/classes/alfresco-global.properties"
|
||||
cp /opt/alfresco/web-server/shared/classes/alfresco-global.properties.sample $ALFRESCO_GLOBAL_PROPERTIES
|
||||
|
||||
cat <<EOL >> $ALFRESCO_GLOBAL_PROPERTIES
|
||||
db.driver=org.postgresql.Driver
|
||||
db.username=alfresco
|
||||
db.password=alfresco
|
||||
db.url=jdbc:postgresql://localhost:5432/alfresco
|
||||
alfresco.host=$IP_ADDR
|
||||
alfresco.port=8080
|
||||
share.host=$IP_ADDR
|
||||
share.port=8080
|
||||
index.subsystem.name=solr6
|
||||
EOL
|
||||
}
|
||||
|
||||
# Alfresco Dienst starten
|
||||
function start_alfresco() {
|
||||
echo "Starte Alfresco..."
|
||||
/opt/alfresco/alfresco.sh start
|
||||
}
|
||||
|
||||
# Hauptfunktion zur Installation und Konfiguration von Alfresco
|
||||
function install_alfresco() {
|
||||
check_os
|
||||
get_system_info
|
||||
|
||||
if [ "$OS" == "debian" ]; then
|
||||
install_debian_dependencies
|
||||
elif [ "$OS" == "redhat" ]; then
|
||||
install_redhat_dependencies
|
||||
fi
|
||||
|
||||
download_alfresco
|
||||
configure_database
|
||||
configure_alfresco
|
||||
start_alfresco
|
||||
|
||||
echo "Alfresco Installation und Konfiguration abgeschlossen!"
|
||||
}
|
||||
|
||||
# Skript starten
|
||||
install_alfresco
|
||||
+666
@@ -0,0 +1,666 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
# Detect the OS
|
||||
if [ -f /etc/redhat-release ]; then
|
||||
OS="RHEL"
|
||||
elif [ -f /etc/lsb-release ]; then
|
||||
OS="Ubuntu"
|
||||
else
|
||||
echo "Unsupported OS"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
#MAIN
|
||||
download_files() {
|
||||
# Array von URLs
|
||||
URLS=(
|
||||
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-content-services-community-distribution/23.2.1/alfresco-content-services-community-distribution-23.2.1.zip"
|
||||
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-search-services/2.0.9.1/alfresco-search-services-2.0.9.1.zip"
|
||||
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-transform-core-aio/5.1.0/alfresco-transform-core-aio-5.1.0.jar"
|
||||
)
|
||||
|
||||
# Verzeichnis, in das die Dateien heruntergeladen werden sollen
|
||||
DEST_DIR="/tmp/downloads"
|
||||
|
||||
# Erstelle das Verzeichnis, falls es nicht existiert
|
||||
mkdir -p "$DEST_DIR"
|
||||
|
||||
# Herunterladen der Dateien
|
||||
for URL in "${URLS[@]}"; do
|
||||
echo "Downloading $URL..."
|
||||
# Extrahiere den Dateinamen aus der URL
|
||||
FILE_NAME=$(basename "$URL")
|
||||
# Lade die Datei herunter und speichere sie im Zielverzeichnis
|
||||
curl -L "$URL" -o "$DEST_DIR/$FILE_NAME"
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Successfully downloaded $FILE_NAME"
|
||||
else
|
||||
echo "Failed to download $FILE_NAME"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
# Functions for RHEL
|
||||
install_postgresql_rhel() {
|
||||
echo "Updating package list..."
|
||||
sudo yum update -y
|
||||
|
||||
echo "Installing PostgreSQL 16..."
|
||||
#sudo yum install -y https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-8-x86_64/pgdg-redhat-repo-latest.noarch.rpm
|
||||
sudo dnf install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-8-x86_64/pgdg-redhat-repo-latest.noarch.rpm
|
||||
sudo dnf -qy module disable postgresql
|
||||
sudo yum install -y postgresql16-server postgresql16-contrib
|
||||
|
||||
echo "Initializing PostgreSQL database..."
|
||||
sudo /usr/pgsql-16/bin/postgresql-16-setup initdb
|
||||
|
||||
echo "Enable local connections"
|
||||
sudo sed -i 's/peer/trust/' /var/lib/pgsql/16/data/pg_hba.conf
|
||||
sudo sed -i 's/ident/md5/' /var/lib/pgsql/16/data/pg_hba.conf
|
||||
|
||||
echo "Starting PostgreSQL service..."
|
||||
sudo systemctl start postgresql-16
|
||||
|
||||
echo "Configuring Alfresco database..."
|
||||
sudo -u postgres psql -c "CREATE USER alfresco WITH PASSWORD 'alfresco';"
|
||||
sudo -u postgres psql -c "CREATE DATABASE alfresco OWNER alfresco ENCODING 'UTF8';"
|
||||
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE alfresco TO alfresco;"
|
||||
|
||||
echo "Stopping PostgreSQL service..."
|
||||
sudo systemctl stop postgresql-16
|
||||
|
||||
echo "Enabling PostgreSQL to start on boot..."
|
||||
sudo systemctl enable postgresql-16
|
||||
|
||||
echo "PostgreSQL installation and setup completed successfully!"
|
||||
}
|
||||
install_java_rhel() {
|
||||
echo "Updating package list..."
|
||||
sudo dnf update -y
|
||||
|
||||
echo "Installing the latest Java JDK and development tools..."
|
||||
# Install Java JDK and development tools (java-17-openjdk and java-17-openjdk-devel)
|
||||
sudo dnf install -y java-17-openjdk java-17-openjdk-devel
|
||||
|
||||
echo "Setting Java as the default version..."
|
||||
# Update alternatives to ensure the correct Java version is used
|
||||
sudo alternatives --install /usr/bin/java java /usr/lib/jvm/java-17-openjdk-*/bin/java 1
|
||||
sudo alternatives --install /usr/bin/javac javac /usr/lib/jvm/java-17-openjdk-*/bin/javac 1
|
||||
|
||||
echo "Checking the installed Java version..."
|
||||
java -version
|
||||
|
||||
# Automatically select the correct version
|
||||
echo "Selecting the Java alternative..."
|
||||
# Hier die Nummer der gewünschten Java-Version setzen. Ersetze "1" durch die entsprechende Nummer.
|
||||
echo "1" | sudo alternatives --config java
|
||||
|
||||
echo "Selecting the javac alternative..."
|
||||
# Hier die Nummer der gewünschten javac-Version setzen. Ersetze "1" durch die entsprechende Nummer.
|
||||
echo "1" | sudo alternatives --config javac
|
||||
|
||||
echo "Verifying Java installation..."
|
||||
java -version
|
||||
javac -version
|
||||
|
||||
echo "Java JDK installation and setup completed successfully!"
|
||||
}
|
||||
install_tomcat_rhel() {
|
||||
# Tomcat installation for RHEL
|
||||
echo "Updating package list..."
|
||||
sudo yum update -y
|
||||
|
||||
echo "Installing Tomcat 10..."
|
||||
sudo yum install -y tomcat tomcat-webapps tomcat-admin-webapps
|
||||
|
||||
echo "Starting Tomcat service..."
|
||||
sudo systemctl start tomcat
|
||||
|
||||
echo "Enabling Tomcat to start on boot..."
|
||||
sudo systemctl enable tomcat
|
||||
|
||||
echo "Tomcat installation and setup completed successfully!"
|
||||
}
|
||||
install_activemq_rhel() {
|
||||
echo "Updating package list..."
|
||||
sudo yum update -y
|
||||
|
||||
echo "Downloading ActiveMQ..."
|
||||
wget https://dlcdn.apache.org/activemq/6.1.3/apache-activemq-6.1.3-bin.tar.gz -O /tmp/apache-activemq-6.1.3-bin.tar.gz
|
||||
|
||||
echo "Extracting ActiveMQ..."
|
||||
sudo mkdir /opt/activemq
|
||||
sudo tar xzvf /tmp/apache-activemq-6.1.3-bin.tar.gz -C /opt/activemq --strip-components=1
|
||||
|
||||
echo "Setting permissions for ActiveMQ directories..."
|
||||
sudo useradd activemq
|
||||
sudo chown -R activemq:activemq /opt/activemq
|
||||
sudo chmod -R 755 /opt/activemq
|
||||
|
||||
echo "Creating ActiveMQ systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/activemq.service
|
||||
[Unit]
|
||||
Description=Apache ActiveMQ
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=activemq
|
||||
Group=activemq
|
||||
|
||||
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||
Environment="ACTIVEMQ_HOME=/opt/activemq"
|
||||
Environment="ACTIVEMQ_BASE=/opt/activemq"
|
||||
Environment="ACTIVEMQ_CONF=/opt/activemq/conf"
|
||||
Environment="ACTIVEMQ_DATA=/opt/activemq/data"
|
||||
|
||||
ExecStart=/opt/activemq/bin/activemq start
|
||||
ExecStop=/opt/activemq/bin/activemq stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting ActiveMQ service..."
|
||||
sudo systemctl start activemq
|
||||
|
||||
echo "Enabling ActiveMQ service to start on boot..."
|
||||
sudo systemctl enable activemq
|
||||
|
||||
echo "Apache ActiveMQ installation and setup completed successfully!"
|
||||
}
|
||||
install_alfresco_rhel(){
|
||||
|
||||
echo "Create support folders and configuration in Tomcat"
|
||||
mkdir -p /etc/tomcat/shared/classes && mkdir -p /etc/tomcat/shared/lib
|
||||
sed -i 's|^shared.loader=$|shared.loader=${catalina.base}/shared/classes,${catalina.base}/shared/lib/*.jar|' /etc/tomcat/catalina.properties
|
||||
|
||||
echo "Unzip Alfresco ZIP Distribution File"
|
||||
mkdir /tmp/downloads/alfresco
|
||||
|
||||
echo "Copy JDBC driver"
|
||||
cp /tmp/downloads/alfresco/web-server/lib/postgresql-42.6.0.jar /etc/tomcat/shared/lib/
|
||||
|
||||
echo "Configure JAR Addons deployment"
|
||||
mkdir -p /etc/modules/platform && mkdir -p /opt/modules/share && mkdir -p /opt/tomcat/conf/Catalina/localhost
|
||||
cp /tmp/downloads/alfresco/web-server/conf/Catalina/localhost/* /opt/tomcat/conf/Catalina/localhost/
|
||||
|
||||
echo "Install Web Applications"
|
||||
cp /tmp/downloads/alfresco/web-server/webapps/* /etc/tomcat/webapps/
|
||||
|
||||
echo "Apply configuration"
|
||||
cp -r /tmp/downloads/alfresco/web-server/shared/classes/* /etc/tomcat/shared/classes/
|
||||
mkdir /opt/keystore && cp -r /tmp/downloads/alfresco/keystore/* /opt/keystore/
|
||||
mkdir /opt/alf_data
|
||||
cat <<EOL | tee /etc/tomcat/shared/classes/alfresco-global.properties
|
||||
#
|
||||
# Custom content and index data location
|
||||
#
|
||||
dir.root=/opt/alf_data
|
||||
dir.keystore=/opt/keystore/
|
||||
|
||||
#
|
||||
# Database connection properties
|
||||
#
|
||||
db.username=alfresco
|
||||
db.password=alfresco
|
||||
db.driver=org.postgresql.Driver
|
||||
db.url=jdbc:postgresql://localhost:5432/alfresco
|
||||
|
||||
#
|
||||
# Solr Configuration
|
||||
#
|
||||
solr.secureComms=secret
|
||||
solr.sharedSecret=secret
|
||||
solr.host=localhost
|
||||
solr.port=8983
|
||||
index.subsystem.name=solr6
|
||||
|
||||
#
|
||||
# Transform Configuration
|
||||
#
|
||||
localTransform.core-aio.url=http://localhost:8090/
|
||||
|
||||
#
|
||||
# Events Configuration
|
||||
#
|
||||
messaging.broker.url=failover:(nio://localhost:61616)?timeout=3000&jms.useCompression=true
|
||||
|
||||
#
|
||||
# URL Generation Parameters
|
||||
#-------------
|
||||
alfresco.context=alfresco
|
||||
alfresco.host=localhost
|
||||
alfresco.port=8080
|
||||
alfresco.protocol=http
|
||||
share.context=share
|
||||
share.host=localhost
|
||||
share.port=8080
|
||||
share.protocol=http
|
||||
EOL
|
||||
|
||||
echo "Apply AMPs"
|
||||
mkdir /opt/amps && cp -r /tmp/downloads/alfresco/amps/* /opt/amps/
|
||||
mkdir /opt/bin && cp -r /tmp/downloads/alfresco/bin/* /opt/bin/
|
||||
java -jar /opt/bin/alfresco-mmt.jar install /opt/amps /etc/tomcat/webapps/alfresco.war -directory
|
||||
java -jar /opt/bin/alfresco-mmt.jar list /etc/tomcat/webapps/alfresco.war
|
||||
|
||||
echo "Modify alfresco and share logs directory"
|
||||
mkdir /etc/tomcat/webapps/alfresco && unzip /etc/tomcat/webapps/alfresco.war -d /etc/tomcat/webapps/alfresco
|
||||
mkdir /etc/tomcat/webapps/share && unzip /etc/tomcat/webapps/share.war -d /etc/tomcat/webapps/share
|
||||
sed -i 's|^appender\.rolling\.fileName=alfresco\.log|appender.rolling.fileName=/opt/tomcat/logs/alfresco.log|' /etc/tomcat/webapps/alfresco/WEB-INF/classes/log4j2.properties
|
||||
sed -i 's|^appender\.rolling\.fileName=share\.log|appender.rolling.fileName=/opt/tomcat/logs/share.log|' /etc/tomcat/webapps/share/WEB-INF/classes/log4j2.properties
|
||||
|
||||
|
||||
echo "Alfresco has been configured"
|
||||
}
|
||||
|
||||
install_solr_rhel() {
|
||||
echo "Unzip SOLR ZIP Distribution File"
|
||||
mkdir /tmp/solr
|
||||
unzip /tmp/downloads/alfresco-search-services-2.0.9.1.zip -d /tmp/solr
|
||||
mv /tmp/solr/alfresco-search-services /opt/solr/alfresco-search-services
|
||||
echo "creating user ..."
|
||||
sudo useradd solr
|
||||
echo "Creating SOLR systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/solr.service
|
||||
[Unit]
|
||||
Description=Apache SOLR Web Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=solr
|
||||
Group=solr
|
||||
|
||||
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk"
|
||||
|
||||
ExecStart=/opt/solr/alfresco-search-services/solr/bin/solr start -a "-Dcreate.alfresco.defaults=alfresco,archive -Dalfresco.secureComms=secret -Dalfresco.secureComms.secret=secret"
|
||||
ExecStop=/opt/solr/alfresco-search-services/solr/bin/solr stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "SELinux anpassungen werden durchgeführt...."
|
||||
ausearch -c '(solr)' --raw | audit2allow -M my-solr
|
||||
semodule -X 300 -i my-solr.pp
|
||||
|
||||
echo "Permission für für solr werden gesetzt...."
|
||||
chmod -R 755 /opt/solr/alfresco-search-services/solr/server/../../logs
|
||||
chown -R solr:solr /opt/solr/alfresco-search-services/solr/server/../../logs
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Solr service..."
|
||||
sudo systemctl start solr
|
||||
|
||||
echo "Enabling Solr service to start on boot..."
|
||||
sudo systemctl enable solr
|
||||
|
||||
echo "SOLR has been configured"
|
||||
}
|
||||
|
||||
install_transform_rhel() {
|
||||
echo "Install Repo Dependency..."
|
||||
sudo subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
sudo dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
|
||||
echo "Install Transform dependencies"
|
||||
sudo dnf install -y GraphicsMagick libreoffice perl-Image-ExifTool
|
||||
|
||||
curl -L -o /tmp/downloads/alfresco-pdf-renderer-1.2-linux.tgz https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-pdf-renderer/1.2/alfresco-pdf-renderer-1.2-linux.tgz
|
||||
sudo tar xf /tmp/downloads/alfresco-pdf-renderer-1.2-linux.tgz -C /usr/bin
|
||||
|
||||
echo "Configure Transform server"
|
||||
mkdir /opt/transform
|
||||
cp /tmp/downloads/alfresco-transform-core-aio-5.1.0.jar /opt/transform
|
||||
|
||||
echo " User wird angelegt..."
|
||||
sudo useradd transform
|
||||
|
||||
echo "Creating Transform systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/transform.service
|
||||
|
||||
[Unit]
|
||||
Description=Transform Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
|
||||
User=transform
|
||||
Group=transform
|
||||
|
||||
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk"
|
||||
Environment="LIBREOFFICE_HOME=/usr/lib/libreoffice"
|
||||
|
||||
ExecStart=java -jar /opt/transform/alfresco-transform-core-aio-5.1.0.jar
|
||||
ExecStop=/bin/kill -15 $MAINPID
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Transform service..."
|
||||
sudo systemctl start transform
|
||||
|
||||
echo "Enabling Transform service to start on boot..."
|
||||
sudo systemctl enable transform
|
||||
|
||||
echo "Transform has been configured"
|
||||
}
|
||||
|
||||
install_nginx_rhel() {
|
||||
echo "Updating system..."
|
||||
sudo yum update -y
|
||||
|
||||
echo "Installing Nginx..."
|
||||
sudo yum install -y nginx
|
||||
|
||||
echo "Creating directory for Alfresco Content App..."
|
||||
sudo mkdir -p /var/www/alfresco-content-app
|
||||
sudo cp -r /tmp/downloads/alfresco-content-app/dist/content-ce/* /var/www/alfresco-content-app
|
||||
|
||||
echo "Creating nginx systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/nginx.service
|
||||
[Unit]
|
||||
Description=NGINX web server
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
ExecStart=/usr/sbin/nginx
|
||||
ExecReload=/usr/sbin/nginx -s reload
|
||||
ExecStop=/usr/sbin/nginx -s stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Nginx service..."
|
||||
sudo systemctl start nginx
|
||||
|
||||
echo "Enabling Nginx to start on boot..."
|
||||
sudo systemctl enable nginx
|
||||
|
||||
echo "Nginx installation and configuration completed successfully!"
|
||||
}
|
||||
|
||||
# Functions for Ubuntu
|
||||
install_postgresql_ubuntu() {
|
||||
echo "Updating package list..."
|
||||
sudo apt update
|
||||
|
||||
echo "Installing PostgreSQL 16..."
|
||||
sudo apt install -y wget ca-certificates
|
||||
wget -qO - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
|
||||
echo "deb http://apt.postgresql.org/pub/repos/apt/ $(lsb_release -cs) pgdg" | sudo tee /etc/apt/sources.list.d/pgdg.list
|
||||
sudo apt update
|
||||
sudo apt install -y postgresql-16 postgresql-client-16
|
||||
|
||||
echo "Enable local connections"
|
||||
sudo sed -i 's/peer/trust/' /etc/postgresql/16/main/pg_hba.conf
|
||||
sudo sed -i 's/ident/md5/' /etc/postgresql/16/main/pg_hba.conf
|
||||
|
||||
echo "Starting PostgreSQL service..."
|
||||
sudo systemctl start postgresql
|
||||
|
||||
echo "Configuring Alfresco database..."
|
||||
sudo -u postgres psql -c "CREATE USER alfresco WITH PASSWORD 'alfresco';"
|
||||
sudo -u postgres psql -c "CREATE DATABASE alfresco OWNER alfresco ENCODING 'UTF8';"
|
||||
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE alfresco TO alfresco;"
|
||||
|
||||
echo "Stopping PostgreSQL service..."
|
||||
sudo systemctl stop postgresql
|
||||
|
||||
echo "Enabling PostgreSQL to start on boot..."
|
||||
sudo systemctl enable postgresql
|
||||
|
||||
echo "PostgreSQL installation and setup completed successfully!"
|
||||
}
|
||||
|
||||
install_java_ubuntu() {
|
||||
echo "Updating package list..."
|
||||
sudo apt update
|
||||
|
||||
echo "Installing Java JDK 17..."
|
||||
sudo apt install -y openjdk-17-jdk
|
||||
|
||||
echo "Checking Java version..."
|
||||
java -version
|
||||
|
||||
echo "Java JDK 17 installation and setup completed successfully!"
|
||||
}
|
||||
|
||||
install_tomcat_ubuntu() {
|
||||
echo "Updating package list..."
|
||||
sudo apt update
|
||||
|
||||
echo "Installing Tomcat 10..."
|
||||
sudo apt install -y tomcat10 tomcat10-admin tomcat10-common tomcat10-examples
|
||||
|
||||
echo "Starting Tomcat service..."
|
||||
sudo systemctl start tomcat10
|
||||
|
||||
echo "Enabling Tomcat to start on boot..."
|
||||
sudo systemctl enable tomcat10
|
||||
|
||||
echo "Tomcat installation and setup completed successfully!"
|
||||
}
|
||||
|
||||
install_activemq_ubuntu() {
|
||||
echo "Updating package list..."
|
||||
sudo apt update
|
||||
|
||||
echo "Downloading ActiveMQ..."
|
||||
wget https://dlcdn.apache.org/activemq/5.18.5/apache-activemq-5.18.5-bin.tar.gz -O /tmp/apache-activemq-5.18.5-bin.tar.gz
|
||||
|
||||
echo "Extracting ActiveMQ..."
|
||||
sudo mkdir -p /home/ubuntu/activemq
|
||||
sudo tar xzvf /tmp/apache-activemq-5.18.5-bin.tar.gz -C /home/ubuntu/activemq --strip-components=1
|
||||
|
||||
echo "Setting permissions for ActiveMQ directories..."
|
||||
sudo chown -R ubuntu:ubuntu /home/ubuntu/activemq
|
||||
sudo chmod -R 755 /home/ubuntu/activemq
|
||||
|
||||
echo "Creating ActiveMQ systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/activemq.service
|
||||
[Unit]
|
||||
Description=Apache ActiveMQ
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=ubuntu
|
||||
Group=ubuntu
|
||||
|
||||
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||
Environment="ACTIVEMQ_HOME=/home/ubuntu/activemq"
|
||||
Environment="ACTIVEMQ_BASE=/home/ubuntu/activemq"
|
||||
Environment="ACTIVEMQ_CONF=/home/ubuntu/activemq/conf"
|
||||
Environment="ACTIVEMQ_DATA=/home/ubuntu/activemq/data"
|
||||
|
||||
ExecStart=/home/ubuntu/activemq/bin/activemq start
|
||||
ExecStop=/home/ubuntu/activemq/bin/activemq stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting ActiveMQ service..."
|
||||
sudo systemctl start activemq
|
||||
|
||||
echo "Enabling ActiveMQ service to start on boot..."
|
||||
sudo systemctl enable activemq
|
||||
|
||||
echo "Apache ActiveMQ installation and setup completed successfully!"
|
||||
}
|
||||
|
||||
install_solr_ubuntu() {
|
||||
echo "Unzip SOLR ZIP Distribution File"
|
||||
mkdir /tmp/solr
|
||||
unzip downloads/alfresco-search-services-2.0.9.1.zip -d /tmp/solr
|
||||
mv /tmp/solr/alfresco-search-services /home/ubuntu
|
||||
|
||||
echo "Creating SOLR systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/solr.service
|
||||
[Unit]
|
||||
Description=Apache SOLR Web Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=ubuntu
|
||||
Group=ubuntu
|
||||
|
||||
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||
|
||||
ExecStart=/home/ubuntu/alfresco-search-services/solr/bin/solr start -a "-Dcreate.alfresco.defaults=alfresco,archive -Dalfresco.secureComms=secret -Dalfresco.secureComms.secret=secret"
|
||||
ExecStop=/home/ubuntu/alfresco-search-services/solr/bin/solr stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Solr service..."
|
||||
sudo systemctl start solr
|
||||
|
||||
echo "Enabling Solr service to start on boot..."
|
||||
sudo systemctl enable solr
|
||||
|
||||
echo "SOLR has been configured"
|
||||
}
|
||||
|
||||
install_transform_ubuntu() {
|
||||
echo "Install Transform dependencies"
|
||||
sudo apt install -y imagemagick libreoffice exiftool
|
||||
|
||||
curl -L -o /tmp/alfresco-pdf-renderer-1.2-linux.tgz https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-pdf-renderer/1.2/alfresco-pdf-renderer-1.2-linux.tgz
|
||||
sudo tar xf /tmp/alfresco-pdf-renderer-1.2-linux.tgz -C /usr/bin
|
||||
|
||||
echo "Configure Transform server"
|
||||
mkdir /home/ubuntu/transform
|
||||
cp downloads/alfresco-transform-core-aio-5.1.0.jar /home/ubuntu/transform
|
||||
|
||||
echo "Creating Transform systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/transform.service
|
||||
[Unit]
|
||||
Description=Transform Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
|
||||
User=ubuntu
|
||||
Group=ubuntu
|
||||
|
||||
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||
Environment="LIBREOFFICE_HOME=/usr/lib/libreoffice"
|
||||
|
||||
ExecStart=java -jar /home/ubuntu/transform/alfresco-transform-core-aio-5.1.0.jar
|
||||
ExecStop=/bin/kill -15 $MAINPID
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Transform service..."
|
||||
sudo systemctl start transform
|
||||
|
||||
echo "Enabling Transform service to start on boot..."
|
||||
sudo systemctl enable transform
|
||||
|
||||
echo "Transform has been configured"
|
||||
}
|
||||
|
||||
install_nginx_ubuntu() {
|
||||
echo "Updating system..."
|
||||
sudo apt update
|
||||
|
||||
echo "Installing Nginx..."
|
||||
sudo apt install -y nginx
|
||||
|
||||
echo "Creating directory for Alfresco Content App..."
|
||||
sudo mkdir -p /var/www/alfresco-content-app
|
||||
sudo cp -r /home/ubuntu/alfresco-content-app/dist/content-ce/* /var/www/alfresco-content-app
|
||||
|
||||
echo "Creating nginx systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/nginx.service
|
||||
[Unit]
|
||||
Description=NGINX web server
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
ExecStart=/usr/sbin/nginx
|
||||
ExecReload=/usr/sbin/nginx -s reload
|
||||
ExecStop=/usr/sbin/nginx -s stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Nginx service..."
|
||||
sudo systemctl start nginx
|
||||
|
||||
echo "Enabling Nginx to start on boot..."
|
||||
sudo systemctl enable nginx
|
||||
|
||||
echo "Nginx installation and configuration completed successfully!"
|
||||
}
|
||||
|
||||
# Run the appropriate installation based on the OS
|
||||
if [ "$OS" == "RHEL" ]; then
|
||||
#download_files
|
||||
#install_postgresql_rhel
|
||||
#install_java_rhel
|
||||
#install_tomcat_rhel
|
||||
#install_activemq_rhel
|
||||
install_alfresco_rhel
|
||||
#install_solr_rhel
|
||||
#install_transform_rhel
|
||||
#install_nginx_rhel
|
||||
elif [ "$OS" == "Ubuntu" ]; then
|
||||
download_files
|
||||
install_postgresql_ubuntu
|
||||
install_java_ubuntu
|
||||
install_tomcat_ubuntu
|
||||
install_activemq_ubuntu
|
||||
install_solr_ubuntu
|
||||
install_transform_ubuntu
|
||||
install_nginx_ubuntu
|
||||
else
|
||||
echo "Unsupported OS"
|
||||
fi
|
||||
+128
@@ -0,0 +1,128 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Farben für die Ausgabe
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# Funktion zur Überprüfung des Linux-Derivats
|
||||
check_distro() {
|
||||
if [ -f /etc/debian_version ]; then
|
||||
echo "Debian/Ubuntu erkannt."
|
||||
DISTRO="debian"
|
||||
elif [ -f /etc/redhat-release ]; then
|
||||
echo "RedHat/CentOS erkannt."
|
||||
DISTRO="redhat"
|
||||
else
|
||||
echo -e "${RED}Unbekanntes Linux-Derivat. Das Skript unterstützt nur Debian/Ubuntu und RedHat/CentOS.${NC}"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion zur Installation von Openfire auf Debian/Ubuntu
|
||||
install_openfire_debian() {
|
||||
echo -e "${GREEN}Installation von Openfire auf Debian/Ubuntu...${NC}"
|
||||
wget -O openfire.deb https://www.igniterealtime.org/downloadServlet?filename=openfire/openfire_4.6.0_all.deb
|
||||
sudo dpkg -i openfire.deb
|
||||
sudo apt-get install -f -y # Um Abhängigkeiten zu installieren
|
||||
sudo systemctl enable openfire
|
||||
sudo systemctl start openfire
|
||||
}
|
||||
|
||||
# Funktion zur Installation von Openfire auf RedHat/CentOS
|
||||
install_openfire_redhat() {
|
||||
echo -e "${GREEN}Installation von Openfire auf RedHat/CentOS...${NC}"
|
||||
wget -O openfire.rpm https://www.igniterealtime.org/downloadServlet?filename=openfire/openfire-4.6.0-1.noarch.rpm
|
||||
sudo yum install -y openfire.rpm
|
||||
sudo systemctl enable openfire
|
||||
sudo systemctl start openfire
|
||||
}
|
||||
|
||||
# Funktion zur Konfiguration als Publisher
|
||||
configure_publisher() {
|
||||
echo -e "${GREEN}Konfiguration als Publisher...${NC}"
|
||||
read -p "Geben Sie die JID des Publishers ein (z.B. publisher@deinserver.com): " PUBLISHER_JID
|
||||
read -sp "Geben Sie das Passwort des Publishers ein: " PUBLISHER_PASSWORD
|
||||
echo ""
|
||||
read -p "Geben Sie den PubSub-Server ein (z.B. pubsub.deinserver.com): " PUBSUB_SERVER
|
||||
read -p "Geben Sie den PubSub-Node ein (z.B. mynode): " PUBSUB_NODE
|
||||
|
||||
# Erstelle ein Bash-Skript für den Publisher
|
||||
cat <<EOL > publisher.sh
|
||||
#!/bin/bash
|
||||
|
||||
JID="$PUBLISHER_JID"
|
||||
PASSWORD="$PUBLISHER_PASSWORD"
|
||||
SERVER="$PUBSUB_SERVER"
|
||||
NODE="$PUBSUB_NODE"
|
||||
MESSAGE="Dies ist eine Testnachricht vom Publisher"
|
||||
|
||||
echo "\$MESSAGE" | sendxmpp -t -u "\$JID" -p "\$PASSWORD" -j "\$SERVER" "\$NODE"
|
||||
EOL
|
||||
|
||||
chmod +x publisher.sh
|
||||
echo -e "${GREEN}Publisher-Skript 'publisher.sh' erstellt.${NC}"
|
||||
}
|
||||
|
||||
# Funktion zur Konfiguration als Subscriber
|
||||
configure_subscriber() {
|
||||
echo -e "${GREEN}Konfiguration als Subscriber...${NC}"
|
||||
read -p "Geben Sie die JID des Subscribers ein (z.B. subscriber@deinserver.com): " SUBSCRIBER_JID
|
||||
read -sp "Geben Sie das Passwort des Subscribers ein: " SUBSCRIBER_PASSWORD
|
||||
echo ""
|
||||
read -p "Geben Sie den PubSub-Server ein (z.B. pubsub.deinserver.com): " PUBSUB_SERVER
|
||||
read -p "Geben Sie den PubSub-Node ein (z.B. mynode): " PUBSUB_NODE
|
||||
|
||||
# Erstelle ein Bash-Skript für den Subscriber
|
||||
cat <<EOL > subscriber.sh
|
||||
#!/bin/bash
|
||||
|
||||
JID="$SUBSCRIBER_JID"
|
||||
PASSWORD="$SUBSCRIBER_PASSWORD"
|
||||
SERVER="$PUBSUB_SERVER"
|
||||
NODE="$PUBSUB_NODE"
|
||||
|
||||
profanity --server "\$SERVER" --username "\$JID" --password "\$PASSWORD" --join "\$NODE"
|
||||
EOL
|
||||
|
||||
chmod +x subscriber.sh
|
||||
echo -e "${GREEN}Subscriber-Skript 'subscriber.sh' erstellt.${NC}"
|
||||
}
|
||||
|
||||
# Auswahlmenü für die Konfiguration
|
||||
show_menu() {
|
||||
echo -e "${GREEN}Openfire wurde erfolgreich installiert!${NC}"
|
||||
echo "Wählen Sie die gewünschte Rolle:"
|
||||
echo "1) Publisher konfigurieren"
|
||||
echo "2) Subscriber konfigurieren"
|
||||
echo "3) Abbrechen"
|
||||
|
||||
read -p "Option [1-3]: " OPTION
|
||||
case $OPTION in
|
||||
1)
|
||||
configure_publisher
|
||||
;;
|
||||
2)
|
||||
configure_subscriber
|
||||
;;
|
||||
3)
|
||||
echo -e "${RED}Abbruch.${NC}"
|
||||
exit 1
|
||||
;;
|
||||
*)
|
||||
echo -e "${RED}Ungültige Option.${NC}"
|
||||
show_menu
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Hauptskript
|
||||
check_distro
|
||||
|
||||
if [ "$DISTRO" == "debian" ]; then
|
||||
install_openfire_debian
|
||||
elif [ "$DISTRO" == "redhat" ]; then
|
||||
install_openfire_redhat
|
||||
fi
|
||||
|
||||
show_menu
|
||||
Executable
+78
@@ -0,0 +1,78 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Funktion zur Installation erforderlicher Pakete
|
||||
install_packages() {
|
||||
local DISTRO=$1
|
||||
case $DISTRO in
|
||||
"debian"|"ubuntu")
|
||||
apt-get update
|
||||
apt-get install -y realmd samba-common samba-common-bin krb5-user sssd adcli packagekit
|
||||
;;
|
||||
"rhel"|"centos"|"fedora")
|
||||
yum install -y realmd samba samba-common samba-common-tools krb5-workstation sssd adcli
|
||||
;;
|
||||
"arch")
|
||||
pacman -Syu --noconfirm realmd samba krb5 sssd adcli
|
||||
;;
|
||||
*)
|
||||
echo "Unsupported distribution: $DISTRO"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Funktion zum Joinen der Domäne
|
||||
join_domain() {
|
||||
local DOMAIN=$1
|
||||
local USER=$2
|
||||
local PASSWORD=$3
|
||||
|
||||
echo "Konfiguriere Domain-Join für Domain: $DOMAIN"
|
||||
|
||||
# Realm beitreten
|
||||
echo "$PASSWORD" | realm join --user="$USER" "$DOMAIN" --password
|
||||
|
||||
# Überprüfen, ob der Join erfolgreich war
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Domain join erfolgreich!"
|
||||
else
|
||||
echo "Fehler beim Domain Join."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Automatische Anmeldung aktivieren
|
||||
if [ -f /etc/pam.d/common-session ]; then
|
||||
sed -i 's/^.*pam_sssd.so/#&/' /etc/pam.d/common-session
|
||||
sed -i 's/^.*pam_sssd.so/#&/' /etc/pam.d/common-session-noninteractive
|
||||
sed -i '/common-session/a session required pam_mkhomedir.so skel=/etc/skel umask=0022' /etc/pam.d/common-session
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion zur Erkennung der Distribution
|
||||
get_distro() {
|
||||
if [ -f /etc/os-release ]; then
|
||||
. /etc/os-release
|
||||
echo "$ID"
|
||||
else
|
||||
echo "Unknown"
|
||||
fi
|
||||
}
|
||||
|
||||
# Hauptskript
|
||||
main() {
|
||||
if [ "$#" -ne 3 ]; then
|
||||
echo "Usage: $0 <domain> <username> <password>"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local DOMAIN=$1
|
||||
local USER=$2
|
||||
local PASSWORD=$3
|
||||
|
||||
local DISTRO=$(get_distro)
|
||||
|
||||
install_packages "$DISTRO"
|
||||
join_domain "$DOMAIN" "$USER" "$PASSWORD"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
Executable
+547
@@ -0,0 +1,547 @@
|
||||
#!/bin/bash
|
||||
# Variablen
|
||||
# Konfiguration für den Zugriff auf die Synology DiskStation
|
||||
SYNOLOGY_HOST="9.99.50.10"
|
||||
SYNOLOGY_USERNAME="Madzone"
|
||||
SYNOLOGY_PASSWORD="P@ssw0rd"
|
||||
SSH_PRIVATE_KEY="$HOME/.ssh/id_rsa_synology"
|
||||
host=$(nslookup 9.99.50.10)
|
||||
# Zielpfad für das Full-Chain-Zertifikat
|
||||
FULLCHAIN_CERT="fullchain.${HOST_FQDN}.crt"
|
||||
HOST_FQDN=$(hostname -f)
|
||||
HOST_NORMAL=$(hostname -s)
|
||||
DOMAIN=$(hostname -d)
|
||||
REMOTE_DIR="/volume1/HEIMLAN/HEIMLAN"
|
||||
NFS_MOUNT="/mnt/CSR"
|
||||
SSH_PRIVATE_KEY="$HOME/.ssh/id_rsa_synology"
|
||||
TMP="/tmp"
|
||||
|
||||
# Name der Zertifikatsdateien
|
||||
ROOT_CERT="CERT_HEIMLAN_RootCA.crt"
|
||||
SUBCA_CERT="CERT_HEIMLAN_SubCA.crt"
|
||||
SERVER_CERT="CERT_${HOST_FQDN}.crt"
|
||||
|
||||
# Globale Variablen für das Betriebssystem
|
||||
OS=""
|
||||
distro=""
|
||||
version=""
|
||||
codename=""
|
||||
|
||||
# Globale Variablen für OPENSSL
|
||||
CSR_DIR="/tmp"
|
||||
KEY_DIR="/tmp"
|
||||
SSL_DIR=""
|
||||
PKI_DIR=""
|
||||
|
||||
# Extrahiere OU (Organizational Unit) und O (Organization) und wandele sie in Großbuchstaben um
|
||||
OU=$(echo "${DOMAIN%%.*}" | tr '[:lower:]' '[:upper:]')
|
||||
O=$(echo "${DOMAIN#*.}" | tr '[:lower:]' '[:upper:]')
|
||||
|
||||
# Read IP address dynamically from active network interface
|
||||
IP_ADDRESS=$(nmcli -t -f IP4.ADDRESS device show | awk -F: '{split($2,a,"/"); print a[1]; exit}')
|
||||
echo "IP Address: $IP_ADDRESS"
|
||||
|
||||
# GLobale SSH Variablen
|
||||
KEY_PATH="$HOME/.ssh/id_rsa_synology" # Pfad zum SSH-Schlüssel
|
||||
NAS_HOME="/var/services/homes/$SYNOLOGY_USERNAME" # Angepasstes Home-Verzeichnis auf der NAS
|
||||
dnf install sshpass nfs-utils -y
|
||||
|
||||
#*********************************************************************
|
||||
#echo "SSH KEY wird im System implemntiert..."
|
||||
#sudo ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_synology
|
||||
#echo "SSH KEY wurde Erfolgreich im System implemntiert"
|
||||
#echo "SSH Verbindung wird in die .ssh eingetragen...."
|
||||
#sudo ssh-copy-id -i ~/.ssh/id_rsa_synology.pub ${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}${SYNOLOGY_PASSWORD}
|
||||
#echo "SSH Verbindung wurde Erfolgreich in die .ssh eingetragen !!!"
|
||||
|
||||
|
||||
colourmsg(){
|
||||
echo -e "\033[0;36m$1\033[0m"
|
||||
}
|
||||
# Funktion zum Erstellen eines Ordners mit Unterordnern über SSH mit sshpass
|
||||
create_remote_folders() {
|
||||
|
||||
# SSH-Befehl zum Erstellen des Ordners mit Unterordnern mit sshpass
|
||||
echo sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CSR"
|
||||
sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CSR"
|
||||
echo sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CERT"
|
||||
sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CERT"
|
||||
echo sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/KEY"
|
||||
sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/KEY"
|
||||
echo "Ordner ${REMOTE_DIR}/$HOST_FQDN/ wurde auf ${host} erstellt."
|
||||
}
|
||||
|
||||
# Funktion zum Erstellen von SSH-Schlüsseln
|
||||
generate_ssh_key() {
|
||||
if [ ! -f "$KEY_PATH" ]; then
|
||||
echo "Erstelle SSH-Schlüssel..."
|
||||
ssh-keygen -t rsa -b 4096 -N "" -f "$KEY_PATH"
|
||||
else
|
||||
echo "SSH-Schlüssel existieren bereits."
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion zum Kopieren des öffentlichen Schlüssels zur NAS
|
||||
copy_ssh_key_to_nas() {
|
||||
echo "Kopiere den öffentlichen Schlüssel zur NAS..."
|
||||
#cat ${KEY_PATH}.pub | ssh -o StrictHostKeyChecking=no $SYNOLOGY_USERNAME@$SYNOLOGY_HOST "tee -a $NAS_HOME/.ssh/authorized_keys && chmod 600 $NAS_HOME/.ssh/authorized_keys"
|
||||
cat ${KEY_PATH}.pub | sshpass -p "$SYNOLOGY_PASSWORD" ssh -o StrictHostKeyChecking=no $SYNOLOGY_USERNAME@$SYNOLOGY_HOST "tee -a $NAS_HOME/.ssh/authorized_keys && chmod 600 $NAS_HOME/.ssh/authorized_keys"
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Öffentlicher Schlüssel erfolgreich zur NAS kopiert."
|
||||
else
|
||||
echo "Fehler beim Kopieren des öffentlichen Schlüssels zur NAS."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion zum Kopieren der Datei von der NAS zum lokalen Rechner
|
||||
copy_file_from_nas() {
|
||||
echo "Kopiere die Datei von der NAS zum lokalen Rechner..."
|
||||
scp -i "$KEY_PATH" $SYNOLOGY_USERNAME@SYNOLOGY_HOST:$NAS_HOME "$KEY_PATH"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Datei erfolgreich kopiert."
|
||||
else
|
||||
echo "Fehler beim Kopieren der Datei."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
# Funktion zum Ermitteln des Betriebssystems
|
||||
detect_os() {
|
||||
echo "Das installierte Derivat wird ermittelt...."
|
||||
OS=$(uname -s)
|
||||
|
||||
case $OS in
|
||||
Linux*)
|
||||
# Überprüfen, ob lsb_release verfügbar ist
|
||||
if command -v lsb_release &> /dev/null; then
|
||||
# Verwende lsb_release, wenn es verfügbar ist
|
||||
distro=$(lsb_release -si)
|
||||
version=$(lsb_release -sr)
|
||||
codename=$(lsb_release -sc)
|
||||
else
|
||||
# Überprüfe /etc/os-release
|
||||
if [ -f /etc/os-release ]; then
|
||||
. /etc/os-release
|
||||
distro=$NAME
|
||||
version=$VERSION_ID
|
||||
codename=$VERSION_CODENAME
|
||||
# Überprüfe /etc/lsb-release
|
||||
elif [ -f /etc/lsb-release ]; then
|
||||
. /etc/lsb-release
|
||||
distro=$DISTRIB_ID
|
||||
version=$DISTRIB_RELEASE
|
||||
codename=$DISTRIB_CODENAME
|
||||
# Überprüfe /etc/debian_version
|
||||
elif [ -f /etc/debian_version ]; then
|
||||
distro="Debian"
|
||||
version=$(cat /etc/debian_version)
|
||||
codename=$(uname -r)
|
||||
# Überprüfe /etc/redhat-release
|
||||
elif [ -f /etc/redhat-release ]; then
|
||||
distro=$(cat /etc/redhat-release)
|
||||
version=$(uname -r)
|
||||
codename=$(uname -r)
|
||||
else
|
||||
distro="Unbekannte Distribution"
|
||||
version="Unbekannte Version"
|
||||
codename="Unbekannter Codename"
|
||||
fi
|
||||
fi
|
||||
# Ausgabe der ermittelten Informationen
|
||||
echo "\n\n"
|
||||
echo "Distribution: $distro"
|
||||
echo "Version: $version"
|
||||
echo "Codename: $codename"
|
||||
echo "\n\n"
|
||||
;;
|
||||
*)
|
||||
echo "Unsupported OS: $OS"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "${distro} wurde ....... Ausgewählt......."
|
||||
}
|
||||
install_requierments(){
|
||||
echo "Erstellen des Zertifikatsrequests..."
|
||||
echo " Funktion create_certificate_request() wert der Variable distro: $distro"
|
||||
case $distro in
|
||||
Debian|Ubuntu)
|
||||
echo "" Alle Noetigen Kompomenten werden Installiert....
|
||||
apt install sudo sshpass nfs-common -y
|
||||
;;
|
||||
CentOS)
|
||||
echo "" Alle Noetigen Kompomenten werden Installiert....
|
||||
dnf install sudo sshpass nfs-utils -y
|
||||
;;
|
||||
"Red Hat Enterprise Linux")
|
||||
echo "" Alle Noetigen Kompomenten werden Installiert....
|
||||
dnf install sudo sshpass nfs-utils -y
|
||||
;;
|
||||
*)
|
||||
echo "Das Betriebssystem wird nicht unterstützt für Zertifikatsrequest.";;
|
||||
esac
|
||||
}
|
||||
# Funktion zum Erstellen des Zertifikatsrequests
|
||||
create_certificate_request() {
|
||||
echo "Erstellen des Zertifikatsrequests..."
|
||||
echo " Funktion create_certificate_request() wert der Variable distro: $distro"
|
||||
case $distro in
|
||||
Debian|Ubuntu)
|
||||
apt install sudo sshpass nfs-common -y
|
||||
# Debian / Ubuntu spezifische Pfade
|
||||
#KEY_DIR="/etc/ssl/private/"
|
||||
# Erstellen des privaten Schlüssels
|
||||
openssl genrsa -out "${KEY_DIR}/KEY_${HOST_FQDN}.pem" 4096
|
||||
echo "Privater Schlüssel wurde erstellt: private.key"
|
||||
# CSR erstellen
|
||||
#CSR_DIR="/tmp"
|
||||
openssl req -new -key "${KEY_DIR}/KEY_${HOST_FQDN}.pem" -out "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -subj "/C=DE/ST=TH/L=ILM/O=${O}/OU=${OU}/CN=${HOST_FQDN}/emailAddress=admin@$DOMAIN"
|
||||
echo "Zertifikatsrequest wurde erstellt: request.csr"
|
||||
# CSR anzeigen
|
||||
echo "Inhalt des erstellten Zertifikatsrequests: DEBIAN|UBUNTU......."
|
||||
openssl req -in "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -text -noout
|
||||
;;
|
||||
CentOS)
|
||||
# CentOS spezifische Pfade
|
||||
#KEY_DIR="/etc/pki/tls/private/"
|
||||
# Erstellen des privaten Schlüssels
|
||||
openssl genrsa -out "${KEY_DIR}KEY_${HOST_FQDN}.pem" 4096
|
||||
echo "Privater Schlüssel wurde erstellt und gespeichert unter: ${KEY_DIR}KEY_${HOST_FQDN}.key"
|
||||
# CSR erstellen
|
||||
#CSR_DIR="/tmp"
|
||||
openssl req -new -key "${KEY_DIR}/KEY_${HOST_FQDN}.pem" -out "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -subj "/C=DE/ST=TH/L=ILM/O=HEIMLAN/OU=HEIMLAN/CN=${HOST_FQDN}/emailAddress=admin@$DOMAIN"
|
||||
echo "Zertifikatsrequest wurde erstellt und gespeichert unter: ${CSR_DIR}/CSR_${HOST_FQDN}.csr"
|
||||
# CSR anzeigen
|
||||
echo "Inhalt des erstellten Zertifikatsrequests: CENTOS....."
|
||||
openssl req -in "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -text -noout
|
||||
;;
|
||||
"Red Hat Enterprise Linux")
|
||||
# CentOS spezifische Pfade
|
||||
#KEY_DIR="/etc/pki/tls/private/"
|
||||
# Erstellen des privaten Schlüssels
|
||||
openssl genrsa -out "${KEY_DIR}/KEY_${HOST_FQDN}.pem" 4096
|
||||
echo "Privater Schlüssel wurde erstellt und gespeichert unter: ${KEY_DIR}KEY_${HOST_FQDN}.key"
|
||||
# CSR erstellen
|
||||
#CSR_DIR="/tmp"
|
||||
openssl req -new -key "${KEY_DIR}/KEY_${HOST_FQDN}.pem" -out "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -subj "/C=DE/ST=TH/L=ILM/O=HEIMLAN/OU=HEIMLAN/CN=${HOST_FQDN}/emailAddress=admin@$DOMAIN"
|
||||
echo "Zertifikatsrequest wurde erstellt und gespeichert unter: ${CSR_DIR}/CSR_${HOST_FQDN}.csr"
|
||||
# CSR anzeigen
|
||||
echo "Inhalt des erstellten Zertifikatsrequests: RHEL ....."
|
||||
openssl req -in "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -text -noout
|
||||
;;
|
||||
*)
|
||||
echo "Das Betriebssystem wird nicht unterstützt für Zertifikatsrequest.";;
|
||||
esac
|
||||
}
|
||||
|
||||
# Funktion zum Erstellen des SSH-Schlüsselpaars und Hinzufügen zur Synology
|
||||
setup_ssh_keys() {
|
||||
echo "=== Einrichten von SSH-Schlüsseln ==="
|
||||
|
||||
# Überprüfen, ob der private Schlüssel bereits vorhanden ist
|
||||
if [ ! -f "${SSH_PRIVATE_KEY}" ]; then
|
||||
echo "Erstelle SSH-Schlüsselpaar..."
|
||||
ssh-keygen -t rsa -b 4096 -f "${SSH_PRIVATE_KEY}" -N "" -C "Synology SSH key"
|
||||
echo "SSH-Schlüsselpaar wurde erstellt: ${SSH_PRIVATE_KEY}"
|
||||
else
|
||||
echo "SSH-Schlüsselpaar ist bereits vorhanden: ${SSH_PRIVATE_KEY}"
|
||||
fi
|
||||
|
||||
# SSH-Schlüssel zur Synology hinzufügen
|
||||
echo "Füge den öffentlichen Schlüssel zur Synology hinzu..."
|
||||
ssh-copy-id -i "${SSH_PRIVATE_KEY}.pub" "${SYNOLOGY_USER}@${SYNOLOGY_HOST}"
|
||||
echo "Öffentlicher Schlüssel wurde zur Synology hinzugefügt."
|
||||
}
|
||||
|
||||
# Funktion zum Hochladen des Requests zur Synology
|
||||
upload_certificate_request() {
|
||||
echo "Hochladen des Zertifikatsrequests zur Synology..."
|
||||
# Mounten der NFS-Freigabe mit Benutzername und Passwort
|
||||
sudo mkdir -p ${NFS_MOUNT}
|
||||
echo "sudo mkdir $NFS_MOUNT"
|
||||
#sudo mkdir -p ${NFS_MOUNT}
|
||||
#sleep 10
|
||||
#ls /mnt/CSR/
|
||||
#sudo mount -t nfs -o username="${SYNOLOGY_USER}",password="${SYNOLOGY_PASSWORD}" "${SYNOLOGY_HOST}:${REMOTE_DIR}/$HOST_NORMAL/CSR" "${NFS_MOUNT}"
|
||||
sudo mount -t nfs -o nfsvers=3 "${SYNOLOGY_HOST}:${REMOTE_DIR}" "${NFS_MOUNT}"
|
||||
ls -lha /mnt/CSR/
|
||||
#echo "TEST WARTE ZEIT 30 SEKUNDEN......"
|
||||
#sleep 30
|
||||
# Überprüfen, ob das Mount erfolgreich war
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "NFS-Freigabe erfolgreich eingebunden: ${NFS_MOUNT}"
|
||||
# Kopieren der Datei auf die NFS-Freigabe
|
||||
ls -lha /mnt/CSR/
|
||||
sleep 5
|
||||
sudo cp "${CSR_DIR}/CSR_${HOST_FQDN}.csr" "${NFS_MOUNT}/${HOST_FQDN}/CSR/"
|
||||
sudo cp "${KEY_DIR}/KEY_${HOST_FQDN}.pem" "${NFS_MOUNT}/${HOST_FQDN}/KEY/"
|
||||
sleep 5
|
||||
ls -lha /mnt/CSR/
|
||||
echo "Datei erfolgreich auf die NFS-Freigabe hochgeladen."
|
||||
#echo "2. TEST WARTE ZEIT 30 SEKUNDEN......"
|
||||
#sleep 30
|
||||
else
|
||||
echo "Fehler beim Einbinden der NFS-Freigabe: ${NFS_MOUNT}"
|
||||
fi
|
||||
echo "Zertifikatsrequest wurde zur Synology hochgeladen."
|
||||
}
|
||||
umountNFS(){
|
||||
# NFS-Freigabe wieder aushängen
|
||||
sudo umount "${NFS_MOUNT}"
|
||||
cd /mnt
|
||||
rmdir CSR/
|
||||
echo "NFS-Freigabe erfolgreich ausgehängt."
|
||||
}
|
||||
# Funktion zum Herunterladen von Root-Zertifikat, Sub-CA-Zertifikat und Server-Zertifikat
|
||||
download_certificates() {
|
||||
echo "Herunterladen von Root-Zertifikat, Sub-CA-Zertifikat und Server-Zertifikat..."
|
||||
echo "=== Überprüfen und Herunterladen der Datei von der Synology ==="
|
||||
|
||||
# SSH-Befehl, um die Existenz der Datei auf der Synology zu überprüfen
|
||||
ssh -i "$KEY_PATH" "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" test -f "${REMOTE_DIR}/${HOST_FQDN}/CERT/$SERVER_CERT"
|
||||
|
||||
# Prüfen des Rückgabewerts von test (-f) und Entscheidung treffen
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Datei CERT_${HOST_FQDN}.crt auf der Synology gefunden. Beginne mit dem Download..."
|
||||
cp "${NFS_MOUNT}/${HOST_FQDN}/CERT/$SERVER_CERT" "${TMP}/$SERVER_CERT"
|
||||
cp "${NFS_MOUNT}/RootCA/$ROOT_CERT" "${TMP}/$ROOT_CERT"
|
||||
cp "${NFS_MOUNT}/SubCA/$SUBCA_CERT" "${TMP}/$SUBCA_CERT"
|
||||
echo "Datei erfolgreich heruntergeladen nach ${TMP}"
|
||||
else
|
||||
#echo "Datei $SERVER_CERT nicht auf der Synology gefunden. Warte 300 Sekunden..."
|
||||
#sleep 300
|
||||
echo "Datei $SERVER_CERT nicht auf der Synology gefunden. Warte 300 Sekunden..."
|
||||
|
||||
# Timer mit Countdown anzeigen
|
||||
for ((i=300; i>0; i--)); do
|
||||
echo -ne "Noch $i Sekunden warten...\r"
|
||||
sleep 1
|
||||
done
|
||||
echo
|
||||
download_certificates # Rekursiver Aufruf, um erneut zu prüfen
|
||||
fi
|
||||
echo "Zertifikate wurden heruntergeladen."
|
||||
}
|
||||
|
||||
# Funktion zum Erstellen des Full-Chain-Zertifikats und Umbenennen
|
||||
create_fullchain_certificate() {
|
||||
echo "Erstellen des Full-Chain-Zertifikats..."
|
||||
# Zielpfad für das Full-Chain-Zertifikat
|
||||
FULLCHAIN_CERT="/tmp/fullchain.crt"
|
||||
|
||||
# Full-Chain-Zertifikat erstellen
|
||||
cat "$TMP/$SERVER_CERT" "$TMP/$SUBCA_CERT" "$TMP/$ROOT_CERT" > "$FULLCHAIN_CERT"
|
||||
|
||||
echo "Full-Chain-Zertifikat wurde erstellt: $FULLCHAIN_CERT"
|
||||
|
||||
# Server-Zertifikat nach Hostnamen benennen
|
||||
HOSTNAME=$(hostname)
|
||||
mv "$FULLCHAIN_CERT" "$TMP/fullchain_$HOST_FQDN.crt"
|
||||
|
||||
echo "Full-Chain-Zertifikat umbenannt zu fullchain_$HOST_FQDN.crt"
|
||||
}
|
||||
|
||||
# Funktion zum Kopieren der Zertifikate in die richtigen Pfade je nach Derivat und Typ
|
||||
copy_certificates() {
|
||||
echo "Kopieren der Zertifikate in die richtigen Pfade..."
|
||||
|
||||
case $distro in
|
||||
Debian|Ubuntu)
|
||||
# Debian / Ubuntu spezifische Pfade
|
||||
SSL_DIR="/usr/local/share/ca-certificates/"
|
||||
KEY_STORE="usr/local/share/ca-certificates/"
|
||||
# Root-Zertifikat kopieren
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR/$ROOT_CERT"
|
||||
# Sub-CA-Zertifikat kopieren
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR/$SUBCA_CERT"
|
||||
# Server-Zertifikat kopieren
|
||||
cp "$TMP/$SERVER_CERT" "$SSL_DIR/$SERVER_CERT"
|
||||
# Server Key kopieren
|
||||
cp "$TMP/KEY_${HOST_FQDN}.pem" "$KEY_STORE/KEY_${HOST_FQDN}.pem"
|
||||
echo "Zertifikate wurden nach $SSL_DIR kopiert."
|
||||
update-ca-certificates
|
||||
;;
|
||||
CentOS|"Red Hat Enterprise Linux")
|
||||
# CentOS spezifische Pfade
|
||||
SSL_DIR="/etc/pki/tls/certs/"
|
||||
KEY_STORE="etc/pki/tls/private/"
|
||||
PKI_DIR="/etc/pki/ca-trust/source/anchors/"
|
||||
# Root-Zertifikat kopieren
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR/$ROOT_CERT"
|
||||
cp "$TMP/$ROOT_CERT" "$PKI_DIR/$ROOT_CERT"
|
||||
# Sub-CA-Zertifikat kopieren
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR/$SUBCA_CERT"
|
||||
cp "$TMP/$SUBCA_CERT" "$PKI_DIR/$SUBCA_CERT"
|
||||
# Server-Zertifikat kopieren
|
||||
cp "$TMP/$SERVER_CERT" "$SSL_DIR/$SERVER_CERT"
|
||||
cp "$TMP/$SERVER_CERT" "$PKI_DIR/$SERVER_CERT"
|
||||
# Server Key kopieren
|
||||
cp "$TMP/KEY_${HOST_FQDN}.pem" "$KEY_STORE/KEY_${HOST_FQDN}.pem"
|
||||
echo "Zertifikate wurden nach $SSL_DIR und nach $PKI_DIR kopiert."
|
||||
update-ca-trust
|
||||
;;
|
||||
*)
|
||||
echo "Das Betriebssystem $OS wird nicht unterstützt für Zertifikate-Kopieren."
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Funktion zum Kopieren der Zertifikate in die richtigen Pfade je nach WebServer Ty
|
||||
copy_web_certificates() {
|
||||
echo "Kopieren der Zertifikate in die richtigen Pfade und Aktualisieren der Konfigurationsdateien..."
|
||||
|
||||
case $distro in
|
||||
Debian|Ubuntu)
|
||||
# Debian / Ubuntu spezifische Pfade
|
||||
SSL_DIR_APACHE="/etc/ssl/certs/"
|
||||
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||
|
||||
# Prüfen, ob Apache installiert ist und den SSL-Pfad anpassen
|
||||
if [ -f "/etc/apache2/apache2.conf" ]; then
|
||||
SSL_DIR_APACHE="/etc/apache2/ssl/"
|
||||
fi
|
||||
|
||||
# Prüfen, ob Nginx installiert ist und den SSL-Pfad anpassen
|
||||
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||
fi
|
||||
|
||||
# Root-Zertifikat kopieren
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR_APACHE/$ROOT_CERT"
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR_NGINX/$ROOT_CERT"
|
||||
# Sub-CA-Zertifikat kopieren
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_APACHE/$SUBCA_CERT"
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_NGINX/$SUBCA_CERT"
|
||||
# Server-Zertifikat kopieren
|
||||
cp "$TMP/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_CERT"
|
||||
cp "$TMP/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_CERT"
|
||||
|
||||
echo "Zertifikate wurden nach $SSL_DIR_APACHE und $SSL_DIR_NGINX kopiert."
|
||||
|
||||
# Aktualisieren der Apache-Konfiguration, falls vorhanden
|
||||
if [ -f "/etc/apache2/apache2.conf" ]; then
|
||||
update_apache_config "$SSL_DIR_APACHE/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_KEY"
|
||||
fi
|
||||
|
||||
# Aktualisieren der Nginx-Konfiguration, falls vorhanden
|
||||
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||
update_nginx_config "$SSL_DIR_NGINX/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_KEY"
|
||||
fi
|
||||
;;
|
||||
CentOS|"Red Hat Enterprise Linux")
|
||||
# CentOS spezifische Pfade
|
||||
SSL_DIR_APACHE="/etc/pki/tls/certs/"
|
||||
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||
|
||||
# Prüfen, ob Apache installiert ist und den SSL-Pfad anpassen
|
||||
if [ -f "/etc/httpd/conf/httpd.conf" ]; then
|
||||
SSL_DIR_APACHE="/etc/httpd/ssl/"
|
||||
fi
|
||||
|
||||
# Prüfen, ob Nginx installiert ist und den SSL-Pfad anpassen
|
||||
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||
fi
|
||||
|
||||
# Root-Zertifikat kopieren
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR_APACHE/$ROOT_CERT"
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR_NGINX/$ROOT_CERT"
|
||||
# Sub-CA-Zertifikat kopieren
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_APACHE/$SUBCA_CERT"
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_NGINX/$SUBCA_CERT"
|
||||
# Server-Zertifikat kopieren
|
||||
cp "$TMP/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_CERT"
|
||||
cp "$TMP/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_CERT"
|
||||
|
||||
echo "Zertifikate wurden nach $SSL_DIR_APACHE und $SSL_DIR_NGINX kopiert."
|
||||
|
||||
# Aktualisieren der Apache-Konfiguration, falls vorhanden
|
||||
if [ -f "/etc/httpd/conf/httpd.conf" ]; then
|
||||
update_apache_config "$SSL_DIR_APACHE/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_KEY"
|
||||
fi
|
||||
|
||||
# Aktualisieren der Nginx-Konfiguration, falls vorhanden
|
||||
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||
update_nginx_config "$SSL_DIR_NGINX/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_KEY"
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
echo "Es ist kein WEbServer auf diesen System Installiert"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Funktion zum Aktualisieren der Apache-Konfiguration
|
||||
update_apache_config() {
|
||||
local cert_file="$1"
|
||||
local key_file="$2"
|
||||
|
||||
echo "Aktualisiere Apache-Konfiguration für SSL-Zertifikate..."
|
||||
|
||||
# Konfigurationsdatei für SSL-Zertifikate finden und bearbeiten
|
||||
local apache_config_file=$(find /etc/apache2 -name "ssl.conf" -o -name "httpd.conf" 2>/dev/null | head -1)
|
||||
if [ -n "$apache_config_file" ]; then
|
||||
# SSLCertificateFile aktualisieren
|
||||
sed -i "s|^\( *SSLCertificateFile *\).*|\1$cert_file|" "$apache_config_file"
|
||||
# SSLCertificateKeyFile aktualisieren
|
||||
sed -i "s|^\( *SSLCertificateKeyFile *\).*|\1$key_file|" "$apache_config_file"
|
||||
echo "Apache-Konfiguration aktualisiert."
|
||||
else
|
||||
echo "Apache-Konfigurationsdatei nicht gefunden oder nicht aktualisiert."
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion zum Aktualisieren der Nginx-Konfiguration
|
||||
update_nginx_config() {
|
||||
local cert_file="$1"
|
||||
local key_file="$2"
|
||||
|
||||
echo "Aktualisiere Nginx-Konfiguration für SSL-Zertifikate..."
|
||||
|
||||
# Konfigurationsdatei für SSL-Zertifikate finden und bearbeiten
|
||||
local nginx_config_file="/etc/nginx/nginx.conf"
|
||||
if [ -f "$nginx_config_file" ]; then
|
||||
# SSL Zertifikat und Key aktualisieren
|
||||
sed -i "s|^\( *ssl_certificate *\).*|\1$cert_file;|" "$nginx_config_file"
|
||||
sed -i "s|^\( *ssl_certificate_key *\).*|\1$key_file;|" "$nginx_config_file"
|
||||
echo "Nginx-Konfiguration aktualisiert."
|
||||
else
|
||||
echo "Nginx-Konfigurationsdatei nicht gefunden oder nicht aktualisiert."
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion zum Ermitteln des installierten Webserver-Dienstes
|
||||
detect_webserver() {
|
||||
if [ -f "/etc/apache2/apache2.conf" ]; then
|
||||
echo "Apache Webserver ist installiert."
|
||||
fi
|
||||
if [ -f "/etc/httpd/conf/httpd.conf" ]; then
|
||||
echo "Apache Webserver ist installiert."
|
||||
fi
|
||||
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||
echo "Nginx Webserver ist installiert."
|
||||
fi
|
||||
}
|
||||
|
||||
echo
|
||||
# Hauptprogramm
|
||||
detect_os
|
||||
install_requierments
|
||||
generate_ssh_key
|
||||
copy_ssh_key_to_nas
|
||||
create_certificate_request
|
||||
create_remote_folders
|
||||
#Wird nicht genutz
|
||||
#setup_ssh_keys
|
||||
upload_certificate_request
|
||||
download_certificates
|
||||
create_fullchain_certificate
|
||||
copy_certificates
|
||||
|
||||
# Funktionen fue WebServer Zertifiakte
|
||||
detect_webserver
|
||||
copy_web_certificates
|
||||
#umountNFS
|
||||
echo "Prozess abgeschlossen."
|
||||
Binary file not shown.
Executable
+177
@@ -0,0 +1,177 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Globale Variablen
|
||||
#HOSTNAME=$(hostname -f | tr '[:lower:]' '[:upper:]') # FQDN in Großbuchstaben
|
||||
HOSTNAME=$(hostname -f)
|
||||
NETBIOS=$(hostname)
|
||||
DOMAIN=$(hostname -d | cut -d'.' -f1 | tr '[:lower:]' '[:upper:]') # Kurze Domain in Großbuchstaben
|
||||
REALM="${DOMAIN^^}.HEIM.LAN" # Realm in Großbuchstaben, muss die gesamte Domain sein
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}')
|
||||
PASSWORD="P@ssw0rd" # Globale Variable für das Administrator-Passwort
|
||||
ERROR_LOG="/var/log/samba_install_error.log"
|
||||
|
||||
# Zertifikat-Pfade
|
||||
tls_keyfile="/etc/samba/tls/private/KEY_${HOSTNAME}.pem"
|
||||
tls_certfile="/etc/samba/tls/certs/fullchain_${HOSTNAME}.crt"
|
||||
tls_cafile="/etc/samba/tls/certs/CERT_HEIMLAN_SubCA.crt"
|
||||
|
||||
# ROOT and SubCa
|
||||
ROOT_CRT="CERT_HEIMLAN_RootCA.crt"
|
||||
SUBCA_CRT="CERT_HEIMLAN_SubCA.crt"
|
||||
# Funktion zum Beenden des Skripts bei einem Fehler
|
||||
error_exit() {
|
||||
echo "$1" | tee -a $ERROR_LOG
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Funktion zum Kopieren der Zertifikate und Schlüssel in das entsprechende Verzeichnis
|
||||
copy_certs_key() {
|
||||
mkdir -p /etc/samba/tls/certs /etc/samba/tls/private || error_exit "Fehler beim Erstellen der Verzeichnisse für Zertifikate und Schlüssel"
|
||||
|
||||
# Kopieren der Zertifikate und Schlüssel
|
||||
cp /tmp/$ROOT_CRT /etc/samba/tls/certs || error_exit "Fehler beim Kopieren des Zertifikats"
|
||||
cp /tmp/$SUBCA_CRT /etc/samba/tls/certs || error_exit "Fehler beim Kopieren des Zertifikats"
|
||||
cp /tmp/CERT_${HOSTNAME}.crt /etc/samba/tls/certs || error_exit "Fehler beim Kopieren des Zertifikats"
|
||||
cp /tmp/fullchain_${HOSTNAME}.crt /etc/samba/tls/certs || error_exit "Fehler beim Kopieren des Fullchain-Zertifikats"
|
||||
cp /tmp/KEY_${HOSTNAME}.pem /etc/samba/tls/private || error_exit "Fehler beim Kopieren des Schlüssels"
|
||||
|
||||
# Setzen der Berechtigungen
|
||||
chmod 644 /etc/samba/tls/certs/* || error_exit "Fehler beim Setzen der Berechtigungen für Zertifikate"
|
||||
chmod 600 /etc/samba/tls/private/* || error_exit "Fehler beim Setzen der Berechtigungen für Schlüssel"
|
||||
}
|
||||
|
||||
# Funktion zum Aktualisieren und Installieren von Paketen
|
||||
install_packages() {
|
||||
apt-get update || error_exit "Fehler beim Ausführen von apt-get update"
|
||||
apt-get upgrade -y || error_exit "Fehler beim Ausführen von apt-get upgrade"
|
||||
apt-get install -y samba samba-common-bin krb5-user krb5-config winbind libnss-winbind libpam-winbind dnsutils bind9 bind9utils bind9-doc || error_exit "Fehler beim Installieren der Pakete"
|
||||
}
|
||||
|
||||
# Funktion zum Sichern von Konfigurationsdateien
|
||||
backup_configs() {
|
||||
[ -f /etc/samba/smb.conf ] && mv /etc/samba/smb.conf /etc/samba/smb.conf.orig || error_exit "Fehler beim Sichern der smb.conf"
|
||||
[ -f /etc/krb5.conf ] && mv /etc/krb5.conf /etc/krb5.conf.orig || error_exit "Fehler beim Sichern der krb5.conf"
|
||||
}
|
||||
|
||||
# Funktion zum Erstellen der Samba-Konfiguration
|
||||
create_samba_config() {
|
||||
cat <<EOL > /etc/samba/smb.conf || error_exit "Fehler beim Schreiben der smb.conf"
|
||||
[global]
|
||||
workgroup = $DOMAIN
|
||||
bind interfaces only = Yes
|
||||
interfaces = $IP_ADDRESS
|
||||
realm = $REALM
|
||||
netbios name = $NETBIOS
|
||||
server role = active directory domain controller
|
||||
idmap_ldb:use rfc2307 = yes
|
||||
server services = -dns
|
||||
|
||||
# TLS SETTING
|
||||
tls enabled = yes
|
||||
tls keyfile = $tls_keyfile
|
||||
tls certfile = $tls_certfile
|
||||
tls cafile = $tls_cafile
|
||||
|
||||
# LOGGING SETTING
|
||||
log level = 1
|
||||
log file = /var/log/samba/log.%m
|
||||
max log size = 1000
|
||||
|
||||
# UNIX PASSWORD SETTING
|
||||
unix password sync = yes
|
||||
|
||||
[sysvol]
|
||||
path = /var/lib/samba/sysvol
|
||||
read only = no
|
||||
|
||||
[netlogon]
|
||||
path = /var/lib/samba/sysvol/${DOMAIN}/scripts
|
||||
read only = no
|
||||
EOL
|
||||
}
|
||||
|
||||
# Funktion zum Erstellen der Kerberos-Konfiguration
|
||||
create_kerberos_config() {
|
||||
cat <<EOL > /etc/krb5.conf || error_exit "Fehler beim Schreiben der krb5.conf"
|
||||
[libdefaults]
|
||||
default_realm = $REALM
|
||||
dns_lookup_realm = true
|
||||
dns_lookup_kdc = true
|
||||
ticket_lifetime = 24h
|
||||
renew_lifetime = 7d
|
||||
forwardable = true
|
||||
|
||||
[realms]
|
||||
$REALM = {
|
||||
default_domain = $(hostname -d)
|
||||
# pkinit_anchors = /etc/samba/tls/certs/CERT_HEIMLAN_Root.crt
|
||||
kdc = $(hostname -f)
|
||||
admin_server = $(hostname -f)
|
||||
}
|
||||
|
||||
[domain_realm]
|
||||
.$(hostname -d) = $REALM
|
||||
$(hostname -d) = $REALM
|
||||
EOL
|
||||
}
|
||||
|
||||
# Funktion zum Provisionieren von Samba
|
||||
provision_samba() {
|
||||
samba-tool domain provision --use-rfc2307 --realm=$REALM --domain=${DOMAIN} --server-role=dc --adminpass=$PASSWORD --dns-backend=BIND9_DLZ || error_exit "Fehler beim Provisionieren der Samba-Domäne"
|
||||
}
|
||||
|
||||
# Funktion zum Konfigurieren von Bind9 für DLZ
|
||||
configure_bind9() {
|
||||
cp /etc/bind/named.conf.options /etc/bind/named.conf.options.orig || error_exit "Fehler beim Sichern der named.conf.options"
|
||||
cp /etc/bind/named.conf.local /etc/bind/named.conf.local.orig || error_exit "Fehler beim Sichern der named.conf.local"
|
||||
|
||||
cat <<EOL > /etc/bind/named.conf.options || error_exit "Fehler beim Schreiben der named.conf.options"
|
||||
options {
|
||||
directory "/var/cache/bind";
|
||||
|
||||
forwarders {
|
||||
8.8.8.8; # Google DNS
|
||||
};
|
||||
|
||||
dnssec-validation auto;
|
||||
auth-nxdomain no; # conform to RFC1035
|
||||
listen-on-v6 { any; };
|
||||
};
|
||||
EOL
|
||||
|
||||
cat <<EOL > /etc/bind/named.conf.local || error_exit "Fehler beim Schreiben der named.conf.local"
|
||||
include "/var/lib/samba/bind-dns/named.conf";
|
||||
EOL
|
||||
}
|
||||
|
||||
# Funktion zum Setzen der Berechtigungen für Bind9 DLZ
|
||||
set_bind9_permissions() {
|
||||
mkdir /var/lib/samba/private/dns
|
||||
chown bind:bind /var/lib/samba/bind-dns/named.conf || error_exit "Fehler beim Setzen der Berechtigungen für named.conf"
|
||||
chown -R bind:bind /var/lib/samba/private/dns || error_exit "Fehler beim Setzen der Berechtigungen für das DNS-Verzeichnis"
|
||||
}
|
||||
|
||||
# Funktion zum Neustarten der Dienste
|
||||
restart_services() {
|
||||
systemctl restart smbd nmbd winbind bind9 || error_exit "Fehler beim Neustarten der Dienste"
|
||||
systemctl enable smbd nmbd winbind bind9 || error_exit "Fehler beim Aktivieren der Dienste"
|
||||
|
||||
}
|
||||
|
||||
# Hauptfunktion zum Ausführen aller Schritte
|
||||
main() {
|
||||
copy_certs_key
|
||||
install_packages
|
||||
backup_configs
|
||||
create_samba_config
|
||||
create_kerberos_config
|
||||
provision_samba
|
||||
configure_bind9
|
||||
set_bind9_permissions
|
||||
restart_services
|
||||
|
||||
echo "Samba AD DC mit Bind9-DLZ Installation abgeschlossen."
|
||||
}
|
||||
|
||||
# Ausführen der Hauptfunktion
|
||||
main
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
+141
@@ -0,0 +1,141 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablenblock
|
||||
NEXTCLOUD_VERSION="29.0.7"
|
||||
DB_NAME="nextcloud"
|
||||
DB_USER="nextclouduser"
|
||||
DB_PASSWORD=$(openssl rand -base64 32)
|
||||
DB_ROOT_PASSWORD=$(openssl rand -base64 32)
|
||||
NEXTCLOUD_DIR="/var/www/nextcloud"
|
||||
SSL_CERT_FILE="/etc/ssl/certs/nextcloud-cert.pem"
|
||||
SSL_KEY_FILE="/etc/ssl/private/nextcloud-key.pem"
|
||||
DOMAIN="nextcloud.example.com"
|
||||
APACHE_CONF="/etc/apache2/sites-available/nextcloud.conf"
|
||||
|
||||
# Funktion: Update und Installiere benötigte Pakete
|
||||
install_dependencies() {
|
||||
echo "System aktualisieren und benötigte Pakete installieren..."
|
||||
apt update && apt upgrade -y
|
||||
apt install -y apache2 mariadb-server libapache2-mod-php php php-mysql php-xml php-mbstring php-zip php-gd php-curl php-intl php-bcmath php-imagick php-gmp php-apcu unzip wget curl
|
||||
}
|
||||
|
||||
# Funktion: MariaDB konfigurieren
|
||||
configure_mariadb() {
|
||||
echo "MariaDB einrichten..."
|
||||
systemctl start mariadb
|
||||
systemctl enable mariadb
|
||||
|
||||
mysql -e "CREATE DATABASE ${DB_NAME};"
|
||||
mysql -e "CREATE USER '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASSWORD}';"
|
||||
mysql -e "GRANT ALL PRIVILEGES ON ${DB_NAME}.* TO '${DB_USER}'@'localhost';"
|
||||
mysql -e "FLUSH PRIVILEGES;"
|
||||
|
||||
# Root Passwort setzen
|
||||
mysqladmin -u root password "${DB_ROOT_PASSWORD}"
|
||||
}
|
||||
|
||||
# Funktion: SSL-Zertifikate konfigurieren
|
||||
configure_ssl() {
|
||||
echo "SSL Zertifikate konfigurieren..."
|
||||
if [[ ! -f "$SSL_CERT_FILE" || ! -f "$SSL_KEY_FILE" ]]; then
|
||||
echo "SSL-Zertifikate nicht gefunden, bitte überprüfen!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
a2enmod ssl
|
||||
systemctl restart apache2
|
||||
}
|
||||
|
||||
# Funktion: Nextcloud herunterladen und installieren
|
||||
install_nextcloud() {
|
||||
echo "Nextcloud herunterladen und installieren..."
|
||||
wget https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.zip
|
||||
unzip nextcloud-${NEXTCLOUD_VERSION}.zip -d /var/www/
|
||||
chown -R www-data:www-data ${NEXTCLOUD_DIR}
|
||||
chmod -R 755 ${NEXTCLOUD_DIR}
|
||||
}
|
||||
|
||||
# Funktion: Apache konfigurieren
|
||||
configure_apache() {
|
||||
echo "Apache für Nextcloud konfigurieren..."
|
||||
|
||||
cat <<EOF > ${APACHE_CONF}
|
||||
<VirtualHost *:80>
|
||||
ServerAdmin admin@${DOMAIN}
|
||||
DocumentRoot ${NEXTCLOUD_DIR}
|
||||
ServerName ${DOMAIN}
|
||||
|
||||
<Directory ${NEXTCLOUD_DIR}>
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ErrorLog \${APACHE_LOG_DIR}/error.log
|
||||
CustomLog \${APACHE_LOG_DIR}/access.log combined
|
||||
|
||||
RewriteEngine on
|
||||
RewriteCond %{SERVER_NAME} =${DOMAIN}
|
||||
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
|
||||
</VirtualHost>
|
||||
|
||||
<VirtualHost *:443>
|
||||
ServerAdmin admin@${DOMAIN}
|
||||
DocumentRoot ${NEXTCLOUD_DIR}
|
||||
ServerName ${DOMAIN}
|
||||
|
||||
<Directory ${NEXTCLOUD_DIR}>
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile ${SSL_CERT_FILE}
|
||||
SSLCertificateKeyFile ${SSL_KEY_FILE}
|
||||
|
||||
ErrorLog \${APACHE_LOG_DIR}/error.log
|
||||
CustomLog \${APACHE_LOG_DIR}/access.log combined
|
||||
</VirtualHost>
|
||||
EOF
|
||||
|
||||
a2ensite nextcloud.conf
|
||||
a2enmod rewrite headers env dir mime
|
||||
systemctl restart apache2
|
||||
}
|
||||
|
||||
# Funktion: Nextcloud über die Kommandozeile initialisieren
|
||||
initialize_nextcloud() {
|
||||
echo "Nextcloud initialisieren..."
|
||||
|
||||
sudo -u www-data php ${NEXTCLOUD_DIR}/occ maintenance:install \
|
||||
--database "mysql" \
|
||||
--database-name "${DB_NAME}" \
|
||||
--database-user "${DB_USER}" \
|
||||
--database-pass "${DB_PASSWORD}" \
|
||||
--admin-user "admin" \
|
||||
--admin-pass "$(openssl rand -base64 16)"
|
||||
|
||||
sudo -u www-data php ${NEXTCLOUD_DIR}/occ config:system:set trusted_domains 0 --value="${DOMAIN}"
|
||||
sudo -u www-data php ${NEXTCLOUD_DIR}/occ config:system:set overwrite.cli.url --value="https://${DOMAIN}/"
|
||||
}
|
||||
|
||||
# Funktion: Firewall konfigurieren
|
||||
configure_firewall() {
|
||||
echo "Firewall konfigurieren..."
|
||||
ufw allow in "Apache Full"
|
||||
ufw enable
|
||||
}
|
||||
|
||||
# Installation starten
|
||||
main() {
|
||||
install_dependencies
|
||||
configure_mariadb
|
||||
configure_ssl
|
||||
install_nextcloud
|
||||
configure_apache
|
||||
initialize_nextcloud
|
||||
configure_firewall
|
||||
echo "Installation abgeschlossen. Besuchen Sie https://${DOMAIN}, um Ihre Nextcloud-Instanz zu nutzen."
|
||||
}
|
||||
|
||||
# Skript starten
|
||||
main
|
||||
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Executable
+87
@@ -0,0 +1,87 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit on any error
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
||||
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
||||
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
||||
DNS_FORWARDER="192.168.1.1" # Externer DNS-Forwarder (Google in diesem Fall)
|
||||
EXTERNAL_CA="true" # Setzt das Skript auf externe CA
|
||||
PASSWORD="P@ssw0rd1234" # Admin-Passwort (in der Praxis sicher speichern)
|
||||
DIRMAN_PASSWORD="P@ssw0rd12345" # Directory Manager Passwort
|
||||
|
||||
# Function to check if running as root
|
||||
function check_root {
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo "Dieses Skript muss als Root ausgeführt werden!" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to install the necessary packages
|
||||
function install_packages {
|
||||
echo "Installiere benötigte Pakete..."
|
||||
# System aktualisieren
|
||||
echo "Aktualisiere das System..."
|
||||
sudo yum update -y
|
||||
|
||||
# Erforderliche Pakete installieren
|
||||
echo "Installiere erforderliche Pakete..."
|
||||
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
sudo dnf -y install @idm:DL1
|
||||
|
||||
# Erforderliche Pakete installieren
|
||||
echo "Installiere erforderliche Pakete..."
|
||||
sudo yum install -y ipa-server ipa-server-dns
|
||||
}
|
||||
|
||||
# Function to install the IDM server
|
||||
function install_idm_server {
|
||||
echo "Installiere IdM-Server mit DNS..."
|
||||
|
||||
# Falls externe CA genutzt werden soll, aber keine eigene CA installiert wird
|
||||
if [ "$EXTERNAL_CA" = "true" ]; then
|
||||
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
||||
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
||||
--ip-address=$IP_ADDRESS --no-pkinit --external-ca \
|
||||
--setup-dns --auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U
|
||||
else
|
||||
# Für den Fall, dass keine externe CA genutzt wird, aber dennoch ohne CA gearbeitet wird
|
||||
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
||||
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
||||
--ip-address=$IP_ADDRESS --no-pkinit --setup-dns \
|
||||
--auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to configure firewall
|
||||
function configure_firewall {
|
||||
echo "Konfiguriere Firewall..."
|
||||
firewall-cmd --add-service=freeipa-ldap --permanent
|
||||
firewall-cmd --add-service=freeipa-ldaps --permanent
|
||||
firewall-cmd --add-service=freeipa-replication --permanent
|
||||
firewall-cmd --add-service=freeipa-trust --permanent
|
||||
firewall-cmd --add-service=dns --permanent
|
||||
firewall-cmd --add-port=88/tcp --permanent # Kerberos
|
||||
firewall-cmd --add-port=88/udp --permanent # Kerberos
|
||||
firewall-cmd --add-port=464/tcp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=464/udp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=123/udp --permanent # NTP
|
||||
firewall-cmd --reload
|
||||
}
|
||||
|
||||
# Main function
|
||||
function main {
|
||||
check_root
|
||||
install_packages
|
||||
install_idm_server
|
||||
configure_firewall
|
||||
echo "IdM-Server Installation abgeschlossen."
|
||||
}
|
||||
|
||||
# Run the script
|
||||
main
|
||||
+556
@@ -0,0 +1,556 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
POSTGRES_USER=alfresco
|
||||
POSTGRES_PASSWORD=alfresco
|
||||
POSTGRES_DB=alfresco
|
||||
|
||||
JAVA_HOME=/usr/lib/jvm/java-17-openjdk
|
||||
TOMCAT_VERSION=10.1.26
|
||||
TOMCAT_USER=rheluser
|
||||
TOMCAT_GROUP=rheluser
|
||||
TOMCAT_HOME=/home/rheluser/tomcat
|
||||
|
||||
ACTIVEMQ_VERSION=5.18.5
|
||||
ACTIVEMQ_USER=rheluser
|
||||
ACTIVEMQ_GROUP=rheluser
|
||||
ACTIVEMQ_HOME=/home/rheluser/activemq
|
||||
|
||||
SOLR_VERSION=2.0.9.1
|
||||
SOLR_USER=rheluser
|
||||
SOLR_GROUP=rheluser
|
||||
SOLR_HOME=/home/rheluser/alfresco-search-services
|
||||
|
||||
TRANSFORM_JAR=alfresco-transform-core-aio-5.1.0.jar
|
||||
TRANSFORM_USER=rheluser
|
||||
TRANSFORM_GROUP=rheluser
|
||||
TRANSFORM_HOME=/home/rheluser/transform
|
||||
|
||||
NODEJS_SETUP_URL="/root/RHEL_full_install_alfresco_addon.sh"
|
||||
CONTENT_APP_REPO=https://github.com/Alfresco/alfresco-content-app.git
|
||||
CONTENT_APP_VERSION=4.4.1
|
||||
NGINX_CONF_PATH=/etc/nginx/conf.d/alfresco-content-app.conf
|
||||
NGINX_ROOT=/var/www/alfresco-content-app
|
||||
|
||||
# Helper function to print and execute commands
|
||||
execute() {
|
||||
echo "$ $@"
|
||||
"$@"
|
||||
}
|
||||
# Anlegen des Users und Gruppe
|
||||
user_add_and_group(){
|
||||
execute sudo groupadd rheluser
|
||||
execute sudo useradd -m -g rheluser rheluser
|
||||
}
|
||||
|
||||
# Update and upgrade the system
|
||||
00_update_system() {
|
||||
echo "Updating system..."
|
||||
execute sudo dnf update -y
|
||||
}
|
||||
|
||||
# Install PostgreSQL and configure database
|
||||
01_install_postgresql() {
|
||||
echo "Installing PostgreSQL..."
|
||||
execute sudo dnf install -y postgresql-server postgresql-contrib
|
||||
|
||||
echo "Initializing PostgreSQL database..."
|
||||
execute sudo postgresql-setup --initdb
|
||||
|
||||
echo "Configuring PostgreSQL..."
|
||||
execute sudo sed -i 's/local\s\+all\s\+postgres\s\+peer/local all postgres trust/' /var/lib/pgsql/data/pg_hba.conf
|
||||
execute sudo sed -i 's/local\s\+all\s\+all\s\+peer/local all all md5/' /var/lib/pgsql/data/pg_hba.conf
|
||||
|
||||
echo "Starting PostgreSQL service..."
|
||||
execute sudo systemctl start postgresql
|
||||
execute sudo systemctl enable postgresql
|
||||
|
||||
echo "Configuring Alfresco database..."
|
||||
execute sudo -u postgres psql -c "CREATE USER ${POSTGRES_USER} WITH PASSWORD '$POSTGRES_PASSWORD';"
|
||||
execute sudo -u postgres psql -c "CREATE DATABASE ${POSTGRES_DB} OWNER ${POSTGRES_USER} ENCODING 'UTF8';"
|
||||
execute sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE ${POSTGRES_DB} TO ${POSTGRES_USER};"
|
||||
}
|
||||
|
||||
# Install Java JDK 17
|
||||
02_install_java() {
|
||||
echo "Installing Java JDK 17..."
|
||||
execute sudo dnf install -y java-17-openjdk
|
||||
|
||||
echo "Checking Java version..."
|
||||
execute java -version
|
||||
}
|
||||
|
||||
# Install Apache Tomcat
|
||||
03_install_tomcat() {
|
||||
echo "Downloading and installing Apache Tomcat..."
|
||||
execute wget https://dlcdn.apache.org/tomcat/tomcat-10/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz -O /tmp/apache-tomcat-$TOMCAT_VERSION.tar.gz
|
||||
execute sudo mkdir -p $TOMCAT_HOME
|
||||
execute sudo tar xzvf /tmp/apache-tomcat-$TOMCAT_VERSION.tar.gz -C $TOMCAT_HOME --strip-components=1
|
||||
|
||||
echo "Setting permissions for Tomcat directories..."
|
||||
execute sudo chown -R $TOMCAT_USER:$TOMCAT_GROUP $TOMCAT_HOME
|
||||
execute sudo chmod -R u+x $TOMCAT_HOME/bin
|
||||
|
||||
echo "Creating Tomcat systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/tomcat.service
|
||||
[Unit]
|
||||
Description=Apache Tomcat Web Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=$TOMCAT_USER
|
||||
Group=$TOMCAT_GROUP
|
||||
|
||||
Environment="JAVA_HOME=$JAVA_HOME"
|
||||
Environment="CATALINA_PID=$TOMCAT_HOME/temp/tomcat.pid"
|
||||
Environment="CATALINA_HOME=$TOMCAT_HOME"
|
||||
Environment="CATALINA_BASE=$TOMCAT_HOME"
|
||||
Environment="CATALINA_OPTS=-Xms2048M -Xmx3072M -server -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80"
|
||||
Environment="JAVA_OPTS=-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom"
|
||||
Environment="JAVA_TOOL_OPTIONS=-Dencryption.keystore.type=JCEKS -Dencryption.cipherAlgorithm=DESede/CBC/PKCS5Padding -Dencryption.keyAlgorithm=DESede -Dencryption.keystore.location=/home/rheluser/keystore/metadata-keystore/keystore -Dmetadata-keystore.password=mp6yc0UD9e -Dmetadata-keystore.aliases=metadata -Dmetadata-keystore.metadata.password=oKIWzVdEdA -Dmetadata-keystore.metadata.algorithm=DESede"
|
||||
|
||||
ExecStart=$TOMCAT_HOME/bin/startup.sh
|
||||
ExecStop=$TOMCAT_HOME/bin/shutdown.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
execute sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Tomcat service..."
|
||||
execute sudo systemctl start tomcat
|
||||
|
||||
echo "Stopping Tomcat service..."
|
||||
execute sudo systemctl stop tomcat
|
||||
|
||||
echo "Enabling Tomcat service to start on boot..."
|
||||
execute sudo systemctl enable tomcat
|
||||
}
|
||||
|
||||
# Install Apache ActiveMQ
|
||||
04_install_activemq() {
|
||||
echo "Downloading and installing Apache ActiveMQ..."
|
||||
execute wget https://dlcdn.apache.org/activemq/$ACTIVEMQ_VERSION/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz -O /tmp/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz
|
||||
execute sudo mkdir -p $ACTIVEMQ_HOME
|
||||
execute sudo tar xzvf /tmp/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz -C $ACTIVEMQ_HOME --strip-components=1
|
||||
|
||||
echo "Setting permissions for ActiveMQ directories..."
|
||||
execute sudo chown -R $ACTIVEMQ_USER:$ACTIVEMQ_GROUP $ACTIVEMQ_HOME
|
||||
execute sudo chmod -R 755 $ACTIVEMQ_HOME
|
||||
|
||||
echo "Creating ActiveMQ systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/activemq.service
|
||||
[Unit]
|
||||
Description=Apache ActiveMQ
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=$ACTIVEMQ_USER
|
||||
Group=$ACTIVEMQ_GROUP
|
||||
|
||||
Environment="JAVA_HOME=$JAVA_HOME"
|
||||
Environment="ACTIVEMQ_HOME=$ACTIVEMQ_HOME"
|
||||
Environment="ACTIVEMQ_BASE=$ACTIVEMQ_HOME"
|
||||
Environment="ACTIVEMQ_CONF=$ACTIVEMQ_HOME/conf"
|
||||
Environment="ACTIVEMQ_DATA=$ACTIVEMQ_HOME/data"
|
||||
|
||||
ExecStart=$ACTIVEMQ_HOME/bin/activemq start
|
||||
ExecStop=$ACTIVEMQ_HOME/bin/activemq stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
execute sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting ActiveMQ service..."
|
||||
execute sudo systemctl start activemq
|
||||
|
||||
echo "Stopping ActiveMQ service..."
|
||||
execute sudo systemctl stop activemq
|
||||
|
||||
echo "Enabling ActiveMQ service to start on boot..."
|
||||
execute sudo systemctl enable activemq
|
||||
}
|
||||
# Download Content
|
||||
05_down_content(){
|
||||
|
||||
# Ensure system is updated and curl is installed
|
||||
echo "Updating package list and installing curl..."
|
||||
sudo dnf update -y
|
||||
sudo dnf install -y curl
|
||||
|
||||
# URLs of the resources to be downloaded
|
||||
URLS=(
|
||||
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-content-services-community-distribution/23.2.1/alfresco-content-services-community-distribution-23.2.1.zip"
|
||||
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-search-services/2.0.9.1/alfresco-search-services-2.0.9.1.zip"
|
||||
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-transform-core-aio/5.1.0/alfresco-transform-core-aio-5.1.0.jar"
|
||||
)
|
||||
|
||||
# Directory to save the downloaded files
|
||||
DOWNLOAD_DIR="./downloads"
|
||||
|
||||
# Create the download directory if it does not exist
|
||||
mkdir -p "$DOWNLOAD_DIR"
|
||||
|
||||
# Function to download a file
|
||||
download_file() {
|
||||
local url=$1
|
||||
local dest_dir=$2
|
||||
local filename=$(basename "$url")
|
||||
|
||||
echo "Downloading $filename..."
|
||||
curl -L -o "$dest_dir/$filename" -w "\nHTTP Status: %{http_code}\n" "$url"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Downloaded $filename successfully."
|
||||
else
|
||||
echo "Failed to download $filename."
|
||||
fi
|
||||
|
||||
# Check if the file size is greater than 0 bytes
|
||||
if [ ! -s "$dest_dir/$filename" ]; then
|
||||
echo "Warning: Downloaded file $filename is empty."
|
||||
fi
|
||||
}
|
||||
|
||||
# Loop through each URL and download the file
|
||||
for url in "${URLS[@]}"; do
|
||||
download_file "$url" "$DOWNLOAD_DIR"
|
||||
done
|
||||
|
||||
echo "All downloads are complete."
|
||||
|
||||
}
|
||||
|
||||
# Install Alfresco Community Edition
|
||||
06_install_alfresco(){
|
||||
|
||||
set -e
|
||||
|
||||
echo "Install unzip command"
|
||||
execute sudo dnf -y install unzip
|
||||
|
||||
echo "Create support folders and configuration in Tomcat"
|
||||
mkdir -p /home/rheluser/tomcat/shared/classes && mkdir -p /home/rheluser/tomcat/shared/lib
|
||||
sed -i 's|^shared.loader=$|shared.loader=${catalina.base}/shared/classes,${catalina.base}/shared/lib/*.jar|' /home/rheluser/tomcat/conf/catalina.properties
|
||||
|
||||
echo "Unzip Alfresco ZIP Distribution File"
|
||||
mkdir /tmp/alfresco
|
||||
unzip downloads/alfresco-content-services-community-distribution-23.2.1.zip -d /tmp/alfresco
|
||||
|
||||
echo "Copy JDBC driver"
|
||||
cp /tmp/alfresco/web-server/lib/postgresql-42.6.0.jar /home/rheluser/tomcat/shared/lib/
|
||||
|
||||
echo "Configure JAR Addons deployment"
|
||||
mkdir -p /home/rheluser/modules/platform && mkdir -p /home/rheluser/modules/share && mkdir -p /home/rheluser/tomcat/conf/Catalina/localhost
|
||||
cp /tmp/alfresco/web-server/conf/Catalina/localhost/* /home/rheluser/tomcat/conf/Catalina/localhost/
|
||||
|
||||
echo "Install Web Applications"
|
||||
cp /tmp/alfresco/web-server/webapps/* /home/rheluser/tomcat/webapps/
|
||||
|
||||
echo "Apply configuration"
|
||||
cp -r /tmp/alfresco/web-server/shared/classes/* /home/rheluser/tomcat/shared/classes/
|
||||
mkdir /home/rheluser/keystore && cp -r /tmp/alfresco/keystore/* /home/rheluser/keystore/
|
||||
mkdir /home/rheluser/alf_data
|
||||
cat <<EOL | tee /home/rheluser/tomcat/shared/classes/alfresco-global.properties
|
||||
#
|
||||
# Custom content and index data location
|
||||
#
|
||||
dir.root=/home/rheluser/alf_data
|
||||
dir.keystore=/home/rheluser/keystore/
|
||||
|
||||
#
|
||||
# Database connection properties
|
||||
#
|
||||
db.username=alfresco
|
||||
db.password=alfresco
|
||||
db.driver=org.postgresql.Driver
|
||||
db.url=jdbc:postgresql://localhost:5432/alfresco
|
||||
|
||||
#
|
||||
# Solr Configuration
|
||||
#
|
||||
solr.secureComms=secret
|
||||
solr.sharedSecret=secret
|
||||
solr.host=localhost
|
||||
solr.port=8983
|
||||
index.subsystem.name=solr6
|
||||
|
||||
#
|
||||
# Transform Configuration
|
||||
#
|
||||
localTransform.core-aio.url=http://localhost:8090/
|
||||
|
||||
#
|
||||
# Events Configuration
|
||||
#
|
||||
messaging.broker.url=failover:(nio://localhost:61616)?timeout=3000&jms.useCompression=true
|
||||
|
||||
#
|
||||
# URL Generation Parameters
|
||||
#-------------
|
||||
alfresco.context=alfresco
|
||||
alfresco.host=localhost
|
||||
alfresco.port=8080
|
||||
alfresco.protocol=http
|
||||
share.context=share
|
||||
share.host=localhost
|
||||
share.port=8080
|
||||
share.protocol=http
|
||||
EOL
|
||||
|
||||
echo "Apply AMPs"
|
||||
mkdir /home/rheluser/amps && cp -r /tmp/alfresco/amps/* /home/rheluser/amps/
|
||||
mkdir /home/rheluser/bin && cp -r /tmp/alfresco/bin/* /home/rheluser/bin/
|
||||
java -jar /home/rheluser/bin/alfresco-mmt.jar install /home/rheluser/amps /home/rheluser/tomcat/webapps/alfresco.war -directory
|
||||
java -jar /home/rheluser/bin/alfresco-mmt.jar list /home/rheluser/tomcat/webapps/alfresco.war
|
||||
|
||||
echo "Modify alfresco and share logs directory"
|
||||
mkdir /home/rheluser/tomcat/webapps/alfresco && unzip /home/rheluser/tomcat/webapps/alfresco.war -d /home/rheluser/tomcat/webapps/alfresco
|
||||
mkdir /home/rheluser/tomcat/webapps/share && unzip /home/rheluser/tomcat/webapps/share.war -d /home/rheluser/tomcat/webapps/share
|
||||
sed -i 's|^appender\.rolling\.fileName=alfresco\.log|appender.rolling.fileName=/home/rheluser/tomcat/logs/alfresco.log|' /home/rheluser/tomcat/webapps/alfresco/WEB-INF/classes/log4j2.properties
|
||||
sed -i 's|^appender\.rolling\.fileName=share\.log|appender.rolling.fileName=/home/rheluser/tomcat/logs/share.log|' /home/rheluser/tomcat/webapps/share/WEB-INF/classes/log4j2.properties
|
||||
|
||||
echo "Alfresco has been configured"
|
||||
|
||||
}
|
||||
# Install Apache Solr
|
||||
07_install_solr() {
|
||||
echo "Downloading and installing Apache Solr..."
|
||||
execute mkdir /tmp/solr
|
||||
execute unzip downloads/alfresco-search-services-$SOLR_VERSION.zip -d /tmp/solr
|
||||
execute mv /tmp/solr/alfresco-search-services /home/rheluser
|
||||
|
||||
echo "Creating Solr systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/solr.service
|
||||
[Unit]
|
||||
Description=Apache SOLR Web Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=$SOLR_USER
|
||||
Group=$SOLR_GROUP
|
||||
|
||||
Environment="JAVA_HOME=$JAVA_HOME"
|
||||
|
||||
ExecStart=/home/rheluser/alfresco-search-services/solr/bin/solr start -a "-Dcreate.alfresco.defaults=alfresco,archive -Dalfresco.secureComms=secret -Dalfresco.secureComms.secret=secret"
|
||||
ExecStop=/home/rheluser/alfresco-search-services/solr/bin/solr stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
execute sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Solr service..."
|
||||
execute sudo systemctl start solr
|
||||
|
||||
echo "Stopping Solr service..."
|
||||
execute sudo systemctl stop solr
|
||||
|
||||
echo "Enabling Solr service to start on boot..."
|
||||
execute sudo systemctl enable solr
|
||||
}
|
||||
|
||||
# Install Transform dependencies
|
||||
08_install_transform() {
|
||||
sudo subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
sudo dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
|
||||
echo "Install Transform dependencies"
|
||||
sudo dnf install -y GraphicsMagick libreoffice perl-Image-ExifTool
|
||||
|
||||
echo "Downloading and installing Alfresco PDF Renderer..."
|
||||
execute curl -L -o /tmp/alfresco-pdf-renderer-1.2-linux.tgz https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-pdf-renderer/1.2/alfresco-pdf-renderer-1.2-linux.tgz
|
||||
execute sudo tar xf /tmp/alfresco-pdf-renderer-1.2-linux.tgz -C /usr/bin
|
||||
|
||||
echo "Configuring Transform server..."
|
||||
execute mkdir /home/rheluser/transform
|
||||
execute cp downloads/alfresco-transform-core-aio-5.1.0.jar /home/rheluser/transform
|
||||
|
||||
echo "Creating Transform systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/transform.service
|
||||
[Unit]
|
||||
Description=Transform Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
|
||||
User=$TRANSFORM_USER
|
||||
Group=$TRANSFORM_GROUP
|
||||
|
||||
Environment="JAVA_HOME=$JAVA_HOME"
|
||||
Environment="LIBREOFFICE_HOME=/usr/lib/libreoffice"
|
||||
|
||||
ExecStart=java -jar /home/rheluser/transform/alfresco-transform-core-aio-5.1.0.jar
|
||||
ExecStop=/bin/kill -15 $MAINPID
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
execute sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Transform service..."
|
||||
execute sudo systemctl start transform
|
||||
|
||||
echo "Stopping Transform service..."
|
||||
execute sudo systemctl stop transform
|
||||
|
||||
echo "Enabling Transform service to start on boot..."
|
||||
execute sudo systemctl enable transform
|
||||
}
|
||||
|
||||
# Install Node.js and build Alfresco Content App
|
||||
09_install_nodejs() {
|
||||
echo "Installing Node.js and npm..."
|
||||
#execute curl -fsSL $NODEJS_SETUP_URL | sudo -E bash -
|
||||
bash $NODEJS_SETUP_UR
|
||||
execute sudo dnf install -y nodejs
|
||||
|
||||
echo "Verifying Node.js and npm installation..."
|
||||
execute node -v
|
||||
execute npm -v
|
||||
|
||||
echo "Cloning and building Alfresco Content App..."
|
||||
execute git clone $CONTENT_APP_REPO
|
||||
execute cd alfresco-content-app
|
||||
execute git checkout tags/$CONTENT_APP_VERSION -b $CONTENT_APP_VERSION
|
||||
execute npm install
|
||||
execute npm run build
|
||||
}
|
||||
|
||||
# Install and configure Nginx
|
||||
10_install_nginx() {
|
||||
echo "Installing Nginx..."
|
||||
execute sudo dnf install -y nginx
|
||||
|
||||
echo "Creating directory for Alfresco Content App..."
|
||||
execute sudo mkdir -p $NGINX_ROOT
|
||||
execute sudo cp -r /home/rheluser/alfresco-content-app/dist/content-ce/* $NGINX_ROOT
|
||||
|
||||
echo "Creating Nginx systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/nginx.service
|
||||
[Unit]
|
||||
Description=A high performance web server and a reverse proxy server
|
||||
Documentation=man:nginx(8)
|
||||
After=network.target remote-fs.target nss-lookup.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
PIDFile=/run/nginx/nginx.pid
|
||||
ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
|
||||
ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
|
||||
ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
|
||||
ExecStop=/bin/kill -s QUIT $MAINPID
|
||||
PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
execute sudo systemctl daemon-reload
|
||||
|
||||
echo "Enabling Nginx service to start on boot..."
|
||||
execute sudo systemctl enable nginx
|
||||
|
||||
echo "Configuring Nginx..."
|
||||
cat <<EOL | sudo tee $NGINX_CONF_PATH
|
||||
server {
|
||||
listen 80;
|
||||
server_name localhost;
|
||||
|
||||
client_max_body_size 0;
|
||||
|
||||
set \$allowOriginSite *;
|
||||
proxy_pass_request_headers on;
|
||||
proxy_pass_header Set-Cookie;
|
||||
|
||||
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
|
||||
proxy_redirect off;
|
||||
proxy_buffering off;
|
||||
proxy_set_header Host \$host:\$server_port;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_pass_header Set-Cookie;
|
||||
|
||||
root $NGINX_ROOT;
|
||||
index index.html;
|
||||
|
||||
location / {
|
||||
try_files \$uri \$uri/ /index.html;
|
||||
}
|
||||
|
||||
location /alfresco/ {
|
||||
proxy_pass http://localhost:8080;
|
||||
}
|
||||
|
||||
location /share/ {
|
||||
proxy_pass http://localhost:8080;
|
||||
}
|
||||
}
|
||||
EOL
|
||||
|
||||
echo "Restarting Nginx..."
|
||||
execute sudo systemctl restart nginx
|
||||
}
|
||||
11_service_restart(){
|
||||
## RECOMMENDATION: run this sequence of commands manually, waiting between one command and the next one to ensure service dependencies are met.
|
||||
|
||||
echo "Starting postgresql"
|
||||
sudo systemctl start postgresql
|
||||
|
||||
echo "Starting activemq"
|
||||
sudo systemctl start activemq
|
||||
|
||||
echo "Starting transform"
|
||||
sudo systemctl start transform
|
||||
|
||||
echo "Starting tomcat"
|
||||
sudo systemctl start tomcat
|
||||
|
||||
echo "Starting solr"
|
||||
sudo systemctl start solr
|
||||
|
||||
echo "Starting nginx"
|
||||
sudo systemctl start nginx
|
||||
|
||||
|
||||
echo "Services have been started successfully!"
|
||||
}
|
||||
|
||||
# Main script execution
|
||||
main() {
|
||||
user_add_and_group
|
||||
00_update_system
|
||||
01_install_postgresql
|
||||
02_install_java
|
||||
03_install_tomcat
|
||||
04_install_activemq
|
||||
05_down_content
|
||||
06_install_alfresco
|
||||
07_install_solr
|
||||
08_install_transform
|
||||
09_install_nodejs
|
||||
10_install_nginx
|
||||
11_servie_restart
|
||||
echo "Installation and configuration complete."
|
||||
}
|
||||
|
||||
main
|
||||
+100
@@ -0,0 +1,100 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Logger Function
|
||||
log() {
|
||||
local message="$1"
|
||||
local type="$2"
|
||||
local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
|
||||
local color
|
||||
local endcolor="\033[0m"
|
||||
|
||||
case "$type" in
|
||||
"info") color="\033[38;5;79m" ;;
|
||||
"success") color="\033[1;32m" ;;
|
||||
"error") color="\033[1;31m" ;;
|
||||
*) color="\033[1;34m" ;;
|
||||
esac
|
||||
|
||||
echo -e "${color}${timestamp} - ${message}${endcolor}"
|
||||
}
|
||||
|
||||
# Error handler function
|
||||
handle_error() {
|
||||
local exit_code=$1
|
||||
local error_message="$2"
|
||||
log "Error: $error_message (Exit Code: $exit_code)" "error"
|
||||
exit $exit_code
|
||||
}
|
||||
|
||||
# Function to check for command availability
|
||||
command_exists() {
|
||||
command -v "$1" &> /dev/null
|
||||
}
|
||||
|
||||
check_os() {
|
||||
if ! [ -f "/etc/redhat-release" ]; then
|
||||
echo "Error: This script is only supported on RHEL-based systems."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to install the script prerequisites
|
||||
install_pre_reqs() {
|
||||
log "Installing pre-requisites" "info"
|
||||
|
||||
# Run 'yum update'
|
||||
if ! yum update -y; then
|
||||
handle_error "$?" "Failed to run 'yum update'"
|
||||
fi
|
||||
|
||||
# Install required packages
|
||||
if ! yum install -y curl ca-certificates gnupg2; then
|
||||
handle_error "$?" "Failed to install required packages"
|
||||
fi
|
||||
|
||||
# Create directory for keyrings
|
||||
if ! mkdir -p /etc/pki/rpm-gpg; then
|
||||
handle_error "$?" "Failed to create /etc/pki/rpm-gpg directory"
|
||||
fi
|
||||
|
||||
# Remove old keyring if exists
|
||||
rm -f /etc/pki/rpm-gpg/nodesource.gpg || true
|
||||
|
||||
# Download and import the NodeSource GPG key
|
||||
if ! curl -fsSL https://rpm.nodesource.com/pub/el/NODESOURCE-GPG-SIGNING-KEY-EL | gpg --dearmor -o /etc/pki/rpm-gpg/nodesource.gpg; then
|
||||
handle_error "$?" "Failed to download and import the NodeSource GPG key"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to configure the Node.js repository for RHEL
|
||||
configure_repo() {
|
||||
local node_version=$1
|
||||
|
||||
# Create the Nodesource repo file
|
||||
cat <<EOF > /etc/yum.repos.d/nodesource.repo
|
||||
[nodesource]
|
||||
name=Node.js Packages for Enterprise Linux
|
||||
baseurl=https://rpm.nodesource.com/pub_$(echo $node_version | tr -d 'x').x/el/\$releasever/\$basearch
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/nodesource.gpg
|
||||
EOF
|
||||
|
||||
# Run 'yum clean all' and 'yum makecache' to refresh the repository
|
||||
if ! yum clean all && yum makecache; then
|
||||
handle_error "$?" "Failed to refresh repositories"
|
||||
else
|
||||
log "Repository configured successfully." "success"
|
||||
log "To install Node.js, run: yum install nodejs -y" "info"
|
||||
fi
|
||||
}
|
||||
|
||||
# Define Node.js version
|
||||
NODE_VERSION="20.x"
|
||||
|
||||
# Check OS
|
||||
check_os
|
||||
|
||||
# Main execution
|
||||
install_pre_reqs || handle_error $? "Failed installing pre-requisites"
|
||||
configure_repo "$NODE_VERSION" || handle_error $? "Failed configuring repository"
|
||||
Executable
+280
@@ -0,0 +1,280 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit immediately if a command exits with a non-zero status
|
||||
set -e
|
||||
|
||||
# Log file
|
||||
LOG_FILE="/var/log/ejbca_install.log"
|
||||
exec > >(tee -i $LOG_FILE)
|
||||
exec 2>&1
|
||||
|
||||
# State file
|
||||
STATE_FILE="/var/log/ejbca_install_state.log"
|
||||
|
||||
# Variables
|
||||
EJBCA_VERSION="r8.3.2"
|
||||
DB_NAME="ejbca"
|
||||
DB_USER="ejbcauser"
|
||||
DB_PASS="your_password"
|
||||
EJBCA_HOST="localhost"
|
||||
EJBCA_PORT="8080"
|
||||
ADMIN_PASSWORD="adminpassword"
|
||||
EJBCA_URL="https://github.com/Keyfactor/ejbca-ce/archive/refs/tags/${EJBCA_VERSION}/${EJBCA_VERSION}.zip"
|
||||
EJBCA_DIR="/opt/ejbca-ce-r8.3.2"
|
||||
|
||||
# Update state function
|
||||
update_state() {
|
||||
echo "$1" > $STATE_FILE
|
||||
}
|
||||
|
||||
# Read state function
|
||||
read_state() {
|
||||
if [ -f $STATE_FILE ]; then
|
||||
cat $STATE_FILE
|
||||
else
|
||||
echo "0"
|
||||
fi
|
||||
}
|
||||
|
||||
# Hauptfunktion: Installation Prerequisites
|
||||
installation_prerequisites() {
|
||||
echo "Installation Prerequisites..."
|
||||
update_state "1"
|
||||
|
||||
# Subfunktion: System Update
|
||||
system_update
|
||||
|
||||
# Subfunktion: Install Utilities
|
||||
install_utilities
|
||||
}
|
||||
|
||||
system_update() {
|
||||
echo "Updating system..."
|
||||
sudo dnf update -y
|
||||
update_state "1.1"
|
||||
}
|
||||
|
||||
install_utilities() {
|
||||
echo "Installing utilities..."
|
||||
sudo dnf install -y epel-release wget unzip
|
||||
update_state "1.2"
|
||||
}
|
||||
|
||||
# Hauptfunktion: Managing EJBCA Configurations
|
||||
managing_ejbca_configurations() {
|
||||
echo "Managing EJBCA Configurations..."
|
||||
update_state "2"
|
||||
|
||||
# Subfunktion: Install Java
|
||||
install_java
|
||||
|
||||
# Subfunktion: Install Application Server
|
||||
install_application_server
|
||||
}
|
||||
|
||||
install_java() {
|
||||
echo "Installing Java..."
|
||||
sudo dnf install -y java-11-openjdk java-11-openjdk-devel
|
||||
java -version
|
||||
update_state "2.1"
|
||||
}
|
||||
|
||||
install_application_server() {
|
||||
echo "Installing Application Server..."
|
||||
sudo dnf install -y tomcat
|
||||
sudo systemctl start tomcat
|
||||
sudo systemctl enable tomcat
|
||||
update_state "2.2"
|
||||
}
|
||||
|
||||
# Hauptfunktion: Creating Database
|
||||
creating_database() {
|
||||
echo "Creating Database..."
|
||||
update_state "3"
|
||||
|
||||
# Subfunktion: Install MariaDB
|
||||
install_mariadb
|
||||
|
||||
# Subfunktion: Secure MariaDB
|
||||
secure_mariadb
|
||||
|
||||
# Subfunktion: Setup Database
|
||||
setup_database
|
||||
}
|
||||
|
||||
install_mariadb() {
|
||||
echo "Installing MariaDB..."
|
||||
sudo dnf install -y mariadb-server
|
||||
sudo systemctl start mariadb
|
||||
sudo systemctl enable mariadb
|
||||
update_state "3.1"
|
||||
}
|
||||
|
||||
secure_mariadb() {
|
||||
echo "Securing MariaDB installation..."
|
||||
sudo mysql_secure_installation <<EOF
|
||||
|
||||
Y
|
||||
${DB_PASS}
|
||||
${DB_PASS}
|
||||
Y
|
||||
Y
|
||||
Y
|
||||
Y
|
||||
EOF
|
||||
update_state "3.2"
|
||||
}
|
||||
|
||||
setup_database() {
|
||||
echo "Setting up EJBCA database..."
|
||||
sudo mysql -u root -p${DB_PASS} -e "CREATE DATABASE ${DB_NAME};"
|
||||
sudo mysql -u root -p${DB_PASS} -e "CREATE USER '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}';"
|
||||
sudo mysql -u root -p${DB_PASS} -e "GRANT ALL PRIVILEGES ON ${DB_NAME}.* TO '${DB_USER}'@'localhost';"
|
||||
sudo mysql -u root -p${DB_PASS} -e "FLUSH PRIVILEGES;"
|
||||
update_state "3.3"
|
||||
}
|
||||
|
||||
# Hauptfunktion: Deploying EJBCA
|
||||
deploying_ejbca() {
|
||||
echo "Deploying EJBCA..."
|
||||
update_state "4"
|
||||
|
||||
# Subfunktion: Download EJBCA
|
||||
download_ejbca
|
||||
|
||||
# Subfunktion: Unzip EJBCA
|
||||
unzip_ejbca
|
||||
}
|
||||
|
||||
download_ejbca() {
|
||||
echo "Downloading EJBCA..."
|
||||
wget ${EJBCA_URL} -O ${EJBCA_VERSION}.zip
|
||||
update_state "4.1"
|
||||
}
|
||||
|
||||
unzip_ejbca() {
|
||||
echo "Unzipping EJBCA..."
|
||||
unzip ${EJBCA_VERSION}.zip -d /opt
|
||||
update_state "4.2"
|
||||
}
|
||||
|
||||
# Hauptfunktion: Installing EJBCA
|
||||
installing_ejbca() {
|
||||
echo "Installing EJBCA..."
|
||||
update_state "5"
|
||||
|
||||
# Subfunktion: Setup EJBCA
|
||||
setup_ejbca
|
||||
|
||||
# Subfunktion: Configure EJBCA
|
||||
configure_ejbca
|
||||
}
|
||||
|
||||
setup_ejbca() {
|
||||
echo "Setting up EJBCA..."
|
||||
cd ${EJBCA_DIR}
|
||||
./bin/ejbca.sh install
|
||||
update_state "5.1"
|
||||
}
|
||||
|
||||
configure_ejbca() {
|
||||
echo "Configuring EJBCA..."
|
||||
sudo cp conf/database.properties.sample conf/database.properties
|
||||
sudo sed -i "s/ejbcauser:ejbcauser_password@localhost:3306/${DB_USER}:${DB_PASS}@localhost:3306/" conf/database.properties
|
||||
update_state "5.2"
|
||||
}
|
||||
|
||||
# Hauptfunktion: Finalizing the Installation
|
||||
finalizing_the_installation() {
|
||||
echo "Finalizing the Installation..."
|
||||
update_state "6"
|
||||
|
||||
# Subfunktion: Deploy on Tomcat
|
||||
deploy_on_tomcat
|
||||
|
||||
# Subfunktion: Configure Firewall
|
||||
configure_firewall
|
||||
|
||||
# Subfunktion: Check Services
|
||||
check_services
|
||||
|
||||
# Subfunktion: Create Status File
|
||||
create_status_file
|
||||
}
|
||||
|
||||
deploy_on_tomcat() {
|
||||
echo "Deploying EJBCA on Tomcat..."
|
||||
sudo ./bin/ejbca.sh deploy tomcat
|
||||
sudo systemctl restart tomcat
|
||||
update_state "6.1"
|
||||
}
|
||||
|
||||
configure_firewall() {
|
||||
echo "Configuring firewall..."
|
||||
sudo firewall-cmd --zone=public --add-port=${EJBCA_PORT}/tcp --permanent
|
||||
sudo firewall-cmd --reload
|
||||
update_state "6.2"
|
||||
}
|
||||
|
||||
check_services() {
|
||||
echo "Checking Tomcat status..."
|
||||
sudo systemctl status tomcat
|
||||
|
||||
echo "Checking MariaDB status..."
|
||||
sudo systemctl status mariadb
|
||||
|
||||
update_state "6.3"
|
||||
}
|
||||
|
||||
create_status_file() {
|
||||
STATUS_FILE="/var/log/ejbca_install_status.txt"
|
||||
{
|
||||
echo "EJBCA Installation Status"
|
||||
echo "-------------------------"
|
||||
echo "Java version:"
|
||||
java -version
|
||||
echo "Tomcat status:"
|
||||
check_service_status tomcat
|
||||
echo "MariaDB status:"
|
||||
check_service_status mariadb
|
||||
echo "Firewall status:"
|
||||
check_port_status $EJBCA_PORT
|
||||
echo "Installation log:"
|
||||
cat $LOG_FILE
|
||||
} > $STATUS_FILE
|
||||
|
||||
echo "EJBCA has been installed and deployed. Access it at http://${EJBCA_HOST}:${EJBCA_PORT}/ejbca"
|
||||
echo "Use the password ${ADMIN_PASSWORD} for the WildFly management console."
|
||||
echo "Installation status saved to ${STATUS_FILE}"
|
||||
update_state "6.4"
|
||||
}
|
||||
|
||||
check_service_status() {
|
||||
local service=$1
|
||||
if systemctl is-active --quiet $service; then
|
||||
echo "$service is active."
|
||||
else
|
||||
echo "$service is not active."
|
||||
fi
|
||||
}
|
||||
|
||||
check_port_status() {
|
||||
local port=$1
|
||||
if sudo firewall-cmd --list-ports | grep -q $port; then
|
||||
echo "Port $port is open."
|
||||
else
|
||||
echo "Port $port is not open."
|
||||
fi
|
||||
}
|
||||
|
||||
# Main script execution based on state
|
||||
case $(read_state) in
|
||||
0) installation_prerequisites ;;
|
||||
1) managing_ejbca_configurations ;;
|
||||
2) creating_database ;;
|
||||
3) deploying_ejbca ;;
|
||||
4) installing_ejbca ;;
|
||||
5) finalizing_the_installation ;;
|
||||
6) echo "Installation is complete." ;;
|
||||
*) echo "Unknown state. Exiting." ;;
|
||||
esac
|
||||
+307
@@ -0,0 +1,307 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen anpassen
|
||||
REALM="MGT.HEIM.LAN"
|
||||
lowerREALM=$(hostname -d)
|
||||
DOMAIN="MGT"
|
||||
HOSTNAME="pdc"
|
||||
PASSWORD="P@ssw0rd"
|
||||
STATE_FILE="/var/log/samba_setup_state"
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}')
|
||||
HOSTNAME=$(hostname)
|
||||
FQDN=$(hostname -f)
|
||||
IP_FORWARDER="192.168.1.1"
|
||||
# Initialisiere den Fortschrittszustand, falls nicht vorhanden
|
||||
if [ ! -f "$STATE_FILE" ]; then
|
||||
echo "0" > "$STATE_FILE"
|
||||
fi
|
||||
|
||||
# Lese den aktuellen Fortschritt
|
||||
CURRENT_STEP=$(cat "$STATE_FILE")
|
||||
|
||||
# Funktion zum Aktualisieren des Fortschritts
|
||||
update_state() {
|
||||
echo "$1" > "$STATE_FILE"
|
||||
}
|
||||
|
||||
# Funktion: /etc/hosts anpassen
|
||||
configure_hosts() {
|
||||
if [ "$CURRENT_STEP" -le 1 ]; then
|
||||
eche "Function Configure Hosts"
|
||||
echo "${IP_ADDRESS} ${FQDN} ${HOSTNAME}" >> /etc/hosts
|
||||
update_state 2
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: Lokaleinstellungen setzen
|
||||
set_locale() {
|
||||
if [ "$CURRENT_STEP" -le 2 ]; then
|
||||
echo "function set locale to en_US.utf8"
|
||||
localectl set-locale LANG=en_US.utf8
|
||||
update_state 3
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: SELinux deaktivieren
|
||||
disable_selinux() {
|
||||
echo "function diable selinux"
|
||||
if [ "$CURRENT_STEP" -le 3 ]; then
|
||||
sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
|
||||
update_state 4
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: System neu starten
|
||||
reboot_system() {
|
||||
echo "function reboot"
|
||||
if [ "$CURRENT_STEP" -le 4 ]; then
|
||||
update_state 5
|
||||
init 6
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: SSHD konfigurieren und neu starten
|
||||
configure_sshd() {
|
||||
echo "function configure sshd"
|
||||
if [ "$CURRENT_STEP" -le 5 ]; then
|
||||
nano /etc/ssh/sshd_config
|
||||
systemctl restart sshd
|
||||
update_state 6
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: SELinux Status prüfen
|
||||
check_selinux_status() {
|
||||
echo "function check selinux"
|
||||
if [ "$CURRENT_STEP" -le 6 ]; then
|
||||
sestatus
|
||||
update_state 7
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: Firewall starten und konfigurieren
|
||||
configure_firewall() {
|
||||
echo "function configure Firewall"
|
||||
if [ "$CURRENT_STEP" -le 7 ]; then
|
||||
systemctl start firewalld
|
||||
systemctl enable firewalld
|
||||
firewall-cmd --zone=public --add-port=53/tcp --add-port=53/udp --permanent
|
||||
firewall-cmd --zone=public --add-port=88/tcp --add-port=88/udp --permanent
|
||||
firewall-cmd --zone=public --add-port=135/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=389/tcp --add-port=389/udp --permanent
|
||||
firewall-cmd --zone=public --add-port=445/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=464/tcp --add-port=464/udp --permanent
|
||||
firewall-cmd --zone=public --add-port=636/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=3268/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=3269/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=50000-51000/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=49152-65535/tcp --permanent
|
||||
firewall-cmd --reload
|
||||
update_state 8
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: System aktualisieren und notwendige Pakete installieren
|
||||
install_packages() {
|
||||
echo "function install required packages"
|
||||
if [ "$CURRENT_STEP" -le 8 ]; then
|
||||
dnf update -y
|
||||
#dnf install -y epel-release
|
||||
|
||||
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
yum repolist
|
||||
wget -O /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8 https://samba.tranquil.it/RPM-GPG-KEY-TISSAMBA-8
|
||||
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8
|
||||
echo "[tis-samba]
|
||||
name=tis-samba
|
||||
baseurl=https://samba.tranquil.it/redhat8/samba-4.19/
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8" > /etc/yum.repos.d/tissamba.repo
|
||||
dnf repolist
|
||||
yum install -y samba samba-dc samba-winbind samba-winbind-clients krb5-workstation ldb-tools bind chrony bind-utils samba-client python39-pip
|
||||
pip3 install markdown
|
||||
yum install -y wget sudo screen nmap telnet tcpdump rsync net-tools bind-utils htop
|
||||
update_state 9
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: Kerberos-Konfiguration anpassen
|
||||
configure_kerberos() {
|
||||
echo "function configure kerberos"
|
||||
if [ "$CURRENT_STEP" -le 9 ]; then
|
||||
cat <<EOF > /etc/krb5.conf
|
||||
# To opt out of the system crypto-policies configuration of krb5, remove the
|
||||
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
|
||||
includedir /etc/krb5.conf.d/
|
||||
|
||||
[logging]
|
||||
default = FILE:/var/log/krb5libs.log
|
||||
kdc = FILE:/var/log/krb5kdc.log
|
||||
admin_server = FILE:/var/log/kadmind.log
|
||||
|
||||
[libdefaults]
|
||||
dns_lookup_realm = false
|
||||
ticket_lifetime = 24h
|
||||
renew_lifetime = 7d
|
||||
forwardable = true
|
||||
rdns = false
|
||||
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
|
||||
spake_preauth_groups = edwards25519
|
||||
default_realm = $REALM
|
||||
default_ccache_name = KEYRING:persistent:%{uid}
|
||||
dns_lookup_kdc = false
|
||||
|
||||
[realms]
|
||||
$REALM = {
|
||||
kdc = ${IP_ADDRESS}
|
||||
#admin_server = ${IP_ADDRESS}
|
||||
}
|
||||
|
||||
[domain_realm]
|
||||
.${lowerREALM} = $REALM
|
||||
${lowerREALM} = $REALM
|
||||
EOF
|
||||
update_state 10
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: Alte Samba-Konfiguration entfernen und neue Konfiguration erstellen
|
||||
configure_samba() {
|
||||
echo "funktion configure samba"
|
||||
if [ "$CURRENT_STEP" -le 10 ]; then
|
||||
rm -f /etc/samba/smb.conf
|
||||
samba-tool domain provision --realm=$REALM --domain=$DOMAIN --server-role=dc
|
||||
samba-tool user setpassword administrator --newpassword=$PASSWORD
|
||||
echo "dns forwarder = ${IP_FORWARDER}" >> /etc/samba/smb.conf
|
||||
systemctl restart NetworkManager
|
||||
rm -f /var/lib/samba/private/krb5.conf
|
||||
ln -s /etc/krb5.conf /var/lib/samba/private/krb5.conf
|
||||
systemctl enable samba
|
||||
systemctl start samba
|
||||
update_state 11
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: BIND9-DLZ installieren und konfigurieren
|
||||
configure_bind() {
|
||||
echo "function configure bind"nan
|
||||
if [ "$CURRENT_STEP" -le 11 ]; then
|
||||
yum install -y bind samba-dc-bind-dlz bind-utils
|
||||
cat <<EOF > /etc/named.conf
|
||||
options {
|
||||
listen-on port 53 { any; };
|
||||
listen-on-v6 port 53 { ::1; };
|
||||
forwarders { ${IP_FORWARDER}; }; # modify depending on your local DNS forwarder
|
||||
tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab";
|
||||
directory "/var/named";
|
||||
dump-file "/var/named/data/cache_dump.db";
|
||||
statistics-file "/var/named/data/named_stats.txt";
|
||||
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
||||
allow-query { any; };
|
||||
allow-recursion { any; };
|
||||
allow-query-cache { any; };
|
||||
recursion yes;
|
||||
dnssec-enable no;
|
||||
dnssec-validation no;
|
||||
bindkeys-file "/etc/named.iscdlv.key";
|
||||
managed-keys-directory "/var/named/dynamic";
|
||||
pid-file "/run/named/named.pid";
|
||||
session-keyfile "/run/named/session.key";
|
||||
minimal-responses yes;
|
||||
};
|
||||
logging {
|
||||
channel default_debug {
|
||||
file "data/named.run";
|
||||
severity dynamic;
|
||||
};
|
||||
};
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "named.ca";
|
||||
};
|
||||
include "/etc/named.rfc1912.zones";
|
||||
include "/etc/named.root.key";
|
||||
dlz "$REALM" {
|
||||
database "dlopen /usr/lib64/samba/bind9/dlz_bind9_11.so";
|
||||
};
|
||||
EOF
|
||||
echo 'OPTIONS="-4"' >> /etc/sysconfig/named
|
||||
sed -i 's/dns forwarder = '${IP_ADDRESS}'//g' /etc/samba/smb.conf
|
||||
echo "server services = -dns" >> /etc/samba/smb.conf
|
||||
mkdir -p /var/lib/samba/bind-dns/dns
|
||||
samba_upgradedns --dns-backend=BIND9_DLZ
|
||||
update_state 12
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: DNS-Konfiguration prüfen
|
||||
verify_dns() {
|
||||
echo "funktion verify dns config"
|
||||
if [ "$CURRENT_STEP" -le 12 ]; then
|
||||
systemctl restart named
|
||||
netstat -tapn | grep 53
|
||||
dig @localhost google.de
|
||||
dig @localhost $FQDN
|
||||
dig. -t SRV @localhost _ldap._tcp.${lowerREALM}
|
||||
update_state 13
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: SELinux wieder aktivieren und konfigurieren
|
||||
enable_selinux() {
|
||||
echo "function enable selinux"
|
||||
if [ "$CURRENT_STEP" -le 13 ]; then
|
||||
# SELinux auf permissive setzen
|
||||
setenforce 0
|
||||
|
||||
# SELinux-Module installieren
|
||||
dnf install -y policycoreutils-python-utils
|
||||
|
||||
# Boolsche Variablen für Samba und BIND9 setzen
|
||||
setsebool -P samba_enable_home_dirs on
|
||||
setsebool -P samba_export_all_rw on
|
||||
setsebool -P named_write_master_zones on
|
||||
setsebool -P named_update_master_zones on
|
||||
|
||||
# Kontext für Samba- und BIND9-Verzeichnisse setzen
|
||||
semanage fcontext -a -t samba_share_t "/var/lib/samba(/.*)?"
|
||||
restorecon -Rv /var/lib/samba
|
||||
|
||||
semanage fcontext -a -t named_cache_t "/var/lib/samba/bind-dns(/.*)?"
|
||||
restorecon -Rv /var/lib/samba/bind-dns
|
||||
|
||||
# Prüfen der SELinux-Protokolle auf Verstöße und anpassen
|
||||
grep samba /var/log/audit/audit.log | audit2allow -M mypol
|
||||
semodule -i mypol.pp
|
||||
|
||||
grep named /var/log/audit/audit.log | audit2allow -M mypol_named
|
||||
semodule -i mypol_named.pp
|
||||
|
||||
# SELinux auf enforcing setzen
|
||||
setenforce 1
|
||||
|
||||
# SELinux-Konfiguration persistent machen
|
||||
sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
|
||||
|
||||
update_state 14
|
||||
fi
|
||||
}
|
||||
|
||||
# Hauptskript: Funktionen nacheinander ausführen
|
||||
configure_hosts
|
||||
set_locale
|
||||
disable_selinux
|
||||
reboot_system
|
||||
configure_sshd
|
||||
check_selinux_status
|
||||
configure_firewall
|
||||
install_packages
|
||||
configure_kerberos
|
||||
configure_samba
|
||||
configure_bind
|
||||
verify_dns
|
||||
##### OPTIONAL #####
|
||||
#enable_selinux #####
|
||||
####################
|
||||
echo "Installation und Konfiguration abgeschlossen."
|
||||
Executable
+86
@@ -0,0 +1,86 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Set variables
|
||||
EJBCA_VERSION="7.9.0.2" # Ändern Sie dies entsprechend der gewünschten Version
|
||||
WILDFLY_VERSION="32.0.1.Final" # Ändern Sie dies entsprechend der gewünschten Version
|
||||
JAVA_VERSION="11" # Ändern Sie dies entsprechend der gewünschten Version
|
||||
INSTALL_DIR="/opt/ejbca"
|
||||
WILDFLY_DIR="/opt/wildfly"
|
||||
JAVA_DIR="/opt/java"
|
||||
DB_USER="ejbcauser"
|
||||
DB_PASS="ejbcapassword"
|
||||
DB_NAME="ejbca"
|
||||
DB_HOST="localhost"
|
||||
|
||||
# Update package list and install prerequisites
|
||||
echo "Updating package list and installing prerequisites..."
|
||||
sudo dnf update -y
|
||||
sudo dnf install -y wget unzip mariadb-server
|
||||
|
||||
# Enable and start MariaDB
|
||||
echo "Enabling and starting MariaDB..."
|
||||
sudo systemctl enable mariadb
|
||||
sudo systemctl start mariadb
|
||||
|
||||
# Install Java
|
||||
echo "Installing Java..."
|
||||
wget https://download.java.net/java/GA/jdk${JAVA_VERSION}/9/GPL/openjdk-${JAVA_VERSION}_linux-x64_bin.tar.gz
|
||||
sudo tar -xzf openjdk-${JAVA_VERSION}_linux-x64_bin.tar.gz -C /opt/
|
||||
sudo ln -s /opt/jdk-${JAVA_VERSION} $JAVA_DIR
|
||||
export JAVA_HOME=$JAVA_DIR
|
||||
export PATH=$JAVA_HOME/bin:$PATH
|
||||
|
||||
# Install WildFly
|
||||
echo "Installing WildFly..."
|
||||
wget https://download.jboss.org/wildfly/${WILDFLY_VERSION}/wildfly-${WILDFLY_VERSION}.zip
|
||||
sudo unzip wildfly-${WILDFLY_VERSION}.zip -d /opt/
|
||||
sudo ln -s /opt/wildfly-${WILDFLY_VERSION} $WILDFLY_DIR
|
||||
|
||||
# Install EJBCA
|
||||
echo "Installing EJBCA..."
|
||||
wget https://sourceforge.net/projects/ejbca/files/ejbca/${EJBCA_VERSION}/ejbca_ce_${EJBCA_VERSION}.tar.gz
|
||||
sudo tar -xzf ejbca_ce_${EJBCA_VERSION}.tar.gz -C /opt/
|
||||
sudo ln -s /opt/ejbca_ce-$EJBCA_VERSION $INSTALL_DIR
|
||||
|
||||
# Configure WildFly for EJBCA
|
||||
echo "Configuring WildFly for EJBCA..."
|
||||
sudo cp $INSTALL_DIR/doc/install/wildfly/jboss/standalone-full.xml $WILDFLY_DIR/standalone/configuration/
|
||||
sudo cp $INSTALL_DIR/doc/install/wildfly/jboss/ejbca.xml $WILDFLY_DIR/standalone/deployments/
|
||||
|
||||
# Start WildFly
|
||||
echo "Starting WildFly..."
|
||||
sudo $WILDFLY_DIR/bin/standalone.sh -c standalone-full.xml &
|
||||
|
||||
# Wait for WildFly to start
|
||||
sleep 20
|
||||
|
||||
# Setup EJBCA
|
||||
echo "Setting up EJBCA..."
|
||||
cd $INSTALL_DIR
|
||||
sudo ./bin/ejbca.sh install wildfly
|
||||
|
||||
# Configure Database
|
||||
echo "Configuring Database..."
|
||||
sudo mysql -u root -e "CREATE DATABASE $DB_NAME;"
|
||||
sudo mysql -u root -e "CREATE USER '$DB_USER'@'$DB_HOST' IDENTIFIED BY '$DB_PASS';"
|
||||
sudo mysql -u root -e "GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'$DB_HOST';"
|
||||
sudo mysql -u root -e "FLUSH PRIVILEGES;"
|
||||
|
||||
# Update EJBCA configuration for MySQL
|
||||
echo "Updating EJBCA configuration for MySQL..."
|
||||
sudo sed -i "s/localhost/$DB_HOST/g" $INSTALL_DIR/conf/database.properties
|
||||
sudo sed -i "s/ejbcauser/$DB_USER/g" $INSTALL_DIR/conf/database.properties
|
||||
sudo sed -i "s/ejbcapassword/$DB_PASS/g" $INSTALL_DIR/conf/database.properties
|
||||
|
||||
# Restart WildFly to apply changes
|
||||
echo "Restarting WildFly..."
|
||||
sudo pkill -f 'wildfly'
|
||||
sudo $WILDFLY_DIR/bin/standalone.sh -c standalone-full.xml &
|
||||
|
||||
# Final setup for EJBCA
|
||||
echo "Final setup for EJBCA..."
|
||||
cd $INSTALL_DIR
|
||||
sudo ./bin/ejbca.sh ca init --dn "CN=EJBCA,O=My Organization,C=US" --caname "ManagementCA" --tokenType "soft" --keytype "RSA" --keyspec "2048" --password "changeit"
|
||||
|
||||
# Print completion message
|
||||
echo "EJBCA installation and configuration completed successfully."
|
||||
Executable
+92
@@ -0,0 +1,92 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit on error
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
||||
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
||||
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
||||
DNS_FORWARDER="192.168.1.1" # Externer DNS-Forwarder (Google in diesem Fall)
|
||||
EXTERNAL_CA="true" # Setzt das Skript auf externe CA
|
||||
PASSWORD="P@ssw0rd1234" # Admin-Passwort (in der Praxis sicher speichern)
|
||||
DIRMAN_PASSWORD="P@ssw0rd12345" # Directory Manager Passwort
|
||||
IPA_PASS="P@ssw0rdIPA" # IPA Password
|
||||
|
||||
# Name der Zertifikatsdateien
|
||||
#ROOT_CERT="CERT_HEIMLAN_RootCA.crt"
|
||||
SUBCA_CERT="CERT_HEIMLAN_SubCA.crt"
|
||||
#SERVER_CERT="CERT_${HOST_FQDN}.crt"
|
||||
SERVER_KEY="KEY_${HOST_FQDN}.pem"
|
||||
SERVER_FULLCHAIN="fullchain_${HOST_FQDN}.crt"
|
||||
|
||||
|
||||
# Read IP address dynamically from active network interface
|
||||
IP_ADDRESS=$(nmcli -t -f IP4.ADDRESS device show | awk -F: '{split($2,a,"/"); print a[1]; exit}')
|
||||
echo "IP Address: $IP_ADDRESS"
|
||||
|
||||
# Eintragung in die HOSTS
|
||||
echo -e "$IP_ADDRESS\t$HOSTNAME\t ipa" | sudo tee -a /etc/hosts
|
||||
|
||||
# System aktualisieren
|
||||
echo "Aktualisiere das System..."
|
||||
sudo yum update -y
|
||||
|
||||
# Erforderliche Pakete installieren
|
||||
echo "Installiere erforderliche Pakete..."
|
||||
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
sudo dnf -y install @idm:DL1
|
||||
|
||||
# Erforderliche Pakete installieren
|
||||
echo "Installiere erforderliche Pakete..."
|
||||
sudo yum install -y ipa-server ipa-server-dns
|
||||
|
||||
# FreeIPA-Server ohne CA installieren
|
||||
sudo ipa-server-install --no-pki \
|
||||
--http-cert-file "${TMP_CERT}/${SERVER_FULLCHAIN}" \
|
||||
--http-cert-file "${TMP_KEY}/${SERVER_KEY}" \
|
||||
--http-pin "${HTTP_PASS}" \
|
||||
--dirsrv-cert-file "$(TMP_CERT)/${SERVER_FULLCHAIN}" \
|
||||
--dirsrv-cert-file "${TMP_KEY}/${SERVER_KEY}" \
|
||||
--dirsrv-pin $DIRSRV_PASS \
|
||||
--ca-cert-file $TMP_CERT/$SUBCA_CERT \
|
||||
--hostname=$HOSTNAME \
|
||||
--domain=$DOMAIN \
|
||||
--realm=$REALM \
|
||||
--ds-password=$ADMIN_PASS \
|
||||
--admin-password=$IPA_PASS \
|
||||
--no-ntp
|
||||
|
||||
# CSR von der Root CA signieren lassen
|
||||
#echo "Signiere CSR mit der Root CA..."
|
||||
#openssl ca -in $CSR_FILE -out $SIGNED_CERT -cert $ROOT_CERT -keyfile $ROOT_CA_KEY -extensions v3_req -config $OPENSSL_CONFIG
|
||||
hour=0
|
||||
min=6
|
||||
sec=0
|
||||
echo " Sie haben $hour h $min min $sec sek zeit um das Zeit das Zertifikat zu signieren."
|
||||
while [ $hour -ge 0 ]; do
|
||||
while [ $min -ge 0 ]; do
|
||||
while [ $sec -ge 0 ]; do
|
||||
echo -ne "$hour:$min:$sec\033[0K\r"
|
||||
let "sec=sec-1"
|
||||
sleep 1
|
||||
done
|
||||
sec=59
|
||||
let "min=min-1"
|
||||
done
|
||||
min=59
|
||||
let "hour=hour-1"
|
||||
done
|
||||
|
||||
|
||||
# FreeIPA-Dienste neu starten
|
||||
echo "Starte FreeIPA-Dienste neu..."
|
||||
sudo ipactl restart
|
||||
|
||||
# FreeIPA-Dienste Status prüfen
|
||||
sudo ipactl status
|
||||
|
||||
echo "Redhat Identity Management erfolgreich Installiert und eingerichtet !!"
|
||||
echo "Sie können die Admnistration über die WebGui https://${HOST_FQDN} fortsetzen !!"
|
||||
Executable
+123
@@ -0,0 +1,123 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit immediately if a command exits with a non-zero status
|
||||
set -e
|
||||
|
||||
HOST_FQDN=$(hostname -f)
|
||||
SERVER_CERT="CERT_${HOST_FQDN}.crt"
|
||||
SERVER_KEY="KEY_${HOST_FQDN}.pem"
|
||||
|
||||
# Update system packages
|
||||
echo "Updating system packages..."
|
||||
sudo dnf update -y
|
||||
|
||||
# Install Apache HTTP Server
|
||||
echo "Installing Apache HTTP Server..."
|
||||
sudo dnf install -y httpd
|
||||
|
||||
# Enable and start Apache
|
||||
echo "Enabling and starting Apache..."
|
||||
sudo systemctl enable httpd
|
||||
sudo systemctl start httpd
|
||||
|
||||
# Install MariaDB (MySQL fork)
|
||||
echo "Installing MariaDB..."
|
||||
sudo dnf install -y mariadb-server
|
||||
|
||||
# Enable and start MariaDB
|
||||
echo "Enabling and starting MariaDB..."
|
||||
sudo systemctl enable mariadb
|
||||
sudo systemctl start mariadb
|
||||
|
||||
# Secure MariaDB installation
|
||||
echo "Securing MariaDB installation..."
|
||||
sudo mysql_secure_installation
|
||||
|
||||
# Install PHP and required extensions
|
||||
echo "Installing PHP and required extensions..."
|
||||
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
sudo dnf install -y php php-mysqlnd php-pdo php-gd php-mbstring php-intl php-json php-xml php-zip libzip
|
||||
sudo dnf install -y php-pecl-zip php-*
|
||||
|
||||
|
||||
# Enable and start PHP-FPM
|
||||
echo "Enabling and starting PHP-FPM..."
|
||||
sudo systemctl enable php-fpm
|
||||
sudo systemctl start php-fpm
|
||||
|
||||
# Download OwnCloud
|
||||
echo "Downloading OwnCloud..."
|
||||
wget https://download.owncloud.com/server/stable/owncloud-latest.zip
|
||||
|
||||
# Extract OwnCloud
|
||||
echo "Extracting OwnCloud..."
|
||||
sudo unzip owncloud-latest.zip -d /var/www/html/
|
||||
|
||||
# Set ownership and permissions
|
||||
echo "Setting ownership and permissions..."
|
||||
sudo chown -R apache:apache /var/www/html/owncloud
|
||||
sudo chmod -R 755 /var/www/html/owncloud
|
||||
|
||||
# Create a new Apache configuration file for OwnCloud
|
||||
echo "Creating Apache configuration for OwnCloud..."
|
||||
sudo bash -c 'cat > /etc/httpd/conf.d/owncloud.conf <<EOF
|
||||
<VirtualHost *:80>
|
||||
DocumentRoot "/var/www/owncloud"
|
||||
ServerName owncloud.example.com
|
||||
|
||||
<Directory "/var/www/owncloud">
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ErrorLog /var/log/httpd/owncloud_error.log
|
||||
CustomLog /var/log/httpd/owncloud_access.log combined
|
||||
</VirtualHost>
|
||||
EOF'
|
||||
|
||||
# Restart Apache to apply changes
|
||||
echo "Restarting Apache to apply changes..."
|
||||
sudo systemctl restart httpd
|
||||
|
||||
# Create OwnCloud database and user
|
||||
echo "Creating OwnCloud database and user..."
|
||||
sudo mysql -u root -p -e "CREATE DATABASE owncloud;"
|
||||
sudo mysql -u root -p -e "CREATE USER 'ownclouduser'@'localhost' IDENTIFIED BY 'owncloudpassword';"
|
||||
sudo mysql -u root -p -e "GRANT ALL PRIVILEGES ON owncloud.* TO 'ownclouduser'@'localhost';"
|
||||
sudo mysql -u root -p -e "FLUSH PRIVILEGES;"
|
||||
|
||||
# Create a new Apache SSL configuration file for OwnCloud
|
||||
echo "Creating Apache SSL configuration for OwnCloud..."
|
||||
sudo cat << EOF > /etc/httpd/conf.d/owncloud-ssl.conf
|
||||
<VirtualHost *:443>
|
||||
DocumentRoot "/var/www/html/owncloud"
|
||||
ServerName owncloud.example.com
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/pki/tls/certs/$SERVER_CERT
|
||||
SSLCertificateKeyFile /etc/pki/tls/private/$SERVER_KEY
|
||||
|
||||
<Directory "/var/www/html/owncloud">
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ErrorLog /var/log/httpd/owncloud_error.log
|
||||
CustomLog /var/log/httpd/owncloud_access.log combined
|
||||
</VirtualHost>
|
||||
EOF
|
||||
|
||||
# Restart Apache to apply changes
|
||||
echo "Restarting Apache to apply changes..."
|
||||
sudo systemctl restart httpd
|
||||
|
||||
# Firewall configuration to allow HTTP and HTTPS traffic
|
||||
echo "Configuring firewall to allow HTTP and HTTPS traffic..."
|
||||
sudo firewall-cmd --permanent --add-service=http
|
||||
sudo firewall-cmd --permanent --add-service=https
|
||||
sudo firewall-cmd --reload
|
||||
|
||||
echo "OwnCloud installation is complete. Please navigate to https://owncloud.example.com to complete the setup through the web interface."
|
||||
+164
@@ -0,0 +1,164 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Funktion zum Konfigurieren des 389 Directory Servers
|
||||
configure_389_ds() {
|
||||
local domain="$1"
|
||||
local admin_password="$2"
|
||||
local ldap_password="$3"
|
||||
local fqdn="$(hostname --fqdn)"
|
||||
|
||||
cat <<EOL | sudo tee /tmp/ds_setup.inf
|
||||
[General]
|
||||
FullMachineName = $fqdn
|
||||
SuiteSpotUserID = nobody
|
||||
SuiteSpotGroup = nobody
|
||||
AdminDomain = $domain
|
||||
|
||||
[slapd]
|
||||
ServerPort = 389
|
||||
ServerIdentifier = ldap
|
||||
Suffix = dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
RootDN = cn=Directory Manager
|
||||
RootDNPwd = $admin_password
|
||||
EOL
|
||||
|
||||
sudo dscreate from-file /tmp/ds_setup.inf
|
||||
sudo rm /tmp/ds_setup.inf
|
||||
}
|
||||
|
||||
# Funktion zum Konfigurieren von LDAPS mit vorhandenen Zertifikaten und Schlüsseln
|
||||
configure_ldaps() {
|
||||
local cert_path="/etc/ssl/certs"
|
||||
local key_path="/etc/ssl/private"
|
||||
local fqdn="$(hostname --fqdn)"
|
||||
local cert_name="CERT_${fqdn//./_}.cer"
|
||||
local key_name="KEY_${fqdn//./_}.pem"
|
||||
|
||||
# Annahme: Die Zertifikats- und Schlüsseldateien sind bereits vorhanden
|
||||
# und müssen nur in die richtigen Pfade verschoben/verlinkt werden
|
||||
sudo cp /path/to/existing_certificates/"$cert_name" "$cert_path/$cert_name"
|
||||
sudo cp /path/to/existing_certificates/"$key_name" "$key_path/$key_name"
|
||||
|
||||
sudo dsconf -D "cn=Directory Manager" ldap:/// config replace nsslapd-security=on
|
||||
sudo dsconf -D "cn=Directory Manager" ldap:/// config replace nsslapd-ldaps-port=636
|
||||
sudo dsconf -D "cn=Directory Manager" ldap:/// tls set --cacertdir="$cert_path" --server-cert="$cert_name" --server-key="$key_name"
|
||||
sudo systemctl restart dirsrv@ldap
|
||||
}
|
||||
|
||||
# Funktion zum Konfigurieren von BIND mit DLZ
|
||||
configure_bind_dlz() {
|
||||
local domain="$1"
|
||||
local fqdn="$(hostname --fqdn)"
|
||||
|
||||
cat <<EOL | sudo tee /etc/named/dlz-ldap.conf
|
||||
uri ldaps://127.0.0.1:636
|
||||
base "cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')"
|
||||
auth_method sasl
|
||||
sasl_mech EXTERNAL
|
||||
EOL
|
||||
|
||||
cat <<EOL | sudo tee /etc/named.conf
|
||||
options {
|
||||
listen-on port 53 { any; };
|
||||
directory "/var/named";
|
||||
dump-file "/var/named/data/cache_dump.db";
|
||||
statistics-file "/var/named/data/named_stats.txt";
|
||||
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
||||
allow-query { any; };
|
||||
recursion yes;
|
||||
};
|
||||
|
||||
include "/etc/named/dlz-ldap.conf";
|
||||
|
||||
dlz "ldap zone" {
|
||||
database "ldap ldaps://127.0.0.1:636/dc=$(echo $domain | sed 's/\./,dc=/g')?relativeDomainName?sub?(objectClass=dnsZone)";
|
||||
};
|
||||
EOL
|
||||
|
||||
sudo systemctl restart named
|
||||
sudo systemctl enable named
|
||||
}
|
||||
|
||||
# Funktion zum Hinzufügen der DNS-Zonen in LDAP
|
||||
add_dns_zones() {
|
||||
local domain="$1"
|
||||
local ldap_password="$2"
|
||||
local fqdn="$(hostname --fqdn)"
|
||||
local ip_address="$(hostname -I | awk '{print $1}')"
|
||||
|
||||
cat <<EOL | ldapadd -H ldaps://127.0.0.1:636 -x -D "cn=Directory Manager" -w "$ldap_password"
|
||||
dn: dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
objectClass: top
|
||||
objectClass: domain
|
||||
dc: $(echo $domain | cut -d'.' -f1)
|
||||
|
||||
dn: cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
objectClass: top
|
||||
objectClass: nsContainer
|
||||
cn: dns
|
||||
|
||||
dn: ou=bind,dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
objectClass: top
|
||||
objectClass: organizationalUnit
|
||||
ou: bind
|
||||
|
||||
dn: relativeDomainName=@,zoneName=$domain,cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
objectClass: top
|
||||
objectClass: dNSZone
|
||||
relativeDomainName: @
|
||||
zoneName: $domain
|
||||
dNSClass: IN
|
||||
dNSTTL: 3600
|
||||
nSRecord: ns.$domain.
|
||||
|
||||
dn: relativeDomainName=ns,zoneName=$domain,cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
objectClass: top
|
||||
objectClass: dNSZone
|
||||
relativeDomainName: ns
|
||||
zoneName: $domain
|
||||
dNSClass: IN
|
||||
dNSTTL: 3600
|
||||
aRecord: $ip_address
|
||||
|
||||
dn: relativeDomainName=$fqdn,zoneName=$domain,cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
objectClass: top
|
||||
objectClass: dNSZone
|
||||
relativeDomainName: $fqdn
|
||||
zoneName: $domain
|
||||
dNSClass: IN
|
||||
dNSTTL: 3600
|
||||
aRecord: $ip_address
|
||||
EOL
|
||||
}
|
||||
|
||||
# Funktion zum Aktualisieren der /etc/hosts-Datei
|
||||
update_hosts_file() {
|
||||
local domain="$1"
|
||||
local fqdn="$(hostname --fqdn)"
|
||||
local ip_address="$(hostname -I | awk '{print $1}')"
|
||||
|
||||
sudo sed -i "/$fqdn/d" /etc/hosts
|
||||
echo "$ip_address $fqdn $domain" | sudo tee -a /etc/hosts > /dev/null
|
||||
}
|
||||
|
||||
# Funktion zum Einlesen von Benutzereingaben
|
||||
read_input() {
|
||||
read -p "$1: " value
|
||||
echo "$value"
|
||||
}
|
||||
|
||||
# Hauptfunktion zum Ausführen des Skripts
|
||||
main() {
|
||||
local domain="$(hostname --domain)"
|
||||
local admin_password="$(read_input "Admin password")"
|
||||
local ldap_password="$(read_input "LDAP password")"
|
||||
|
||||
configure_389_ds "$domain" "$admin_password" "$ldap_password"
|
||||
configure_ldaps
|
||||
configure_bind_dlz "$domain"
|
||||
add_dns_zones "$domain" "$ldap_password"
|
||||
update_hosts_file "$domain"
|
||||
}
|
||||
|
||||
# Hauptprogramm starten
|
||||
main
|
||||
BIN
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
Executable
BIN
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
Executable
+85
@@ -0,0 +1,85 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variables
|
||||
API_KEY="your_api_key"
|
||||
API_URL="http://localhost:81/api/v1"
|
||||
PRIVATE_KEY="/path/to/private-key.pem"
|
||||
CERTIFICATE="/path/to/certificate.pem"
|
||||
CHAIN="/path/to/chain.pem" # Optional
|
||||
|
||||
# Function to install Nginx Proxy Manager
|
||||
install_nginx_proxy_manager() {
|
||||
# Install dependencies
|
||||
apt-get update
|
||||
apt-get install -y curl gnupg2 lsb-release git sudo
|
||||
|
||||
# Install Node.js and Yarn
|
||||
curl -fsSL https://deb.nodesource.com/setup_14.x | sudo -E bash -
|
||||
curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -
|
||||
echo "deb https://dl.yarnpkg.com/debian/ stable main" | sudo tee /etc/apt/sources.list.d/yarn.list
|
||||
apt-get update
|
||||
apt-get install -y nodejs yarn
|
||||
|
||||
# Clone Nginx Proxy Manager repository
|
||||
git clone https://github.com/jc21/nginx-proxy-manager /opt/nginx-proxy-manager
|
||||
cd /opt/nginx-proxy-manager
|
||||
|
||||
# Install backend dependencies
|
||||
cd backend
|
||||
yarn install
|
||||
|
||||
# Configure MariaDB (assuming it's already installed and secured)
|
||||
mysql -u root -p -e "CREATE DATABASE npm;"
|
||||
mysql -u root -p -e "CREATE USER 'npm_user'@'localhost' IDENTIFIED BY 'password';"
|
||||
mysql -u root -p -e "GRANT ALL PRIVILEGES ON npm.* TO 'npm_user'@'localhost';"
|
||||
mysql -u root -p -e "FLUSH PRIVILEGES;"
|
||||
|
||||
# Configure backend environment
|
||||
cp .env.example .env
|
||||
# Edit .env file with appropriate database credentials and other settings
|
||||
|
||||
# Start backend server
|
||||
yarn start &
|
||||
|
||||
# Install frontend dependencies
|
||||
cd ../frontend
|
||||
yarn install
|
||||
|
||||
# Build frontend
|
||||
yarn build
|
||||
|
||||
# Configure Nginx or other web server to serve frontend
|
||||
|
||||
# Optionally, set up SSL certificates in the frontend configuration
|
||||
|
||||
# Wait for backend to start (adjust sleep time as needed)
|
||||
sleep 10
|
||||
|
||||
# Import SSL certificate using API
|
||||
import_certificate
|
||||
}
|
||||
|
||||
# Function to import SSL certificate using API
|
||||
import_certificate() {
|
||||
# Create JSON data for certificate import
|
||||
certificate_data=$(cat <<EOF
|
||||
{
|
||||
"privateKey": "$(cat $PRIVATE_KEY)",
|
||||
"certificate": "$(cat $CERTIFICATE)",
|
||||
"chain": "$(cat $CHAIN)"
|
||||
}
|
||||
EOF
|
||||
)
|
||||
|
||||
# Make API request to import certificate
|
||||
curl -X POST \
|
||||
-H "Authorization: Bearer $API_KEY" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "$certificate_data" \
|
||||
"$API_URL/certificates"
|
||||
|
||||
echo "Certificate imported successfully."
|
||||
}
|
||||
|
||||
# Main script execution
|
||||
install_nginx_proxy_manager
|
||||
Executable
+36
@@ -0,0 +1,36 @@
|
||||
#!/bin/bash
|
||||
|
||||
#Install IDM
|
||||
vorbereitung(){
|
||||
sudo yum update -y
|
||||
sudo yum install ipa-server ipa-server-dns -y
|
||||
}
|
||||
install(){
|
||||
echo "Es werden einige Daten von Ihnen zur Eingabe verlangt"
|
||||
echo "Domain name: Der DNS-Domain-Name für das IdM-Server-Deployment.
|
||||
IPA Server realm name: Der Kerberos-Realm-Name (üblicherweise die Domain in Großbuchstaben).
|
||||
Directory Manager password: Passwort für den Directory Manager (Admin-Passwort für den LDAP-Server).
|
||||
IPA admin password: Passwort für den admin Benutzer in IdM."
|
||||
sudo ipa-server-install
|
||||
}
|
||||
|
||||
#Firewall Konfiguration
|
||||
firewall(){
|
||||
sudo firewall-cmd --add-service=freeipa-ldap --permanent
|
||||
sudo firewall-cmd --add-service=freeipa-ldaps --permanent
|
||||
sudo firewall-cmd --add-service=freeipa-replication --permanent
|
||||
sudo firewall-cmd --add-service=freeipa --permanent
|
||||
sudo firewall-cmd --reload
|
||||
}
|
||||
|
||||
#CLient aufnahme
|
||||
client(){
|
||||
sudo yum install ipa-client -y
|
||||
sudo ipa-client-install
|
||||
}
|
||||
|
||||
echo "Sie können unter https://<hostname>/ipa/ui die WEB-UI aufrufen"
|
||||
#vorbereitung
|
||||
#install
|
||||
#firewall
|
||||
#client
|
||||
Executable
+158
@@ -0,0 +1,158 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit on any error
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
||||
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
||||
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
||||
DNS_FORWARDER="8.8.8.8" # Externer DNS-Forwarder (Google in diesem Fall)
|
||||
PASSWORD="ipaAdminPassword" # Admin-Passwort (in der Praxis sicher speichern)
|
||||
DIRMAN_PASSWORD="dirmanPassword" # Directory Manager Passwort
|
||||
AD_REALM=$REALM # Active Directory Realm in Großbuchstaben
|
||||
AD_DOMAIN=$DOMAIN # Active Directory Domain in Kleinbuchstaben
|
||||
AD_ADMIN_USER="administrator" # Administrator-Account der AD-Domäne
|
||||
AD_ADMIN_PASS="adAdminPassword" # Passwort des Administrator-Accounts
|
||||
|
||||
LOGFILE="/var/log/idm_install.log"
|
||||
|
||||
# Function to check if running as root
|
||||
function check_root {
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo "Dieses Skript muss als Root ausgeführt werden!" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to install the necessary packages
|
||||
function install_packages {
|
||||
echo "Installiere benötigte Pakete..." | tee -a $LOGFILE
|
||||
yum update -y | tee -a $LOGFILE
|
||||
|
||||
echo "Installiere erforderliche Pakete..." | tee -a $LOGFILE
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm | tee -a $LOGFILE
|
||||
dnf -y install @idm:DL1 | tee -a $LOGFILE
|
||||
yum install -y ipa-server ipa-server-dns bind samba samba-client bind-pkcs11-utils | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to install the IDM server with DNS
|
||||
function install_idm_server {
|
||||
echo "Installiere IdM-Server mit DNS..." | tee -a $LOGFILE
|
||||
|
||||
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
||||
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
||||
--ip-address=$IP_ADDRESS --no-pkinit \
|
||||
--setup-dns --auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure AD trust
|
||||
function configure_ad_trust {
|
||||
echo "Konfiguriere AD-Trust..." | tee -a $LOGFILE
|
||||
|
||||
yum install -y ipa-server-trust-ad | tee -a $LOGFILE
|
||||
|
||||
ipa-adtrust-install --add-sids --netbios-name=$(echo $REALM | cut -d. -f1) --no-msdcs --admin-password=$PASSWORD -U | tee -a $LOGFILE
|
||||
|
||||
ipa trust-add --type=ad $AD_REALM --admin=$AD_ADMIN_USER --password=$AD_ADMIN_PASS | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure Samba
|
||||
function configure_samba {
|
||||
echo "Konfiguriere Samba..." | tee -a $LOGFILE
|
||||
|
||||
cat <<EOF > /etc/samba/smb.conf
|
||||
[global]
|
||||
workgroup = $(echo $REALM | cut -d. -f1)
|
||||
realm = $REALM
|
||||
security = ADS
|
||||
idmap config * : backend = tdb
|
||||
idmap config * : range = 1000-9999
|
||||
idmap config $REALM : backend = ad
|
||||
idmap config $REALM : range = 10000-99999
|
||||
log file = /var/log/samba/%m.log
|
||||
log level = 1
|
||||
kerberos method = system keytab
|
||||
dedicated keytab file = /etc/samba/samba.keytab
|
||||
map to guest = Bad User
|
||||
winbind use default domain = true
|
||||
template shell = /bin/bash
|
||||
template homedir = /home/%U
|
||||
EOF
|
||||
|
||||
# Restart Samba services
|
||||
systemctl restart smb nmb winbind
|
||||
}
|
||||
|
||||
# Function to configure firewall
|
||||
function configure_firewall {
|
||||
echo "Konfiguriere Firewall..." | tee -a $LOGFILE
|
||||
|
||||
firewall-cmd --add-service=freeipa-ldap --permanent
|
||||
firewall-cmd --add-service=freeipa-ldaps --permanent
|
||||
firewall-cmd --add-service=freeipa-replication --permanent
|
||||
firewall-cmd --add-service=freeipa-trust --permanent
|
||||
firewall-cmd --add-service=dns --permanent
|
||||
firewall-cmd --add-port=88/tcp --permanent # Kerberos
|
||||
firewall-cmd --add-port=88/udp --permanent # Kerberos
|
||||
firewall-cmd --add-port=464/tcp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=464/udp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=123/udp --permanent # NTP
|
||||
firewall-cmd --add-port=135/tcp --permanent # DCE/RPC locator service
|
||||
firewall-cmd --add-port=138/udp --permanent # NetBIOS Datagram Service
|
||||
firewall-cmd --add-port=139/tcp --permanent # NetBIOS Session Service
|
||||
firewall-cmd --add-port=445/tcp --permanent # Microsoft-DS Active Directory, Windows shares
|
||||
firewall-cmd --add-port=1024-1300/tcp --permanent # High ports for AD trust
|
||||
firewall-cmd --add-port=1024-1300/udp --permanent # High ports for AD trust
|
||||
firewall-cmd --reload | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure DNS settings without DNSSEC
|
||||
function configure_dns {
|
||||
echo "Konfiguriere DNS..." | tee -a $LOGFILE
|
||||
|
||||
cat <<EOF > /etc/named.conf
|
||||
options {
|
||||
directory "/var/named";
|
||||
forwarders {
|
||||
$DNS_FORWARDER;
|
||||
};
|
||||
};
|
||||
zone "$DOMAIN" IN {
|
||||
type master;
|
||||
file "$DOMAIN.zone";
|
||||
};
|
||||
EOF
|
||||
|
||||
cat <<EOF > /var/named/$DOMAIN.zone
|
||||
\$TTL 86400
|
||||
@ IN SOA $HOSTNAME. admin.$DOMAIN. (
|
||||
2024090701 ; Serial
|
||||
3600 ; Refresh
|
||||
1800 ; Retry
|
||||
1209600 ; Expire
|
||||
86400 ) ; Minimum TTL
|
||||
|
||||
@ IN NS $HOSTNAME.
|
||||
@ IN A $IP_ADDRESS
|
||||
EOF
|
||||
|
||||
# Restart DNS service
|
||||
systemctl restart named
|
||||
}
|
||||
|
||||
# Main function
|
||||
function main {
|
||||
check_root
|
||||
install_packages
|
||||
install_idm_server
|
||||
configure_ad_trust
|
||||
configure_samba
|
||||
configure_firewall
|
||||
configure_dns
|
||||
echo "IdM-Server Installation und Konfiguration abgeschlossen." | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Run the script
|
||||
main
|
||||
Executable
+95
@@ -0,0 +1,95 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit on any error
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
||||
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
||||
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
||||
DNS_FORWARDER="192.168.1.1" # Externer DNS-Forwarder (Google in diesem Fall)
|
||||
PASSWORD="ipaAdminPassword" # Admin-Passwort (in der Praxis sicher speichern)
|
||||
DIRMAN_PASSWORD="dirmanPassword" # Directory Manager Passwort
|
||||
AD_REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Active Directory Realm in Großbuchstaben
|
||||
AD_DOMAIN=$(hostname -d) # Active Directory Domain in Kleinbuchstaben
|
||||
AD_ADMIN_USER="administrator" # Administrator-Account der AD-Domäne
|
||||
AD_ADMIN_PASS="adAdminPassword" # Passwort des Administrator-Accounts
|
||||
|
||||
LOGFILE="/var/log/idm_install.log"
|
||||
|
||||
# Function to check if running as root
|
||||
function check_root {
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo "Dieses Skript muss als Root ausgeführt werden!" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to install the necessary packages
|
||||
function install_packages {
|
||||
echo "Installiere benötigte Pakete..." | tee -a $LOGFILE
|
||||
yum update -y | tee -a $LOGFILE
|
||||
|
||||
echo "Installiere erforderliche Pakete..." | tee -a $LOGFILE
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm | tee -a $LOGFILE
|
||||
dnf -y install @idm:DL1 | tee -a $LOGFILE
|
||||
yum install -y ipa-server ipa-server-dns bind samba samba-client bind-pkcs11-utils | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to install the IDM server with DNS and AD Trust
|
||||
function install_idm_server {
|
||||
echo "Installiere IdM-Server mit DNS und AD-Trust..." | tee -a $LOGFILE
|
||||
|
||||
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
||||
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
||||
--ip-address=$IP_ADDRESS --no-pkinit \
|
||||
--setup-dns --auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure AD trust
|
||||
function configure_ad_trust {
|
||||
echo "Konfiguriere AD-Trust..." | tee -a $LOGFILE
|
||||
|
||||
yum install -y ipa-server-trust-ad | tee -a $LOGFILE
|
||||
|
||||
ipa-adtrust-install --add-sids --netbios-name=$(echo $REALM | cut -d. -f1) --no-msdcs --admin-password=$PASSWORD -U | tee -a $LOGFILE
|
||||
|
||||
ipa trust-add --type=ad $AD_REALM --admin=$AD_ADMIN_USER --password=$AD_ADMIN_PASS | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure firewall
|
||||
function configure_firewall {
|
||||
echo "Konfiguriere Firewall..." | tee -a $LOGFILE
|
||||
|
||||
firewall-cmd --add-service=freeipa-ldap --permanent
|
||||
firewall-cmd --add-service=freeipa-ldaps --permanent
|
||||
firewall-cmd --add-service=freeipa-replication --permanent
|
||||
firewall-cmd --add-service=freeipa-trust --permanent
|
||||
firewall-cmd --add-service=dns --permanent
|
||||
firewall-cmd --add-port=88/tcp --permanent # Kerberos
|
||||
firewall-cmd --add-port=88/udp --permanent # Kerberos
|
||||
firewall-cmd --add-port=464/tcp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=464/udp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=123/udp --permanent # NTP
|
||||
firewall-cmd --add-port=135/tcp --permanent # DCE/RPC locator service
|
||||
firewall-cmd --add-port=138/udp --permanent # NetBIOS Datagram Service
|
||||
firewall-cmd --add-port=139/tcp --permanent # NetBIOS Session Service
|
||||
firewall-cmd --add-port=445/tcp --permanent # Microsoft-DS Active Directory, Windows shares
|
||||
firewall-cmd --add-port=1024-1300/tcp --permanent # High ports for AD trust
|
||||
firewall-cmd --add-port=1024-1300/udp --permanent # High ports for AD trust
|
||||
firewall-cmd --reload | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Main function
|
||||
function main {
|
||||
check_root
|
||||
install_packages
|
||||
install_idm_server
|
||||
configure_ad_trust
|
||||
configure_firewall
|
||||
echo "IdM-Server mit DNS und AD-Trust Installation abgeschlossen." | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Run the script
|
||||
main
|
||||
Executable
Executable
+118
@@ -0,0 +1,118 @@
|
||||
#!/bin/bash
|
||||
|
||||
|
||||
gruppe="MGT_SG_TIER1_Admins"
|
||||
|
||||
# Pfad zur Konfigurationsdatei
|
||||
file="/etc/resolv.conf"
|
||||
file2="/etc/sssd/sssd.conf"
|
||||
file3="/etc/pam.d/common-session"
|
||||
file4="/etc/sudoers.d/realm"
|
||||
|
||||
# Wert, den Sie überprüfen und setzen möchten
|
||||
value="domain heim.lan"
|
||||
|
||||
|
||||
resolv () {
|
||||
#anpassung resolv.conf
|
||||
echo "!!!! Erforderlichen Daten werden in die resolv.conf geschrieben !!!!"
|
||||
# Prüfen, ob der Wert in der Datei vorhanden ist
|
||||
if grep -q "$value" "$file"; then
|
||||
echo "Der Wert '$value' ist bereits in der Datei vorhanden."
|
||||
else
|
||||
# Setzen Sie den Wert, wenn er nicht vorhanden ist
|
||||
echo "damain heim.lan" >> /etc/resolv.conf
|
||||
echo "search heim.lan" >> /etc/resolv.conf
|
||||
fi
|
||||
}
|
||||
packages () {
|
||||
#Packete installieren
|
||||
echo "!!!! Domain Packete werden installiert !!!!"
|
||||
apt -y install realmd sssd sssd-tools libnss-sss libpam-sss adcli samba-common-bin oddjob oddjob-mkhomedir packagekit libsss-sudo
|
||||
}
|
||||
join () {
|
||||
#domain join
|
||||
realm join HEIM.LAN
|
||||
echo "P@ssw0rd"
|
||||
}
|
||||
ssh () {
|
||||
#SSH Berechtigung
|
||||
realm -v permit -g "$gruppe"
|
||||
}
|
||||
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
||||
#Anpassung der SSDD.CONF
|
||||
sssd () {
|
||||
# Dienste, die hinzugefügt werden sollen
|
||||
services="nss, pam, ssh, sudo"
|
||||
service1="False"
|
||||
group="MGT_SG_TIER1_Admins"
|
||||
text="\n \n
|
||||
# add to the end \n
|
||||
ldap_user_uid_number = uidNumber \n
|
||||
ldap_user_gid_number = gidNumber \n
|
||||
simple_allow_groups = MGT_SG_TIER1_Admins \n
|
||||
sudoers_provider = ad \n
|
||||
ad_sudo_search_base = CN=MGT_SG_TIER1_Admins,OU=Tier1_Admins,OU=Domain Groups,DC=heim,DC=lan \n
|
||||
\n
|
||||
\n
|
||||
[sudo] \n
|
||||
debug_level=5"
|
||||
|
||||
# Überprüfen und Anhängen der Dienste und Gruppen
|
||||
if ! grep -q "^services = $services" "$file2"; then
|
||||
if grep -q "^services = " "$file2"; then
|
||||
sed -i "s|^services =.*|services = $services|g" "$file2"
|
||||
else
|
||||
echo "services = $services" >> "$file2"
|
||||
fi
|
||||
fi
|
||||
|
||||
if ! grep -q "^use_fully_qualified_names = $service1" "$file2"; then
|
||||
if grep -q "^use_fully_qualified_names = " "$file2"; then
|
||||
sed -i "s|use_fully_qualified_names =.*|use_fully_qualified_names = $service1|g" "$file2"
|
||||
else
|
||||
echo "use_fully_qualified_names = $service1" >> "$file2"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
if ! grep -q "^simple_allow_group = $group" "$file2"; then
|
||||
echo "simple_allow_group = $group" >> "$file2"
|
||||
fi
|
||||
echo -e $text >> "$file"
|
||||
echo "Dienste und Gruppe wurden der Konfigurationsdatei hinzugefügt."
|
||||
}
|
||||
|
||||
pam () {
|
||||
# Anpassung der Pam Common-Session
|
||||
echo "!!!! Anpannsung der Common-session Home Directory einrichtung !!!!"
|
||||
pamtext="session optional pam_mkhomedir.so skel=/etc/skel umask=077"
|
||||
|
||||
#feststellen der vorletzen Zeile
|
||||
line_count=$(wc -l < "$file3")
|
||||
|
||||
# Einfügen des Textes in die vorletzte Zeile
|
||||
sed -i "$((line_count-1))i$pamtext" "$file3"
|
||||
}
|
||||
sudo () {
|
||||
# Anpassung der Sudo Rechte
|
||||
echo "!!!! Anpassung der Sudo rechte Für die Domain Gruppe" $group
|
||||
sudo="%MGT_SG_TIER1_Admins ALL=(ALL:ALL) NOPASSWD:ALL"
|
||||
touch /etc/sudoers.d/REALM
|
||||
echo "$sudo" >> "$file4"
|
||||
}
|
||||
dienst (){
|
||||
systemctl restart sssd
|
||||
systemctl restart sshd
|
||||
reboot
|
||||
}
|
||||
|
||||
# Aufruf der Funktionen
|
||||
resolv
|
||||
packages
|
||||
join
|
||||
ssh
|
||||
sssd
|
||||
pam
|
||||
sudo
|
||||
dienst
|
||||
+60
@@ -0,0 +1,60 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen
|
||||
REALM="SAMDOM.EXAMPLE.COM"
|
||||
DOMAIN="SAMDOM"
|
||||
ADMIN_PASS="AdminPassword123"
|
||||
HOSTNAME="dc1.samdom.example.com"
|
||||
|
||||
# Systemaktualisierung und Installation von Paketen
|
||||
echo "Aktualisieren des Systems und Installieren der notwendigen Pakete..."
|
||||
yum update -y
|
||||
yum install -y epel-release
|
||||
yum install -y wget vim samba samba-client samba-common samba-krb5-printing samba-common-tools bind-utils
|
||||
|
||||
# Setzen des Hostnamens
|
||||
echo "Setzen des Hostnamens..."
|
||||
hostnamectl set-hostname $HOSTNAME
|
||||
|
||||
# Provisionierung des Samba-Domain Controllers
|
||||
echo "Provisionieren des Samba-Domain Controllers..."
|
||||
samba-tool domain provision --realm=$REALM --domain=$DOMAIN --server-role=dc --dns-backend=SAMBA_INTERNAL --adminpass=$ADMIN_PASS --use-rfc2307
|
||||
|
||||
# Konfiguration der /etc/krb5.conf
|
||||
echo "Konfigurieren der /etc/krb5.conf..."
|
||||
cat <<EOT > /etc/krb5.conf
|
||||
[libdefaults]
|
||||
default_realm = $REALM
|
||||
dns_lookup_realm = false
|
||||
dns_lookup_kdc = true
|
||||
EOT
|
||||
|
||||
# Konfiguration der /etc/resolv.conf
|
||||
echo "Konfigurieren der /etc/resolv.conf..."
|
||||
cat <<EOT > /etc/resolv.conf
|
||||
search $DOMAIN
|
||||
nameserver 127.0.0.1
|
||||
EOT
|
||||
|
||||
# Starten und Aktivieren des Samba-Dienstes
|
||||
echo "Starten und Aktivieren des Samba-Dienstes..."
|
||||
systemctl enable samba-ad-dc
|
||||
systemctl start samba-ad-dc
|
||||
|
||||
# Firewall-Konfiguration
|
||||
echo "Konfigurieren der Firewall..."
|
||||
firewall-cmd --permanent --add-service=samba
|
||||
firewall-cmd --permanent --add-service=kerberos
|
||||
firewall-cmd --permanent --add-service=dns
|
||||
firewall-cmd --reload
|
||||
|
||||
# Überprüfen der Samba-Konfiguration
|
||||
echo "Überprüfen der Samba-Konfiguration..."
|
||||
samba-tool domain level show
|
||||
|
||||
# Überprüfen des DNS-Dienstes
|
||||
echo "Überprüfen des DNS-Dienstes..."
|
||||
nslookup -type=SRV _ldap._tcp.$DOMAIN
|
||||
nslookup -type=SRV _kerberos._tcp.$DOMAIN
|
||||
|
||||
echo "Die Konfiguration ist abgeschlossen."
|
||||
Executable
+53
@@ -0,0 +1,53 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen
|
||||
REALM="SAMDOM.EXAMPLE.COM"
|
||||
DOMAIN="SAMDOM"
|
||||
ADMIN_PASS="AdminPassword123"
|
||||
HOSTNAME="dc1.samdom.example.com"
|
||||
|
||||
# Systemaktualisierung und Installation von Paketen
|
||||
echo "Aktualisieren des Systems und Installieren der notwendigen Pakete..."
|
||||
yum update -y
|
||||
yum install -y epel-release
|
||||
yum install -y wget vim samba samba-client samba-common samba-krb5-printing samba-common-tools
|
||||
|
||||
# Setzen des Hostnamens
|
||||
echo "Setzen des Hostnamens..."
|
||||
hostnamectl set-hostname $HOSTNAME
|
||||
|
||||
# Provisionierung des Samba-Domain Controllers
|
||||
echo "Provisionieren des Samba-Domain Controllers..."
|
||||
samba-tool domain provision --realm=$REALM --domain=$DOMAIN --server-role=dc --dns-backend=SAMBA_INTERNAL --adminpass=$ADMIN_PASS --use-rfc2307
|
||||
|
||||
# Konfiguration der /etc/krb5.conf
|
||||
echo "Konfigurieren der /etc/krb5.conf..."
|
||||
cat <<EOT > /etc/krb5.conf
|
||||
[libdefaults]
|
||||
default_realm = $REALM
|
||||
dns_lookup_realm = false
|
||||
dns_lookup_kdc = true
|
||||
EOT
|
||||
|
||||
# Starten und Aktivieren des Samba-Dienstes
|
||||
echo "Starten und Aktivieren des Samba-Dienstes..."
|
||||
systemctl enable samba-ad-dc
|
||||
systemctl start samba-ad-dc
|
||||
|
||||
# Firewall-Konfiguration
|
||||
echo "Konfigurieren der Firewall..."
|
||||
firewall-cmd --permanent --add-service=samba
|
||||
firewall-cmd --permanent --add-service=kerberos
|
||||
firewall-cmd --permanent --add-service=dns
|
||||
firewall-cmd --reload
|
||||
|
||||
# Überprüfen der Samba-Konfiguration
|
||||
echo "Überprüfen der Samba-Konfiguration..."
|
||||
samba-tool domain level show
|
||||
|
||||
# Überprüfen des DNS-Dienstes
|
||||
echo "Überprüfen des DNS-Dienstes..."
|
||||
nslookup -type=SRV _ldap._tcp.$DOMAIN
|
||||
nslookup -type=SRV _kerberos._tcp.$DOMAIN
|
||||
|
||||
echo "Die Konfiguration ist abgeschlossen."
|
||||
Executable
+86
@@ -0,0 +1,86 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen für benutzerdefinierte Einstellungen
|
||||
DB_NAME="openxpki"
|
||||
DB_USER="your_db_user"
|
||||
DB_PASSWORD="your_db_password"
|
||||
SERVER_NAME="ca.test.lan"
|
||||
|
||||
# Aktualisiere das System
|
||||
sudo apt-get update
|
||||
sudo apt-get upgrade -y
|
||||
|
||||
# Installiere erforderliche Pakete
|
||||
sudo apt-get install -y build-essential libssl-dev libdbi-perl libdbd-sqlite3-perl libdbd-mysql-perl \
|
||||
libdbd-pg-perl libdata-uuid-perl libdatetime-perl libdatetime-timezone-perl libmime-base64-urlsafe-perl \
|
||||
libxml-parser-perl libxml-simple-perl libmoose-perl libmoosex-aliases-perl libtry-tiny-perl \
|
||||
libjson-perl libdbd-mysql-perl libdbd-sqlite3-perl libdbd-pg-perl
|
||||
|
||||
# Füge das OpenXPKI-Repository hinzu
|
||||
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1397BC53640DB551
|
||||
echo "deb http://packages.openxpki.org/debian/ focal release" | sudo tee /etc/apt/sources.list.d/openxpki.list
|
||||
sudo apt-get update
|
||||
|
||||
# Installiere OpenXPKI
|
||||
sudo apt-get install -y openxpki
|
||||
|
||||
# Installiere MySQL-Server
|
||||
sudo apt-get install -y mysql-server
|
||||
sudo mysql_secure_installation
|
||||
|
||||
# Erstelle und konfiguriere die OpenXPKI-Datenbank
|
||||
sudo mysql -u root -p <<EOF
|
||||
CREATE DATABASE $DB_NAME;
|
||||
CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASSWORD';
|
||||
GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';
|
||||
FLUSH PRIVILEGES;
|
||||
EXIT;
|
||||
EOF
|
||||
|
||||
# Konfigurationsdateien bearbeiten, um den benutzerdefinierten Datenbankbenutzer zu verwenden
|
||||
sudo sed -i "s/DBI:mysql:database=openxpki;host=localhost/DBI:mysql:database=$DB_NAME;host=localhost/" /etc/openxpki/config.d/system/database.yaml
|
||||
sudo sed -i "s/user: openxpki/user: $DB_USER/" /etc/openxpki/config.d/system/database.yaml
|
||||
sudo sed -i "s/pass: secret/password: $DB_PASSWORD/" /etc/openxpki/config.d/system/database.yaml
|
||||
|
||||
# Starte und aktiviere OpenXPKI
|
||||
sudo systemctl start openxpki
|
||||
sudo systemctl enable openxpki
|
||||
|
||||
# Installiere und konfiguriere Apache
|
||||
sudo apt-get install -y apache2 libapache2-mod-fcgid
|
||||
|
||||
# Erstelle die Apache-Konfigurationsdatei
|
||||
sudo tee /etc/apache2/sites-available/openxpki.conf <<EOF
|
||||
<VirtualHost *:80>
|
||||
ServerName $SERVER_NAME
|
||||
|
||||
DocumentRoot /var/www/openxpki
|
||||
|
||||
<Directory /var/www/openxpki>
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
|
||||
<Directory "/usr/lib/cgi-bin">
|
||||
AllowOverride None
|
||||
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
Alias /openxpki /var/www/openxpki
|
||||
<Directory /var/www/openxpki>
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
</VirtualHost>
|
||||
EOF
|
||||
|
||||
# Konfiguriere und starte Apache neu
|
||||
sudo a2enmod cgi
|
||||
sudo a2ensite openxpki
|
||||
sudo systemctl restart apache2
|
||||
|
||||
echo "Installation und Konfiguration von OpenXPKI abgeschlossen. Öffne http://$SERVER_NAME/openxpki in deinem Browser."
|
||||
Executable
+84
@@ -0,0 +1,84 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Funktion zum Installieren des OnlyOffice Document Servers
|
||||
install_onlyoffice() {
|
||||
OS=$1
|
||||
SSL_CERT_PATH="/etc/onlyoffice/documentserver/ssl"
|
||||
|
||||
if [[ "$OS" == "ubuntu" || "$OS" == "debian" ]]; then
|
||||
sudo apt update
|
||||
sudo apt upgrade -y
|
||||
sudo apt install -y software-properties-common wget gnupg
|
||||
wget -qO - https://download.onlyoffice.com/repo/onlyoffice.asc | sudo apt-key add -
|
||||
echo "deb https://download.onlyoffice.com/repo/debian squeeze main" | sudo tee /etc/apt/sources.list.d/onlyoffice.list
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y onlyoffice-documentserver
|
||||
elif [[ "$OS" == "centos" || "$OS" == "rhel" ]]; then
|
||||
sudo yum update -y
|
||||
sudo yum install -y epel-release wget
|
||||
wget https://download.onlyoffice.com/repo/centos/main/onlyoffice-repo.noarch.rpm
|
||||
sudo rpm -ivh onlyoffice-repo.noarch.rpm
|
||||
sudo yum install -y onlyoffice-documentserver
|
||||
else
|
||||
echo "Nicht unterstütztes Betriebssystem: $OS"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Hinweis anzeigen und auf Benutzeraktion warten
|
||||
echo "Bitte kopieren Sie die Zertifikatsdateien (fullchain.pem und privkey.pem) auf Ihre Synology NAS unter /volume1/certs/"
|
||||
read -p "Drücken Sie Enter, sobald Sie die Zertifikatsdateien bereitgestellt haben..."
|
||||
|
||||
# SSL-Zertifikate von Synology NAS kopieren
|
||||
NAS_IP="<IP-der-Synology-NAS>"
|
||||
NAS_CERT_PATH="/volume1/certs"
|
||||
sudo mkdir -p $SSL_CERT_PATH
|
||||
scp admin@$NAS_IP:$NAS_CERT_PATH/fullchain.pem /tmp/fullchain.pem
|
||||
scp admin@$NAS_IP:$NAS_CERT_PATH/privkey.pem /tmp/privkey.pem
|
||||
|
||||
# SSL-Zertifikate verschieben
|
||||
sudo mv /tmp/fullchain.pem $SSL_CERT_PATH/fullchain.pem
|
||||
sudo mv /tmp/privkey.pem $SSL_CERT_PATH/privkey.pem
|
||||
|
||||
# Berechtigungen setzen
|
||||
sudo chown -R onlyoffice:onlyoffice $SSL_CERT_PATH
|
||||
sudo chmod 600 $SSL_CERT_PATH/*
|
||||
|
||||
# OnlyOffice Konfiguration aktualisieren
|
||||
ONLYOFFICE_CONFIG="/etc/onlyoffice/documentserver/local.json"
|
||||
sudo tee $ONLYOFFICE_CONFIG > /dev/null <<EOL
|
||||
{
|
||||
"services": {
|
||||
"CoAuthoring": {
|
||||
"ssl": {
|
||||
"enable": true,
|
||||
"cert_path": "/etc/onlyoffice/documentserver/ssl/fullchain.pem",
|
||||
"key_path": "/etc/onlyoffice/documentserver/ssl/privkey.pem"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
EOL
|
||||
|
||||
# OnlyOffice Document Server neu starten
|
||||
sudo systemctl restart onlyoffice-documentserver
|
||||
|
||||
# Installation abschließen
|
||||
echo "OnlyOffice Document Server wurde installiert und konfiguriert."
|
||||
echo "Besuchen Sie https://<IP-der-VM>, um den Dienst zu testen."
|
||||
}
|
||||
|
||||
# Betriebssystem erkennen
|
||||
if [ -f /etc/os-release ]; then
|
||||
. /etc/os-release
|
||||
OS=$ID
|
||||
elif [ -f /etc/centos-release ]; then
|
||||
OS="centos"
|
||||
elif [ -f /etc/redhat-release ]; then
|
||||
OS="rhel"
|
||||
else
|
||||
echo "Unbekanntes Betriebssystem"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# OnlyOffice Document Server installieren
|
||||
install_onlyoffice $OS
|
||||
+102
@@ -0,0 +1,102 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen für benutzerdefinierte Einstellungen
|
||||
DB_NAME="openxpki_intermediate"
|
||||
DB_USER="intermediate_db_user"
|
||||
DB_PASSWORD="intermediate_db_password"
|
||||
SERVER_NAME="intermediateca.heim.lan"
|
||||
ROOT_CA_CERT_PATH="/path/to/root/ca-cert.crt"
|
||||
INTERMEDIATE_CA_CERT_PATH="/path/to/intermediate/ca-cert.crt"
|
||||
INTERMEDIATE_CA_KEY_PATH="/path/to/intermediate/ca-key.key"
|
||||
|
||||
# System aktualisieren
|
||||
sudo dnf update -y
|
||||
|
||||
# Installiere erforderliche Pakete
|
||||
sudo dnf install -y epel-release
|
||||
sudo dnf install -y gcc gcc-c++ make perl-CPAN perl-DBI perl-DBD-MySQL perl-DBD-SQLite perl-DBD-Pg \
|
||||
perl-Data-UUID perl-DateTime perl-DateTime-TimeZone perl-MIME-Base64-URLSafe \
|
||||
perl-XML-Parser perl-XML-Simple perl-Moose perl-MooseX-Aliases perl-Try-Tiny \
|
||||
perl-JSON perl-DBD-MySQL perl-DBD-SQLite perl-DBD-Pg mariadb-server
|
||||
|
||||
# Füge das OpenXPKI-Repository hinzu
|
||||
sudo rpm --import https://packages.openxpki.org/key/OpenXPKI-2016-02-15.pub
|
||||
sudo tee /etc/yum.repos.d/openxpki.repo <<EOF
|
||||
[openxpki]
|
||||
name=OpenXPKI
|
||||
baseurl=http://packages.openxpki.org/rhel/8/release/
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
EOF
|
||||
sudo dnf update -y
|
||||
|
||||
# Installiere OpenXPKI
|
||||
sudo dnf install -y openxpki
|
||||
|
||||
# Starte und sichere die MariaDB-Installation
|
||||
sudo systemctl start mariadb
|
||||
sudo systemctl enable mariadb
|
||||
sudo mysql_secure_installation
|
||||
|
||||
# Erstelle und konfiguriere die OpenXPKI-Datenbank
|
||||
sudo mysql -u root -p <<EOF
|
||||
CREATE DATABASE $DB_NAME;
|
||||
CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASSWORD';
|
||||
GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';
|
||||
FLUSH PRIVILEGES;
|
||||
EXIT;
|
||||
EOF
|
||||
|
||||
# Konfigurationsdateien bearbeiten, um den benutzerdefinierten Datenbankbenutzer zu verwenden
|
||||
sudo sed -i "s/DBI:mysql:database=openxpki;host=localhost/DBI:mysql:database=$DB_NAME;host=localhost/" /etc/openxpki/config.d/system/database.yaml
|
||||
sudo sed -i "s/user: openxpki/user: $DB_USER/" /etc/openxpki/config.d/system/database.yaml
|
||||
sudo sed -i "s/pass: secret/password: $DB_PASSWORD/" /etc/openxpki/config.d/system/database.yaml
|
||||
|
||||
# Starte und aktiviere OpenXPKI
|
||||
sudo systemctl start openxpki
|
||||
sudo systemctl enable openxpki
|
||||
|
||||
# Installiere und konfiguriere Apache
|
||||
sudo dnf install -y httpd mod_fcgid
|
||||
|
||||
# Erstelle die Apache-Konfigurationsdatei
|
||||
sudo tee /etc/httpd/conf.d/openxpki.conf <<EOF
|
||||
<VirtualHost *:80>
|
||||
ServerName $SERVER_NAME
|
||||
|
||||
DocumentRoot /var/www/openxpki
|
||||
|
||||
<Directory /var/www/openxpki>
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
|
||||
<Directory "/usr/lib/cgi-bin">
|
||||
AllowOverride None
|
||||
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
Alias /openxpki /var/www/openxpki
|
||||
<Directory /var/www/openxpki>
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
</VirtualHost>
|
||||
EOF
|
||||
|
||||
# Konfiguriere und starte Apache neu
|
||||
sudo systemctl start httpd
|
||||
sudo systemctl enable httpd
|
||||
sudo systemctl restart httpd
|
||||
|
||||
# Firewall-Einstellungen anpassen
|
||||
sudo firewall-cmd --zone=public --add-service=http --permanent
|
||||
sudo firewall-cmd --zone=public --add-service=https --permanent
|
||||
sudo firewall-cmd --reload
|
||||
|
||||
# OpenXPKI als Intermediate CA initialisieren (Beispielkonfiguration)
|
||||
sudo tee /etc/openxpki/config.d/realm/heim.lan
|
||||
+111
@@ -0,0 +1,111 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen für benutzerdefinierte Einstellungen
|
||||
DB_NAME="openxpki_root"
|
||||
DB_USER="root_db_user"
|
||||
DB_PASSWORD="root_db_password"
|
||||
SERVER_NAME="rootca.heim.lan"
|
||||
|
||||
# System aktualisieren
|
||||
sudo dnf update -y
|
||||
|
||||
# Installiere erforderliche Pakete
|
||||
sudo dnf install -y epel-release
|
||||
sudo dnf install -y gcc gcc-c++ make perl-CPAN perl-DBI perl-DBD-MySQL perl-DBD-SQLite perl-DBD-Pg \
|
||||
perl-Data-UUID perl-DateTime perl-DateTime-TimeZone perl-MIME-Base64-URLSafe \
|
||||
perl-XML-Parser perl-XML-Simple perl-Moose perl-MooseX-Aliases perl-Try-Tiny \
|
||||
perl-JSON perl-DBD-MySQL perl-DBD-SQLite perl-DBD-Pg mariadb-server
|
||||
|
||||
# Füge das OpenXPKI-Repository hinzu
|
||||
sudo rpm --import https://packages.openxpki.org/key/OpenXPKI-2016-02-15.pub
|
||||
sudo tee /etc/yum.repos.d/openxpki.repo <<EOF
|
||||
[openxpki]
|
||||
name=OpenXPKI
|
||||
baseurl=http://packages.openxpki.org/rhel/8/release/
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
EOF
|
||||
sudo dnf update -y
|
||||
|
||||
# Installiere OpenXPKI
|
||||
sudo dnf install -y openxpki
|
||||
|
||||
# Starte und sichere die MariaDB-Installation
|
||||
sudo systemctl start mariadb
|
||||
sudo systemctl enable mariadb
|
||||
sudo mysql_secure_installation
|
||||
|
||||
# Erstelle und konfiguriere die OpenXPKI-Datenbank
|
||||
sudo mysql -u root -p <<EOF
|
||||
CREATE DATABASE $DB_NAME;
|
||||
CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASSWORD';
|
||||
GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';
|
||||
FLUSH PRIVILEGES;
|
||||
EXIT;
|
||||
EOF
|
||||
|
||||
# Konfigurationsdateien bearbeiten, um den benutzerdefinierten Datenbankbenutzer zu verwenden
|
||||
sudo sed -i "s/DBI:mysql:database=openxpki;host=localhost/DBI:mysql:database=$DB_NAME;host=localhost/" /etc/openxpki/config.d/system/database.yaml
|
||||
sudo sed -i "s/user: openxpki/user: $DB_USER/" /etc/openxpki/config.d/system/database.yaml
|
||||
sudo sed -i "s/pass: secret/password: $DB_PASSWORD/" /etc/openxpki/config.d/system/database.yaml
|
||||
|
||||
# Starte und aktiviere OpenXPKI
|
||||
sudo systemctl start openxpki
|
||||
sudo systemctl enable openxpki
|
||||
|
||||
# Installiere und konfiguriere Apache
|
||||
sudo dnf install -y httpd mod_fcgid
|
||||
|
||||
# Erstelle die Apache-Konfigurationsdatei
|
||||
sudo tee /etc/httpd/conf.d/openxpki.conf <<EOF
|
||||
<VirtualHost *:80>
|
||||
ServerName $SERVER_NAME
|
||||
|
||||
DocumentRoot /var/www/openxpki
|
||||
|
||||
<Directory /var/www/openxpki>
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
|
||||
<Directory "/usr/lib/cgi-bin">
|
||||
AllowOverride None
|
||||
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
Alias /openxpki /var/www/openxpki
|
||||
<Directory /var/www/openxpki>
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
</VirtualHost>
|
||||
EOF
|
||||
|
||||
# Konfiguriere und starte Apache neu
|
||||
sudo systemctl start httpd
|
||||
sudo systemctl enable httpd
|
||||
sudo systemctl restart httpd
|
||||
|
||||
# Firewall-Einstellungen anpassen
|
||||
sudo firewall-cmd --zone=public --add-service=http --permanent
|
||||
sudo firewall-cmd --zone=public --add-service=https --permanent
|
||||
sudo firewall-cmd --reload
|
||||
|
||||
# OpenXPKI als Root CA initialisieren (Beispielkonfiguration)
|
||||
sudo tee /etc/openxpki/config.d/realm/heim.lan/crypto.yaml <<EOF
|
||||
crypto:
|
||||
default:
|
||||
backend: OpenSSL
|
||||
key: /etc/openxpki/keys/root-ca.key
|
||||
cert: /etc/openxpki/keys/root-ca.crt
|
||||
chain: []
|
||||
tls_profile:
|
||||
default:
|
||||
label: "Root CA"
|
||||
EOF
|
||||
|
||||
echo "Installation und Konfiguration von OpenXPKI als Root CA abgeschlossen. Öffne http://$SERVER_NAME/openxpki in deinem Browser."
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user