Initialer Import der Synology Scripts
This commit is contained in:
root
Binary file not shown.
Executable
+177
@@ -0,0 +1,177 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Globale Variablen
|
||||
#HOSTNAME=$(hostname -f | tr '[:lower:]' '[:upper:]') # FQDN in Großbuchstaben
|
||||
HOSTNAME=$(hostname -f)
|
||||
NETBIOS=$(hostname)
|
||||
DOMAIN=$(hostname -d | cut -d'.' -f1 | tr '[:lower:]' '[:upper:]') # Kurze Domain in Großbuchstaben
|
||||
REALM="${DOMAIN^^}.HEIM.LAN" # Realm in Großbuchstaben, muss die gesamte Domain sein
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}')
|
||||
PASSWORD="P@ssw0rd" # Globale Variable für das Administrator-Passwort
|
||||
ERROR_LOG="/var/log/samba_install_error.log"
|
||||
|
||||
# Zertifikat-Pfade
|
||||
tls_keyfile="/etc/samba/tls/private/KEY_${HOSTNAME}.pem"
|
||||
tls_certfile="/etc/samba/tls/certs/fullchain_${HOSTNAME}.crt"
|
||||
tls_cafile="/etc/samba/tls/certs/CERT_HEIMLAN_SubCA.crt"
|
||||
|
||||
# ROOT and SubCa
|
||||
ROOT_CRT="CERT_HEIMLAN_RootCA.crt"
|
||||
SUBCA_CRT="CERT_HEIMLAN_SubCA.crt"
|
||||
# Funktion zum Beenden des Skripts bei einem Fehler
|
||||
error_exit() {
|
||||
echo "$1" | tee -a $ERROR_LOG
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Funktion zum Kopieren der Zertifikate und Schlüssel in das entsprechende Verzeichnis
|
||||
copy_certs_key() {
|
||||
mkdir -p /etc/samba/tls/certs /etc/samba/tls/private || error_exit "Fehler beim Erstellen der Verzeichnisse für Zertifikate und Schlüssel"
|
||||
|
||||
# Kopieren der Zertifikate und Schlüssel
|
||||
cp /tmp/$ROOT_CRT /etc/samba/tls/certs || error_exit "Fehler beim Kopieren des Zertifikats"
|
||||
cp /tmp/$SUBCA_CRT /etc/samba/tls/certs || error_exit "Fehler beim Kopieren des Zertifikats"
|
||||
cp /tmp/CERT_${HOSTNAME}.crt /etc/samba/tls/certs || error_exit "Fehler beim Kopieren des Zertifikats"
|
||||
cp /tmp/fullchain_${HOSTNAME}.crt /etc/samba/tls/certs || error_exit "Fehler beim Kopieren des Fullchain-Zertifikats"
|
||||
cp /tmp/KEY_${HOSTNAME}.pem /etc/samba/tls/private || error_exit "Fehler beim Kopieren des Schlüssels"
|
||||
|
||||
# Setzen der Berechtigungen
|
||||
chmod 644 /etc/samba/tls/certs/* || error_exit "Fehler beim Setzen der Berechtigungen für Zertifikate"
|
||||
chmod 600 /etc/samba/tls/private/* || error_exit "Fehler beim Setzen der Berechtigungen für Schlüssel"
|
||||
}
|
||||
|
||||
# Funktion zum Aktualisieren und Installieren von Paketen
|
||||
install_packages() {
|
||||
apt-get update || error_exit "Fehler beim Ausführen von apt-get update"
|
||||
apt-get upgrade -y || error_exit "Fehler beim Ausführen von apt-get upgrade"
|
||||
apt-get install -y samba samba-common-bin krb5-user krb5-config winbind libnss-winbind libpam-winbind dnsutils bind9 bind9utils bind9-doc || error_exit "Fehler beim Installieren der Pakete"
|
||||
}
|
||||
|
||||
# Funktion zum Sichern von Konfigurationsdateien
|
||||
backup_configs() {
|
||||
[ -f /etc/samba/smb.conf ] && mv /etc/samba/smb.conf /etc/samba/smb.conf.orig || error_exit "Fehler beim Sichern der smb.conf"
|
||||
[ -f /etc/krb5.conf ] && mv /etc/krb5.conf /etc/krb5.conf.orig || error_exit "Fehler beim Sichern der krb5.conf"
|
||||
}
|
||||
|
||||
# Funktion zum Erstellen der Samba-Konfiguration
|
||||
create_samba_config() {
|
||||
cat <<EOL > /etc/samba/smb.conf || error_exit "Fehler beim Schreiben der smb.conf"
|
||||
[global]
|
||||
workgroup = $DOMAIN
|
||||
bind interfaces only = Yes
|
||||
interfaces = $IP_ADDRESS
|
||||
realm = $REALM
|
||||
netbios name = $NETBIOS
|
||||
server role = active directory domain controller
|
||||
idmap_ldb:use rfc2307 = yes
|
||||
server services = -dns
|
||||
|
||||
# TLS SETTING
|
||||
tls enabled = yes
|
||||
tls keyfile = $tls_keyfile
|
||||
tls certfile = $tls_certfile
|
||||
tls cafile = $tls_cafile
|
||||
|
||||
# LOGGING SETTING
|
||||
log level = 1
|
||||
log file = /var/log/samba/log.%m
|
||||
max log size = 1000
|
||||
|
||||
# UNIX PASSWORD SETTING
|
||||
unix password sync = yes
|
||||
|
||||
[sysvol]
|
||||
path = /var/lib/samba/sysvol
|
||||
read only = no
|
||||
|
||||
[netlogon]
|
||||
path = /var/lib/samba/sysvol/${DOMAIN}/scripts
|
||||
read only = no
|
||||
EOL
|
||||
}
|
||||
|
||||
# Funktion zum Erstellen der Kerberos-Konfiguration
|
||||
create_kerberos_config() {
|
||||
cat <<EOL > /etc/krb5.conf || error_exit "Fehler beim Schreiben der krb5.conf"
|
||||
[libdefaults]
|
||||
default_realm = $REALM
|
||||
dns_lookup_realm = true
|
||||
dns_lookup_kdc = true
|
||||
ticket_lifetime = 24h
|
||||
renew_lifetime = 7d
|
||||
forwardable = true
|
||||
|
||||
[realms]
|
||||
$REALM = {
|
||||
default_domain = $(hostname -d)
|
||||
# pkinit_anchors = /etc/samba/tls/certs/CERT_HEIMLAN_Root.crt
|
||||
kdc = $(hostname -f)
|
||||
admin_server = $(hostname -f)
|
||||
}
|
||||
|
||||
[domain_realm]
|
||||
.$(hostname -d) = $REALM
|
||||
$(hostname -d) = $REALM
|
||||
EOL
|
||||
}
|
||||
|
||||
# Funktion zum Provisionieren von Samba
|
||||
provision_samba() {
|
||||
samba-tool domain provision --use-rfc2307 --realm=$REALM --domain=${DOMAIN} --server-role=dc --adminpass=$PASSWORD --dns-backend=BIND9_DLZ || error_exit "Fehler beim Provisionieren der Samba-Domäne"
|
||||
}
|
||||
|
||||
# Funktion zum Konfigurieren von Bind9 für DLZ
|
||||
configure_bind9() {
|
||||
cp /etc/bind/named.conf.options /etc/bind/named.conf.options.orig || error_exit "Fehler beim Sichern der named.conf.options"
|
||||
cp /etc/bind/named.conf.local /etc/bind/named.conf.local.orig || error_exit "Fehler beim Sichern der named.conf.local"
|
||||
|
||||
cat <<EOL > /etc/bind/named.conf.options || error_exit "Fehler beim Schreiben der named.conf.options"
|
||||
options {
|
||||
directory "/var/cache/bind";
|
||||
|
||||
forwarders {
|
||||
8.8.8.8; # Google DNS
|
||||
};
|
||||
|
||||
dnssec-validation auto;
|
||||
auth-nxdomain no; # conform to RFC1035
|
||||
listen-on-v6 { any; };
|
||||
};
|
||||
EOL
|
||||
|
||||
cat <<EOL > /etc/bind/named.conf.local || error_exit "Fehler beim Schreiben der named.conf.local"
|
||||
include "/var/lib/samba/bind-dns/named.conf";
|
||||
EOL
|
||||
}
|
||||
|
||||
# Funktion zum Setzen der Berechtigungen für Bind9 DLZ
|
||||
set_bind9_permissions() {
|
||||
mkdir /var/lib/samba/private/dns
|
||||
chown bind:bind /var/lib/samba/bind-dns/named.conf || error_exit "Fehler beim Setzen der Berechtigungen für named.conf"
|
||||
chown -R bind:bind /var/lib/samba/private/dns || error_exit "Fehler beim Setzen der Berechtigungen für das DNS-Verzeichnis"
|
||||
}
|
||||
|
||||
# Funktion zum Neustarten der Dienste
|
||||
restart_services() {
|
||||
systemctl restart smbd nmbd winbind bind9 || error_exit "Fehler beim Neustarten der Dienste"
|
||||
systemctl enable smbd nmbd winbind bind9 || error_exit "Fehler beim Aktivieren der Dienste"
|
||||
|
||||
}
|
||||
|
||||
# Hauptfunktion zum Ausführen aller Schritte
|
||||
main() {
|
||||
copy_certs_key
|
||||
install_packages
|
||||
backup_configs
|
||||
create_samba_config
|
||||
create_kerberos_config
|
||||
provision_samba
|
||||
configure_bind9
|
||||
set_bind9_permissions
|
||||
restart_services
|
||||
|
||||
echo "Samba AD DC mit Bind9-DLZ Installation abgeschlossen."
|
||||
}
|
||||
|
||||
# Ausführen der Hauptfunktion
|
||||
main
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
+141
@@ -0,0 +1,141 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablenblock
|
||||
NEXTCLOUD_VERSION="29.0.7"
|
||||
DB_NAME="nextcloud"
|
||||
DB_USER="nextclouduser"
|
||||
DB_PASSWORD=$(openssl rand -base64 32)
|
||||
DB_ROOT_PASSWORD=$(openssl rand -base64 32)
|
||||
NEXTCLOUD_DIR="/var/www/nextcloud"
|
||||
SSL_CERT_FILE="/etc/ssl/certs/nextcloud-cert.pem"
|
||||
SSL_KEY_FILE="/etc/ssl/private/nextcloud-key.pem"
|
||||
DOMAIN="nextcloud.example.com"
|
||||
APACHE_CONF="/etc/apache2/sites-available/nextcloud.conf"
|
||||
|
||||
# Funktion: Update und Installiere benötigte Pakete
|
||||
install_dependencies() {
|
||||
echo "System aktualisieren und benötigte Pakete installieren..."
|
||||
apt update && apt upgrade -y
|
||||
apt install -y apache2 mariadb-server libapache2-mod-php php php-mysql php-xml php-mbstring php-zip php-gd php-curl php-intl php-bcmath php-imagick php-gmp php-apcu unzip wget curl
|
||||
}
|
||||
|
||||
# Funktion: MariaDB konfigurieren
|
||||
configure_mariadb() {
|
||||
echo "MariaDB einrichten..."
|
||||
systemctl start mariadb
|
||||
systemctl enable mariadb
|
||||
|
||||
mysql -e "CREATE DATABASE ${DB_NAME};"
|
||||
mysql -e "CREATE USER '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASSWORD}';"
|
||||
mysql -e "GRANT ALL PRIVILEGES ON ${DB_NAME}.* TO '${DB_USER}'@'localhost';"
|
||||
mysql -e "FLUSH PRIVILEGES;"
|
||||
|
||||
# Root Passwort setzen
|
||||
mysqladmin -u root password "${DB_ROOT_PASSWORD}"
|
||||
}
|
||||
|
||||
# Funktion: SSL-Zertifikate konfigurieren
|
||||
configure_ssl() {
|
||||
echo "SSL Zertifikate konfigurieren..."
|
||||
if [[ ! -f "$SSL_CERT_FILE" || ! -f "$SSL_KEY_FILE" ]]; then
|
||||
echo "SSL-Zertifikate nicht gefunden, bitte überprüfen!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
a2enmod ssl
|
||||
systemctl restart apache2
|
||||
}
|
||||
|
||||
# Funktion: Nextcloud herunterladen und installieren
|
||||
install_nextcloud() {
|
||||
echo "Nextcloud herunterladen und installieren..."
|
||||
wget https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.zip
|
||||
unzip nextcloud-${NEXTCLOUD_VERSION}.zip -d /var/www/
|
||||
chown -R www-data:www-data ${NEXTCLOUD_DIR}
|
||||
chmod -R 755 ${NEXTCLOUD_DIR}
|
||||
}
|
||||
|
||||
# Funktion: Apache konfigurieren
|
||||
configure_apache() {
|
||||
echo "Apache für Nextcloud konfigurieren..."
|
||||
|
||||
cat <<EOF > ${APACHE_CONF}
|
||||
<VirtualHost *:80>
|
||||
ServerAdmin admin@${DOMAIN}
|
||||
DocumentRoot ${NEXTCLOUD_DIR}
|
||||
ServerName ${DOMAIN}
|
||||
|
||||
<Directory ${NEXTCLOUD_DIR}>
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ErrorLog \${APACHE_LOG_DIR}/error.log
|
||||
CustomLog \${APACHE_LOG_DIR}/access.log combined
|
||||
|
||||
RewriteEngine on
|
||||
RewriteCond %{SERVER_NAME} =${DOMAIN}
|
||||
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
|
||||
</VirtualHost>
|
||||
|
||||
<VirtualHost *:443>
|
||||
ServerAdmin admin@${DOMAIN}
|
||||
DocumentRoot ${NEXTCLOUD_DIR}
|
||||
ServerName ${DOMAIN}
|
||||
|
||||
<Directory ${NEXTCLOUD_DIR}>
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile ${SSL_CERT_FILE}
|
||||
SSLCertificateKeyFile ${SSL_KEY_FILE}
|
||||
|
||||
ErrorLog \${APACHE_LOG_DIR}/error.log
|
||||
CustomLog \${APACHE_LOG_DIR}/access.log combined
|
||||
</VirtualHost>
|
||||
EOF
|
||||
|
||||
a2ensite nextcloud.conf
|
||||
a2enmod rewrite headers env dir mime
|
||||
systemctl restart apache2
|
||||
}
|
||||
|
||||
# Funktion: Nextcloud über die Kommandozeile initialisieren
|
||||
initialize_nextcloud() {
|
||||
echo "Nextcloud initialisieren..."
|
||||
|
||||
sudo -u www-data php ${NEXTCLOUD_DIR}/occ maintenance:install \
|
||||
--database "mysql" \
|
||||
--database-name "${DB_NAME}" \
|
||||
--database-user "${DB_USER}" \
|
||||
--database-pass "${DB_PASSWORD}" \
|
||||
--admin-user "admin" \
|
||||
--admin-pass "$(openssl rand -base64 16)"
|
||||
|
||||
sudo -u www-data php ${NEXTCLOUD_DIR}/occ config:system:set trusted_domains 0 --value="${DOMAIN}"
|
||||
sudo -u www-data php ${NEXTCLOUD_DIR}/occ config:system:set overwrite.cli.url --value="https://${DOMAIN}/"
|
||||
}
|
||||
|
||||
# Funktion: Firewall konfigurieren
|
||||
configure_firewall() {
|
||||
echo "Firewall konfigurieren..."
|
||||
ufw allow in "Apache Full"
|
||||
ufw enable
|
||||
}
|
||||
|
||||
# Installation starten
|
||||
main() {
|
||||
install_dependencies
|
||||
configure_mariadb
|
||||
configure_ssl
|
||||
install_nextcloud
|
||||
configure_apache
|
||||
initialize_nextcloud
|
||||
configure_firewall
|
||||
echo "Installation abgeschlossen. Besuchen Sie https://${DOMAIN}, um Ihre Nextcloud-Instanz zu nutzen."
|
||||
}
|
||||
|
||||
# Skript starten
|
||||
main
|
||||
Reference in New Issue
Block a user