Initialer Import der Synology Scripts
This commit is contained in:
root
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Executable
+87
@@ -0,0 +1,87 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit on any error
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
||||
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
||||
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
||||
DNS_FORWARDER="192.168.1.1" # Externer DNS-Forwarder (Google in diesem Fall)
|
||||
EXTERNAL_CA="true" # Setzt das Skript auf externe CA
|
||||
PASSWORD="P@ssw0rd1234" # Admin-Passwort (in der Praxis sicher speichern)
|
||||
DIRMAN_PASSWORD="P@ssw0rd12345" # Directory Manager Passwort
|
||||
|
||||
# Function to check if running as root
|
||||
function check_root {
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo "Dieses Skript muss als Root ausgeführt werden!" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to install the necessary packages
|
||||
function install_packages {
|
||||
echo "Installiere benötigte Pakete..."
|
||||
# System aktualisieren
|
||||
echo "Aktualisiere das System..."
|
||||
sudo yum update -y
|
||||
|
||||
# Erforderliche Pakete installieren
|
||||
echo "Installiere erforderliche Pakete..."
|
||||
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
sudo dnf -y install @idm:DL1
|
||||
|
||||
# Erforderliche Pakete installieren
|
||||
echo "Installiere erforderliche Pakete..."
|
||||
sudo yum install -y ipa-server ipa-server-dns
|
||||
}
|
||||
|
||||
# Function to install the IDM server
|
||||
function install_idm_server {
|
||||
echo "Installiere IdM-Server mit DNS..."
|
||||
|
||||
# Falls externe CA genutzt werden soll, aber keine eigene CA installiert wird
|
||||
if [ "$EXTERNAL_CA" = "true" ]; then
|
||||
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
||||
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
||||
--ip-address=$IP_ADDRESS --no-pkinit --external-ca \
|
||||
--setup-dns --auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U
|
||||
else
|
||||
# Für den Fall, dass keine externe CA genutzt wird, aber dennoch ohne CA gearbeitet wird
|
||||
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
||||
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
||||
--ip-address=$IP_ADDRESS --no-pkinit --setup-dns \
|
||||
--auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to configure firewall
|
||||
function configure_firewall {
|
||||
echo "Konfiguriere Firewall..."
|
||||
firewall-cmd --add-service=freeipa-ldap --permanent
|
||||
firewall-cmd --add-service=freeipa-ldaps --permanent
|
||||
firewall-cmd --add-service=freeipa-replication --permanent
|
||||
firewall-cmd --add-service=freeipa-trust --permanent
|
||||
firewall-cmd --add-service=dns --permanent
|
||||
firewall-cmd --add-port=88/tcp --permanent # Kerberos
|
||||
firewall-cmd --add-port=88/udp --permanent # Kerberos
|
||||
firewall-cmd --add-port=464/tcp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=464/udp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=123/udp --permanent # NTP
|
||||
firewall-cmd --reload
|
||||
}
|
||||
|
||||
# Main function
|
||||
function main {
|
||||
check_root
|
||||
install_packages
|
||||
install_idm_server
|
||||
configure_firewall
|
||||
echo "IdM-Server Installation abgeschlossen."
|
||||
}
|
||||
|
||||
# Run the script
|
||||
main
|
||||
+556
@@ -0,0 +1,556 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
POSTGRES_USER=alfresco
|
||||
POSTGRES_PASSWORD=alfresco
|
||||
POSTGRES_DB=alfresco
|
||||
|
||||
JAVA_HOME=/usr/lib/jvm/java-17-openjdk
|
||||
TOMCAT_VERSION=10.1.26
|
||||
TOMCAT_USER=rheluser
|
||||
TOMCAT_GROUP=rheluser
|
||||
TOMCAT_HOME=/home/rheluser/tomcat
|
||||
|
||||
ACTIVEMQ_VERSION=5.18.5
|
||||
ACTIVEMQ_USER=rheluser
|
||||
ACTIVEMQ_GROUP=rheluser
|
||||
ACTIVEMQ_HOME=/home/rheluser/activemq
|
||||
|
||||
SOLR_VERSION=2.0.9.1
|
||||
SOLR_USER=rheluser
|
||||
SOLR_GROUP=rheluser
|
||||
SOLR_HOME=/home/rheluser/alfresco-search-services
|
||||
|
||||
TRANSFORM_JAR=alfresco-transform-core-aio-5.1.0.jar
|
||||
TRANSFORM_USER=rheluser
|
||||
TRANSFORM_GROUP=rheluser
|
||||
TRANSFORM_HOME=/home/rheluser/transform
|
||||
|
||||
NODEJS_SETUP_URL="/root/RHEL_full_install_alfresco_addon.sh"
|
||||
CONTENT_APP_REPO=https://github.com/Alfresco/alfresco-content-app.git
|
||||
CONTENT_APP_VERSION=4.4.1
|
||||
NGINX_CONF_PATH=/etc/nginx/conf.d/alfresco-content-app.conf
|
||||
NGINX_ROOT=/var/www/alfresco-content-app
|
||||
|
||||
# Helper function to print and execute commands
|
||||
execute() {
|
||||
echo "$ $@"
|
||||
"$@"
|
||||
}
|
||||
# Anlegen des Users und Gruppe
|
||||
user_add_and_group(){
|
||||
execute sudo groupadd rheluser
|
||||
execute sudo useradd -m -g rheluser rheluser
|
||||
}
|
||||
|
||||
# Update and upgrade the system
|
||||
00_update_system() {
|
||||
echo "Updating system..."
|
||||
execute sudo dnf update -y
|
||||
}
|
||||
|
||||
# Install PostgreSQL and configure database
|
||||
01_install_postgresql() {
|
||||
echo "Installing PostgreSQL..."
|
||||
execute sudo dnf install -y postgresql-server postgresql-contrib
|
||||
|
||||
echo "Initializing PostgreSQL database..."
|
||||
execute sudo postgresql-setup --initdb
|
||||
|
||||
echo "Configuring PostgreSQL..."
|
||||
execute sudo sed -i 's/local\s\+all\s\+postgres\s\+peer/local all postgres trust/' /var/lib/pgsql/data/pg_hba.conf
|
||||
execute sudo sed -i 's/local\s\+all\s\+all\s\+peer/local all all md5/' /var/lib/pgsql/data/pg_hba.conf
|
||||
|
||||
echo "Starting PostgreSQL service..."
|
||||
execute sudo systemctl start postgresql
|
||||
execute sudo systemctl enable postgresql
|
||||
|
||||
echo "Configuring Alfresco database..."
|
||||
execute sudo -u postgres psql -c "CREATE USER ${POSTGRES_USER} WITH PASSWORD '$POSTGRES_PASSWORD';"
|
||||
execute sudo -u postgres psql -c "CREATE DATABASE ${POSTGRES_DB} OWNER ${POSTGRES_USER} ENCODING 'UTF8';"
|
||||
execute sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE ${POSTGRES_DB} TO ${POSTGRES_USER};"
|
||||
}
|
||||
|
||||
# Install Java JDK 17
|
||||
02_install_java() {
|
||||
echo "Installing Java JDK 17..."
|
||||
execute sudo dnf install -y java-17-openjdk
|
||||
|
||||
echo "Checking Java version..."
|
||||
execute java -version
|
||||
}
|
||||
|
||||
# Install Apache Tomcat
|
||||
03_install_tomcat() {
|
||||
echo "Downloading and installing Apache Tomcat..."
|
||||
execute wget https://dlcdn.apache.org/tomcat/tomcat-10/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz -O /tmp/apache-tomcat-$TOMCAT_VERSION.tar.gz
|
||||
execute sudo mkdir -p $TOMCAT_HOME
|
||||
execute sudo tar xzvf /tmp/apache-tomcat-$TOMCAT_VERSION.tar.gz -C $TOMCAT_HOME --strip-components=1
|
||||
|
||||
echo "Setting permissions for Tomcat directories..."
|
||||
execute sudo chown -R $TOMCAT_USER:$TOMCAT_GROUP $TOMCAT_HOME
|
||||
execute sudo chmod -R u+x $TOMCAT_HOME/bin
|
||||
|
||||
echo "Creating Tomcat systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/tomcat.service
|
||||
[Unit]
|
||||
Description=Apache Tomcat Web Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=$TOMCAT_USER
|
||||
Group=$TOMCAT_GROUP
|
||||
|
||||
Environment="JAVA_HOME=$JAVA_HOME"
|
||||
Environment="CATALINA_PID=$TOMCAT_HOME/temp/tomcat.pid"
|
||||
Environment="CATALINA_HOME=$TOMCAT_HOME"
|
||||
Environment="CATALINA_BASE=$TOMCAT_HOME"
|
||||
Environment="CATALINA_OPTS=-Xms2048M -Xmx3072M -server -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80"
|
||||
Environment="JAVA_OPTS=-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom"
|
||||
Environment="JAVA_TOOL_OPTIONS=-Dencryption.keystore.type=JCEKS -Dencryption.cipherAlgorithm=DESede/CBC/PKCS5Padding -Dencryption.keyAlgorithm=DESede -Dencryption.keystore.location=/home/rheluser/keystore/metadata-keystore/keystore -Dmetadata-keystore.password=mp6yc0UD9e -Dmetadata-keystore.aliases=metadata -Dmetadata-keystore.metadata.password=oKIWzVdEdA -Dmetadata-keystore.metadata.algorithm=DESede"
|
||||
|
||||
ExecStart=$TOMCAT_HOME/bin/startup.sh
|
||||
ExecStop=$TOMCAT_HOME/bin/shutdown.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
execute sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Tomcat service..."
|
||||
execute sudo systemctl start tomcat
|
||||
|
||||
echo "Stopping Tomcat service..."
|
||||
execute sudo systemctl stop tomcat
|
||||
|
||||
echo "Enabling Tomcat service to start on boot..."
|
||||
execute sudo systemctl enable tomcat
|
||||
}
|
||||
|
||||
# Install Apache ActiveMQ
|
||||
04_install_activemq() {
|
||||
echo "Downloading and installing Apache ActiveMQ..."
|
||||
execute wget https://dlcdn.apache.org/activemq/$ACTIVEMQ_VERSION/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz -O /tmp/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz
|
||||
execute sudo mkdir -p $ACTIVEMQ_HOME
|
||||
execute sudo tar xzvf /tmp/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz -C $ACTIVEMQ_HOME --strip-components=1
|
||||
|
||||
echo "Setting permissions for ActiveMQ directories..."
|
||||
execute sudo chown -R $ACTIVEMQ_USER:$ACTIVEMQ_GROUP $ACTIVEMQ_HOME
|
||||
execute sudo chmod -R 755 $ACTIVEMQ_HOME
|
||||
|
||||
echo "Creating ActiveMQ systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/activemq.service
|
||||
[Unit]
|
||||
Description=Apache ActiveMQ
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=$ACTIVEMQ_USER
|
||||
Group=$ACTIVEMQ_GROUP
|
||||
|
||||
Environment="JAVA_HOME=$JAVA_HOME"
|
||||
Environment="ACTIVEMQ_HOME=$ACTIVEMQ_HOME"
|
||||
Environment="ACTIVEMQ_BASE=$ACTIVEMQ_HOME"
|
||||
Environment="ACTIVEMQ_CONF=$ACTIVEMQ_HOME/conf"
|
||||
Environment="ACTIVEMQ_DATA=$ACTIVEMQ_HOME/data"
|
||||
|
||||
ExecStart=$ACTIVEMQ_HOME/bin/activemq start
|
||||
ExecStop=$ACTIVEMQ_HOME/bin/activemq stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
execute sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting ActiveMQ service..."
|
||||
execute sudo systemctl start activemq
|
||||
|
||||
echo "Stopping ActiveMQ service..."
|
||||
execute sudo systemctl stop activemq
|
||||
|
||||
echo "Enabling ActiveMQ service to start on boot..."
|
||||
execute sudo systemctl enable activemq
|
||||
}
|
||||
# Download Content
|
||||
05_down_content(){
|
||||
|
||||
# Ensure system is updated and curl is installed
|
||||
echo "Updating package list and installing curl..."
|
||||
sudo dnf update -y
|
||||
sudo dnf install -y curl
|
||||
|
||||
# URLs of the resources to be downloaded
|
||||
URLS=(
|
||||
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-content-services-community-distribution/23.2.1/alfresco-content-services-community-distribution-23.2.1.zip"
|
||||
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-search-services/2.0.9.1/alfresco-search-services-2.0.9.1.zip"
|
||||
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-transform-core-aio/5.1.0/alfresco-transform-core-aio-5.1.0.jar"
|
||||
)
|
||||
|
||||
# Directory to save the downloaded files
|
||||
DOWNLOAD_DIR="./downloads"
|
||||
|
||||
# Create the download directory if it does not exist
|
||||
mkdir -p "$DOWNLOAD_DIR"
|
||||
|
||||
# Function to download a file
|
||||
download_file() {
|
||||
local url=$1
|
||||
local dest_dir=$2
|
||||
local filename=$(basename "$url")
|
||||
|
||||
echo "Downloading $filename..."
|
||||
curl -L -o "$dest_dir/$filename" -w "\nHTTP Status: %{http_code}\n" "$url"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Downloaded $filename successfully."
|
||||
else
|
||||
echo "Failed to download $filename."
|
||||
fi
|
||||
|
||||
# Check if the file size is greater than 0 bytes
|
||||
if [ ! -s "$dest_dir/$filename" ]; then
|
||||
echo "Warning: Downloaded file $filename is empty."
|
||||
fi
|
||||
}
|
||||
|
||||
# Loop through each URL and download the file
|
||||
for url in "${URLS[@]}"; do
|
||||
download_file "$url" "$DOWNLOAD_DIR"
|
||||
done
|
||||
|
||||
echo "All downloads are complete."
|
||||
|
||||
}
|
||||
|
||||
# Install Alfresco Community Edition
|
||||
06_install_alfresco(){
|
||||
|
||||
set -e
|
||||
|
||||
echo "Install unzip command"
|
||||
execute sudo dnf -y install unzip
|
||||
|
||||
echo "Create support folders and configuration in Tomcat"
|
||||
mkdir -p /home/rheluser/tomcat/shared/classes && mkdir -p /home/rheluser/tomcat/shared/lib
|
||||
sed -i 's|^shared.loader=$|shared.loader=${catalina.base}/shared/classes,${catalina.base}/shared/lib/*.jar|' /home/rheluser/tomcat/conf/catalina.properties
|
||||
|
||||
echo "Unzip Alfresco ZIP Distribution File"
|
||||
mkdir /tmp/alfresco
|
||||
unzip downloads/alfresco-content-services-community-distribution-23.2.1.zip -d /tmp/alfresco
|
||||
|
||||
echo "Copy JDBC driver"
|
||||
cp /tmp/alfresco/web-server/lib/postgresql-42.6.0.jar /home/rheluser/tomcat/shared/lib/
|
||||
|
||||
echo "Configure JAR Addons deployment"
|
||||
mkdir -p /home/rheluser/modules/platform && mkdir -p /home/rheluser/modules/share && mkdir -p /home/rheluser/tomcat/conf/Catalina/localhost
|
||||
cp /tmp/alfresco/web-server/conf/Catalina/localhost/* /home/rheluser/tomcat/conf/Catalina/localhost/
|
||||
|
||||
echo "Install Web Applications"
|
||||
cp /tmp/alfresco/web-server/webapps/* /home/rheluser/tomcat/webapps/
|
||||
|
||||
echo "Apply configuration"
|
||||
cp -r /tmp/alfresco/web-server/shared/classes/* /home/rheluser/tomcat/shared/classes/
|
||||
mkdir /home/rheluser/keystore && cp -r /tmp/alfresco/keystore/* /home/rheluser/keystore/
|
||||
mkdir /home/rheluser/alf_data
|
||||
cat <<EOL | tee /home/rheluser/tomcat/shared/classes/alfresco-global.properties
|
||||
#
|
||||
# Custom content and index data location
|
||||
#
|
||||
dir.root=/home/rheluser/alf_data
|
||||
dir.keystore=/home/rheluser/keystore/
|
||||
|
||||
#
|
||||
# Database connection properties
|
||||
#
|
||||
db.username=alfresco
|
||||
db.password=alfresco
|
||||
db.driver=org.postgresql.Driver
|
||||
db.url=jdbc:postgresql://localhost:5432/alfresco
|
||||
|
||||
#
|
||||
# Solr Configuration
|
||||
#
|
||||
solr.secureComms=secret
|
||||
solr.sharedSecret=secret
|
||||
solr.host=localhost
|
||||
solr.port=8983
|
||||
index.subsystem.name=solr6
|
||||
|
||||
#
|
||||
# Transform Configuration
|
||||
#
|
||||
localTransform.core-aio.url=http://localhost:8090/
|
||||
|
||||
#
|
||||
# Events Configuration
|
||||
#
|
||||
messaging.broker.url=failover:(nio://localhost:61616)?timeout=3000&jms.useCompression=true
|
||||
|
||||
#
|
||||
# URL Generation Parameters
|
||||
#-------------
|
||||
alfresco.context=alfresco
|
||||
alfresco.host=localhost
|
||||
alfresco.port=8080
|
||||
alfresco.protocol=http
|
||||
share.context=share
|
||||
share.host=localhost
|
||||
share.port=8080
|
||||
share.protocol=http
|
||||
EOL
|
||||
|
||||
echo "Apply AMPs"
|
||||
mkdir /home/rheluser/amps && cp -r /tmp/alfresco/amps/* /home/rheluser/amps/
|
||||
mkdir /home/rheluser/bin && cp -r /tmp/alfresco/bin/* /home/rheluser/bin/
|
||||
java -jar /home/rheluser/bin/alfresco-mmt.jar install /home/rheluser/amps /home/rheluser/tomcat/webapps/alfresco.war -directory
|
||||
java -jar /home/rheluser/bin/alfresco-mmt.jar list /home/rheluser/tomcat/webapps/alfresco.war
|
||||
|
||||
echo "Modify alfresco and share logs directory"
|
||||
mkdir /home/rheluser/tomcat/webapps/alfresco && unzip /home/rheluser/tomcat/webapps/alfresco.war -d /home/rheluser/tomcat/webapps/alfresco
|
||||
mkdir /home/rheluser/tomcat/webapps/share && unzip /home/rheluser/tomcat/webapps/share.war -d /home/rheluser/tomcat/webapps/share
|
||||
sed -i 's|^appender\.rolling\.fileName=alfresco\.log|appender.rolling.fileName=/home/rheluser/tomcat/logs/alfresco.log|' /home/rheluser/tomcat/webapps/alfresco/WEB-INF/classes/log4j2.properties
|
||||
sed -i 's|^appender\.rolling\.fileName=share\.log|appender.rolling.fileName=/home/rheluser/tomcat/logs/share.log|' /home/rheluser/tomcat/webapps/share/WEB-INF/classes/log4j2.properties
|
||||
|
||||
echo "Alfresco has been configured"
|
||||
|
||||
}
|
||||
# Install Apache Solr
|
||||
07_install_solr() {
|
||||
echo "Downloading and installing Apache Solr..."
|
||||
execute mkdir /tmp/solr
|
||||
execute unzip downloads/alfresco-search-services-$SOLR_VERSION.zip -d /tmp/solr
|
||||
execute mv /tmp/solr/alfresco-search-services /home/rheluser
|
||||
|
||||
echo "Creating Solr systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/solr.service
|
||||
[Unit]
|
||||
Description=Apache SOLR Web Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
|
||||
User=$SOLR_USER
|
||||
Group=$SOLR_GROUP
|
||||
|
||||
Environment="JAVA_HOME=$JAVA_HOME"
|
||||
|
||||
ExecStart=/home/rheluser/alfresco-search-services/solr/bin/solr start -a "-Dcreate.alfresco.defaults=alfresco,archive -Dalfresco.secureComms=secret -Dalfresco.secureComms.secret=secret"
|
||||
ExecStop=/home/rheluser/alfresco-search-services/solr/bin/solr stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
execute sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Solr service..."
|
||||
execute sudo systemctl start solr
|
||||
|
||||
echo "Stopping Solr service..."
|
||||
execute sudo systemctl stop solr
|
||||
|
||||
echo "Enabling Solr service to start on boot..."
|
||||
execute sudo systemctl enable solr
|
||||
}
|
||||
|
||||
# Install Transform dependencies
|
||||
08_install_transform() {
|
||||
sudo subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
sudo dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
|
||||
echo "Install Transform dependencies"
|
||||
sudo dnf install -y GraphicsMagick libreoffice perl-Image-ExifTool
|
||||
|
||||
echo "Downloading and installing Alfresco PDF Renderer..."
|
||||
execute curl -L -o /tmp/alfresco-pdf-renderer-1.2-linux.tgz https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-pdf-renderer/1.2/alfresco-pdf-renderer-1.2-linux.tgz
|
||||
execute sudo tar xf /tmp/alfresco-pdf-renderer-1.2-linux.tgz -C /usr/bin
|
||||
|
||||
echo "Configuring Transform server..."
|
||||
execute mkdir /home/rheluser/transform
|
||||
execute cp downloads/alfresco-transform-core-aio-5.1.0.jar /home/rheluser/transform
|
||||
|
||||
echo "Creating Transform systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/transform.service
|
||||
[Unit]
|
||||
Description=Transform Application Container
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
|
||||
User=$TRANSFORM_USER
|
||||
Group=$TRANSFORM_GROUP
|
||||
|
||||
Environment="JAVA_HOME=$JAVA_HOME"
|
||||
Environment="LIBREOFFICE_HOME=/usr/lib/libreoffice"
|
||||
|
||||
ExecStart=java -jar /home/rheluser/transform/alfresco-transform-core-aio-5.1.0.jar
|
||||
ExecStop=/bin/kill -15 $MAINPID
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
execute sudo systemctl daemon-reload
|
||||
|
||||
echo "Starting Transform service..."
|
||||
execute sudo systemctl start transform
|
||||
|
||||
echo "Stopping Transform service..."
|
||||
execute sudo systemctl stop transform
|
||||
|
||||
echo "Enabling Transform service to start on boot..."
|
||||
execute sudo systemctl enable transform
|
||||
}
|
||||
|
||||
# Install Node.js and build Alfresco Content App
|
||||
09_install_nodejs() {
|
||||
echo "Installing Node.js and npm..."
|
||||
#execute curl -fsSL $NODEJS_SETUP_URL | sudo -E bash -
|
||||
bash $NODEJS_SETUP_UR
|
||||
execute sudo dnf install -y nodejs
|
||||
|
||||
echo "Verifying Node.js and npm installation..."
|
||||
execute node -v
|
||||
execute npm -v
|
||||
|
||||
echo "Cloning and building Alfresco Content App..."
|
||||
execute git clone $CONTENT_APP_REPO
|
||||
execute cd alfresco-content-app
|
||||
execute git checkout tags/$CONTENT_APP_VERSION -b $CONTENT_APP_VERSION
|
||||
execute npm install
|
||||
execute npm run build
|
||||
}
|
||||
|
||||
# Install and configure Nginx
|
||||
10_install_nginx() {
|
||||
echo "Installing Nginx..."
|
||||
execute sudo dnf install -y nginx
|
||||
|
||||
echo "Creating directory for Alfresco Content App..."
|
||||
execute sudo mkdir -p $NGINX_ROOT
|
||||
execute sudo cp -r /home/rheluser/alfresco-content-app/dist/content-ce/* $NGINX_ROOT
|
||||
|
||||
echo "Creating Nginx systemd service file..."
|
||||
cat <<EOL | sudo tee /etc/systemd/system/nginx.service
|
||||
[Unit]
|
||||
Description=A high performance web server and a reverse proxy server
|
||||
Documentation=man:nginx(8)
|
||||
After=network.target remote-fs.target nss-lookup.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
PIDFile=/run/nginx/nginx.pid
|
||||
ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
|
||||
ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
|
||||
ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
|
||||
ExecStop=/bin/kill -s QUIT $MAINPID
|
||||
PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOL
|
||||
|
||||
echo "Reloading systemd daemon..."
|
||||
execute sudo systemctl daemon-reload
|
||||
|
||||
echo "Enabling Nginx service to start on boot..."
|
||||
execute sudo systemctl enable nginx
|
||||
|
||||
echo "Configuring Nginx..."
|
||||
cat <<EOL | sudo tee $NGINX_CONF_PATH
|
||||
server {
|
||||
listen 80;
|
||||
server_name localhost;
|
||||
|
||||
client_max_body_size 0;
|
||||
|
||||
set \$allowOriginSite *;
|
||||
proxy_pass_request_headers on;
|
||||
proxy_pass_header Set-Cookie;
|
||||
|
||||
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
|
||||
proxy_redirect off;
|
||||
proxy_buffering off;
|
||||
proxy_set_header Host \$host:\$server_port;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_pass_header Set-Cookie;
|
||||
|
||||
root $NGINX_ROOT;
|
||||
index index.html;
|
||||
|
||||
location / {
|
||||
try_files \$uri \$uri/ /index.html;
|
||||
}
|
||||
|
||||
location /alfresco/ {
|
||||
proxy_pass http://localhost:8080;
|
||||
}
|
||||
|
||||
location /share/ {
|
||||
proxy_pass http://localhost:8080;
|
||||
}
|
||||
}
|
||||
EOL
|
||||
|
||||
echo "Restarting Nginx..."
|
||||
execute sudo systemctl restart nginx
|
||||
}
|
||||
11_service_restart(){
|
||||
## RECOMMENDATION: run this sequence of commands manually, waiting between one command and the next one to ensure service dependencies are met.
|
||||
|
||||
echo "Starting postgresql"
|
||||
sudo systemctl start postgresql
|
||||
|
||||
echo "Starting activemq"
|
||||
sudo systemctl start activemq
|
||||
|
||||
echo "Starting transform"
|
||||
sudo systemctl start transform
|
||||
|
||||
echo "Starting tomcat"
|
||||
sudo systemctl start tomcat
|
||||
|
||||
echo "Starting solr"
|
||||
sudo systemctl start solr
|
||||
|
||||
echo "Starting nginx"
|
||||
sudo systemctl start nginx
|
||||
|
||||
|
||||
echo "Services have been started successfully!"
|
||||
}
|
||||
|
||||
# Main script execution
|
||||
main() {
|
||||
user_add_and_group
|
||||
00_update_system
|
||||
01_install_postgresql
|
||||
02_install_java
|
||||
03_install_tomcat
|
||||
04_install_activemq
|
||||
05_down_content
|
||||
06_install_alfresco
|
||||
07_install_solr
|
||||
08_install_transform
|
||||
09_install_nodejs
|
||||
10_install_nginx
|
||||
11_servie_restart
|
||||
echo "Installation and configuration complete."
|
||||
}
|
||||
|
||||
main
|
||||
+100
@@ -0,0 +1,100 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Logger Function
|
||||
log() {
|
||||
local message="$1"
|
||||
local type="$2"
|
||||
local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
|
||||
local color
|
||||
local endcolor="\033[0m"
|
||||
|
||||
case "$type" in
|
||||
"info") color="\033[38;5;79m" ;;
|
||||
"success") color="\033[1;32m" ;;
|
||||
"error") color="\033[1;31m" ;;
|
||||
*) color="\033[1;34m" ;;
|
||||
esac
|
||||
|
||||
echo -e "${color}${timestamp} - ${message}${endcolor}"
|
||||
}
|
||||
|
||||
# Error handler function
|
||||
handle_error() {
|
||||
local exit_code=$1
|
||||
local error_message="$2"
|
||||
log "Error: $error_message (Exit Code: $exit_code)" "error"
|
||||
exit $exit_code
|
||||
}
|
||||
|
||||
# Function to check for command availability
|
||||
command_exists() {
|
||||
command -v "$1" &> /dev/null
|
||||
}
|
||||
|
||||
check_os() {
|
||||
if ! [ -f "/etc/redhat-release" ]; then
|
||||
echo "Error: This script is only supported on RHEL-based systems."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to install the script prerequisites
|
||||
install_pre_reqs() {
|
||||
log "Installing pre-requisites" "info"
|
||||
|
||||
# Run 'yum update'
|
||||
if ! yum update -y; then
|
||||
handle_error "$?" "Failed to run 'yum update'"
|
||||
fi
|
||||
|
||||
# Install required packages
|
||||
if ! yum install -y curl ca-certificates gnupg2; then
|
||||
handle_error "$?" "Failed to install required packages"
|
||||
fi
|
||||
|
||||
# Create directory for keyrings
|
||||
if ! mkdir -p /etc/pki/rpm-gpg; then
|
||||
handle_error "$?" "Failed to create /etc/pki/rpm-gpg directory"
|
||||
fi
|
||||
|
||||
# Remove old keyring if exists
|
||||
rm -f /etc/pki/rpm-gpg/nodesource.gpg || true
|
||||
|
||||
# Download and import the NodeSource GPG key
|
||||
if ! curl -fsSL https://rpm.nodesource.com/pub/el/NODESOURCE-GPG-SIGNING-KEY-EL | gpg --dearmor -o /etc/pki/rpm-gpg/nodesource.gpg; then
|
||||
handle_error "$?" "Failed to download and import the NodeSource GPG key"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to configure the Node.js repository for RHEL
|
||||
configure_repo() {
|
||||
local node_version=$1
|
||||
|
||||
# Create the Nodesource repo file
|
||||
cat <<EOF > /etc/yum.repos.d/nodesource.repo
|
||||
[nodesource]
|
||||
name=Node.js Packages for Enterprise Linux
|
||||
baseurl=https://rpm.nodesource.com/pub_$(echo $node_version | tr -d 'x').x/el/\$releasever/\$basearch
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/nodesource.gpg
|
||||
EOF
|
||||
|
||||
# Run 'yum clean all' and 'yum makecache' to refresh the repository
|
||||
if ! yum clean all && yum makecache; then
|
||||
handle_error "$?" "Failed to refresh repositories"
|
||||
else
|
||||
log "Repository configured successfully." "success"
|
||||
log "To install Node.js, run: yum install nodejs -y" "info"
|
||||
fi
|
||||
}
|
||||
|
||||
# Define Node.js version
|
||||
NODE_VERSION="20.x"
|
||||
|
||||
# Check OS
|
||||
check_os
|
||||
|
||||
# Main execution
|
||||
install_pre_reqs || handle_error $? "Failed installing pre-requisites"
|
||||
configure_repo "$NODE_VERSION" || handle_error $? "Failed configuring repository"
|
||||
Executable
+280
@@ -0,0 +1,280 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit immediately if a command exits with a non-zero status
|
||||
set -e
|
||||
|
||||
# Log file
|
||||
LOG_FILE="/var/log/ejbca_install.log"
|
||||
exec > >(tee -i $LOG_FILE)
|
||||
exec 2>&1
|
||||
|
||||
# State file
|
||||
STATE_FILE="/var/log/ejbca_install_state.log"
|
||||
|
||||
# Variables
|
||||
EJBCA_VERSION="r8.3.2"
|
||||
DB_NAME="ejbca"
|
||||
DB_USER="ejbcauser"
|
||||
DB_PASS="your_password"
|
||||
EJBCA_HOST="localhost"
|
||||
EJBCA_PORT="8080"
|
||||
ADMIN_PASSWORD="adminpassword"
|
||||
EJBCA_URL="https://github.com/Keyfactor/ejbca-ce/archive/refs/tags/${EJBCA_VERSION}/${EJBCA_VERSION}.zip"
|
||||
EJBCA_DIR="/opt/ejbca-ce-r8.3.2"
|
||||
|
||||
# Update state function
|
||||
update_state() {
|
||||
echo "$1" > $STATE_FILE
|
||||
}
|
||||
|
||||
# Read state function
|
||||
read_state() {
|
||||
if [ -f $STATE_FILE ]; then
|
||||
cat $STATE_FILE
|
||||
else
|
||||
echo "0"
|
||||
fi
|
||||
}
|
||||
|
||||
# Hauptfunktion: Installation Prerequisites
|
||||
installation_prerequisites() {
|
||||
echo "Installation Prerequisites..."
|
||||
update_state "1"
|
||||
|
||||
# Subfunktion: System Update
|
||||
system_update
|
||||
|
||||
# Subfunktion: Install Utilities
|
||||
install_utilities
|
||||
}
|
||||
|
||||
system_update() {
|
||||
echo "Updating system..."
|
||||
sudo dnf update -y
|
||||
update_state "1.1"
|
||||
}
|
||||
|
||||
install_utilities() {
|
||||
echo "Installing utilities..."
|
||||
sudo dnf install -y epel-release wget unzip
|
||||
update_state "1.2"
|
||||
}
|
||||
|
||||
# Hauptfunktion: Managing EJBCA Configurations
|
||||
managing_ejbca_configurations() {
|
||||
echo "Managing EJBCA Configurations..."
|
||||
update_state "2"
|
||||
|
||||
# Subfunktion: Install Java
|
||||
install_java
|
||||
|
||||
# Subfunktion: Install Application Server
|
||||
install_application_server
|
||||
}
|
||||
|
||||
install_java() {
|
||||
echo "Installing Java..."
|
||||
sudo dnf install -y java-11-openjdk java-11-openjdk-devel
|
||||
java -version
|
||||
update_state "2.1"
|
||||
}
|
||||
|
||||
install_application_server() {
|
||||
echo "Installing Application Server..."
|
||||
sudo dnf install -y tomcat
|
||||
sudo systemctl start tomcat
|
||||
sudo systemctl enable tomcat
|
||||
update_state "2.2"
|
||||
}
|
||||
|
||||
# Hauptfunktion: Creating Database
|
||||
creating_database() {
|
||||
echo "Creating Database..."
|
||||
update_state "3"
|
||||
|
||||
# Subfunktion: Install MariaDB
|
||||
install_mariadb
|
||||
|
||||
# Subfunktion: Secure MariaDB
|
||||
secure_mariadb
|
||||
|
||||
# Subfunktion: Setup Database
|
||||
setup_database
|
||||
}
|
||||
|
||||
install_mariadb() {
|
||||
echo "Installing MariaDB..."
|
||||
sudo dnf install -y mariadb-server
|
||||
sudo systemctl start mariadb
|
||||
sudo systemctl enable mariadb
|
||||
update_state "3.1"
|
||||
}
|
||||
|
||||
secure_mariadb() {
|
||||
echo "Securing MariaDB installation..."
|
||||
sudo mysql_secure_installation <<EOF
|
||||
|
||||
Y
|
||||
${DB_PASS}
|
||||
${DB_PASS}
|
||||
Y
|
||||
Y
|
||||
Y
|
||||
Y
|
||||
EOF
|
||||
update_state "3.2"
|
||||
}
|
||||
|
||||
setup_database() {
|
||||
echo "Setting up EJBCA database..."
|
||||
sudo mysql -u root -p${DB_PASS} -e "CREATE DATABASE ${DB_NAME};"
|
||||
sudo mysql -u root -p${DB_PASS} -e "CREATE USER '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}';"
|
||||
sudo mysql -u root -p${DB_PASS} -e "GRANT ALL PRIVILEGES ON ${DB_NAME}.* TO '${DB_USER}'@'localhost';"
|
||||
sudo mysql -u root -p${DB_PASS} -e "FLUSH PRIVILEGES;"
|
||||
update_state "3.3"
|
||||
}
|
||||
|
||||
# Hauptfunktion: Deploying EJBCA
|
||||
deploying_ejbca() {
|
||||
echo "Deploying EJBCA..."
|
||||
update_state "4"
|
||||
|
||||
# Subfunktion: Download EJBCA
|
||||
download_ejbca
|
||||
|
||||
# Subfunktion: Unzip EJBCA
|
||||
unzip_ejbca
|
||||
}
|
||||
|
||||
download_ejbca() {
|
||||
echo "Downloading EJBCA..."
|
||||
wget ${EJBCA_URL} -O ${EJBCA_VERSION}.zip
|
||||
update_state "4.1"
|
||||
}
|
||||
|
||||
unzip_ejbca() {
|
||||
echo "Unzipping EJBCA..."
|
||||
unzip ${EJBCA_VERSION}.zip -d /opt
|
||||
update_state "4.2"
|
||||
}
|
||||
|
||||
# Hauptfunktion: Installing EJBCA
|
||||
installing_ejbca() {
|
||||
echo "Installing EJBCA..."
|
||||
update_state "5"
|
||||
|
||||
# Subfunktion: Setup EJBCA
|
||||
setup_ejbca
|
||||
|
||||
# Subfunktion: Configure EJBCA
|
||||
configure_ejbca
|
||||
}
|
||||
|
||||
setup_ejbca() {
|
||||
echo "Setting up EJBCA..."
|
||||
cd ${EJBCA_DIR}
|
||||
./bin/ejbca.sh install
|
||||
update_state "5.1"
|
||||
}
|
||||
|
||||
configure_ejbca() {
|
||||
echo "Configuring EJBCA..."
|
||||
sudo cp conf/database.properties.sample conf/database.properties
|
||||
sudo sed -i "s/ejbcauser:ejbcauser_password@localhost:3306/${DB_USER}:${DB_PASS}@localhost:3306/" conf/database.properties
|
||||
update_state "5.2"
|
||||
}
|
||||
|
||||
# Hauptfunktion: Finalizing the Installation
|
||||
finalizing_the_installation() {
|
||||
echo "Finalizing the Installation..."
|
||||
update_state "6"
|
||||
|
||||
# Subfunktion: Deploy on Tomcat
|
||||
deploy_on_tomcat
|
||||
|
||||
# Subfunktion: Configure Firewall
|
||||
configure_firewall
|
||||
|
||||
# Subfunktion: Check Services
|
||||
check_services
|
||||
|
||||
# Subfunktion: Create Status File
|
||||
create_status_file
|
||||
}
|
||||
|
||||
deploy_on_tomcat() {
|
||||
echo "Deploying EJBCA on Tomcat..."
|
||||
sudo ./bin/ejbca.sh deploy tomcat
|
||||
sudo systemctl restart tomcat
|
||||
update_state "6.1"
|
||||
}
|
||||
|
||||
configure_firewall() {
|
||||
echo "Configuring firewall..."
|
||||
sudo firewall-cmd --zone=public --add-port=${EJBCA_PORT}/tcp --permanent
|
||||
sudo firewall-cmd --reload
|
||||
update_state "6.2"
|
||||
}
|
||||
|
||||
check_services() {
|
||||
echo "Checking Tomcat status..."
|
||||
sudo systemctl status tomcat
|
||||
|
||||
echo "Checking MariaDB status..."
|
||||
sudo systemctl status mariadb
|
||||
|
||||
update_state "6.3"
|
||||
}
|
||||
|
||||
create_status_file() {
|
||||
STATUS_FILE="/var/log/ejbca_install_status.txt"
|
||||
{
|
||||
echo "EJBCA Installation Status"
|
||||
echo "-------------------------"
|
||||
echo "Java version:"
|
||||
java -version
|
||||
echo "Tomcat status:"
|
||||
check_service_status tomcat
|
||||
echo "MariaDB status:"
|
||||
check_service_status mariadb
|
||||
echo "Firewall status:"
|
||||
check_port_status $EJBCA_PORT
|
||||
echo "Installation log:"
|
||||
cat $LOG_FILE
|
||||
} > $STATUS_FILE
|
||||
|
||||
echo "EJBCA has been installed and deployed. Access it at http://${EJBCA_HOST}:${EJBCA_PORT}/ejbca"
|
||||
echo "Use the password ${ADMIN_PASSWORD} for the WildFly management console."
|
||||
echo "Installation status saved to ${STATUS_FILE}"
|
||||
update_state "6.4"
|
||||
}
|
||||
|
||||
check_service_status() {
|
||||
local service=$1
|
||||
if systemctl is-active --quiet $service; then
|
||||
echo "$service is active."
|
||||
else
|
||||
echo "$service is not active."
|
||||
fi
|
||||
}
|
||||
|
||||
check_port_status() {
|
||||
local port=$1
|
||||
if sudo firewall-cmd --list-ports | grep -q $port; then
|
||||
echo "Port $port is open."
|
||||
else
|
||||
echo "Port $port is not open."
|
||||
fi
|
||||
}
|
||||
|
||||
# Main script execution based on state
|
||||
case $(read_state) in
|
||||
0) installation_prerequisites ;;
|
||||
1) managing_ejbca_configurations ;;
|
||||
2) creating_database ;;
|
||||
3) deploying_ejbca ;;
|
||||
4) installing_ejbca ;;
|
||||
5) finalizing_the_installation ;;
|
||||
6) echo "Installation is complete." ;;
|
||||
*) echo "Unknown state. Exiting." ;;
|
||||
esac
|
||||
+307
@@ -0,0 +1,307 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen anpassen
|
||||
REALM="MGT.HEIM.LAN"
|
||||
lowerREALM=$(hostname -d)
|
||||
DOMAIN="MGT"
|
||||
HOSTNAME="pdc"
|
||||
PASSWORD="P@ssw0rd"
|
||||
STATE_FILE="/var/log/samba_setup_state"
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}')
|
||||
HOSTNAME=$(hostname)
|
||||
FQDN=$(hostname -f)
|
||||
IP_FORWARDER="192.168.1.1"
|
||||
# Initialisiere den Fortschrittszustand, falls nicht vorhanden
|
||||
if [ ! -f "$STATE_FILE" ]; then
|
||||
echo "0" > "$STATE_FILE"
|
||||
fi
|
||||
|
||||
# Lese den aktuellen Fortschritt
|
||||
CURRENT_STEP=$(cat "$STATE_FILE")
|
||||
|
||||
# Funktion zum Aktualisieren des Fortschritts
|
||||
update_state() {
|
||||
echo "$1" > "$STATE_FILE"
|
||||
}
|
||||
|
||||
# Funktion: /etc/hosts anpassen
|
||||
configure_hosts() {
|
||||
if [ "$CURRENT_STEP" -le 1 ]; then
|
||||
eche "Function Configure Hosts"
|
||||
echo "${IP_ADDRESS} ${FQDN} ${HOSTNAME}" >> /etc/hosts
|
||||
update_state 2
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: Lokaleinstellungen setzen
|
||||
set_locale() {
|
||||
if [ "$CURRENT_STEP" -le 2 ]; then
|
||||
echo "function set locale to en_US.utf8"
|
||||
localectl set-locale LANG=en_US.utf8
|
||||
update_state 3
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: SELinux deaktivieren
|
||||
disable_selinux() {
|
||||
echo "function diable selinux"
|
||||
if [ "$CURRENT_STEP" -le 3 ]; then
|
||||
sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
|
||||
update_state 4
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: System neu starten
|
||||
reboot_system() {
|
||||
echo "function reboot"
|
||||
if [ "$CURRENT_STEP" -le 4 ]; then
|
||||
update_state 5
|
||||
init 6
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: SSHD konfigurieren und neu starten
|
||||
configure_sshd() {
|
||||
echo "function configure sshd"
|
||||
if [ "$CURRENT_STEP" -le 5 ]; then
|
||||
nano /etc/ssh/sshd_config
|
||||
systemctl restart sshd
|
||||
update_state 6
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: SELinux Status prüfen
|
||||
check_selinux_status() {
|
||||
echo "function check selinux"
|
||||
if [ "$CURRENT_STEP" -le 6 ]; then
|
||||
sestatus
|
||||
update_state 7
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: Firewall starten und konfigurieren
|
||||
configure_firewall() {
|
||||
echo "function configure Firewall"
|
||||
if [ "$CURRENT_STEP" -le 7 ]; then
|
||||
systemctl start firewalld
|
||||
systemctl enable firewalld
|
||||
firewall-cmd --zone=public --add-port=53/tcp --add-port=53/udp --permanent
|
||||
firewall-cmd --zone=public --add-port=88/tcp --add-port=88/udp --permanent
|
||||
firewall-cmd --zone=public --add-port=135/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=389/tcp --add-port=389/udp --permanent
|
||||
firewall-cmd --zone=public --add-port=445/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=464/tcp --add-port=464/udp --permanent
|
||||
firewall-cmd --zone=public --add-port=636/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=3268/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=3269/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=50000-51000/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=49152-65535/tcp --permanent
|
||||
firewall-cmd --reload
|
||||
update_state 8
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: System aktualisieren und notwendige Pakete installieren
|
||||
install_packages() {
|
||||
echo "function install required packages"
|
||||
if [ "$CURRENT_STEP" -le 8 ]; then
|
||||
dnf update -y
|
||||
#dnf install -y epel-release
|
||||
|
||||
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
yum repolist
|
||||
wget -O /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8 https://samba.tranquil.it/RPM-GPG-KEY-TISSAMBA-8
|
||||
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8
|
||||
echo "[tis-samba]
|
||||
name=tis-samba
|
||||
baseurl=https://samba.tranquil.it/redhat8/samba-4.19/
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8" > /etc/yum.repos.d/tissamba.repo
|
||||
dnf repolist
|
||||
yum install -y samba samba-dc samba-winbind samba-winbind-clients krb5-workstation ldb-tools bind chrony bind-utils samba-client python39-pip
|
||||
pip3 install markdown
|
||||
yum install -y wget sudo screen nmap telnet tcpdump rsync net-tools bind-utils htop
|
||||
update_state 9
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: Kerberos-Konfiguration anpassen
|
||||
configure_kerberos() {
|
||||
echo "function configure kerberos"
|
||||
if [ "$CURRENT_STEP" -le 9 ]; then
|
||||
cat <<EOF > /etc/krb5.conf
|
||||
# To opt out of the system crypto-policies configuration of krb5, remove the
|
||||
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
|
||||
includedir /etc/krb5.conf.d/
|
||||
|
||||
[logging]
|
||||
default = FILE:/var/log/krb5libs.log
|
||||
kdc = FILE:/var/log/krb5kdc.log
|
||||
admin_server = FILE:/var/log/kadmind.log
|
||||
|
||||
[libdefaults]
|
||||
dns_lookup_realm = false
|
||||
ticket_lifetime = 24h
|
||||
renew_lifetime = 7d
|
||||
forwardable = true
|
||||
rdns = false
|
||||
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
|
||||
spake_preauth_groups = edwards25519
|
||||
default_realm = $REALM
|
||||
default_ccache_name = KEYRING:persistent:%{uid}
|
||||
dns_lookup_kdc = false
|
||||
|
||||
[realms]
|
||||
$REALM = {
|
||||
kdc = ${IP_ADDRESS}
|
||||
#admin_server = ${IP_ADDRESS}
|
||||
}
|
||||
|
||||
[domain_realm]
|
||||
.${lowerREALM} = $REALM
|
||||
${lowerREALM} = $REALM
|
||||
EOF
|
||||
update_state 10
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: Alte Samba-Konfiguration entfernen und neue Konfiguration erstellen
|
||||
configure_samba() {
|
||||
echo "funktion configure samba"
|
||||
if [ "$CURRENT_STEP" -le 10 ]; then
|
||||
rm -f /etc/samba/smb.conf
|
||||
samba-tool domain provision --realm=$REALM --domain=$DOMAIN --server-role=dc
|
||||
samba-tool user setpassword administrator --newpassword=$PASSWORD
|
||||
echo "dns forwarder = ${IP_FORWARDER}" >> /etc/samba/smb.conf
|
||||
systemctl restart NetworkManager
|
||||
rm -f /var/lib/samba/private/krb5.conf
|
||||
ln -s /etc/krb5.conf /var/lib/samba/private/krb5.conf
|
||||
systemctl enable samba
|
||||
systemctl start samba
|
||||
update_state 11
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: BIND9-DLZ installieren und konfigurieren
|
||||
configure_bind() {
|
||||
echo "function configure bind"nan
|
||||
if [ "$CURRENT_STEP" -le 11 ]; then
|
||||
yum install -y bind samba-dc-bind-dlz bind-utils
|
||||
cat <<EOF > /etc/named.conf
|
||||
options {
|
||||
listen-on port 53 { any; };
|
||||
listen-on-v6 port 53 { ::1; };
|
||||
forwarders { ${IP_FORWARDER}; }; # modify depending on your local DNS forwarder
|
||||
tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab";
|
||||
directory "/var/named";
|
||||
dump-file "/var/named/data/cache_dump.db";
|
||||
statistics-file "/var/named/data/named_stats.txt";
|
||||
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
||||
allow-query { any; };
|
||||
allow-recursion { any; };
|
||||
allow-query-cache { any; };
|
||||
recursion yes;
|
||||
dnssec-enable no;
|
||||
dnssec-validation no;
|
||||
bindkeys-file "/etc/named.iscdlv.key";
|
||||
managed-keys-directory "/var/named/dynamic";
|
||||
pid-file "/run/named/named.pid";
|
||||
session-keyfile "/run/named/session.key";
|
||||
minimal-responses yes;
|
||||
};
|
||||
logging {
|
||||
channel default_debug {
|
||||
file "data/named.run";
|
||||
severity dynamic;
|
||||
};
|
||||
};
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "named.ca";
|
||||
};
|
||||
include "/etc/named.rfc1912.zones";
|
||||
include "/etc/named.root.key";
|
||||
dlz "$REALM" {
|
||||
database "dlopen /usr/lib64/samba/bind9/dlz_bind9_11.so";
|
||||
};
|
||||
EOF
|
||||
echo 'OPTIONS="-4"' >> /etc/sysconfig/named
|
||||
sed -i 's/dns forwarder = '${IP_ADDRESS}'//g' /etc/samba/smb.conf
|
||||
echo "server services = -dns" >> /etc/samba/smb.conf
|
||||
mkdir -p /var/lib/samba/bind-dns/dns
|
||||
samba_upgradedns --dns-backend=BIND9_DLZ
|
||||
update_state 12
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: DNS-Konfiguration prüfen
|
||||
verify_dns() {
|
||||
echo "funktion verify dns config"
|
||||
if [ "$CURRENT_STEP" -le 12 ]; then
|
||||
systemctl restart named
|
||||
netstat -tapn | grep 53
|
||||
dig @localhost google.de
|
||||
dig @localhost $FQDN
|
||||
dig. -t SRV @localhost _ldap._tcp.${lowerREALM}
|
||||
update_state 13
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: SELinux wieder aktivieren und konfigurieren
|
||||
enable_selinux() {
|
||||
echo "function enable selinux"
|
||||
if [ "$CURRENT_STEP" -le 13 ]; then
|
||||
# SELinux auf permissive setzen
|
||||
setenforce 0
|
||||
|
||||
# SELinux-Module installieren
|
||||
dnf install -y policycoreutils-python-utils
|
||||
|
||||
# Boolsche Variablen für Samba und BIND9 setzen
|
||||
setsebool -P samba_enable_home_dirs on
|
||||
setsebool -P samba_export_all_rw on
|
||||
setsebool -P named_write_master_zones on
|
||||
setsebool -P named_update_master_zones on
|
||||
|
||||
# Kontext für Samba- und BIND9-Verzeichnisse setzen
|
||||
semanage fcontext -a -t samba_share_t "/var/lib/samba(/.*)?"
|
||||
restorecon -Rv /var/lib/samba
|
||||
|
||||
semanage fcontext -a -t named_cache_t "/var/lib/samba/bind-dns(/.*)?"
|
||||
restorecon -Rv /var/lib/samba/bind-dns
|
||||
|
||||
# Prüfen der SELinux-Protokolle auf Verstöße und anpassen
|
||||
grep samba /var/log/audit/audit.log | audit2allow -M mypol
|
||||
semodule -i mypol.pp
|
||||
|
||||
grep named /var/log/audit/audit.log | audit2allow -M mypol_named
|
||||
semodule -i mypol_named.pp
|
||||
|
||||
# SELinux auf enforcing setzen
|
||||
setenforce 1
|
||||
|
||||
# SELinux-Konfiguration persistent machen
|
||||
sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
|
||||
|
||||
update_state 14
|
||||
fi
|
||||
}
|
||||
|
||||
# Hauptskript: Funktionen nacheinander ausführen
|
||||
configure_hosts
|
||||
set_locale
|
||||
disable_selinux
|
||||
reboot_system
|
||||
configure_sshd
|
||||
check_selinux_status
|
||||
configure_firewall
|
||||
install_packages
|
||||
configure_kerberos
|
||||
configure_samba
|
||||
configure_bind
|
||||
verify_dns
|
||||
##### OPTIONAL #####
|
||||
#enable_selinux #####
|
||||
####################
|
||||
echo "Installation und Konfiguration abgeschlossen."
|
||||
Executable
+86
@@ -0,0 +1,86 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Set variables
|
||||
EJBCA_VERSION="7.9.0.2" # Ändern Sie dies entsprechend der gewünschten Version
|
||||
WILDFLY_VERSION="32.0.1.Final" # Ändern Sie dies entsprechend der gewünschten Version
|
||||
JAVA_VERSION="11" # Ändern Sie dies entsprechend der gewünschten Version
|
||||
INSTALL_DIR="/opt/ejbca"
|
||||
WILDFLY_DIR="/opt/wildfly"
|
||||
JAVA_DIR="/opt/java"
|
||||
DB_USER="ejbcauser"
|
||||
DB_PASS="ejbcapassword"
|
||||
DB_NAME="ejbca"
|
||||
DB_HOST="localhost"
|
||||
|
||||
# Update package list and install prerequisites
|
||||
echo "Updating package list and installing prerequisites..."
|
||||
sudo dnf update -y
|
||||
sudo dnf install -y wget unzip mariadb-server
|
||||
|
||||
# Enable and start MariaDB
|
||||
echo "Enabling and starting MariaDB..."
|
||||
sudo systemctl enable mariadb
|
||||
sudo systemctl start mariadb
|
||||
|
||||
# Install Java
|
||||
echo "Installing Java..."
|
||||
wget https://download.java.net/java/GA/jdk${JAVA_VERSION}/9/GPL/openjdk-${JAVA_VERSION}_linux-x64_bin.tar.gz
|
||||
sudo tar -xzf openjdk-${JAVA_VERSION}_linux-x64_bin.tar.gz -C /opt/
|
||||
sudo ln -s /opt/jdk-${JAVA_VERSION} $JAVA_DIR
|
||||
export JAVA_HOME=$JAVA_DIR
|
||||
export PATH=$JAVA_HOME/bin:$PATH
|
||||
|
||||
# Install WildFly
|
||||
echo "Installing WildFly..."
|
||||
wget https://download.jboss.org/wildfly/${WILDFLY_VERSION}/wildfly-${WILDFLY_VERSION}.zip
|
||||
sudo unzip wildfly-${WILDFLY_VERSION}.zip -d /opt/
|
||||
sudo ln -s /opt/wildfly-${WILDFLY_VERSION} $WILDFLY_DIR
|
||||
|
||||
# Install EJBCA
|
||||
echo "Installing EJBCA..."
|
||||
wget https://sourceforge.net/projects/ejbca/files/ejbca/${EJBCA_VERSION}/ejbca_ce_${EJBCA_VERSION}.tar.gz
|
||||
sudo tar -xzf ejbca_ce_${EJBCA_VERSION}.tar.gz -C /opt/
|
||||
sudo ln -s /opt/ejbca_ce-$EJBCA_VERSION $INSTALL_DIR
|
||||
|
||||
# Configure WildFly for EJBCA
|
||||
echo "Configuring WildFly for EJBCA..."
|
||||
sudo cp $INSTALL_DIR/doc/install/wildfly/jboss/standalone-full.xml $WILDFLY_DIR/standalone/configuration/
|
||||
sudo cp $INSTALL_DIR/doc/install/wildfly/jboss/ejbca.xml $WILDFLY_DIR/standalone/deployments/
|
||||
|
||||
# Start WildFly
|
||||
echo "Starting WildFly..."
|
||||
sudo $WILDFLY_DIR/bin/standalone.sh -c standalone-full.xml &
|
||||
|
||||
# Wait for WildFly to start
|
||||
sleep 20
|
||||
|
||||
# Setup EJBCA
|
||||
echo "Setting up EJBCA..."
|
||||
cd $INSTALL_DIR
|
||||
sudo ./bin/ejbca.sh install wildfly
|
||||
|
||||
# Configure Database
|
||||
echo "Configuring Database..."
|
||||
sudo mysql -u root -e "CREATE DATABASE $DB_NAME;"
|
||||
sudo mysql -u root -e "CREATE USER '$DB_USER'@'$DB_HOST' IDENTIFIED BY '$DB_PASS';"
|
||||
sudo mysql -u root -e "GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'$DB_HOST';"
|
||||
sudo mysql -u root -e "FLUSH PRIVILEGES;"
|
||||
|
||||
# Update EJBCA configuration for MySQL
|
||||
echo "Updating EJBCA configuration for MySQL..."
|
||||
sudo sed -i "s/localhost/$DB_HOST/g" $INSTALL_DIR/conf/database.properties
|
||||
sudo sed -i "s/ejbcauser/$DB_USER/g" $INSTALL_DIR/conf/database.properties
|
||||
sudo sed -i "s/ejbcapassword/$DB_PASS/g" $INSTALL_DIR/conf/database.properties
|
||||
|
||||
# Restart WildFly to apply changes
|
||||
echo "Restarting WildFly..."
|
||||
sudo pkill -f 'wildfly'
|
||||
sudo $WILDFLY_DIR/bin/standalone.sh -c standalone-full.xml &
|
||||
|
||||
# Final setup for EJBCA
|
||||
echo "Final setup for EJBCA..."
|
||||
cd $INSTALL_DIR
|
||||
sudo ./bin/ejbca.sh ca init --dn "CN=EJBCA,O=My Organization,C=US" --caname "ManagementCA" --tokenType "soft" --keytype "RSA" --keyspec "2048" --password "changeit"
|
||||
|
||||
# Print completion message
|
||||
echo "EJBCA installation and configuration completed successfully."
|
||||
Executable
+92
@@ -0,0 +1,92 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit on error
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
||||
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
||||
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
||||
DNS_FORWARDER="192.168.1.1" # Externer DNS-Forwarder (Google in diesem Fall)
|
||||
EXTERNAL_CA="true" # Setzt das Skript auf externe CA
|
||||
PASSWORD="P@ssw0rd1234" # Admin-Passwort (in der Praxis sicher speichern)
|
||||
DIRMAN_PASSWORD="P@ssw0rd12345" # Directory Manager Passwort
|
||||
IPA_PASS="P@ssw0rdIPA" # IPA Password
|
||||
|
||||
# Name der Zertifikatsdateien
|
||||
#ROOT_CERT="CERT_HEIMLAN_RootCA.crt"
|
||||
SUBCA_CERT="CERT_HEIMLAN_SubCA.crt"
|
||||
#SERVER_CERT="CERT_${HOST_FQDN}.crt"
|
||||
SERVER_KEY="KEY_${HOST_FQDN}.pem"
|
||||
SERVER_FULLCHAIN="fullchain_${HOST_FQDN}.crt"
|
||||
|
||||
|
||||
# Read IP address dynamically from active network interface
|
||||
IP_ADDRESS=$(nmcli -t -f IP4.ADDRESS device show | awk -F: '{split($2,a,"/"); print a[1]; exit}')
|
||||
echo "IP Address: $IP_ADDRESS"
|
||||
|
||||
# Eintragung in die HOSTS
|
||||
echo -e "$IP_ADDRESS\t$HOSTNAME\t ipa" | sudo tee -a /etc/hosts
|
||||
|
||||
# System aktualisieren
|
||||
echo "Aktualisiere das System..."
|
||||
sudo yum update -y
|
||||
|
||||
# Erforderliche Pakete installieren
|
||||
echo "Installiere erforderliche Pakete..."
|
||||
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
sudo dnf -y install @idm:DL1
|
||||
|
||||
# Erforderliche Pakete installieren
|
||||
echo "Installiere erforderliche Pakete..."
|
||||
sudo yum install -y ipa-server ipa-server-dns
|
||||
|
||||
# FreeIPA-Server ohne CA installieren
|
||||
sudo ipa-server-install --no-pki \
|
||||
--http-cert-file "${TMP_CERT}/${SERVER_FULLCHAIN}" \
|
||||
--http-cert-file "${TMP_KEY}/${SERVER_KEY}" \
|
||||
--http-pin "${HTTP_PASS}" \
|
||||
--dirsrv-cert-file "$(TMP_CERT)/${SERVER_FULLCHAIN}" \
|
||||
--dirsrv-cert-file "${TMP_KEY}/${SERVER_KEY}" \
|
||||
--dirsrv-pin $DIRSRV_PASS \
|
||||
--ca-cert-file $TMP_CERT/$SUBCA_CERT \
|
||||
--hostname=$HOSTNAME \
|
||||
--domain=$DOMAIN \
|
||||
--realm=$REALM \
|
||||
--ds-password=$ADMIN_PASS \
|
||||
--admin-password=$IPA_PASS \
|
||||
--no-ntp
|
||||
|
||||
# CSR von der Root CA signieren lassen
|
||||
#echo "Signiere CSR mit der Root CA..."
|
||||
#openssl ca -in $CSR_FILE -out $SIGNED_CERT -cert $ROOT_CERT -keyfile $ROOT_CA_KEY -extensions v3_req -config $OPENSSL_CONFIG
|
||||
hour=0
|
||||
min=6
|
||||
sec=0
|
||||
echo " Sie haben $hour h $min min $sec sek zeit um das Zeit das Zertifikat zu signieren."
|
||||
while [ $hour -ge 0 ]; do
|
||||
while [ $min -ge 0 ]; do
|
||||
while [ $sec -ge 0 ]; do
|
||||
echo -ne "$hour:$min:$sec\033[0K\r"
|
||||
let "sec=sec-1"
|
||||
sleep 1
|
||||
done
|
||||
sec=59
|
||||
let "min=min-1"
|
||||
done
|
||||
min=59
|
||||
let "hour=hour-1"
|
||||
done
|
||||
|
||||
|
||||
# FreeIPA-Dienste neu starten
|
||||
echo "Starte FreeIPA-Dienste neu..."
|
||||
sudo ipactl restart
|
||||
|
||||
# FreeIPA-Dienste Status prüfen
|
||||
sudo ipactl status
|
||||
|
||||
echo "Redhat Identity Management erfolgreich Installiert und eingerichtet !!"
|
||||
echo "Sie können die Admnistration über die WebGui https://${HOST_FQDN} fortsetzen !!"
|
||||
Executable
+123
@@ -0,0 +1,123 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit immediately if a command exits with a non-zero status
|
||||
set -e
|
||||
|
||||
HOST_FQDN=$(hostname -f)
|
||||
SERVER_CERT="CERT_${HOST_FQDN}.crt"
|
||||
SERVER_KEY="KEY_${HOST_FQDN}.pem"
|
||||
|
||||
# Update system packages
|
||||
echo "Updating system packages..."
|
||||
sudo dnf update -y
|
||||
|
||||
# Install Apache HTTP Server
|
||||
echo "Installing Apache HTTP Server..."
|
||||
sudo dnf install -y httpd
|
||||
|
||||
# Enable and start Apache
|
||||
echo "Enabling and starting Apache..."
|
||||
sudo systemctl enable httpd
|
||||
sudo systemctl start httpd
|
||||
|
||||
# Install MariaDB (MySQL fork)
|
||||
echo "Installing MariaDB..."
|
||||
sudo dnf install -y mariadb-server
|
||||
|
||||
# Enable and start MariaDB
|
||||
echo "Enabling and starting MariaDB..."
|
||||
sudo systemctl enable mariadb
|
||||
sudo systemctl start mariadb
|
||||
|
||||
# Secure MariaDB installation
|
||||
echo "Securing MariaDB installation..."
|
||||
sudo mysql_secure_installation
|
||||
|
||||
# Install PHP and required extensions
|
||||
echo "Installing PHP and required extensions..."
|
||||
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
sudo dnf install -y php php-mysqlnd php-pdo php-gd php-mbstring php-intl php-json php-xml php-zip libzip
|
||||
sudo dnf install -y php-pecl-zip php-*
|
||||
|
||||
|
||||
# Enable and start PHP-FPM
|
||||
echo "Enabling and starting PHP-FPM..."
|
||||
sudo systemctl enable php-fpm
|
||||
sudo systemctl start php-fpm
|
||||
|
||||
# Download OwnCloud
|
||||
echo "Downloading OwnCloud..."
|
||||
wget https://download.owncloud.com/server/stable/owncloud-latest.zip
|
||||
|
||||
# Extract OwnCloud
|
||||
echo "Extracting OwnCloud..."
|
||||
sudo unzip owncloud-latest.zip -d /var/www/html/
|
||||
|
||||
# Set ownership and permissions
|
||||
echo "Setting ownership and permissions..."
|
||||
sudo chown -R apache:apache /var/www/html/owncloud
|
||||
sudo chmod -R 755 /var/www/html/owncloud
|
||||
|
||||
# Create a new Apache configuration file for OwnCloud
|
||||
echo "Creating Apache configuration for OwnCloud..."
|
||||
sudo bash -c 'cat > /etc/httpd/conf.d/owncloud.conf <<EOF
|
||||
<VirtualHost *:80>
|
||||
DocumentRoot "/var/www/owncloud"
|
||||
ServerName owncloud.example.com
|
||||
|
||||
<Directory "/var/www/owncloud">
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ErrorLog /var/log/httpd/owncloud_error.log
|
||||
CustomLog /var/log/httpd/owncloud_access.log combined
|
||||
</VirtualHost>
|
||||
EOF'
|
||||
|
||||
# Restart Apache to apply changes
|
||||
echo "Restarting Apache to apply changes..."
|
||||
sudo systemctl restart httpd
|
||||
|
||||
# Create OwnCloud database and user
|
||||
echo "Creating OwnCloud database and user..."
|
||||
sudo mysql -u root -p -e "CREATE DATABASE owncloud;"
|
||||
sudo mysql -u root -p -e "CREATE USER 'ownclouduser'@'localhost' IDENTIFIED BY 'owncloudpassword';"
|
||||
sudo mysql -u root -p -e "GRANT ALL PRIVILEGES ON owncloud.* TO 'ownclouduser'@'localhost';"
|
||||
sudo mysql -u root -p -e "FLUSH PRIVILEGES;"
|
||||
|
||||
# Create a new Apache SSL configuration file for OwnCloud
|
||||
echo "Creating Apache SSL configuration for OwnCloud..."
|
||||
sudo cat << EOF > /etc/httpd/conf.d/owncloud-ssl.conf
|
||||
<VirtualHost *:443>
|
||||
DocumentRoot "/var/www/html/owncloud"
|
||||
ServerName owncloud.example.com
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/pki/tls/certs/$SERVER_CERT
|
||||
SSLCertificateKeyFile /etc/pki/tls/private/$SERVER_KEY
|
||||
|
||||
<Directory "/var/www/html/owncloud">
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ErrorLog /var/log/httpd/owncloud_error.log
|
||||
CustomLog /var/log/httpd/owncloud_access.log combined
|
||||
</VirtualHost>
|
||||
EOF
|
||||
|
||||
# Restart Apache to apply changes
|
||||
echo "Restarting Apache to apply changes..."
|
||||
sudo systemctl restart httpd
|
||||
|
||||
# Firewall configuration to allow HTTP and HTTPS traffic
|
||||
echo "Configuring firewall to allow HTTP and HTTPS traffic..."
|
||||
sudo firewall-cmd --permanent --add-service=http
|
||||
sudo firewall-cmd --permanent --add-service=https
|
||||
sudo firewall-cmd --reload
|
||||
|
||||
echo "OwnCloud installation is complete. Please navigate to https://owncloud.example.com to complete the setup through the web interface."
|
||||
+164
@@ -0,0 +1,164 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Funktion zum Konfigurieren des 389 Directory Servers
|
||||
configure_389_ds() {
|
||||
local domain="$1"
|
||||
local admin_password="$2"
|
||||
local ldap_password="$3"
|
||||
local fqdn="$(hostname --fqdn)"
|
||||
|
||||
cat <<EOL | sudo tee /tmp/ds_setup.inf
|
||||
[General]
|
||||
FullMachineName = $fqdn
|
||||
SuiteSpotUserID = nobody
|
||||
SuiteSpotGroup = nobody
|
||||
AdminDomain = $domain
|
||||
|
||||
[slapd]
|
||||
ServerPort = 389
|
||||
ServerIdentifier = ldap
|
||||
Suffix = dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
RootDN = cn=Directory Manager
|
||||
RootDNPwd = $admin_password
|
||||
EOL
|
||||
|
||||
sudo dscreate from-file /tmp/ds_setup.inf
|
||||
sudo rm /tmp/ds_setup.inf
|
||||
}
|
||||
|
||||
# Funktion zum Konfigurieren von LDAPS mit vorhandenen Zertifikaten und Schlüsseln
|
||||
configure_ldaps() {
|
||||
local cert_path="/etc/ssl/certs"
|
||||
local key_path="/etc/ssl/private"
|
||||
local fqdn="$(hostname --fqdn)"
|
||||
local cert_name="CERT_${fqdn//./_}.cer"
|
||||
local key_name="KEY_${fqdn//./_}.pem"
|
||||
|
||||
# Annahme: Die Zertifikats- und Schlüsseldateien sind bereits vorhanden
|
||||
# und müssen nur in die richtigen Pfade verschoben/verlinkt werden
|
||||
sudo cp /path/to/existing_certificates/"$cert_name" "$cert_path/$cert_name"
|
||||
sudo cp /path/to/existing_certificates/"$key_name" "$key_path/$key_name"
|
||||
|
||||
sudo dsconf -D "cn=Directory Manager" ldap:/// config replace nsslapd-security=on
|
||||
sudo dsconf -D "cn=Directory Manager" ldap:/// config replace nsslapd-ldaps-port=636
|
||||
sudo dsconf -D "cn=Directory Manager" ldap:/// tls set --cacertdir="$cert_path" --server-cert="$cert_name" --server-key="$key_name"
|
||||
sudo systemctl restart dirsrv@ldap
|
||||
}
|
||||
|
||||
# Funktion zum Konfigurieren von BIND mit DLZ
|
||||
configure_bind_dlz() {
|
||||
local domain="$1"
|
||||
local fqdn="$(hostname --fqdn)"
|
||||
|
||||
cat <<EOL | sudo tee /etc/named/dlz-ldap.conf
|
||||
uri ldaps://127.0.0.1:636
|
||||
base "cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')"
|
||||
auth_method sasl
|
||||
sasl_mech EXTERNAL
|
||||
EOL
|
||||
|
||||
cat <<EOL | sudo tee /etc/named.conf
|
||||
options {
|
||||
listen-on port 53 { any; };
|
||||
directory "/var/named";
|
||||
dump-file "/var/named/data/cache_dump.db";
|
||||
statistics-file "/var/named/data/named_stats.txt";
|
||||
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
||||
allow-query { any; };
|
||||
recursion yes;
|
||||
};
|
||||
|
||||
include "/etc/named/dlz-ldap.conf";
|
||||
|
||||
dlz "ldap zone" {
|
||||
database "ldap ldaps://127.0.0.1:636/dc=$(echo $domain | sed 's/\./,dc=/g')?relativeDomainName?sub?(objectClass=dnsZone)";
|
||||
};
|
||||
EOL
|
||||
|
||||
sudo systemctl restart named
|
||||
sudo systemctl enable named
|
||||
}
|
||||
|
||||
# Funktion zum Hinzufügen der DNS-Zonen in LDAP
|
||||
add_dns_zones() {
|
||||
local domain="$1"
|
||||
local ldap_password="$2"
|
||||
local fqdn="$(hostname --fqdn)"
|
||||
local ip_address="$(hostname -I | awk '{print $1}')"
|
||||
|
||||
cat <<EOL | ldapadd -H ldaps://127.0.0.1:636 -x -D "cn=Directory Manager" -w "$ldap_password"
|
||||
dn: dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
objectClass: top
|
||||
objectClass: domain
|
||||
dc: $(echo $domain | cut -d'.' -f1)
|
||||
|
||||
dn: cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
objectClass: top
|
||||
objectClass: nsContainer
|
||||
cn: dns
|
||||
|
||||
dn: ou=bind,dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
objectClass: top
|
||||
objectClass: organizationalUnit
|
||||
ou: bind
|
||||
|
||||
dn: relativeDomainName=@,zoneName=$domain,cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
objectClass: top
|
||||
objectClass: dNSZone
|
||||
relativeDomainName: @
|
||||
zoneName: $domain
|
||||
dNSClass: IN
|
||||
dNSTTL: 3600
|
||||
nSRecord: ns.$domain.
|
||||
|
||||
dn: relativeDomainName=ns,zoneName=$domain,cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
objectClass: top
|
||||
objectClass: dNSZone
|
||||
relativeDomainName: ns
|
||||
zoneName: $domain
|
||||
dNSClass: IN
|
||||
dNSTTL: 3600
|
||||
aRecord: $ip_address
|
||||
|
||||
dn: relativeDomainName=$fqdn,zoneName=$domain,cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
|
||||
objectClass: top
|
||||
objectClass: dNSZone
|
||||
relativeDomainName: $fqdn
|
||||
zoneName: $domain
|
||||
dNSClass: IN
|
||||
dNSTTL: 3600
|
||||
aRecord: $ip_address
|
||||
EOL
|
||||
}
|
||||
|
||||
# Funktion zum Aktualisieren der /etc/hosts-Datei
|
||||
update_hosts_file() {
|
||||
local domain="$1"
|
||||
local fqdn="$(hostname --fqdn)"
|
||||
local ip_address="$(hostname -I | awk '{print $1}')"
|
||||
|
||||
sudo sed -i "/$fqdn/d" /etc/hosts
|
||||
echo "$ip_address $fqdn $domain" | sudo tee -a /etc/hosts > /dev/null
|
||||
}
|
||||
|
||||
# Funktion zum Einlesen von Benutzereingaben
|
||||
read_input() {
|
||||
read -p "$1: " value
|
||||
echo "$value"
|
||||
}
|
||||
|
||||
# Hauptfunktion zum Ausführen des Skripts
|
||||
main() {
|
||||
local domain="$(hostname --domain)"
|
||||
local admin_password="$(read_input "Admin password")"
|
||||
local ldap_password="$(read_input "LDAP password")"
|
||||
|
||||
configure_389_ds "$domain" "$admin_password" "$ldap_password"
|
||||
configure_ldaps
|
||||
configure_bind_dlz "$domain"
|
||||
add_dns_zones "$domain" "$ldap_password"
|
||||
update_hosts_file "$domain"
|
||||
}
|
||||
|
||||
# Hauptprogramm starten
|
||||
main
|
||||
Reference in New Issue
Block a user