Initialer Import der Synology Scripts
This commit is contained in:
root
+307
@@ -0,0 +1,307 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen anpassen
|
||||
REALM="MGT.HEIM.LAN"
|
||||
lowerREALM=$(hostname -d)
|
||||
DOMAIN="MGT"
|
||||
HOSTNAME="pdc"
|
||||
PASSWORD="P@ssw0rd"
|
||||
STATE_FILE="/var/log/samba_setup_state"
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}')
|
||||
HOSTNAME=$(hostname)
|
||||
FQDN=$(hostname -f)
|
||||
IP_FORWARDER="192.168.1.1"
|
||||
# Initialisiere den Fortschrittszustand, falls nicht vorhanden
|
||||
if [ ! -f "$STATE_FILE" ]; then
|
||||
echo "0" > "$STATE_FILE"
|
||||
fi
|
||||
|
||||
# Lese den aktuellen Fortschritt
|
||||
CURRENT_STEP=$(cat "$STATE_FILE")
|
||||
|
||||
# Funktion zum Aktualisieren des Fortschritts
|
||||
update_state() {
|
||||
echo "$1" > "$STATE_FILE"
|
||||
}
|
||||
|
||||
# Funktion: /etc/hosts anpassen
|
||||
configure_hosts() {
|
||||
if [ "$CURRENT_STEP" -le 1 ]; then
|
||||
eche "Function Configure Hosts"
|
||||
echo "${IP_ADDRESS} ${FQDN} ${HOSTNAME}" >> /etc/hosts
|
||||
update_state 2
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: Lokaleinstellungen setzen
|
||||
set_locale() {
|
||||
if [ "$CURRENT_STEP" -le 2 ]; then
|
||||
echo "function set locale to en_US.utf8"
|
||||
localectl set-locale LANG=en_US.utf8
|
||||
update_state 3
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: SELinux deaktivieren
|
||||
disable_selinux() {
|
||||
echo "function diable selinux"
|
||||
if [ "$CURRENT_STEP" -le 3 ]; then
|
||||
sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
|
||||
update_state 4
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: System neu starten
|
||||
reboot_system() {
|
||||
echo "function reboot"
|
||||
if [ "$CURRENT_STEP" -le 4 ]; then
|
||||
update_state 5
|
||||
init 6
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: SSHD konfigurieren und neu starten
|
||||
configure_sshd() {
|
||||
echo "function configure sshd"
|
||||
if [ "$CURRENT_STEP" -le 5 ]; then
|
||||
nano /etc/ssh/sshd_config
|
||||
systemctl restart sshd
|
||||
update_state 6
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: SELinux Status prüfen
|
||||
check_selinux_status() {
|
||||
echo "function check selinux"
|
||||
if [ "$CURRENT_STEP" -le 6 ]; then
|
||||
sestatus
|
||||
update_state 7
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: Firewall starten und konfigurieren
|
||||
configure_firewall() {
|
||||
echo "function configure Firewall"
|
||||
if [ "$CURRENT_STEP" -le 7 ]; then
|
||||
systemctl start firewalld
|
||||
systemctl enable firewalld
|
||||
firewall-cmd --zone=public --add-port=53/tcp --add-port=53/udp --permanent
|
||||
firewall-cmd --zone=public --add-port=88/tcp --add-port=88/udp --permanent
|
||||
firewall-cmd --zone=public --add-port=135/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=389/tcp --add-port=389/udp --permanent
|
||||
firewall-cmd --zone=public --add-port=445/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=464/tcp --add-port=464/udp --permanent
|
||||
firewall-cmd --zone=public --add-port=636/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=3268/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=3269/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=50000-51000/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=49152-65535/tcp --permanent
|
||||
firewall-cmd --reload
|
||||
update_state 8
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: System aktualisieren und notwendige Pakete installieren
|
||||
install_packages() {
|
||||
echo "function install required packages"
|
||||
if [ "$CURRENT_STEP" -le 8 ]; then
|
||||
dnf update -y
|
||||
#dnf install -y epel-release
|
||||
|
||||
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
yum repolist
|
||||
wget -O /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8 https://samba.tranquil.it/RPM-GPG-KEY-TISSAMBA-8
|
||||
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8
|
||||
echo "[tis-samba]
|
||||
name=tis-samba
|
||||
baseurl=https://samba.tranquil.it/redhat8/samba-4.19/
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8" > /etc/yum.repos.d/tissamba.repo
|
||||
dnf repolist
|
||||
yum install -y samba samba-dc samba-winbind samba-winbind-clients krb5-workstation ldb-tools bind chrony bind-utils samba-client python39-pip
|
||||
pip3 install markdown
|
||||
yum install -y wget sudo screen nmap telnet tcpdump rsync net-tools bind-utils htop
|
||||
update_state 9
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: Kerberos-Konfiguration anpassen
|
||||
configure_kerberos() {
|
||||
echo "function configure kerberos"
|
||||
if [ "$CURRENT_STEP" -le 9 ]; then
|
||||
cat <<EOF > /etc/krb5.conf
|
||||
# To opt out of the system crypto-policies configuration of krb5, remove the
|
||||
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
|
||||
includedir /etc/krb5.conf.d/
|
||||
|
||||
[logging]
|
||||
default = FILE:/var/log/krb5libs.log
|
||||
kdc = FILE:/var/log/krb5kdc.log
|
||||
admin_server = FILE:/var/log/kadmind.log
|
||||
|
||||
[libdefaults]
|
||||
dns_lookup_realm = false
|
||||
ticket_lifetime = 24h
|
||||
renew_lifetime = 7d
|
||||
forwardable = true
|
||||
rdns = false
|
||||
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
|
||||
spake_preauth_groups = edwards25519
|
||||
default_realm = $REALM
|
||||
default_ccache_name = KEYRING:persistent:%{uid}
|
||||
dns_lookup_kdc = false
|
||||
|
||||
[realms]
|
||||
$REALM = {
|
||||
kdc = ${IP_ADDRESS}
|
||||
#admin_server = ${IP_ADDRESS}
|
||||
}
|
||||
|
||||
[domain_realm]
|
||||
.${lowerREALM} = $REALM
|
||||
${lowerREALM} = $REALM
|
||||
EOF
|
||||
update_state 10
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: Alte Samba-Konfiguration entfernen und neue Konfiguration erstellen
|
||||
configure_samba() {
|
||||
echo "funktion configure samba"
|
||||
if [ "$CURRENT_STEP" -le 10 ]; then
|
||||
rm -f /etc/samba/smb.conf
|
||||
samba-tool domain provision --realm=$REALM --domain=$DOMAIN --server-role=dc
|
||||
samba-tool user setpassword administrator --newpassword=$PASSWORD
|
||||
echo "dns forwarder = ${IP_FORWARDER}" >> /etc/samba/smb.conf
|
||||
systemctl restart NetworkManager
|
||||
rm -f /var/lib/samba/private/krb5.conf
|
||||
ln -s /etc/krb5.conf /var/lib/samba/private/krb5.conf
|
||||
systemctl enable samba
|
||||
systemctl start samba
|
||||
update_state 11
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: BIND9-DLZ installieren und konfigurieren
|
||||
configure_bind() {
|
||||
echo "function configure bind"nan
|
||||
if [ "$CURRENT_STEP" -le 11 ]; then
|
||||
yum install -y bind samba-dc-bind-dlz bind-utils
|
||||
cat <<EOF > /etc/named.conf
|
||||
options {
|
||||
listen-on port 53 { any; };
|
||||
listen-on-v6 port 53 { ::1; };
|
||||
forwarders { ${IP_FORWARDER}; }; # modify depending on your local DNS forwarder
|
||||
tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab";
|
||||
directory "/var/named";
|
||||
dump-file "/var/named/data/cache_dump.db";
|
||||
statistics-file "/var/named/data/named_stats.txt";
|
||||
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
||||
allow-query { any; };
|
||||
allow-recursion { any; };
|
||||
allow-query-cache { any; };
|
||||
recursion yes;
|
||||
dnssec-enable no;
|
||||
dnssec-validation no;
|
||||
bindkeys-file "/etc/named.iscdlv.key";
|
||||
managed-keys-directory "/var/named/dynamic";
|
||||
pid-file "/run/named/named.pid";
|
||||
session-keyfile "/run/named/session.key";
|
||||
minimal-responses yes;
|
||||
};
|
||||
logging {
|
||||
channel default_debug {
|
||||
file "data/named.run";
|
||||
severity dynamic;
|
||||
};
|
||||
};
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "named.ca";
|
||||
};
|
||||
include "/etc/named.rfc1912.zones";
|
||||
include "/etc/named.root.key";
|
||||
dlz "$REALM" {
|
||||
database "dlopen /usr/lib64/samba/bind9/dlz_bind9_11.so";
|
||||
};
|
||||
EOF
|
||||
echo 'OPTIONS="-4"' >> /etc/sysconfig/named
|
||||
sed -i 's/dns forwarder = '${IP_ADDRESS}'//g' /etc/samba/smb.conf
|
||||
echo "server services = -dns" >> /etc/samba/smb.conf
|
||||
mkdir -p /var/lib/samba/bind-dns/dns
|
||||
samba_upgradedns --dns-backend=BIND9_DLZ
|
||||
update_state 12
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: DNS-Konfiguration prüfen
|
||||
verify_dns() {
|
||||
echo "funktion verify dns config"
|
||||
if [ "$CURRENT_STEP" -le 12 ]; then
|
||||
systemctl restart named
|
||||
netstat -tapn | grep 53
|
||||
dig @localhost google.de
|
||||
dig @localhost $FQDN
|
||||
dig. -t SRV @localhost _ldap._tcp.${lowerREALM}
|
||||
update_state 13
|
||||
fi
|
||||
}
|
||||
|
||||
# Funktion: SELinux wieder aktivieren und konfigurieren
|
||||
enable_selinux() {
|
||||
echo "function enable selinux"
|
||||
if [ "$CURRENT_STEP" -le 13 ]; then
|
||||
# SELinux auf permissive setzen
|
||||
setenforce 0
|
||||
|
||||
# SELinux-Module installieren
|
||||
dnf install -y policycoreutils-python-utils
|
||||
|
||||
# Boolsche Variablen für Samba und BIND9 setzen
|
||||
setsebool -P samba_enable_home_dirs on
|
||||
setsebool -P samba_export_all_rw on
|
||||
setsebool -P named_write_master_zones on
|
||||
setsebool -P named_update_master_zones on
|
||||
|
||||
# Kontext für Samba- und BIND9-Verzeichnisse setzen
|
||||
semanage fcontext -a -t samba_share_t "/var/lib/samba(/.*)?"
|
||||
restorecon -Rv /var/lib/samba
|
||||
|
||||
semanage fcontext -a -t named_cache_t "/var/lib/samba/bind-dns(/.*)?"
|
||||
restorecon -Rv /var/lib/samba/bind-dns
|
||||
|
||||
# Prüfen der SELinux-Protokolle auf Verstöße und anpassen
|
||||
grep samba /var/log/audit/audit.log | audit2allow -M mypol
|
||||
semodule -i mypol.pp
|
||||
|
||||
grep named /var/log/audit/audit.log | audit2allow -M mypol_named
|
||||
semodule -i mypol_named.pp
|
||||
|
||||
# SELinux auf enforcing setzen
|
||||
setenforce 1
|
||||
|
||||
# SELinux-Konfiguration persistent machen
|
||||
sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
|
||||
|
||||
update_state 14
|
||||
fi
|
||||
}
|
||||
|
||||
# Hauptskript: Funktionen nacheinander ausführen
|
||||
configure_hosts
|
||||
set_locale
|
||||
disable_selinux
|
||||
reboot_system
|
||||
configure_sshd
|
||||
check_selinux_status
|
||||
configure_firewall
|
||||
install_packages
|
||||
configure_kerberos
|
||||
configure_samba
|
||||
configure_bind
|
||||
verify_dns
|
||||
##### OPTIONAL #####
|
||||
#enable_selinux #####
|
||||
####################
|
||||
echo "Installation und Konfiguration abgeschlossen."
|
||||
Reference in New Issue
Block a user