Initialer Import der Synology Scripts
This commit is contained in:
root
BIN
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
Executable
BIN
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
Executable
+85
@@ -0,0 +1,85 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variables
|
||||
API_KEY="your_api_key"
|
||||
API_URL="http://localhost:81/api/v1"
|
||||
PRIVATE_KEY="/path/to/private-key.pem"
|
||||
CERTIFICATE="/path/to/certificate.pem"
|
||||
CHAIN="/path/to/chain.pem" # Optional
|
||||
|
||||
# Function to install Nginx Proxy Manager
|
||||
install_nginx_proxy_manager() {
|
||||
# Install dependencies
|
||||
apt-get update
|
||||
apt-get install -y curl gnupg2 lsb-release git sudo
|
||||
|
||||
# Install Node.js and Yarn
|
||||
curl -fsSL https://deb.nodesource.com/setup_14.x | sudo -E bash -
|
||||
curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -
|
||||
echo "deb https://dl.yarnpkg.com/debian/ stable main" | sudo tee /etc/apt/sources.list.d/yarn.list
|
||||
apt-get update
|
||||
apt-get install -y nodejs yarn
|
||||
|
||||
# Clone Nginx Proxy Manager repository
|
||||
git clone https://github.com/jc21/nginx-proxy-manager /opt/nginx-proxy-manager
|
||||
cd /opt/nginx-proxy-manager
|
||||
|
||||
# Install backend dependencies
|
||||
cd backend
|
||||
yarn install
|
||||
|
||||
# Configure MariaDB (assuming it's already installed and secured)
|
||||
mysql -u root -p -e "CREATE DATABASE npm;"
|
||||
mysql -u root -p -e "CREATE USER 'npm_user'@'localhost' IDENTIFIED BY 'password';"
|
||||
mysql -u root -p -e "GRANT ALL PRIVILEGES ON npm.* TO 'npm_user'@'localhost';"
|
||||
mysql -u root -p -e "FLUSH PRIVILEGES;"
|
||||
|
||||
# Configure backend environment
|
||||
cp .env.example .env
|
||||
# Edit .env file with appropriate database credentials and other settings
|
||||
|
||||
# Start backend server
|
||||
yarn start &
|
||||
|
||||
# Install frontend dependencies
|
||||
cd ../frontend
|
||||
yarn install
|
||||
|
||||
# Build frontend
|
||||
yarn build
|
||||
|
||||
# Configure Nginx or other web server to serve frontend
|
||||
|
||||
# Optionally, set up SSL certificates in the frontend configuration
|
||||
|
||||
# Wait for backend to start (adjust sleep time as needed)
|
||||
sleep 10
|
||||
|
||||
# Import SSL certificate using API
|
||||
import_certificate
|
||||
}
|
||||
|
||||
# Function to import SSL certificate using API
|
||||
import_certificate() {
|
||||
# Create JSON data for certificate import
|
||||
certificate_data=$(cat <<EOF
|
||||
{
|
||||
"privateKey": "$(cat $PRIVATE_KEY)",
|
||||
"certificate": "$(cat $CERTIFICATE)",
|
||||
"chain": "$(cat $CHAIN)"
|
||||
}
|
||||
EOF
|
||||
)
|
||||
|
||||
# Make API request to import certificate
|
||||
curl -X POST \
|
||||
-H "Authorization: Bearer $API_KEY" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "$certificate_data" \
|
||||
"$API_URL/certificates"
|
||||
|
||||
echo "Certificate imported successfully."
|
||||
}
|
||||
|
||||
# Main script execution
|
||||
install_nginx_proxy_manager
|
||||
Executable
+36
@@ -0,0 +1,36 @@
|
||||
#!/bin/bash
|
||||
|
||||
#Install IDM
|
||||
vorbereitung(){
|
||||
sudo yum update -y
|
||||
sudo yum install ipa-server ipa-server-dns -y
|
||||
}
|
||||
install(){
|
||||
echo "Es werden einige Daten von Ihnen zur Eingabe verlangt"
|
||||
echo "Domain name: Der DNS-Domain-Name für das IdM-Server-Deployment.
|
||||
IPA Server realm name: Der Kerberos-Realm-Name (üblicherweise die Domain in Großbuchstaben).
|
||||
Directory Manager password: Passwort für den Directory Manager (Admin-Passwort für den LDAP-Server).
|
||||
IPA admin password: Passwort für den admin Benutzer in IdM."
|
||||
sudo ipa-server-install
|
||||
}
|
||||
|
||||
#Firewall Konfiguration
|
||||
firewall(){
|
||||
sudo firewall-cmd --add-service=freeipa-ldap --permanent
|
||||
sudo firewall-cmd --add-service=freeipa-ldaps --permanent
|
||||
sudo firewall-cmd --add-service=freeipa-replication --permanent
|
||||
sudo firewall-cmd --add-service=freeipa --permanent
|
||||
sudo firewall-cmd --reload
|
||||
}
|
||||
|
||||
#CLient aufnahme
|
||||
client(){
|
||||
sudo yum install ipa-client -y
|
||||
sudo ipa-client-install
|
||||
}
|
||||
|
||||
echo "Sie können unter https://<hostname>/ipa/ui die WEB-UI aufrufen"
|
||||
#vorbereitung
|
||||
#install
|
||||
#firewall
|
||||
#client
|
||||
Executable
+158
@@ -0,0 +1,158 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit on any error
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
||||
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
||||
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
||||
DNS_FORWARDER="8.8.8.8" # Externer DNS-Forwarder (Google in diesem Fall)
|
||||
PASSWORD="ipaAdminPassword" # Admin-Passwort (in der Praxis sicher speichern)
|
||||
DIRMAN_PASSWORD="dirmanPassword" # Directory Manager Passwort
|
||||
AD_REALM=$REALM # Active Directory Realm in Großbuchstaben
|
||||
AD_DOMAIN=$DOMAIN # Active Directory Domain in Kleinbuchstaben
|
||||
AD_ADMIN_USER="administrator" # Administrator-Account der AD-Domäne
|
||||
AD_ADMIN_PASS="adAdminPassword" # Passwort des Administrator-Accounts
|
||||
|
||||
LOGFILE="/var/log/idm_install.log"
|
||||
|
||||
# Function to check if running as root
|
||||
function check_root {
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo "Dieses Skript muss als Root ausgeführt werden!" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to install the necessary packages
|
||||
function install_packages {
|
||||
echo "Installiere benötigte Pakete..." | tee -a $LOGFILE
|
||||
yum update -y | tee -a $LOGFILE
|
||||
|
||||
echo "Installiere erforderliche Pakete..." | tee -a $LOGFILE
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm | tee -a $LOGFILE
|
||||
dnf -y install @idm:DL1 | tee -a $LOGFILE
|
||||
yum install -y ipa-server ipa-server-dns bind samba samba-client bind-pkcs11-utils | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to install the IDM server with DNS
|
||||
function install_idm_server {
|
||||
echo "Installiere IdM-Server mit DNS..." | tee -a $LOGFILE
|
||||
|
||||
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
||||
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
||||
--ip-address=$IP_ADDRESS --no-pkinit \
|
||||
--setup-dns --auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure AD trust
|
||||
function configure_ad_trust {
|
||||
echo "Konfiguriere AD-Trust..." | tee -a $LOGFILE
|
||||
|
||||
yum install -y ipa-server-trust-ad | tee -a $LOGFILE
|
||||
|
||||
ipa-adtrust-install --add-sids --netbios-name=$(echo $REALM | cut -d. -f1) --no-msdcs --admin-password=$PASSWORD -U | tee -a $LOGFILE
|
||||
|
||||
ipa trust-add --type=ad $AD_REALM --admin=$AD_ADMIN_USER --password=$AD_ADMIN_PASS | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure Samba
|
||||
function configure_samba {
|
||||
echo "Konfiguriere Samba..." | tee -a $LOGFILE
|
||||
|
||||
cat <<EOF > /etc/samba/smb.conf
|
||||
[global]
|
||||
workgroup = $(echo $REALM | cut -d. -f1)
|
||||
realm = $REALM
|
||||
security = ADS
|
||||
idmap config * : backend = tdb
|
||||
idmap config * : range = 1000-9999
|
||||
idmap config $REALM : backend = ad
|
||||
idmap config $REALM : range = 10000-99999
|
||||
log file = /var/log/samba/%m.log
|
||||
log level = 1
|
||||
kerberos method = system keytab
|
||||
dedicated keytab file = /etc/samba/samba.keytab
|
||||
map to guest = Bad User
|
||||
winbind use default domain = true
|
||||
template shell = /bin/bash
|
||||
template homedir = /home/%U
|
||||
EOF
|
||||
|
||||
# Restart Samba services
|
||||
systemctl restart smb nmb winbind
|
||||
}
|
||||
|
||||
# Function to configure firewall
|
||||
function configure_firewall {
|
||||
echo "Konfiguriere Firewall..." | tee -a $LOGFILE
|
||||
|
||||
firewall-cmd --add-service=freeipa-ldap --permanent
|
||||
firewall-cmd --add-service=freeipa-ldaps --permanent
|
||||
firewall-cmd --add-service=freeipa-replication --permanent
|
||||
firewall-cmd --add-service=freeipa-trust --permanent
|
||||
firewall-cmd --add-service=dns --permanent
|
||||
firewall-cmd --add-port=88/tcp --permanent # Kerberos
|
||||
firewall-cmd --add-port=88/udp --permanent # Kerberos
|
||||
firewall-cmd --add-port=464/tcp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=464/udp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=123/udp --permanent # NTP
|
||||
firewall-cmd --add-port=135/tcp --permanent # DCE/RPC locator service
|
||||
firewall-cmd --add-port=138/udp --permanent # NetBIOS Datagram Service
|
||||
firewall-cmd --add-port=139/tcp --permanent # NetBIOS Session Service
|
||||
firewall-cmd --add-port=445/tcp --permanent # Microsoft-DS Active Directory, Windows shares
|
||||
firewall-cmd --add-port=1024-1300/tcp --permanent # High ports for AD trust
|
||||
firewall-cmd --add-port=1024-1300/udp --permanent # High ports for AD trust
|
||||
firewall-cmd --reload | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure DNS settings without DNSSEC
|
||||
function configure_dns {
|
||||
echo "Konfiguriere DNS..." | tee -a $LOGFILE
|
||||
|
||||
cat <<EOF > /etc/named.conf
|
||||
options {
|
||||
directory "/var/named";
|
||||
forwarders {
|
||||
$DNS_FORWARDER;
|
||||
};
|
||||
};
|
||||
zone "$DOMAIN" IN {
|
||||
type master;
|
||||
file "$DOMAIN.zone";
|
||||
};
|
||||
EOF
|
||||
|
||||
cat <<EOF > /var/named/$DOMAIN.zone
|
||||
\$TTL 86400
|
||||
@ IN SOA $HOSTNAME. admin.$DOMAIN. (
|
||||
2024090701 ; Serial
|
||||
3600 ; Refresh
|
||||
1800 ; Retry
|
||||
1209600 ; Expire
|
||||
86400 ) ; Minimum TTL
|
||||
|
||||
@ IN NS $HOSTNAME.
|
||||
@ IN A $IP_ADDRESS
|
||||
EOF
|
||||
|
||||
# Restart DNS service
|
||||
systemctl restart named
|
||||
}
|
||||
|
||||
# Main function
|
||||
function main {
|
||||
check_root
|
||||
install_packages
|
||||
install_idm_server
|
||||
configure_ad_trust
|
||||
configure_samba
|
||||
configure_firewall
|
||||
configure_dns
|
||||
echo "IdM-Server Installation und Konfiguration abgeschlossen." | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Run the script
|
||||
main
|
||||
Executable
+95
@@ -0,0 +1,95 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit on any error
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
||||
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
||||
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
||||
DNS_FORWARDER="192.168.1.1" # Externer DNS-Forwarder (Google in diesem Fall)
|
||||
PASSWORD="ipaAdminPassword" # Admin-Passwort (in der Praxis sicher speichern)
|
||||
DIRMAN_PASSWORD="dirmanPassword" # Directory Manager Passwort
|
||||
AD_REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Active Directory Realm in Großbuchstaben
|
||||
AD_DOMAIN=$(hostname -d) # Active Directory Domain in Kleinbuchstaben
|
||||
AD_ADMIN_USER="administrator" # Administrator-Account der AD-Domäne
|
||||
AD_ADMIN_PASS="adAdminPassword" # Passwort des Administrator-Accounts
|
||||
|
||||
LOGFILE="/var/log/idm_install.log"
|
||||
|
||||
# Function to check if running as root
|
||||
function check_root {
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo "Dieses Skript muss als Root ausgeführt werden!" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to install the necessary packages
|
||||
function install_packages {
|
||||
echo "Installiere benötigte Pakete..." | tee -a $LOGFILE
|
||||
yum update -y | tee -a $LOGFILE
|
||||
|
||||
echo "Installiere erforderliche Pakete..." | tee -a $LOGFILE
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm | tee -a $LOGFILE
|
||||
dnf -y install @idm:DL1 | tee -a $LOGFILE
|
||||
yum install -y ipa-server ipa-server-dns bind samba samba-client bind-pkcs11-utils | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to install the IDM server with DNS and AD Trust
|
||||
function install_idm_server {
|
||||
echo "Installiere IdM-Server mit DNS und AD-Trust..." | tee -a $LOGFILE
|
||||
|
||||
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
||||
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
||||
--ip-address=$IP_ADDRESS --no-pkinit \
|
||||
--setup-dns --auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure AD trust
|
||||
function configure_ad_trust {
|
||||
echo "Konfiguriere AD-Trust..." | tee -a $LOGFILE
|
||||
|
||||
yum install -y ipa-server-trust-ad | tee -a $LOGFILE
|
||||
|
||||
ipa-adtrust-install --add-sids --netbios-name=$(echo $REALM | cut -d. -f1) --no-msdcs --admin-password=$PASSWORD -U | tee -a $LOGFILE
|
||||
|
||||
ipa trust-add --type=ad $AD_REALM --admin=$AD_ADMIN_USER --password=$AD_ADMIN_PASS | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure firewall
|
||||
function configure_firewall {
|
||||
echo "Konfiguriere Firewall..." | tee -a $LOGFILE
|
||||
|
||||
firewall-cmd --add-service=freeipa-ldap --permanent
|
||||
firewall-cmd --add-service=freeipa-ldaps --permanent
|
||||
firewall-cmd --add-service=freeipa-replication --permanent
|
||||
firewall-cmd --add-service=freeipa-trust --permanent
|
||||
firewall-cmd --add-service=dns --permanent
|
||||
firewall-cmd --add-port=88/tcp --permanent # Kerberos
|
||||
firewall-cmd --add-port=88/udp --permanent # Kerberos
|
||||
firewall-cmd --add-port=464/tcp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=464/udp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=123/udp --permanent # NTP
|
||||
firewall-cmd --add-port=135/tcp --permanent # DCE/RPC locator service
|
||||
firewall-cmd --add-port=138/udp --permanent # NetBIOS Datagram Service
|
||||
firewall-cmd --add-port=139/tcp --permanent # NetBIOS Session Service
|
||||
firewall-cmd --add-port=445/tcp --permanent # Microsoft-DS Active Directory, Windows shares
|
||||
firewall-cmd --add-port=1024-1300/tcp --permanent # High ports for AD trust
|
||||
firewall-cmd --add-port=1024-1300/udp --permanent # High ports for AD trust
|
||||
firewall-cmd --reload | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Main function
|
||||
function main {
|
||||
check_root
|
||||
install_packages
|
||||
install_idm_server
|
||||
configure_ad_trust
|
||||
configure_firewall
|
||||
echo "IdM-Server mit DNS und AD-Trust Installation abgeschlossen." | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Run the script
|
||||
main
|
||||
Executable
Executable
+118
@@ -0,0 +1,118 @@
|
||||
#!/bin/bash
|
||||
|
||||
|
||||
gruppe="MGT_SG_TIER1_Admins"
|
||||
|
||||
# Pfad zur Konfigurationsdatei
|
||||
file="/etc/resolv.conf"
|
||||
file2="/etc/sssd/sssd.conf"
|
||||
file3="/etc/pam.d/common-session"
|
||||
file4="/etc/sudoers.d/realm"
|
||||
|
||||
# Wert, den Sie überprüfen und setzen möchten
|
||||
value="domain heim.lan"
|
||||
|
||||
|
||||
resolv () {
|
||||
#anpassung resolv.conf
|
||||
echo "!!!! Erforderlichen Daten werden in die resolv.conf geschrieben !!!!"
|
||||
# Prüfen, ob der Wert in der Datei vorhanden ist
|
||||
if grep -q "$value" "$file"; then
|
||||
echo "Der Wert '$value' ist bereits in der Datei vorhanden."
|
||||
else
|
||||
# Setzen Sie den Wert, wenn er nicht vorhanden ist
|
||||
echo "damain heim.lan" >> /etc/resolv.conf
|
||||
echo "search heim.lan" >> /etc/resolv.conf
|
||||
fi
|
||||
}
|
||||
packages () {
|
||||
#Packete installieren
|
||||
echo "!!!! Domain Packete werden installiert !!!!"
|
||||
apt -y install realmd sssd sssd-tools libnss-sss libpam-sss adcli samba-common-bin oddjob oddjob-mkhomedir packagekit libsss-sudo
|
||||
}
|
||||
join () {
|
||||
#domain join
|
||||
realm join HEIM.LAN
|
||||
echo "P@ssw0rd"
|
||||
}
|
||||
ssh () {
|
||||
#SSH Berechtigung
|
||||
realm -v permit -g "$gruppe"
|
||||
}
|
||||
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
||||
#Anpassung der SSDD.CONF
|
||||
sssd () {
|
||||
# Dienste, die hinzugefügt werden sollen
|
||||
services="nss, pam, ssh, sudo"
|
||||
service1="False"
|
||||
group="MGT_SG_TIER1_Admins"
|
||||
text="\n \n
|
||||
# add to the end \n
|
||||
ldap_user_uid_number = uidNumber \n
|
||||
ldap_user_gid_number = gidNumber \n
|
||||
simple_allow_groups = MGT_SG_TIER1_Admins \n
|
||||
sudoers_provider = ad \n
|
||||
ad_sudo_search_base = CN=MGT_SG_TIER1_Admins,OU=Tier1_Admins,OU=Domain Groups,DC=heim,DC=lan \n
|
||||
\n
|
||||
\n
|
||||
[sudo] \n
|
||||
debug_level=5"
|
||||
|
||||
# Überprüfen und Anhängen der Dienste und Gruppen
|
||||
if ! grep -q "^services = $services" "$file2"; then
|
||||
if grep -q "^services = " "$file2"; then
|
||||
sed -i "s|^services =.*|services = $services|g" "$file2"
|
||||
else
|
||||
echo "services = $services" >> "$file2"
|
||||
fi
|
||||
fi
|
||||
|
||||
if ! grep -q "^use_fully_qualified_names = $service1" "$file2"; then
|
||||
if grep -q "^use_fully_qualified_names = " "$file2"; then
|
||||
sed -i "s|use_fully_qualified_names =.*|use_fully_qualified_names = $service1|g" "$file2"
|
||||
else
|
||||
echo "use_fully_qualified_names = $service1" >> "$file2"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
if ! grep -q "^simple_allow_group = $group" "$file2"; then
|
||||
echo "simple_allow_group = $group" >> "$file2"
|
||||
fi
|
||||
echo -e $text >> "$file"
|
||||
echo "Dienste und Gruppe wurden der Konfigurationsdatei hinzugefügt."
|
||||
}
|
||||
|
||||
pam () {
|
||||
# Anpassung der Pam Common-Session
|
||||
echo "!!!! Anpannsung der Common-session Home Directory einrichtung !!!!"
|
||||
pamtext="session optional pam_mkhomedir.so skel=/etc/skel umask=077"
|
||||
|
||||
#feststellen der vorletzen Zeile
|
||||
line_count=$(wc -l < "$file3")
|
||||
|
||||
# Einfügen des Textes in die vorletzte Zeile
|
||||
sed -i "$((line_count-1))i$pamtext" "$file3"
|
||||
}
|
||||
sudo () {
|
||||
# Anpassung der Sudo Rechte
|
||||
echo "!!!! Anpassung der Sudo rechte Für die Domain Gruppe" $group
|
||||
sudo="%MGT_SG_TIER1_Admins ALL=(ALL:ALL) NOPASSWD:ALL"
|
||||
touch /etc/sudoers.d/REALM
|
||||
echo "$sudo" >> "$file4"
|
||||
}
|
||||
dienst (){
|
||||
systemctl restart sssd
|
||||
systemctl restart sshd
|
||||
reboot
|
||||
}
|
||||
|
||||
# Aufruf der Funktionen
|
||||
resolv
|
||||
packages
|
||||
join
|
||||
ssh
|
||||
sssd
|
||||
pam
|
||||
sudo
|
||||
dienst
|
||||
+60
@@ -0,0 +1,60 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen
|
||||
REALM="SAMDOM.EXAMPLE.COM"
|
||||
DOMAIN="SAMDOM"
|
||||
ADMIN_PASS="AdminPassword123"
|
||||
HOSTNAME="dc1.samdom.example.com"
|
||||
|
||||
# Systemaktualisierung und Installation von Paketen
|
||||
echo "Aktualisieren des Systems und Installieren der notwendigen Pakete..."
|
||||
yum update -y
|
||||
yum install -y epel-release
|
||||
yum install -y wget vim samba samba-client samba-common samba-krb5-printing samba-common-tools bind-utils
|
||||
|
||||
# Setzen des Hostnamens
|
||||
echo "Setzen des Hostnamens..."
|
||||
hostnamectl set-hostname $HOSTNAME
|
||||
|
||||
# Provisionierung des Samba-Domain Controllers
|
||||
echo "Provisionieren des Samba-Domain Controllers..."
|
||||
samba-tool domain provision --realm=$REALM --domain=$DOMAIN --server-role=dc --dns-backend=SAMBA_INTERNAL --adminpass=$ADMIN_PASS --use-rfc2307
|
||||
|
||||
# Konfiguration der /etc/krb5.conf
|
||||
echo "Konfigurieren der /etc/krb5.conf..."
|
||||
cat <<EOT > /etc/krb5.conf
|
||||
[libdefaults]
|
||||
default_realm = $REALM
|
||||
dns_lookup_realm = false
|
||||
dns_lookup_kdc = true
|
||||
EOT
|
||||
|
||||
# Konfiguration der /etc/resolv.conf
|
||||
echo "Konfigurieren der /etc/resolv.conf..."
|
||||
cat <<EOT > /etc/resolv.conf
|
||||
search $DOMAIN
|
||||
nameserver 127.0.0.1
|
||||
EOT
|
||||
|
||||
# Starten und Aktivieren des Samba-Dienstes
|
||||
echo "Starten und Aktivieren des Samba-Dienstes..."
|
||||
systemctl enable samba-ad-dc
|
||||
systemctl start samba-ad-dc
|
||||
|
||||
# Firewall-Konfiguration
|
||||
echo "Konfigurieren der Firewall..."
|
||||
firewall-cmd --permanent --add-service=samba
|
||||
firewall-cmd --permanent --add-service=kerberos
|
||||
firewall-cmd --permanent --add-service=dns
|
||||
firewall-cmd --reload
|
||||
|
||||
# Überprüfen der Samba-Konfiguration
|
||||
echo "Überprüfen der Samba-Konfiguration..."
|
||||
samba-tool domain level show
|
||||
|
||||
# Überprüfen des DNS-Dienstes
|
||||
echo "Überprüfen des DNS-Dienstes..."
|
||||
nslookup -type=SRV _ldap._tcp.$DOMAIN
|
||||
nslookup -type=SRV _kerberos._tcp.$DOMAIN
|
||||
|
||||
echo "Die Konfiguration ist abgeschlossen."
|
||||
Executable
+53
@@ -0,0 +1,53 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen
|
||||
REALM="SAMDOM.EXAMPLE.COM"
|
||||
DOMAIN="SAMDOM"
|
||||
ADMIN_PASS="AdminPassword123"
|
||||
HOSTNAME="dc1.samdom.example.com"
|
||||
|
||||
# Systemaktualisierung und Installation von Paketen
|
||||
echo "Aktualisieren des Systems und Installieren der notwendigen Pakete..."
|
||||
yum update -y
|
||||
yum install -y epel-release
|
||||
yum install -y wget vim samba samba-client samba-common samba-krb5-printing samba-common-tools
|
||||
|
||||
# Setzen des Hostnamens
|
||||
echo "Setzen des Hostnamens..."
|
||||
hostnamectl set-hostname $HOSTNAME
|
||||
|
||||
# Provisionierung des Samba-Domain Controllers
|
||||
echo "Provisionieren des Samba-Domain Controllers..."
|
||||
samba-tool domain provision --realm=$REALM --domain=$DOMAIN --server-role=dc --dns-backend=SAMBA_INTERNAL --adminpass=$ADMIN_PASS --use-rfc2307
|
||||
|
||||
# Konfiguration der /etc/krb5.conf
|
||||
echo "Konfigurieren der /etc/krb5.conf..."
|
||||
cat <<EOT > /etc/krb5.conf
|
||||
[libdefaults]
|
||||
default_realm = $REALM
|
||||
dns_lookup_realm = false
|
||||
dns_lookup_kdc = true
|
||||
EOT
|
||||
|
||||
# Starten und Aktivieren des Samba-Dienstes
|
||||
echo "Starten und Aktivieren des Samba-Dienstes..."
|
||||
systemctl enable samba-ad-dc
|
||||
systemctl start samba-ad-dc
|
||||
|
||||
# Firewall-Konfiguration
|
||||
echo "Konfigurieren der Firewall..."
|
||||
firewall-cmd --permanent --add-service=samba
|
||||
firewall-cmd --permanent --add-service=kerberos
|
||||
firewall-cmd --permanent --add-service=dns
|
||||
firewall-cmd --reload
|
||||
|
||||
# Überprüfen der Samba-Konfiguration
|
||||
echo "Überprüfen der Samba-Konfiguration..."
|
||||
samba-tool domain level show
|
||||
|
||||
# Überprüfen des DNS-Dienstes
|
||||
echo "Überprüfen des DNS-Dienstes..."
|
||||
nslookup -type=SRV _ldap._tcp.$DOMAIN
|
||||
nslookup -type=SRV _kerberos._tcp.$DOMAIN
|
||||
|
||||
echo "Die Konfiguration ist abgeschlossen."
|
||||
Executable
+86
@@ -0,0 +1,86 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen für benutzerdefinierte Einstellungen
|
||||
DB_NAME="openxpki"
|
||||
DB_USER="your_db_user"
|
||||
DB_PASSWORD="your_db_password"
|
||||
SERVER_NAME="ca.test.lan"
|
||||
|
||||
# Aktualisiere das System
|
||||
sudo apt-get update
|
||||
sudo apt-get upgrade -y
|
||||
|
||||
# Installiere erforderliche Pakete
|
||||
sudo apt-get install -y build-essential libssl-dev libdbi-perl libdbd-sqlite3-perl libdbd-mysql-perl \
|
||||
libdbd-pg-perl libdata-uuid-perl libdatetime-perl libdatetime-timezone-perl libmime-base64-urlsafe-perl \
|
||||
libxml-parser-perl libxml-simple-perl libmoose-perl libmoosex-aliases-perl libtry-tiny-perl \
|
||||
libjson-perl libdbd-mysql-perl libdbd-sqlite3-perl libdbd-pg-perl
|
||||
|
||||
# Füge das OpenXPKI-Repository hinzu
|
||||
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1397BC53640DB551
|
||||
echo "deb http://packages.openxpki.org/debian/ focal release" | sudo tee /etc/apt/sources.list.d/openxpki.list
|
||||
sudo apt-get update
|
||||
|
||||
# Installiere OpenXPKI
|
||||
sudo apt-get install -y openxpki
|
||||
|
||||
# Installiere MySQL-Server
|
||||
sudo apt-get install -y mysql-server
|
||||
sudo mysql_secure_installation
|
||||
|
||||
# Erstelle und konfiguriere die OpenXPKI-Datenbank
|
||||
sudo mysql -u root -p <<EOF
|
||||
CREATE DATABASE $DB_NAME;
|
||||
CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASSWORD';
|
||||
GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';
|
||||
FLUSH PRIVILEGES;
|
||||
EXIT;
|
||||
EOF
|
||||
|
||||
# Konfigurationsdateien bearbeiten, um den benutzerdefinierten Datenbankbenutzer zu verwenden
|
||||
sudo sed -i "s/DBI:mysql:database=openxpki;host=localhost/DBI:mysql:database=$DB_NAME;host=localhost/" /etc/openxpki/config.d/system/database.yaml
|
||||
sudo sed -i "s/user: openxpki/user: $DB_USER/" /etc/openxpki/config.d/system/database.yaml
|
||||
sudo sed -i "s/pass: secret/password: $DB_PASSWORD/" /etc/openxpki/config.d/system/database.yaml
|
||||
|
||||
# Starte und aktiviere OpenXPKI
|
||||
sudo systemctl start openxpki
|
||||
sudo systemctl enable openxpki
|
||||
|
||||
# Installiere und konfiguriere Apache
|
||||
sudo apt-get install -y apache2 libapache2-mod-fcgid
|
||||
|
||||
# Erstelle die Apache-Konfigurationsdatei
|
||||
sudo tee /etc/apache2/sites-available/openxpki.conf <<EOF
|
||||
<VirtualHost *:80>
|
||||
ServerName $SERVER_NAME
|
||||
|
||||
DocumentRoot /var/www/openxpki
|
||||
|
||||
<Directory /var/www/openxpki>
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
|
||||
<Directory "/usr/lib/cgi-bin">
|
||||
AllowOverride None
|
||||
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
Alias /openxpki /var/www/openxpki
|
||||
<Directory /var/www/openxpki>
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
</VirtualHost>
|
||||
EOF
|
||||
|
||||
# Konfiguriere und starte Apache neu
|
||||
sudo a2enmod cgi
|
||||
sudo a2ensite openxpki
|
||||
sudo systemctl restart apache2
|
||||
|
||||
echo "Installation und Konfiguration von OpenXPKI abgeschlossen. Öffne http://$SERVER_NAME/openxpki in deinem Browser."
|
||||
Executable
+84
@@ -0,0 +1,84 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Funktion zum Installieren des OnlyOffice Document Servers
|
||||
install_onlyoffice() {
|
||||
OS=$1
|
||||
SSL_CERT_PATH="/etc/onlyoffice/documentserver/ssl"
|
||||
|
||||
if [[ "$OS" == "ubuntu" || "$OS" == "debian" ]]; then
|
||||
sudo apt update
|
||||
sudo apt upgrade -y
|
||||
sudo apt install -y software-properties-common wget gnupg
|
||||
wget -qO - https://download.onlyoffice.com/repo/onlyoffice.asc | sudo apt-key add -
|
||||
echo "deb https://download.onlyoffice.com/repo/debian squeeze main" | sudo tee /etc/apt/sources.list.d/onlyoffice.list
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y onlyoffice-documentserver
|
||||
elif [[ "$OS" == "centos" || "$OS" == "rhel" ]]; then
|
||||
sudo yum update -y
|
||||
sudo yum install -y epel-release wget
|
||||
wget https://download.onlyoffice.com/repo/centos/main/onlyoffice-repo.noarch.rpm
|
||||
sudo rpm -ivh onlyoffice-repo.noarch.rpm
|
||||
sudo yum install -y onlyoffice-documentserver
|
||||
else
|
||||
echo "Nicht unterstütztes Betriebssystem: $OS"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Hinweis anzeigen und auf Benutzeraktion warten
|
||||
echo "Bitte kopieren Sie die Zertifikatsdateien (fullchain.pem und privkey.pem) auf Ihre Synology NAS unter /volume1/certs/"
|
||||
read -p "Drücken Sie Enter, sobald Sie die Zertifikatsdateien bereitgestellt haben..."
|
||||
|
||||
# SSL-Zertifikate von Synology NAS kopieren
|
||||
NAS_IP="<IP-der-Synology-NAS>"
|
||||
NAS_CERT_PATH="/volume1/certs"
|
||||
sudo mkdir -p $SSL_CERT_PATH
|
||||
scp admin@$NAS_IP:$NAS_CERT_PATH/fullchain.pem /tmp/fullchain.pem
|
||||
scp admin@$NAS_IP:$NAS_CERT_PATH/privkey.pem /tmp/privkey.pem
|
||||
|
||||
# SSL-Zertifikate verschieben
|
||||
sudo mv /tmp/fullchain.pem $SSL_CERT_PATH/fullchain.pem
|
||||
sudo mv /tmp/privkey.pem $SSL_CERT_PATH/privkey.pem
|
||||
|
||||
# Berechtigungen setzen
|
||||
sudo chown -R onlyoffice:onlyoffice $SSL_CERT_PATH
|
||||
sudo chmod 600 $SSL_CERT_PATH/*
|
||||
|
||||
# OnlyOffice Konfiguration aktualisieren
|
||||
ONLYOFFICE_CONFIG="/etc/onlyoffice/documentserver/local.json"
|
||||
sudo tee $ONLYOFFICE_CONFIG > /dev/null <<EOL
|
||||
{
|
||||
"services": {
|
||||
"CoAuthoring": {
|
||||
"ssl": {
|
||||
"enable": true,
|
||||
"cert_path": "/etc/onlyoffice/documentserver/ssl/fullchain.pem",
|
||||
"key_path": "/etc/onlyoffice/documentserver/ssl/privkey.pem"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
EOL
|
||||
|
||||
# OnlyOffice Document Server neu starten
|
||||
sudo systemctl restart onlyoffice-documentserver
|
||||
|
||||
# Installation abschließen
|
||||
echo "OnlyOffice Document Server wurde installiert und konfiguriert."
|
||||
echo "Besuchen Sie https://<IP-der-VM>, um den Dienst zu testen."
|
||||
}
|
||||
|
||||
# Betriebssystem erkennen
|
||||
if [ -f /etc/os-release ]; then
|
||||
. /etc/os-release
|
||||
OS=$ID
|
||||
elif [ -f /etc/centos-release ]; then
|
||||
OS="centos"
|
||||
elif [ -f /etc/redhat-release ]; then
|
||||
OS="rhel"
|
||||
else
|
||||
echo "Unbekanntes Betriebssystem"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# OnlyOffice Document Server installieren
|
||||
install_onlyoffice $OS
|
||||
+102
@@ -0,0 +1,102 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen für benutzerdefinierte Einstellungen
|
||||
DB_NAME="openxpki_intermediate"
|
||||
DB_USER="intermediate_db_user"
|
||||
DB_PASSWORD="intermediate_db_password"
|
||||
SERVER_NAME="intermediateca.heim.lan"
|
||||
ROOT_CA_CERT_PATH="/path/to/root/ca-cert.crt"
|
||||
INTERMEDIATE_CA_CERT_PATH="/path/to/intermediate/ca-cert.crt"
|
||||
INTERMEDIATE_CA_KEY_PATH="/path/to/intermediate/ca-key.key"
|
||||
|
||||
# System aktualisieren
|
||||
sudo dnf update -y
|
||||
|
||||
# Installiere erforderliche Pakete
|
||||
sudo dnf install -y epel-release
|
||||
sudo dnf install -y gcc gcc-c++ make perl-CPAN perl-DBI perl-DBD-MySQL perl-DBD-SQLite perl-DBD-Pg \
|
||||
perl-Data-UUID perl-DateTime perl-DateTime-TimeZone perl-MIME-Base64-URLSafe \
|
||||
perl-XML-Parser perl-XML-Simple perl-Moose perl-MooseX-Aliases perl-Try-Tiny \
|
||||
perl-JSON perl-DBD-MySQL perl-DBD-SQLite perl-DBD-Pg mariadb-server
|
||||
|
||||
# Füge das OpenXPKI-Repository hinzu
|
||||
sudo rpm --import https://packages.openxpki.org/key/OpenXPKI-2016-02-15.pub
|
||||
sudo tee /etc/yum.repos.d/openxpki.repo <<EOF
|
||||
[openxpki]
|
||||
name=OpenXPKI
|
||||
baseurl=http://packages.openxpki.org/rhel/8/release/
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
EOF
|
||||
sudo dnf update -y
|
||||
|
||||
# Installiere OpenXPKI
|
||||
sudo dnf install -y openxpki
|
||||
|
||||
# Starte und sichere die MariaDB-Installation
|
||||
sudo systemctl start mariadb
|
||||
sudo systemctl enable mariadb
|
||||
sudo mysql_secure_installation
|
||||
|
||||
# Erstelle und konfiguriere die OpenXPKI-Datenbank
|
||||
sudo mysql -u root -p <<EOF
|
||||
CREATE DATABASE $DB_NAME;
|
||||
CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASSWORD';
|
||||
GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';
|
||||
FLUSH PRIVILEGES;
|
||||
EXIT;
|
||||
EOF
|
||||
|
||||
# Konfigurationsdateien bearbeiten, um den benutzerdefinierten Datenbankbenutzer zu verwenden
|
||||
sudo sed -i "s/DBI:mysql:database=openxpki;host=localhost/DBI:mysql:database=$DB_NAME;host=localhost/" /etc/openxpki/config.d/system/database.yaml
|
||||
sudo sed -i "s/user: openxpki/user: $DB_USER/" /etc/openxpki/config.d/system/database.yaml
|
||||
sudo sed -i "s/pass: secret/password: $DB_PASSWORD/" /etc/openxpki/config.d/system/database.yaml
|
||||
|
||||
# Starte und aktiviere OpenXPKI
|
||||
sudo systemctl start openxpki
|
||||
sudo systemctl enable openxpki
|
||||
|
||||
# Installiere und konfiguriere Apache
|
||||
sudo dnf install -y httpd mod_fcgid
|
||||
|
||||
# Erstelle die Apache-Konfigurationsdatei
|
||||
sudo tee /etc/httpd/conf.d/openxpki.conf <<EOF
|
||||
<VirtualHost *:80>
|
||||
ServerName $SERVER_NAME
|
||||
|
||||
DocumentRoot /var/www/openxpki
|
||||
|
||||
<Directory /var/www/openxpki>
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
|
||||
<Directory "/usr/lib/cgi-bin">
|
||||
AllowOverride None
|
||||
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
Alias /openxpki /var/www/openxpki
|
||||
<Directory /var/www/openxpki>
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
</VirtualHost>
|
||||
EOF
|
||||
|
||||
# Konfiguriere und starte Apache neu
|
||||
sudo systemctl start httpd
|
||||
sudo systemctl enable httpd
|
||||
sudo systemctl restart httpd
|
||||
|
||||
# Firewall-Einstellungen anpassen
|
||||
sudo firewall-cmd --zone=public --add-service=http --permanent
|
||||
sudo firewall-cmd --zone=public --add-service=https --permanent
|
||||
sudo firewall-cmd --reload
|
||||
|
||||
# OpenXPKI als Intermediate CA initialisieren (Beispielkonfiguration)
|
||||
sudo tee /etc/openxpki/config.d/realm/heim.lan
|
||||
+111
@@ -0,0 +1,111 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen für benutzerdefinierte Einstellungen
|
||||
DB_NAME="openxpki_root"
|
||||
DB_USER="root_db_user"
|
||||
DB_PASSWORD="root_db_password"
|
||||
SERVER_NAME="rootca.heim.lan"
|
||||
|
||||
# System aktualisieren
|
||||
sudo dnf update -y
|
||||
|
||||
# Installiere erforderliche Pakete
|
||||
sudo dnf install -y epel-release
|
||||
sudo dnf install -y gcc gcc-c++ make perl-CPAN perl-DBI perl-DBD-MySQL perl-DBD-SQLite perl-DBD-Pg \
|
||||
perl-Data-UUID perl-DateTime perl-DateTime-TimeZone perl-MIME-Base64-URLSafe \
|
||||
perl-XML-Parser perl-XML-Simple perl-Moose perl-MooseX-Aliases perl-Try-Tiny \
|
||||
perl-JSON perl-DBD-MySQL perl-DBD-SQLite perl-DBD-Pg mariadb-server
|
||||
|
||||
# Füge das OpenXPKI-Repository hinzu
|
||||
sudo rpm --import https://packages.openxpki.org/key/OpenXPKI-2016-02-15.pub
|
||||
sudo tee /etc/yum.repos.d/openxpki.repo <<EOF
|
||||
[openxpki]
|
||||
name=OpenXPKI
|
||||
baseurl=http://packages.openxpki.org/rhel/8/release/
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
EOF
|
||||
sudo dnf update -y
|
||||
|
||||
# Installiere OpenXPKI
|
||||
sudo dnf install -y openxpki
|
||||
|
||||
# Starte und sichere die MariaDB-Installation
|
||||
sudo systemctl start mariadb
|
||||
sudo systemctl enable mariadb
|
||||
sudo mysql_secure_installation
|
||||
|
||||
# Erstelle und konfiguriere die OpenXPKI-Datenbank
|
||||
sudo mysql -u root -p <<EOF
|
||||
CREATE DATABASE $DB_NAME;
|
||||
CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASSWORD';
|
||||
GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';
|
||||
FLUSH PRIVILEGES;
|
||||
EXIT;
|
||||
EOF
|
||||
|
||||
# Konfigurationsdateien bearbeiten, um den benutzerdefinierten Datenbankbenutzer zu verwenden
|
||||
sudo sed -i "s/DBI:mysql:database=openxpki;host=localhost/DBI:mysql:database=$DB_NAME;host=localhost/" /etc/openxpki/config.d/system/database.yaml
|
||||
sudo sed -i "s/user: openxpki/user: $DB_USER/" /etc/openxpki/config.d/system/database.yaml
|
||||
sudo sed -i "s/pass: secret/password: $DB_PASSWORD/" /etc/openxpki/config.d/system/database.yaml
|
||||
|
||||
# Starte und aktiviere OpenXPKI
|
||||
sudo systemctl start openxpki
|
||||
sudo systemctl enable openxpki
|
||||
|
||||
# Installiere und konfiguriere Apache
|
||||
sudo dnf install -y httpd mod_fcgid
|
||||
|
||||
# Erstelle die Apache-Konfigurationsdatei
|
||||
sudo tee /etc/httpd/conf.d/openxpki.conf <<EOF
|
||||
<VirtualHost *:80>
|
||||
ServerName $SERVER_NAME
|
||||
|
||||
DocumentRoot /var/www/openxpki
|
||||
|
||||
<Directory /var/www/openxpki>
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
|
||||
<Directory "/usr/lib/cgi-bin">
|
||||
AllowOverride None
|
||||
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
Alias /openxpki /var/www/openxpki
|
||||
<Directory /var/www/openxpki>
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
</VirtualHost>
|
||||
EOF
|
||||
|
||||
# Konfiguriere und starte Apache neu
|
||||
sudo systemctl start httpd
|
||||
sudo systemctl enable httpd
|
||||
sudo systemctl restart httpd
|
||||
|
||||
# Firewall-Einstellungen anpassen
|
||||
sudo firewall-cmd --zone=public --add-service=http --permanent
|
||||
sudo firewall-cmd --zone=public --add-service=https --permanent
|
||||
sudo firewall-cmd --reload
|
||||
|
||||
# OpenXPKI als Root CA initialisieren (Beispielkonfiguration)
|
||||
sudo tee /etc/openxpki/config.d/realm/heim.lan/crypto.yaml <<EOF
|
||||
crypto:
|
||||
default:
|
||||
backend: OpenSSL
|
||||
key: /etc/openxpki/keys/root-ca.key
|
||||
cert: /etc/openxpki/keys/root-ca.crt
|
||||
chain: []
|
||||
tls_profile:
|
||||
default:
|
||||
label: "Root CA"
|
||||
EOF
|
||||
|
||||
echo "Installation und Konfiguration von OpenXPKI als Root CA abgeschlossen. Öffne http://$SERVER_NAME/openxpki in deinem Browser."
|
||||
Executable
+71
@@ -0,0 +1,71 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Set hostname
|
||||
hostnamectl set-hostname ds389.heim.lan
|
||||
DOMAIN=$(hostname -d)
|
||||
# Set IP address (Assuming RHEL 8+ with NetworkManager)
|
||||
nmcli connection modify eth0 ipv4.addresses 192.168.44.200/24
|
||||
nmcli connection up eth0
|
||||
|
||||
# Install required packages
|
||||
dnf install epel-release -y
|
||||
dnf install 389-ds-base -y
|
||||
|
||||
# Angaben für erstellung CSR
|
||||
C="DE" # Country ANgabe
|
||||
ST="TH" # State Angabe
|
||||
L="ILM" # Location Angabe
|
||||
# Extrahiere OU (Organizational Unit) und O (Organization) und wandele sie in Großbuchstaben um
|
||||
O=$(echo "${DOMAIN#*.}" | tr '[:lower:]' '[:upper:]') # Organisation Angabe
|
||||
OU=$(echo "${DOMAIN%%.*}" | tr '[:lower:]' '[:upper:]') # Organisation Unit Angaben
|
||||
|
||||
|
||||
# Read IP address dynamically from active network interface
|
||||
IP_ADDRESS=$(nmcli -t -f IP4.ADDRESS device show | awk -F: '{split($2,a,"/"); print a[1]; exit}')
|
||||
echo "IP Address: ${IP_ADDRESS}"
|
||||
|
||||
# Read DNS name dynamically
|
||||
HOST_FQDN=$(hostname -f)
|
||||
echo "DNS Name: ${HOST_FQDN}"
|
||||
|
||||
# Read Hostname dynamically
|
||||
HOST_NORMAL=$(hostname -s)
|
||||
echo "Hostname: ${HOST_NORMAL}"
|
||||
|
||||
# Set paths to your CA certificates and CSR files
|
||||
CA_ROOT_CERT="/path/to/root_ca.crt"
|
||||
CA_INTERMEDIATE_CERT="/path/to/intermediate_ca.crt"
|
||||
SERVER_CERT="/path/to/server_cert.crt"
|
||||
CSR_FILE="/tmp/ds389.heim.lan.csr"
|
||||
KEY_FILE="/tmp/ds389.heim.lan.key"
|
||||
|
||||
# Generate CSR and private key with IP address as SAN
|
||||
openssl req -new -newkey rsa:4096 -nodes \
|
||||
-keyout "$KEY_FILE" -out "$CSR_FILE" \
|
||||
-subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${HOST_FQDN}" \
|
||||
-reqexts SAN -config <(cat /etc/pki/tls/openssl.cnf \
|
||||
<(printf "[SAN]\nsubjectAltName=IP:${IP_ADDRESS},DNS:${HOST_FQDN}"))
|
||||
|
||||
# Install CA certificates
|
||||
cp "$CA_ROOT_CERT" /etc/pki/ca-trust/source/anchors/
|
||||
cp "$CA_INTERMEDIATE_CERT" /etc/pki/ca-trust/source/anchors/
|
||||
update-ca-trust extract
|
||||
|
||||
# Setup Directory Server
|
||||
setup-ds-admin --silent \
|
||||
--hostname ${HOST_FQDN} \
|
||||
--domain "$DOMAIN" \
|
||||
--rootdn "cn=Directory Manager" \
|
||||
--rootpw your_password_here \
|
||||
--admin "admin" \
|
||||
--enable ldaps \
|
||||
--fips off \
|
||||
--addn add
|
||||
|
||||
# Configure SSL/TLS for Directory Server using CSR
|
||||
dsconf -D "cn=Directory Manager" ldap://localhost ssl import-cert "$SERVER_CERT" "$CA_INTERMEDIATE_CERT" "$CA_ROOT_CERT"
|
||||
dsconf -D "cn=Directory Manager" ldap://localhost ssl on
|
||||
|
||||
# Start and enable Directory Server
|
||||
systemctl start dirsrv@ds389
|
||||
systemctl enable dirsrv@ds389
|
||||
Executable
+186
@@ -0,0 +1,186 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen setzen
|
||||
DOMAIN="iot.heim.lan"
|
||||
CERT_DIR="/etc/pki/tls/certs"
|
||||
PRIVATE_DIR="/etc/pki/tls/private"
|
||||
APACHE_CONF="/etc/httpd/conf.d/nextcloud.conf"
|
||||
NEXTCLOUD_DIR="/var/www/html/nextcloud"
|
||||
NC_DATASTORE="/volume1/DATEN1/nextcloud-data"
|
||||
DB_NAME="nextcloud"
|
||||
DB_USER="nextclouduser"
|
||||
DB_PASSWORD="P@ssw0rd"
|
||||
SYNOLOGY_IP="192.168.31.250"
|
||||
SYNOLOGY_USER="Madzone"
|
||||
SYNOLOGY_PW="P@ssw0rd"
|
||||
SYNOLOGY_PATH_SERVER="/volume1/DATEN1/HEIMLAN/IOT-NC.IOT.HEIM.LAN"
|
||||
SYNOLOGY_PATH_SubCA="/volume1/DATEN1/HEIMLAN/SubCA"
|
||||
SYNOLOGY_PATH_RootCA="/volume1/DATEN1/HEIMLAN/RootCA"
|
||||
CERT_NAME_SRV="CERT_$(hostname -f).crt"
|
||||
KEY_NAME_SRV="KEY_$(hostname -f).pem}"
|
||||
CERT_NAME_ROOT="CERT_HEIMLAN_RootCA.crt"
|
||||
CERT_NAME_SUBCA="CERT_HEIMLAN_SubCA.crt"
|
||||
|
||||
# System-Updates und erforderliche Pakete installieren
|
||||
00_system_update(){
|
||||
echo "System-Updates und erforderliche Pakete installieren"
|
||||
yum update -y
|
||||
#yum install -y epel-release
|
||||
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
dnf install -y https://rpms.remirepo.net/enterprise/remi-release-8.rpm
|
||||
dnf module enable php:remi-8.3 -y
|
||||
yum install -y httpd mariadb-server php php-mysqlnd php-xml php-mbstring php-gd php-curl php-intl php-zip php-bcmath wget unzip mod_ssl sshpass
|
||||
}
|
||||
# Zertifikate von Synology kopieren
|
||||
01_cert_import(){
|
||||
mkdir -p ~/.ssh
|
||||
sudo mkdir -p /root/.ssh
|
||||
sudo chmod 700 /root/.ssh
|
||||
sudo ssh-keyscan -H $SYNOLOGY_IP >> ~/.ssh/known_hosts
|
||||
ssh-keyscan -H $SYNOLOGY_IP >> ~/.ssh/known_hosts
|
||||
sshpass -p $SYNOLOGY_PW scp $SYNOLOGY_USER@$SYNOLOGY_IP:$SYNOLOGY_PATH_SERVER/$CERT_NAME_SRV $CERT_DIR/$CERT_NAME_SRV
|
||||
sshpass -p $SYNOLOGY_PW scp $SYNOLOGY_USER@$SYNOLOGY_IP:$SYNOLOGY_PATH_SERVER/$KEY_NAME_SRV $PRIVATE_DIR/$KEY_NAME_SRV
|
||||
sshpass -p $SYNOLOGY_PW scp $SYNOLOGY_USER@$SYNOLOGY_IP:$SYNOLOGY_PATH_SubCA/$CERT_NAME_SUBCA $CERT_DIR/$CERT_NAME_SUBCA
|
||||
sshpass -p $SYNOLOGY_PW scp $SYNOLOGY_USER@$SYNOLOGY_IP:$SYNOLOGY_PATH_RootCA/$CERT_NAME_ROOT $CERT_DIR/$CERT_NAME_ROOT
|
||||
}
|
||||
# Dienste starten und aktivieren
|
||||
02_service_start(){
|
||||
systemctl start httpd mariadb
|
||||
systemctl enable httpd mariadb
|
||||
}
|
||||
# Nextcloud herunterladen und entpacken
|
||||
03_download_nc(){
|
||||
echo "Nextcloud herunterladen und entpacken"
|
||||
cd /var/www/html
|
||||
wget https://download.nextcloud.com/server/releases/latest.zip
|
||||
unzip latest.zip
|
||||
chown -R apache:apache $NEXTCLOUD_DIR
|
||||
chmod -R 755 $NEXTCLOUD_DIR
|
||||
}
|
||||
# MariaDB konfigurieren
|
||||
04_install_db(){
|
||||
echo "MariaDB konfigurieren"
|
||||
mysql_secure_installation<<EOF
|
||||
|
||||
y
|
||||
$DB_PASSWORD
|
||||
$DB_PASSWORD
|
||||
y
|
||||
y
|
||||
y
|
||||
y
|
||||
EOF
|
||||
}
|
||||
# Nextcloud-Datenbank und Benutzer erstellen
|
||||
05_config_nc_db(){
|
||||
echo "Nextcloud-Datenbank und Benutzer erstellen"
|
||||
mysql -u root -p$DB_PASSWORD<<EOF
|
||||
CREATE DATABASE $DB_NAME;
|
||||
CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASSWORD';
|
||||
GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';
|
||||
FLUSH PRIVILEGES;
|
||||
EXIT;
|
||||
EOF
|
||||
echo "Nextcloud-Datenbank mit Name $DB_NAME und Benutzer $DB_USER erstellt"
|
||||
}
|
||||
#
|
||||
|
||||
# OnlyOffice Document Server installieren (falls erforderlich)
|
||||
07_install_onlyoffice(){
|
||||
echo "OnlyOffice Document Server installieren"
|
||||
yum install -y onlyoffice-documentserver
|
||||
}
|
||||
# Apache-Konfiguration erstellen
|
||||
07_config_webserver(){
|
||||
echo "Apache-Konfiguration erstellen"
|
||||
cat <<EOF > $APACHE_CONF
|
||||
<VirtualHost *:443>
|
||||
DocumentRoot "$NEXTCLOUD_DIR"
|
||||
ServerName $DOMAIN
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile $CERT_DIR/$CERT_NAME_SRV
|
||||
SSLCertificateKeyFile $PRIVATE_DIR/$KEY_NAME_SRV
|
||||
SSLCertificateChainFile $CERT_DIR/$CERT_NAME_SUBCA
|
||||
|
||||
<Directory "$NEXTCLOUD_DIR">
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ErrorLog /var/log/httpd/nextcloud_error.log
|
||||
CustomLog /var/log/httpd/nextcloud_access.log combined
|
||||
</VirtualHost>
|
||||
EOF
|
||||
}
|
||||
# Firewall-Einstellungen
|
||||
08_config_firewall(){
|
||||
echo "Firewall-Einstellungen"
|
||||
firewall-cmd --permanent --add-service=https
|
||||
firewall-cmd --reload
|
||||
}
|
||||
# Apache neu starten
|
||||
09_restart_webserver(){
|
||||
echo "Apache neu starten"
|
||||
systemctl restart httpd
|
||||
}
|
||||
10_ending(){
|
||||
echo "Installation abgeschlossen. Nextcloud ist unter https://"hostname-f" verfügbar."
|
||||
}
|
||||
# OPTIONAL FALLS ERFORDERLICH
|
||||
# Diese Funktionen sind bei Fehler der PHP Version und bei Aufruf der Website ( Fehlende Berechtigung ) nötig
|
||||
11_php_update(){
|
||||
echo "PHP Version wird von 7.2 auf 8.X von REMI aktuallisiert!!!....."
|
||||
sudo dnf install -y https://rpms.remirepo.net/enterprise/remi-release-8.rpm
|
||||
sudo dnf module list php -y
|
||||
sudo dnf install -y dnf-utils
|
||||
dnf update -y
|
||||
rpm -qi epel-release
|
||||
dnf module reset php -y
|
||||
dnf module enable php:remi-8.2 -y
|
||||
dnf install php php-process php-apcu redis php-redis php82-php-opcache php-gmp -y
|
||||
usermod -a -G redis apache
|
||||
}
|
||||
12_SELINUX(){
|
||||
sudo chcon -R -t httpd_sys_rw_content_t /var/www/html/nextcloud/
|
||||
}
|
||||
13_external_datastore(){
|
||||
echo "Einrichtigung des External Data Storage......"
|
||||
echo "$SYNOLOGY_IP:$NC_DATASTORE /mnt/nextcloud-data nfs defaults 0 0" >> /etc/fstab
|
||||
dnf install nfs-utils -y
|
||||
sudo mkdir -p /mnt/nextcloud-data
|
||||
sudo mount -a
|
||||
echo "Berechtigungen fuer den External Storage werden gesetzt......"
|
||||
sudo chown -R apache:apache /mnt/nextcloud-data
|
||||
sudo chmod -R 775 /mnt/nextcloud-data
|
||||
echo "****************************************************************************************"
|
||||
echo "************* Die Einstellung wurden erfolgreich gesetzt und durchgeführt **************"
|
||||
echo "****************************************************************************************"
|
||||
echo "************* Sie MÜSSEN AUF IHRER NFS FREIGABE FOLGENDE COMMANDS AUSFUEHREN ***********"
|
||||
echo "************* SIE MUSSEN DIE BERECHTIGUNG FUER DEN USER APACHE SETZEN .... *************"
|
||||
echo "************* BSP.: chown 48:48 /volume1/nextcloud-data/ *************"
|
||||
echo "************* BSP.: chmod 770 -R /volume1/nextcloud-data/ *************"
|
||||
echo "****************************************************************************************"
|
||||
echo "****************************************************************************************"
|
||||
echo "****************************************************************************************"
|
||||
|
||||
}
|
||||
|
||||
|
||||
#Aufruf der Funktionen
|
||||
00_system_update
|
||||
01_cert_import
|
||||
02_service_start
|
||||
03_download_nc
|
||||
04_install_db
|
||||
05_config_nc_db
|
||||
06_install_onlyoffice
|
||||
07_config_webserver
|
||||
08_config_firewall
|
||||
09_restart_webserver
|
||||
10_ending
|
||||
# OPTIONAL
|
||||
11_php_update
|
||||
12_SELINUX
|
||||
13_external_datastore
|
||||
Executable
+251
@@ -0,0 +1,251 @@
|
||||
#!/bin/bash
|
||||
|
||||
|
||||
# Zielpfad für das Full-Chain-Zertifikat
|
||||
FULLCHAIN_CERT="/tmp/fullchain.crt"
|
||||
HOST_FQDN=$(hostname -f)
|
||||
HOST_NORMAL=$(hostname -s)
|
||||
DOMAIN=$(hostname -d)
|
||||
|
||||
# Name der Zertifikatsdateien
|
||||
ROOT_CERT="CERT_HEIMLAN_RootCA.crt"
|
||||
SUBCA_CERT="CERT_HEIMLAN_SubCA.crt"
|
||||
SERVER_CERT="CERT_${HOST_FQDN}.crt"
|
||||
SERVER_KEY="KEY_${HOST_FQDN}.pem"
|
||||
TMP=""
|
||||
KEY=""
|
||||
KEY_DIR=""
|
||||
LDAP_PASS="P@SSW0RD"
|
||||
# LDAP-Serverinformationen für mehrere Domänen (LDAPS)
|
||||
LDAP_SERVERS=(
|
||||
"HEIM.LAN|ldaps://dc.heim.lan|dc=heim,dc=lan|CN=Administrator,CN=Users,DC=heim,DC=lan|${LDAP_PASS}"
|
||||
"IOT.HEIM.LAN|ldaps://ipa.iot.heim.lan|dc=domain2,dc=com|uid=admin,cn=users,cn=accounts,dc=iot,dc=heim,dc=lan|${LDAP_PASS}"
|
||||
)
|
||||
# Funktion zum Kopieren der Zertifikate in die richtigen Pfade je nach Derivat und Typ
|
||||
copy_certificates() {
|
||||
echo "Kopieren der Zertifikate in die richtigen Pfade..."
|
||||
|
||||
# Betriebssystem erkennen
|
||||
if grep -q -i "ubuntu\|debian" /etc/os-release; then
|
||||
distro="Debian"
|
||||
elif grep -q -i "centos\|rhel\|red hat" /etc/os-release; then
|
||||
distro="CentOS"w
|
||||
else
|
||||
echo "Nicht unterstütztes Betriebssystem."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
case $distro in
|
||||
Debian)
|
||||
SSL_DIR="/etc/nginx/ssl"
|
||||
TMP="/usr/local/share/ca-certificates"
|
||||
KEY="/etc/ssl/private/"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "***************** Eforderlichen Pakete werden installiert..... *********************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
sudo apt update
|
||||
sudo apt install -y nginx openldap-clients
|
||||
sudo apt install -y wget gnupg2 ca-certificates lsb-release
|
||||
sudo apt install -y build-essential libpcre3 libpcre3-dev zlib1g-dev libssl-dev
|
||||
sudo apt install -y git
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "***************** Zusaetzlichen Pakete von GIT werden heruntergeladen...... *********************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
cd /usr/local/src
|
||||
sudo wget http://nginx.org/download/nginx-1.20.2.tar.gz
|
||||
sudo tar -zxvf nginx-1.20.2.tar.gz
|
||||
sudo git clone https://github.com/kvspb/nginx-auth-ldap.git
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "***************** Zusaetzlichen Pakete von GIT wird installiert...... *+++++********************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
sudo yum install -y epel-release
|
||||
sudo yum groupinstall -y "Development Tools"
|
||||
sudo yum install -y pcre pcre-devel zlib zlib-devel openssl openssl-devel
|
||||
sudo yum install -y git
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "***************** Sie sind auf einen Debian \ Ubuntu System...... ******************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
;;
|
||||
CentOS)
|
||||
SSL_DIR="/etc/nginx/ssl"
|
||||
TMP="/etc/pki/ca-trust/source/anchors/"
|
||||
KEY="/etc/pki/tls/private/"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "***************** Eforderlichen Pakete werden installiert..... *********************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
sudo yum install -y epel-release
|
||||
sudo yum install -y nginx openldap-clients openldap-servers
|
||||
sudo yum install -y epel-release
|
||||
sudo yum groupinstall -y "Development Tools"
|
||||
sudo yum install -y pcre pcre-devel zlib zlib-devel openssl openssl-devel
|
||||
sudo yum install -y git
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "***************** Zusaetzlichen Pakete von GIT werden heruntergeladen...... *********************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
cd /usr/local/src
|
||||
sudo wget http://nginx.org/download/nginx-1.20.2.tar.gz
|
||||
sudo tar -zxvf nginx-1.20.2.tar.gz
|
||||
sudo git clone https://github.com/kvspb/nginx-auth-ldap.git
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "***************** Zusaetzlichen Pakete von GIT wird installiert...... *+++++********************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
cd nginx-1.20.2
|
||||
sudo ./configure --add-module=/usr/local/src/nginx-auth-ldap
|
||||
sudo make
|
||||
sudo make install
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "***************** Sie sind auf einen Red Hat \ CentOS System...... *****************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
;;
|
||||
*)
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "***************** Sie fuehren dieses SCRIPT auf ein nicht dafür Ausgelegen System aus..... *****************"
|
||||
echo "***************** Bitte wenden Sie Sich an einen System Administrator..... *********************************"
|
||||
echo "***************** Dieses Script ird jetzt beendet..... *****************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
echo "*************************************************************************************************************"
|
||||
;;
|
||||
esac
|
||||
|
||||
# Verzeichnisse erstellen, falls nicht vorhanden
|
||||
mkdir -p $SSL_DIR
|
||||
|
||||
# Zertifikate kopieren
|
||||
cp "$TMP/$ROOT_CERT" "$SSL_DIR/$ROOT_CERT"
|
||||
cp "$TMP/$SUBCA_CERT" "$SSL_DIR/$SUBCA_CERT"
|
||||
cp "$TMP/${SERVER_CERT}" "$SSL_DIR/${SERVER_CERT}"
|
||||
cp "$KEY/$SERVER_KEY}" "$SSL_DIR/${SERVER_KEY}"
|
||||
|
||||
echo "Zertifikate wurden nach $SSL_DIR kopiert."
|
||||
}
|
||||
|
||||
# Funktion zur Erstellung der LDAP-Serverkonfiguration
|
||||
create_ldap_config() {
|
||||
echo "Erstellen der LDAP-Konfigurationsdatei..."
|
||||
|
||||
LDAP_CONF="/etc/nginx/conf.d/ldap.conf"
|
||||
sudo tee $LDAP_CONF > /dev/null <<EOL
|
||||
# LDAP-Server-Konfiguration für mehrere Domänen
|
||||
EOL
|
||||
|
||||
for entry in "${LDAP_SERVERS[@]}"; do
|
||||
IFS='|' read -r -a server_info <<< "$entry"
|
||||
domain="${server_info[0]}"
|
||||
url="${server_info[1]}"
|
||||
base_dn="${server_info[2]}"
|
||||
bind_dn="${server_info[3]}"
|
||||
bind_password="${server_info[4]}"
|
||||
|
||||
cat <<EOL | sudo tee -a $LDAP_CONF
|
||||
ldap_server $domain {
|
||||
url $url/$base_dn?uid?sub?(objectClass=person);
|
||||
binddn "$bind_dn";
|
||||
binddn_passwd "$bind_password";
|
||||
group_attribute uniquemember;
|
||||
group_attribute_is_dn on;
|
||||
require valid_user;
|
||||
require valid_ssl;
|
||||
ssl_check_cert on;
|
||||
ssl_check_cert_cn on;
|
||||
ssl_cert $SSL_DIR/$ROOT_CERT;
|
||||
ssl_trusted_cert $SSL_DIR/$ROOT_CERT;
|
||||
}
|
||||
EOL
|
||||
done
|
||||
|
||||
echo "LDAP-Konfigurationsdatei wurde erstellt."
|
||||
}
|
||||
|
||||
# Funktion zur Installation und Konfiguration von Nginx
|
||||
install_configure_nginx() {
|
||||
echo "Installation und Konfiguration von Nginx..."
|
||||
|
||||
# Nginx-Konfigurationsdatei erstellen
|
||||
NGINX_CONF="/etc/nginx/conf.d/file_server.conf"
|
||||
sudo tee $NGINX_CONF > /dev/null <<EOL
|
||||
server {
|
||||
listen 80;
|
||||
server_name localhost;
|
||||
|
||||
# Redirect to HTTPS
|
||||
location / {
|
||||
return 301 https://\$host\$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name localhost;
|
||||
|
||||
ssl_certificate $SSL_DIR/$SERVER_CERT;
|
||||
ssl_certificate_key $SSL_DIR/$SERVER_KEY;
|
||||
ssl_trusted_certificate $SSL_DIR/$SUBCA_CERT;
|
||||
|
||||
root /usr/share/nginx/html;
|
||||
autoindex on;
|
||||
autoindex_exact_size off;
|
||||
autoindex_localtime on;
|
||||
|
||||
EOL
|
||||
|
||||
for entry in "${LDAP_SERVERS[@]}"; do
|
||||
IFS='|' read -r -a server_info <<< "$entry"
|
||||
domain="${server_info[0]}"
|
||||
|
||||
cat <<EOL | sudo tee -a $NGINX_CONF
|
||||
location /$domain/ {
|
||||
auth_ldap "Restricted $domain";
|
||||
auth_ldap_servers $domain;
|
||||
try_files \$uri \$uri/ =404;
|
||||
}
|
||||
|
||||
EOL
|
||||
done
|
||||
|
||||
cat <<EOL | sudo tee -a $NGINX_CONF
|
||||
}
|
||||
EOL
|
||||
|
||||
# Nginx-Konfiguration testen und neu starten
|
||||
sudo nginx -t && sudo systemctl restart nginx
|
||||
|
||||
echo "Nginx wurde erfolgreich installiert und konfiguriert."
|
||||
}
|
||||
|
||||
# Funktion zum Setzen der richtigen Berechtigungen
|
||||
set_permissions() {
|
||||
echo "Setzen der richtigen Berechtigungen für das SSL-Verzeichnis..."
|
||||
|
||||
sudo chown -R root:root $SSL_DIR
|
||||
sudo chmod -R 700 $SSL_DIR
|
||||
|
||||
echo "Berechtigungen wurden gesetzt."
|
||||
}
|
||||
|
||||
# Hauptskript
|
||||
main() {
|
||||
copy_certificates
|
||||
create_ldap_config
|
||||
install_configure_nginx
|
||||
#set_permissions
|
||||
echo "Setup abgeschlossen. Zugriff auf den Dateiserver unter https://localhost"
|
||||
}
|
||||
|
||||
main
|
||||
+201
@@ -0,0 +1,201 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Zielpfad für das Full-Chain-Zertifikat
|
||||
FULLCHAIN_CERT="/tmp/fullchain.crt"
|
||||
HOST_FQDN=$(hostname -f)
|
||||
HOST_NORMAL=$(hostname -s)
|
||||
DOMAIN=$(hostname -d)
|
||||
|
||||
# Name der Zertifikatsdateien
|
||||
ROOT_CERT="CERT_HEIMLAN_RootCA.crt"
|
||||
SUBCA_CERT="CERT_HEIMLAN_SubCA.crt"
|
||||
SERVER_CERT="CERT_${HOST_FQDN}.crt"
|
||||
SERVER_KEY="KEY_${HOST_FQDN}.pem"
|
||||
|
||||
LDAP_PASS="P@SSW0RD"
|
||||
# LDAP-Serverinformationen für mehrere Domänen (LDAPS)
|
||||
LDAP_SERVERS=(
|
||||
"HEIM.LAN|ldaps://dc.heim.lan|dc=heim,dc=lan|CN=Administrator,CN=Users,DC=heim,DC=lan|${LDAP_PASS}"
|
||||
"IOT.HEIM.LAN|ldaps://ipa.iot.heim.lan|dc=iot,dc=heim,dc=lan|uid=admin,cn=users,cn=accounts,dc=iot,dc=heim,dc=lan|${LDAP_PASS}"
|
||||
)
|
||||
|
||||
colormsg() {
|
||||
echo -e "\033[0;36m$1\033[0m"
|
||||
}
|
||||
|
||||
# Funktion zum Kopieren der Zertifikate in die richtigen Pfade je nach Derivat und Typ
|
||||
copy_certificates() {
|
||||
echo "Kopieren der Zertifikate in die richtigen Pfade..."
|
||||
|
||||
# Betriebssystem erkennen
|
||||
if grep -q -i "ubuntu\|debian" /etc/os-release; then
|
||||
distro="Debian"
|
||||
elif grep -q -i "centos\|rhel\|red hat" /etc/os-release; then
|
||||
distro="CentOS"
|
||||
else
|
||||
echo "Nicht unterstütztes Betriebssystem."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
case $distro in
|
||||
Debian)
|
||||
SSL_DIR="/etc/nginx/ssl"
|
||||
TMP="/usr/local/share/ca-certificates"
|
||||
KEY="/etc/ssl/private"
|
||||
echo -e "\033[0;32mEforderliche Pakete werden installiert...\033[0m"
|
||||
sudo apt update
|
||||
sudo apt install -y nginx openldap-clients wget gnupg2 ca-certificates lsb-release build-essential libpcre3 libpcre3-dev zlib1g-dev libssl-dev git
|
||||
echo "***************** Sie sind auf einen Debian \ Ubuntu System...... ******************************************"
|
||||
;;
|
||||
CentOS)
|
||||
SSL_DIR="/etc/nginx/ssl"
|
||||
TMP="/etc/pki/ca-trust/source/anchors"
|
||||
KEY="/etc/pki/tls/private"
|
||||
echo -e "\033[0;32mEforderliche Pakete werden installiert...\033[0m"
|
||||
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
sudo dnf install -y epel-release nginx openldap-clients openldap-servers openldap-devel pcre pcre-devel zlib zlib-devel openssl openssl-devel git gcc
|
||||
sudo yum groupinstall -y "Development Tools"
|
||||
echo "***************** Sie sind auf einen Red Hat \ CentOS System...... *****************************************"
|
||||
|
||||
;;
|
||||
esac
|
||||
|
||||
echo -e "\033[0;32mZusätzliche Pakete von GIT werden heruntergeladen und installiert...\033[0m"
|
||||
cd /usr/local/src
|
||||
sudo wget https://nginx.org/download/nginx-1.26.1.tar.gz
|
||||
sudo tar -zxvf nginx-1.26.1.tar.gz
|
||||
sudo git clone https://github.com/kvspb/nginx-auth-ldap.git
|
||||
|
||||
echo -e "\033[0;32mNginx mit LDAP-Modul kompilieren und installieren...\033[0m"
|
||||
cd nginx-1.26.1
|
||||
sudo ./configure --add-module=/usr/local/src/nginx-auth-ldap
|
||||
sudo make
|
||||
sudo make install
|
||||
|
||||
# Verzeichnisse erstellen, falls nicht vorhanden
|
||||
sudo mkdir -p $SSL_DIR
|
||||
|
||||
# Zertifikate kopieren
|
||||
sudo cp "$TMP/$ROOT_CERT" "$SSL_DIR/$ROOT_CERT"
|
||||
sudo cp "$TMP/$SUBCA_CERT" "$SSL_DIR/$SUBCA_CERT"
|
||||
sudo cp "$TMP/${SERVER_CERT}" "$SSL_DIR/${SERVER_CERT}"
|
||||
sudo cp "$KEY/$SERVER_KEY" "$SSL_DIR/${SERVER_KEY}"
|
||||
|
||||
echo "Zertifikate wurden nach $SSL_DIR kopiert."
|
||||
}
|
||||
|
||||
# Funktion zur Erstellung der LDAP-Serverkonfiguration
|
||||
create_ldap_config() {
|
||||
echo "Erstellen der LDAP-Konfigurationsdatei..."
|
||||
|
||||
LDAP_CONF="/etc/nginx/conf.d/ldap.conf"
|
||||
sudo tee $LDAP_CONF > /dev/null <<EOL
|
||||
# LDAP-Server-Konfiguration für mehrere Domänen
|
||||
EOL
|
||||
|
||||
for entry in "${LDAP_SERVERS[@]}"; do
|
||||
IFS='|' read -r -a server_info <<< "$entry"
|
||||
domain="${server_info[0]}"
|
||||
url="${server_info[1]}"
|
||||
base_dn="${server_info[2]}"
|
||||
bind_dn="${server_info[3]}"
|
||||
bind_password="${server_info[4]}"
|
||||
|
||||
cat <<EOL | sudo tee -a $LDAP_CONF
|
||||
ldap_server $domain {
|
||||
url $url/$base_dn?uid?sub?(objectClass=person);
|
||||
binddn "$bind_dn";
|
||||
binddn_passwd "$bind_password";
|
||||
group_attribute uniquemember;
|
||||
group_attribute_is_dn on;
|
||||
require valid_user;
|
||||
require valid_ssl;
|
||||
ssl_check_cert on;
|
||||
ssl_check_cert_cn on;
|
||||
ssl_cert $SSL_DIR/$ROOT_CERT;
|
||||
ssl_trusted_cert $SSL_DIR/$ROOT_CERT;
|
||||
}
|
||||
EOL
|
||||
done
|
||||
|
||||
echo "LDAP-Konfigurationsdatei wurde erstellt."
|
||||
}
|
||||
|
||||
# Funktion zur Installation und Konfiguration von Nginx
|
||||
install_configure_nginx() {
|
||||
echo "Installation und Konfiguration von Nginx..."
|
||||
|
||||
# Nginx-Konfigurationsdatei erstellen
|
||||
NGINX_CONF="/etc/nginx/conf.d/file_server.conf"
|
||||
sudo tee $NGINX_CONF > /dev/null <<EOL
|
||||
server {
|
||||
listen 80;
|
||||
server_name localhost;
|
||||
|
||||
# Redirect to HTTPS
|
||||
location / {
|
||||
return 301 https://\$host\$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name localhost;
|
||||
|
||||
ssl_certificate $SSL_DIR/$SERVER_CERT;
|
||||
ssl_certificate_key $SSL_DIR/$SERVER_KEY;
|
||||
ssl_trusted_certificate $SSL_DIR/$SUBCA_CERT;
|
||||
|
||||
root /usr/share/nginx/html;
|
||||
autoindex on;
|
||||
autoindex_exact_size off;
|
||||
autoindex_localtime on;
|
||||
|
||||
EOL
|
||||
|
||||
for entry in "${LDAP_SERVERS[@]}"; do
|
||||
IFS='|' read -r -a server_info <<< "$entry"
|
||||
domain="${server_info[0]}"
|
||||
|
||||
cat <<EOL | sudo tee -a $NGINX_CONF
|
||||
location /$domain/ {
|
||||
auth_ldap "Restricted $domain";
|
||||
auth_ldap_servers $domain;
|
||||
try_files \$uri \$uri/ =404;
|
||||
}
|
||||
|
||||
EOL
|
||||
done
|
||||
|
||||
cat <<EOL | sudo tee -a $NGINX_CONF
|
||||
}
|
||||
EOL
|
||||
|
||||
# Nginx-Konfiguration testen und neu starten
|
||||
sudo nginx -t && sudo systemctl restart nginx
|
||||
|
||||
echo "Nginx wurde erfolgreich installiert und konfiguriert."
|
||||
}
|
||||
|
||||
# Funktion zum Setzen der richtigen Berechtigungen
|
||||
set_permissions() {
|
||||
echo "Setzen der richtigen Berechtigungen für das SSL-Verzeichnis..."
|
||||
|
||||
sudo chown -R root:root $SSL_DIR
|
||||
sudo chmod -R 700 $SSL_DIR # Stellen Sie sicher, dass nur root Zugriff hat
|
||||
|
||||
echo "Berechtigungen wurden gesetzt."
|
||||
}
|
||||
|
||||
# Hauptskript
|
||||
colormsg "Setup startet..."
|
||||
main() {
|
||||
copy_certificates
|
||||
create_ldap_config
|
||||
install_configure_nginx
|
||||
set_permissions
|
||||
echo "Setup abgeschlossen. Zugriff auf den Dateiserver unter https://localhost"
|
||||
}
|
||||
|
||||
main
|
||||
+57
@@ -0,0 +1,57 @@
|
||||
#!/bin/bash
|
||||
echo(){
|
||||
echo -e "\033[0;36m$1\033[0m"
|
||||
}
|
||||
# Funktion zur Ausgabe von Fehlermeldungen und Beenden des Skripts
|
||||
function die {
|
||||
echo "$1" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Überprüfen, ob das Skript mit root-Rechten ausgeführt wird
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
die "Dieses Skript muss mit root-Rechten ausgeführt werden."
|
||||
fi
|
||||
|
||||
# Variablen für die Splunk Forwarder Paketdatei und Installationsverzeichnis
|
||||
SPLUNK_FORWARDER_PACKAGE="splunkforwarder-9.2.2-d76edf6f0a15-Linux-x86_64.tgz"
|
||||
SPLUNK_HOME="/opt/splunkforwarder"
|
||||
|
||||
# Funktion zur Installation des Splunk Forwarders
|
||||
function install_splunk_forwarder {
|
||||
# Entpacken des Splunk Forwarder Archivs
|
||||
tar xzf "$SPLUNK_FORWARDER_PACKAGE" -C /opt || die "Entpacken des Splunk Forwarder Pakets fehlgeschlagen."
|
||||
|
||||
# Ausführen des Installationsprogramms
|
||||
"$SPLUNK_HOME/bin/splunk" start --accept-license --answer-yes --no-prompt || die "Starten des Splunk Forwarders fehlgeschlagen."
|
||||
|
||||
# Konfigurieren des Splunk Forwarders
|
||||
"$SPLUNK_HOME/bin/splunk" enable boot-start || die "Konfiguration für Autostart fehlgeschlagen."
|
||||
|
||||
# Beispielhaftes Hinzufügen einer Indexierungskonfiguration
|
||||
"$SPLUNK_HOME/bin/splunk" add forward-server splunk-server:9997 || die "Hinzufügen des Forward-Servers fehlgeschlagen."
|
||||
|
||||
# Neustart des Splunk Forwarders, damit Konfigurationen übernommen werden
|
||||
"$SPLUNK_HOME/bin/splunk" restart || die "Neustart des Splunk Forwarders fehlgeschlagen."
|
||||
}
|
||||
|
||||
# Funktion zum Identifizieren und Installieren des Splunk Forwarders basierend auf der Linux-Distribution
|
||||
function main {
|
||||
# Ermitteln der Linux-Distribution
|
||||
if [ -f /etc/redhat-release ]; then
|
||||
# Red Hat / CentOS / Fedora
|
||||
yum install -y tar || die "Installation von tar fehlgeschlagen."
|
||||
install_splunk_forwarder
|
||||
elif [ -f /etc/debian_version ]; then
|
||||
# Debian / Ubuntu
|
||||
apt-get update || die "Aktualisieren der Paketquellen fehlgeschlagen."
|
||||
apt-get install -y tar || die "Installation von tar fehlgeschlagen."
|
||||
install_splunk_forwarder
|
||||
else
|
||||
die "Linux-Distribution nicht unterstützt oder erkannt."
|
||||
fi
|
||||
}
|
||||
|
||||
# Hauptprogramm aufrufen
|
||||
echo
|
||||
main
|
||||
Executable
+77
@@ -0,0 +1,77 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit on error
|
||||
set -e
|
||||
|
||||
# Variablen
|
||||
DOMAIN="iot.heim.lan"
|
||||
REALM="IOT.HEIM.LAN"
|
||||
HOSTNAME="ipa.iot.heim.lan"
|
||||
ADMIN_PASS="AdminPass123" # Anpassen
|
||||
IPA_PASS="IpaPass123" # Anpassen
|
||||
CSR_CONFIG="subca.cfg"
|
||||
CSR_FILE="subca.csr"
|
||||
KEY_FILE="subca.key"
|
||||
SIGNED_CERT="subca.crt"
|
||||
ROOT_CA="rootCA.pem" # Pfad zu Ihrem Root-CA-Zertifikat (XCA exportiert als PEM)
|
||||
ROOT_CA_KEY="rootCA.key" # Pfad zu Ihrem Root-CA-Schlüssel (XCA exportiert als PEM)
|
||||
OPENSSL_CONFIG="/etc/pki/tls/openssl.cnf"
|
||||
|
||||
# Sub-CA Konfigurationsdatei erstellen
|
||||
echo "Erstelle Sub-CA Konfigurationsdatei..."
|
||||
cat > $CSR_CONFIG << EOF
|
||||
[ req ]
|
||||
default_bits = 4096
|
||||
prompt = no
|
||||
default_md = sha256
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = XX
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = State
|
||||
localityName = Locality Name (eg, city)
|
||||
localityName_default = City
|
||||
organizationName = Organization Name (eg, company)
|
||||
organizationName_default = Organization
|
||||
commonName = Common Name (eg, your name or your server's hostname)
|
||||
commonName_max = 64
|
||||
|
||||
[ v3_req ]
|
||||
basicConstraints = CA:TRUE,pathlen:0
|
||||
keyUsage = keyCertSign, cRLSign
|
||||
EOF
|
||||
|
||||
# CSR und privaten Schlüssel für die Sub-CA generieren
|
||||
echo "Generiere CSR und privaten Schlüssel für Sub-CA..."
|
||||
openssl req -new -newkey rsa:2048 -nodes -out $CSR_FILE -keyout $KEY_FILE -config $CSR_CONFIG
|
||||
|
||||
# Ausgabe des CSR für Upload in die Root-CA
|
||||
echo "Der CSR für die Sub-CA wurde erstellt: $CSR_FILE"
|
||||
echo "Laden Sie diesen CSR in Ihre Root-CA hoch, signieren Sie ihn dort und speichern Sie das signierte Zertifikat als $SIGNED_CERT"
|
||||
|
||||
# Warten, bis das signierte Zertifikat verfügbar ist
|
||||
read -p "Nachdem Sie das Zertifikat signiert und heruntergeladen haben, drücken Sie [Enter]..."
|
||||
|
||||
# Prüfen, ob das signierte Zertifikat vorhanden ist
|
||||
if [ ! -f "$SIGNED_CERT" ]; then
|
||||
echo "Fehler: Das signierte Zertifikat wurde nicht gefunden: $SIGNED_CERT"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Sub-CA-Zertifikat in FreeIPA importieren
|
||||
echo "Importiere Sub-CA-Zertifikat in FreeIPA..."
|
||||
sudo ipa-cacert-manage install --certificate $SIGNED_CERT --external-cert-file $ROOT_CA
|
||||
|
||||
# FreeIPA-Dienste neu starten
|
||||
echo "Starte FreeIPA-Dienste neu..."
|
||||
sudo ipactl restart
|
||||
|
||||
# Installation der Sub-CA überprüfen
|
||||
echo "Überprüfe Installation der Sub-CA..."
|
||||
sudo ipa-cacert-manage list
|
||||
sudo ipa-cert-show $SIGNED_CERT
|
||||
|
||||
echo "Subordinate CA erfolgreich eingerichtet!"
|
||||
Executable
+70
@@ -0,0 +1,70 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen
|
||||
DOMAIN="example.com"
|
||||
LDAP_CONF="/etc/samba/smb.conf"
|
||||
SSL_DIR="/etc/openldap/certs"
|
||||
SSL_KEY="$SSL_DIR/ldap.key"
|
||||
SSL_CERT="$SSL_DIR/ldap.crt"
|
||||
SSL_CA="$SSL_DIR/ca.crt"
|
||||
LDAP_PORT=389
|
||||
LDAPS_PORT=636
|
||||
|
||||
# Überprüfen, ob das Skript als Root ausgeführt wird
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "Bitte führen Sie dieses Skript als Root aus."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Funktion zum Erstellen von Zertifikaten und Schlüsseln
|
||||
create_certificates() {
|
||||
mkdir -p $SSL_DIR
|
||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
|
||||
-keyout $SSL_KEY -out $SSL_CERT -subj "/CN=$DOMAIN"
|
||||
cp $SSL_CERT $SSL_CA
|
||||
}
|
||||
|
||||
# Funktion zum Importieren des Zertifikats in Samba AD DC
|
||||
import_certificate() {
|
||||
echo "Importieren des Zertifikats in Samba AD DC..."
|
||||
net ads tls ca import $SSL_CA
|
||||
}
|
||||
|
||||
# Funktion zum Konfigurieren von Samba für die Verwendung von LDAPS
|
||||
configure_samba_for_ldaps() {
|
||||
echo "Konfigurieren von Samba für die Verwendung von LDAPS..."
|
||||
cat <<EOT >> $LDAP_CONF
|
||||
|
||||
# LDAPS Konfiguration
|
||||
tls enabled = yes
|
||||
tls keyfile = $SSL_KEY
|
||||
tls certfile = $SSL_CERT
|
||||
tls cafile = $SSL_CA
|
||||
EOT
|
||||
}
|
||||
|
||||
# Funktion zum Aktualisieren der Firewall-Regeln
|
||||
update_firewall_rules() {
|
||||
echo "Aktualisieren der Firewall-Regeln..."
|
||||
firewall-cmd --permanent --add-port=$LDAPS_PORT/tcp
|
||||
firewall-cmd --reload
|
||||
}
|
||||
|
||||
# Funktion zum Neustarten von Samba
|
||||
restart_samba() {
|
||||
echo "Neustarten von Samba..."
|
||||
systemctl restart samba-ad-dc
|
||||
}
|
||||
|
||||
# Hauptprogramm
|
||||
create_certificates
|
||||
import_certificate
|
||||
configure_samba_for_ldaps
|
||||
update_firewall_rules
|
||||
restart_samba
|
||||
|
||||
# Überprüfen der Konfiguration
|
||||
echo "Überprüfen der LDAPS-Konfiguration..."
|
||||
netstat -tulpen | grep :$LDAPS_PORT
|
||||
|
||||
echo "Die Konfiguration ist abgeschlossen. LDAP verwendet jetzt LDAPS auf Port $LDAPS_PORT."
|
||||
Executable
+176
@@ -0,0 +1,176 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Variablen setzen
|
||||
DOMAIN="iot.heim.lan"
|
||||
CERT_DIR="/etc/pki/tls/certs"
|
||||
PRIVATE_DIR="/etc/pki/tls/private"
|
||||
APACHE_CONF="/etc/httpd/conf.d/nextcloud.conf"
|
||||
NEXTCLOUD_DIR="/var/www/html/nextcloud"
|
||||
NC_DATASTORE="/volume1/DATEN1/nextcloud-data"
|
||||
DB_NAME="nextcloud"
|
||||
DB_USER="nextclouduser"
|
||||
DB_PASSWORD="P@ssw0rd"
|
||||
SYNOLOGY_IP="192.168.31.250"
|
||||
SYNOLOGY_USER="Madzone"
|
||||
SYNOLOGY_PW="P@ssw0rd"
|
||||
SYNOLOGY_PATH_SERVER="/volume1/DATEN1/HEIMLAN/IOT-NC.IOT.HEIM.LAN"
|
||||
SYNOLOGY_PATH_SubCA="/volume1/DATEN1/HEIMLAN/SubCA"
|
||||
SYNOLOGY_PATH_RootCA="/volume1/DATEN1/HEIMLAN/RootCA"
|
||||
CERT_NAME_SRV="CERT_iot-nc.iot.heim.lan.crt"
|
||||
KEY_NAME_SRV="KEY_iot-nc.iot.heim.lan.pem"
|
||||
CERT_NAME_ROOT="CERT_HEIMLAN_RootCA.crt"
|
||||
CERT_NAME_SUBCA="CERT_HEIMLAN_SubCA.crt"
|
||||
|
||||
# System-Updates und erforderliche Pakete installieren
|
||||
00_system_update(){
|
||||
echo "System-Updates und erforderliche Pakete installieren"
|
||||
yum update -y
|
||||
#yum install -y epel-release
|
||||
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||
dnf install -y https://rpms.remirepo.net/enterprise/remi-release-8.rpm
|
||||
dnf module enable php:remi-8.3 -y
|
||||
yum install -y httpd mariadb-server php php-mysqlnd php-xml php-mbstring php-gd php-curl php-intl php-zip php-bcmath wget unzip mod_ssl sshpass
|
||||
}
|
||||
# Zertifikate von Synology kopieren
|
||||
01_cert_import(){
|
||||
mkdir -p ~/.ssh
|
||||
sudo mkdir -p /root/.ssh
|
||||
sudo chmod 700 /root/.ssh
|
||||
sudo ssh-keyscan -H $SYNOLOGY_IP >> ~/.ssh/known_hosts
|
||||
ssh-keyscan -H $SYNOLOGY_IP >> ~/.ssh/known_hosts
|
||||
sshpass -p $SYNOLOGY_PW scp $SYNOLOGY_USER@$SYNOLOGY_IP:$SYNOLOGY_PATH_SERVER/$CERT_NAME_SRV $CERT_DIR/$CERT_NAME_SRV
|
||||
sshpass -p $SYNOLOGY_PW scp $SYNOLOGY_USER@$SYNOLOGY_IP:$SYNOLOGY_PATH_SERVER/$KEY_NAME_SRV $PRIVATE_DIR/$KEY_NAME_SRV
|
||||
sshpass -p $SYNOLOGY_PW scp $SYNOLOGY_USER@$SYNOLOGY_IP:$SYNOLOGY_PATH_SubCA/$CERT_NAME_SUBCA $CERT_DIR/$CERT_NAME_SUBCA
|
||||
sshpass -p $SYNOLOGY_PW scp $SYNOLOGY_USER@$SYNOLOGY_IP:$SYNOLOGY_PATH_RootCA/$CERT_NAME_ROOT $CERT_DIR/$CERT_NAME_ROOT
|
||||
}
|
||||
# Dienste starten und aktivieren
|
||||
02_service_start(){
|
||||
systemctl start httpd mariadb
|
||||
systemctl enable httpd mariadb
|
||||
}
|
||||
# Nextcloud herunterladen und entpacken
|
||||
03_download_nc(){
|
||||
echo "Nextcloud herunterladen und entpacken"
|
||||
cd /var/www/html
|
||||
wget https://download.nextcloud.com/server/releases/latest.zip
|
||||
unzip latest.zip
|
||||
chown -R apache:apache $NEXTCLOUD_DIR
|
||||
chmod -R 755 $NEXTCLOUD_DIR
|
||||
}
|
||||
# MariaDB konfigurieren
|
||||
04_install_db(){
|
||||
echo "MariaDB konfigurieren"
|
||||
mysql_secure_installation<<EOF
|
||||
|
||||
y
|
||||
$DB_PASSWORD
|
||||
$DB_PASSWORD
|
||||
y
|
||||
y
|
||||
y
|
||||
y
|
||||
EOF
|
||||
}
|
||||
# Nextcloud-Datenbank und Benutzer erstellen
|
||||
05_config_nc_db(){
|
||||
echo "Nextcloud-Datenbank und Benutzer erstellen"
|
||||
mysql -u root -p$DB_PASSWORD<<EOF
|
||||
CREATE DATABASE $DB_NAME;
|
||||
CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASSWORD';
|
||||
GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';
|
||||
FLUSH PRIVILEGES;
|
||||
EXIT;
|
||||
EOF
|
||||
echo "Nextcloud-Datenbank mit Name $DB_NAME und Benutzer $DB_USER erstellt"
|
||||
}
|
||||
#
|
||||
|
||||
# OnlyOffice Document Server installieren (falls erforderlich)
|
||||
07_install_onlyoffice(){
|
||||
echo "OnlyOffice Document Server installieren"
|
||||
yum install -y onlyoffice-documentserver
|
||||
}
|
||||
# Apache-Konfiguration erstellen
|
||||
07_config_webserver(){
|
||||
echo "Apache-Konfiguration erstellen"
|
||||
cat <<EOF > $APACHE_CONF
|
||||
<VirtualHost *:443>
|
||||
DocumentRoot "$NEXTCLOUD_DIR"
|
||||
ServerName $DOMAIN
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile $CERT_DIR/$CERT_NAME_SRV
|
||||
SSLCertificateKeyFile $PRIVATE_DIR/$KEY_NAME_SRV
|
||||
SSLCertificateChainFile $CERT_DIR/$CERT_NAME_SUBCA
|
||||
|
||||
<Directory "$NEXTCLOUD_DIR">
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ErrorLog /var/log/httpd/nextcloud_error.log
|
||||
CustomLog /var/log/httpd/nextcloud_access.log combined
|
||||
</VirtualHost>
|
||||
EOF
|
||||
}
|
||||
# Firewall-Einstellungen
|
||||
08_config_firewall(){
|
||||
echo "Firewall-Einstellungen"
|
||||
firewall-cmd --permanent --add-service=https
|
||||
firewall-cmd --reload
|
||||
}
|
||||
# Apache neu starten
|
||||
09_restart_webserver(){
|
||||
echo "Apache neu starten"
|
||||
systemctl restart httpd
|
||||
}
|
||||
10_ending(){
|
||||
echo "Installation abgeschlossen. Nextcloud ist unter https://"hostname-f" verfügbar."
|
||||
}
|
||||
# OPTIONAL FALLS ERFORDERLICH
|
||||
# Diese Funktionen sind bei Fehler der PHP Version und bei Aufruf der Website ( Fehlende Berechtigung ) nötig
|
||||
11_php_update(){
|
||||
echo "PHP Version wird von 7.2 auf 8.X von REMI aktuallisiert!!!....."
|
||||
sudo dnf install -y https://rpms.remirepo.net/enterprise/remi-release-8.rpm
|
||||
sudo dnf module list php -y
|
||||
sudo dnf install -y dnf-utils
|
||||
dnf update -y
|
||||
rpm -qi epel-release
|
||||
dnf module reset php -y
|
||||
dnf module enable php:remi-8.2 -y
|
||||
dnf install php -y
|
||||
}
|
||||
12_SELINUX(){
|
||||
sudo chcon -R -t httpd_sys_rw_content_t /var/www/html/nextcloud/
|
||||
}
|
||||
13_external_datastore(){
|
||||
echo "Einrichtigung des External Data Storage......"
|
||||
echo "$SYNOLOGY_IP:$NC_DATASTORE /mnt/nextcloud-data nfs defaults 0 0" >> /etc/fstab
|
||||
sudo mkdir -p /mnt/nextcloud-data
|
||||
sudo mount -a
|
||||
echo "Berechtigungen fuer den External Storage werden gesetzt......"
|
||||
sudo chown -R apache:apache /mnt/nextcloud-data
|
||||
sudo chmod -R 755 /mnt/nextcloud-data
|
||||
echo "****************************************************************************************"
|
||||
echo "************* Die Einstellung wurden erfolgreich gesetzt und durchgeführt **************"
|
||||
echo "****************************************************************************************"
|
||||
}
|
||||
|
||||
|
||||
#Aufruf der Funktionen
|
||||
#00_system_update
|
||||
#01_cert_import
|
||||
#02_service_start
|
||||
#03_download_nc
|
||||
04_install_db
|
||||
05_config_nc_db
|
||||
06_install_onlyoffice
|
||||
07_config_webserver
|
||||
08_config_firewall
|
||||
09_restart_webserver
|
||||
10_ending
|
||||
# OPTIONAL
|
||||
11_php_update
|
||||
12_SELINUX
|
||||
13_external_datastore
|
||||
Executable
+75
@@ -0,0 +1,75 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Globale Variablen für das Betriebssystem
|
||||
OS=""
|
||||
distro=""
|
||||
version=""
|
||||
codename=""
|
||||
|
||||
detect_os() {
|
||||
echo "Das installierte Derivat wird ermittelt...."
|
||||
OS=$(uname -s)
|
||||
|
||||
case $OS in
|
||||
Linux*)
|
||||
# Überprüfen, ob lsb_release verfügbar ist
|
||||
if command -v lsb_release &> /dev/null; then
|
||||
# Verwende lsb_release, wenn es verfügbar ist
|
||||
distro=$(lsb_release -si)
|
||||
version=$(lsb_release -sr)
|
||||
codename=$(lsb_release -sc)
|
||||
else
|
||||
# Überprüfe /etc/os-release
|
||||
if [ -f /etc/os-release ]; then
|
||||
. /etc/os-release
|
||||
distro=$NAME
|
||||
version=$VERSION_ID
|
||||
codename=$VERSION_CODENAME
|
||||
# Überprüfe /etc/lsb-release
|
||||
elif [ -f /etc/lsb-release ]; then
|
||||
. /etc/lsb-release
|
||||
distro=$DISTRIB_ID
|
||||
version=$DISTRIB_RELEASE
|
||||
codename=$DISTRIB_CODENAME
|
||||
# Überprüfe /etc/debian_version
|
||||
elif [ -f /etc/debian_version ]; then
|
||||
distro="Debian"
|
||||
version=$(cat /etc/debian_version)
|
||||
codename=$(uname -r)
|
||||
# Überprüfe /etc/redhat-release
|
||||
elif [ -f /etc/redhat-release ]; then
|
||||
distro=$(cat /etc/redhat-release)
|
||||
version=$(uname -r)
|
||||
codename=$(uname -r)
|
||||
else
|
||||
distro="Unbekannte Distribution"
|
||||
version="Unbekannte Version"
|
||||
codename="Unbekannter Codename"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Ausgabe der ermittelten Informationen
|
||||
echo "Distribution: $distro"
|
||||
echo "Version: $version"
|
||||
echo "Codename: $codename"
|
||||
;;
|
||||
*)
|
||||
echo "Unsupported OS: $OS"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "${OS} wurde ....... Ausgewählt......."
|
||||
}
|
||||
|
||||
use_os_info() {
|
||||
echo "Verwende Informationen über das Betriebssystem:"
|
||||
echo "Distribution: $distro"
|
||||
echo "Version: $version"
|
||||
echo "Codename: $codename"
|
||||
# Hier kannst du mehr Code hinzufügen, der die Variablen $distro, $version und $codename verwendet
|
||||
}
|
||||
|
||||
# Hauptprogramm
|
||||
detect_os
|
||||
use_os_info
|
||||
Executable
+8
@@ -0,0 +1,8 @@
|
||||
#!/bin/#!/usr/bin/bash
|
||||
|
||||
|
||||
#Variablen
|
||||
|
||||
domainname="heim.lan"
|
||||
realmname="HEIM.LAN"
|
||||
|
||||
Reference in New Issue
Block a user