Initialer Import der Synology Scripts
This commit is contained in:
root
Executable
+158
@@ -0,0 +1,158 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit on any error
|
||||
set -e
|
||||
|
||||
# Variables
|
||||
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
||||
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
||||
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
||||
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
||||
DNS_FORWARDER="8.8.8.8" # Externer DNS-Forwarder (Google in diesem Fall)
|
||||
PASSWORD="ipaAdminPassword" # Admin-Passwort (in der Praxis sicher speichern)
|
||||
DIRMAN_PASSWORD="dirmanPassword" # Directory Manager Passwort
|
||||
AD_REALM=$REALM # Active Directory Realm in Großbuchstaben
|
||||
AD_DOMAIN=$DOMAIN # Active Directory Domain in Kleinbuchstaben
|
||||
AD_ADMIN_USER="administrator" # Administrator-Account der AD-Domäne
|
||||
AD_ADMIN_PASS="adAdminPassword" # Passwort des Administrator-Accounts
|
||||
|
||||
LOGFILE="/var/log/idm_install.log"
|
||||
|
||||
# Function to check if running as root
|
||||
function check_root {
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo "Dieses Skript muss als Root ausgeführt werden!" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to install the necessary packages
|
||||
function install_packages {
|
||||
echo "Installiere benötigte Pakete..." | tee -a $LOGFILE
|
||||
yum update -y | tee -a $LOGFILE
|
||||
|
||||
echo "Installiere erforderliche Pakete..." | tee -a $LOGFILE
|
||||
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm | tee -a $LOGFILE
|
||||
dnf -y install @idm:DL1 | tee -a $LOGFILE
|
||||
yum install -y ipa-server ipa-server-dns bind samba samba-client bind-pkcs11-utils | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to install the IDM server with DNS
|
||||
function install_idm_server {
|
||||
echo "Installiere IdM-Server mit DNS..." | tee -a $LOGFILE
|
||||
|
||||
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
||||
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
||||
--ip-address=$IP_ADDRESS --no-pkinit \
|
||||
--setup-dns --auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure AD trust
|
||||
function configure_ad_trust {
|
||||
echo "Konfiguriere AD-Trust..." | tee -a $LOGFILE
|
||||
|
||||
yum install -y ipa-server-trust-ad | tee -a $LOGFILE
|
||||
|
||||
ipa-adtrust-install --add-sids --netbios-name=$(echo $REALM | cut -d. -f1) --no-msdcs --admin-password=$PASSWORD -U | tee -a $LOGFILE
|
||||
|
||||
ipa trust-add --type=ad $AD_REALM --admin=$AD_ADMIN_USER --password=$AD_ADMIN_PASS | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure Samba
|
||||
function configure_samba {
|
||||
echo "Konfiguriere Samba..." | tee -a $LOGFILE
|
||||
|
||||
cat <<EOF > /etc/samba/smb.conf
|
||||
[global]
|
||||
workgroup = $(echo $REALM | cut -d. -f1)
|
||||
realm = $REALM
|
||||
security = ADS
|
||||
idmap config * : backend = tdb
|
||||
idmap config * : range = 1000-9999
|
||||
idmap config $REALM : backend = ad
|
||||
idmap config $REALM : range = 10000-99999
|
||||
log file = /var/log/samba/%m.log
|
||||
log level = 1
|
||||
kerberos method = system keytab
|
||||
dedicated keytab file = /etc/samba/samba.keytab
|
||||
map to guest = Bad User
|
||||
winbind use default domain = true
|
||||
template shell = /bin/bash
|
||||
template homedir = /home/%U
|
||||
EOF
|
||||
|
||||
# Restart Samba services
|
||||
systemctl restart smb nmb winbind
|
||||
}
|
||||
|
||||
# Function to configure firewall
|
||||
function configure_firewall {
|
||||
echo "Konfiguriere Firewall..." | tee -a $LOGFILE
|
||||
|
||||
firewall-cmd --add-service=freeipa-ldap --permanent
|
||||
firewall-cmd --add-service=freeipa-ldaps --permanent
|
||||
firewall-cmd --add-service=freeipa-replication --permanent
|
||||
firewall-cmd --add-service=freeipa-trust --permanent
|
||||
firewall-cmd --add-service=dns --permanent
|
||||
firewall-cmd --add-port=88/tcp --permanent # Kerberos
|
||||
firewall-cmd --add-port=88/udp --permanent # Kerberos
|
||||
firewall-cmd --add-port=464/tcp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=464/udp --permanent # Kerberos kpasswd
|
||||
firewall-cmd --add-port=123/udp --permanent # NTP
|
||||
firewall-cmd --add-port=135/tcp --permanent # DCE/RPC locator service
|
||||
firewall-cmd --add-port=138/udp --permanent # NetBIOS Datagram Service
|
||||
firewall-cmd --add-port=139/tcp --permanent # NetBIOS Session Service
|
||||
firewall-cmd --add-port=445/tcp --permanent # Microsoft-DS Active Directory, Windows shares
|
||||
firewall-cmd --add-port=1024-1300/tcp --permanent # High ports for AD trust
|
||||
firewall-cmd --add-port=1024-1300/udp --permanent # High ports for AD trust
|
||||
firewall-cmd --reload | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Function to configure DNS settings without DNSSEC
|
||||
function configure_dns {
|
||||
echo "Konfiguriere DNS..." | tee -a $LOGFILE
|
||||
|
||||
cat <<EOF > /etc/named.conf
|
||||
options {
|
||||
directory "/var/named";
|
||||
forwarders {
|
||||
$DNS_FORWARDER;
|
||||
};
|
||||
};
|
||||
zone "$DOMAIN" IN {
|
||||
type master;
|
||||
file "$DOMAIN.zone";
|
||||
};
|
||||
EOF
|
||||
|
||||
cat <<EOF > /var/named/$DOMAIN.zone
|
||||
\$TTL 86400
|
||||
@ IN SOA $HOSTNAME. admin.$DOMAIN. (
|
||||
2024090701 ; Serial
|
||||
3600 ; Refresh
|
||||
1800 ; Retry
|
||||
1209600 ; Expire
|
||||
86400 ) ; Minimum TTL
|
||||
|
||||
@ IN NS $HOSTNAME.
|
||||
@ IN A $IP_ADDRESS
|
||||
EOF
|
||||
|
||||
# Restart DNS service
|
||||
systemctl restart named
|
||||
}
|
||||
|
||||
# Main function
|
||||
function main {
|
||||
check_root
|
||||
install_packages
|
||||
install_idm_server
|
||||
configure_ad_trust
|
||||
configure_samba
|
||||
configure_firewall
|
||||
configure_dns
|
||||
echo "IdM-Server Installation und Konfiguration abgeschlossen." | tee -a $LOGFILE
|
||||
}
|
||||
|
||||
# Run the script
|
||||
main
|
||||
Reference in New Issue
Block a user