308 lines
9.3 KiB
Bash
Executable File
308 lines
9.3 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Variablen anpassen
|
|
REALM="MGT.HEIM.LAN"
|
|
lowerREALM=$(hostname -d)
|
|
DOMAIN="MGT"
|
|
HOSTNAME="pdc"
|
|
PASSWORD="P@ssw0rd"
|
|
STATE_FILE="/var/log/samba_setup_state"
|
|
IP_ADDRESS=$(hostname -I | awk '{print $1}')
|
|
HOSTNAME=$(hostname)
|
|
FQDN=$(hostname -f)
|
|
IP_FORWARDER="192.168.1.1"
|
|
# Initialisiere den Fortschrittszustand, falls nicht vorhanden
|
|
if [ ! -f "$STATE_FILE" ]; then
|
|
echo "0" > "$STATE_FILE"
|
|
fi
|
|
|
|
# Lese den aktuellen Fortschritt
|
|
CURRENT_STEP=$(cat "$STATE_FILE")
|
|
|
|
# Funktion zum Aktualisieren des Fortschritts
|
|
update_state() {
|
|
echo "$1" > "$STATE_FILE"
|
|
}
|
|
|
|
# Funktion: /etc/hosts anpassen
|
|
configure_hosts() {
|
|
if [ "$CURRENT_STEP" -le 1 ]; then
|
|
eche "Function Configure Hosts"
|
|
echo "${IP_ADDRESS} ${FQDN} ${HOSTNAME}" >> /etc/hosts
|
|
update_state 2
|
|
fi
|
|
}
|
|
|
|
# Funktion: Lokaleinstellungen setzen
|
|
set_locale() {
|
|
if [ "$CURRENT_STEP" -le 2 ]; then
|
|
echo "function set locale to en_US.utf8"
|
|
localectl set-locale LANG=en_US.utf8
|
|
update_state 3
|
|
fi
|
|
}
|
|
|
|
# Funktion: SELinux deaktivieren
|
|
disable_selinux() {
|
|
echo "function diable selinux"
|
|
if [ "$CURRENT_STEP" -le 3 ]; then
|
|
sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
|
|
update_state 4
|
|
fi
|
|
}
|
|
|
|
# Funktion: System neu starten
|
|
reboot_system() {
|
|
echo "function reboot"
|
|
if [ "$CURRENT_STEP" -le 4 ]; then
|
|
update_state 5
|
|
init 6
|
|
fi
|
|
}
|
|
|
|
# Funktion: SSHD konfigurieren und neu starten
|
|
configure_sshd() {
|
|
echo "function configure sshd"
|
|
if [ "$CURRENT_STEP" -le 5 ]; then
|
|
nano /etc/ssh/sshd_config
|
|
systemctl restart sshd
|
|
update_state 6
|
|
fi
|
|
}
|
|
|
|
# Funktion: SELinux Status prüfen
|
|
check_selinux_status() {
|
|
echo "function check selinux"
|
|
if [ "$CURRENT_STEP" -le 6 ]; then
|
|
sestatus
|
|
update_state 7
|
|
fi
|
|
}
|
|
|
|
# Funktion: Firewall starten und konfigurieren
|
|
configure_firewall() {
|
|
echo "function configure Firewall"
|
|
if [ "$CURRENT_STEP" -le 7 ]; then
|
|
systemctl start firewalld
|
|
systemctl enable firewalld
|
|
firewall-cmd --zone=public --add-port=53/tcp --add-port=53/udp --permanent
|
|
firewall-cmd --zone=public --add-port=88/tcp --add-port=88/udp --permanent
|
|
firewall-cmd --zone=public --add-port=135/tcp --permanent
|
|
firewall-cmd --zone=public --add-port=389/tcp --add-port=389/udp --permanent
|
|
firewall-cmd --zone=public --add-port=445/tcp --permanent
|
|
firewall-cmd --zone=public --add-port=464/tcp --add-port=464/udp --permanent
|
|
firewall-cmd --zone=public --add-port=636/tcp --permanent
|
|
firewall-cmd --zone=public --add-port=3268/tcp --permanent
|
|
firewall-cmd --zone=public --add-port=3269/tcp --permanent
|
|
firewall-cmd --zone=public --add-port=50000-51000/tcp --permanent
|
|
firewall-cmd --zone=public --add-port=49152-65535/tcp --permanent
|
|
firewall-cmd --reload
|
|
update_state 8
|
|
fi
|
|
}
|
|
|
|
# Funktion: System aktualisieren und notwendige Pakete installieren
|
|
install_packages() {
|
|
echo "function install required packages"
|
|
if [ "$CURRENT_STEP" -le 8 ]; then
|
|
dnf update -y
|
|
#dnf install -y epel-release
|
|
|
|
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
|
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
|
yum repolist
|
|
wget -O /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8 https://samba.tranquil.it/RPM-GPG-KEY-TISSAMBA-8
|
|
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8
|
|
echo "[tis-samba]
|
|
name=tis-samba
|
|
baseurl=https://samba.tranquil.it/redhat8/samba-4.19/
|
|
gpgcheck=1
|
|
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8" > /etc/yum.repos.d/tissamba.repo
|
|
dnf repolist
|
|
yum install -y samba samba-dc samba-winbind samba-winbind-clients krb5-workstation ldb-tools bind chrony bind-utils samba-client python39-pip
|
|
pip3 install markdown
|
|
yum install -y wget sudo screen nmap telnet tcpdump rsync net-tools bind-utils htop
|
|
update_state 9
|
|
fi
|
|
}
|
|
|
|
# Funktion: Kerberos-Konfiguration anpassen
|
|
configure_kerberos() {
|
|
echo "function configure kerberos"
|
|
if [ "$CURRENT_STEP" -le 9 ]; then
|
|
cat <<EOF > /etc/krb5.conf
|
|
# To opt out of the system crypto-policies configuration of krb5, remove the
|
|
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
|
|
includedir /etc/krb5.conf.d/
|
|
|
|
[logging]
|
|
default = FILE:/var/log/krb5libs.log
|
|
kdc = FILE:/var/log/krb5kdc.log
|
|
admin_server = FILE:/var/log/kadmind.log
|
|
|
|
[libdefaults]
|
|
dns_lookup_realm = false
|
|
ticket_lifetime = 24h
|
|
renew_lifetime = 7d
|
|
forwardable = true
|
|
rdns = false
|
|
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
|
|
spake_preauth_groups = edwards25519
|
|
default_realm = $REALM
|
|
default_ccache_name = KEYRING:persistent:%{uid}
|
|
dns_lookup_kdc = false
|
|
|
|
[realms]
|
|
$REALM = {
|
|
kdc = ${IP_ADDRESS}
|
|
#admin_server = ${IP_ADDRESS}
|
|
}
|
|
|
|
[domain_realm]
|
|
.${lowerREALM} = $REALM
|
|
${lowerREALM} = $REALM
|
|
EOF
|
|
update_state 10
|
|
fi
|
|
}
|
|
|
|
# Funktion: Alte Samba-Konfiguration entfernen und neue Konfiguration erstellen
|
|
configure_samba() {
|
|
echo "funktion configure samba"
|
|
if [ "$CURRENT_STEP" -le 10 ]; then
|
|
rm -f /etc/samba/smb.conf
|
|
samba-tool domain provision --realm=$REALM --domain=$DOMAIN --server-role=dc
|
|
samba-tool user setpassword administrator --newpassword=$PASSWORD
|
|
echo "dns forwarder = ${IP_FORWARDER}" >> /etc/samba/smb.conf
|
|
systemctl restart NetworkManager
|
|
rm -f /var/lib/samba/private/krb5.conf
|
|
ln -s /etc/krb5.conf /var/lib/samba/private/krb5.conf
|
|
systemctl enable samba
|
|
systemctl start samba
|
|
update_state 11
|
|
fi
|
|
}
|
|
|
|
# Funktion: BIND9-DLZ installieren und konfigurieren
|
|
configure_bind() {
|
|
echo "function configure bind"nan
|
|
if [ "$CURRENT_STEP" -le 11 ]; then
|
|
yum install -y bind samba-dc-bind-dlz bind-utils
|
|
cat <<EOF > /etc/named.conf
|
|
options {
|
|
listen-on port 53 { any; };
|
|
listen-on-v6 port 53 { ::1; };
|
|
forwarders { ${IP_FORWARDER}; }; # modify depending on your local DNS forwarder
|
|
tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab";
|
|
directory "/var/named";
|
|
dump-file "/var/named/data/cache_dump.db";
|
|
statistics-file "/var/named/data/named_stats.txt";
|
|
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
|
allow-query { any; };
|
|
allow-recursion { any; };
|
|
allow-query-cache { any; };
|
|
recursion yes;
|
|
dnssec-enable no;
|
|
dnssec-validation no;
|
|
bindkeys-file "/etc/named.iscdlv.key";
|
|
managed-keys-directory "/var/named/dynamic";
|
|
pid-file "/run/named/named.pid";
|
|
session-keyfile "/run/named/session.key";
|
|
minimal-responses yes;
|
|
};
|
|
logging {
|
|
channel default_debug {
|
|
file "data/named.run";
|
|
severity dynamic;
|
|
};
|
|
};
|
|
zone "." IN {
|
|
type hint;
|
|
file "named.ca";
|
|
};
|
|
include "/etc/named.rfc1912.zones";
|
|
include "/etc/named.root.key";
|
|
dlz "$REALM" {
|
|
database "dlopen /usr/lib64/samba/bind9/dlz_bind9_11.so";
|
|
};
|
|
EOF
|
|
echo 'OPTIONS="-4"' >> /etc/sysconfig/named
|
|
sed -i 's/dns forwarder = '${IP_ADDRESS}'//g' /etc/samba/smb.conf
|
|
echo "server services = -dns" >> /etc/samba/smb.conf
|
|
mkdir -p /var/lib/samba/bind-dns/dns
|
|
samba_upgradedns --dns-backend=BIND9_DLZ
|
|
update_state 12
|
|
fi
|
|
}
|
|
|
|
# Funktion: DNS-Konfiguration prüfen
|
|
verify_dns() {
|
|
echo "funktion verify dns config"
|
|
if [ "$CURRENT_STEP" -le 12 ]; then
|
|
systemctl restart named
|
|
netstat -tapn | grep 53
|
|
dig @localhost google.de
|
|
dig @localhost $FQDN
|
|
dig. -t SRV @localhost _ldap._tcp.${lowerREALM}
|
|
update_state 13
|
|
fi
|
|
}
|
|
|
|
# Funktion: SELinux wieder aktivieren und konfigurieren
|
|
enable_selinux() {
|
|
echo "function enable selinux"
|
|
if [ "$CURRENT_STEP" -le 13 ]; then
|
|
# SELinux auf permissive setzen
|
|
setenforce 0
|
|
|
|
# SELinux-Module installieren
|
|
dnf install -y policycoreutils-python-utils
|
|
|
|
# Boolsche Variablen für Samba und BIND9 setzen
|
|
setsebool -P samba_enable_home_dirs on
|
|
setsebool -P samba_export_all_rw on
|
|
setsebool -P named_write_master_zones on
|
|
setsebool -P named_update_master_zones on
|
|
|
|
# Kontext für Samba- und BIND9-Verzeichnisse setzen
|
|
semanage fcontext -a -t samba_share_t "/var/lib/samba(/.*)?"
|
|
restorecon -Rv /var/lib/samba
|
|
|
|
semanage fcontext -a -t named_cache_t "/var/lib/samba/bind-dns(/.*)?"
|
|
restorecon -Rv /var/lib/samba/bind-dns
|
|
|
|
# Prüfen der SELinux-Protokolle auf Verstöße und anpassen
|
|
grep samba /var/log/audit/audit.log | audit2allow -M mypol
|
|
semodule -i mypol.pp
|
|
|
|
grep named /var/log/audit/audit.log | audit2allow -M mypol_named
|
|
semodule -i mypol_named.pp
|
|
|
|
# SELinux auf enforcing setzen
|
|
setenforce 1
|
|
|
|
# SELinux-Konfiguration persistent machen
|
|
sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
|
|
|
|
update_state 14
|
|
fi
|
|
}
|
|
|
|
# Hauptskript: Funktionen nacheinander ausführen
|
|
configure_hosts
|
|
set_locale
|
|
disable_selinux
|
|
reboot_system
|
|
configure_sshd
|
|
check_selinux_status
|
|
configure_firewall
|
|
install_packages
|
|
configure_kerberos
|
|
configure_samba
|
|
configure_bind
|
|
verify_dns
|
|
##### OPTIONAL #####
|
|
#enable_selinux #####
|
|
####################
|
|
echo "Installation und Konfiguration abgeschlossen."
|