root/packages/fuss-server/fuss-server @ fd015c8b2452a0021ff6b4a8929919985126c286

Revision fd015c8b2452a0021ff6b4a8929919985126c286, 28.8 KB (checked in by Simone Piccardi <piccardi@…>, 13 months ago)

Modifica alla versione del pacchetto, e correzione di permessi dei
certificati.
  • Property mode set to 100755
Line 
1#!/bin/bash
2#
3# fuss-server: script to configure a FUSS Server.
4#
5# Copyright (C) 2007-2012 Simone Piccardi <piccardi@truelite.it>
6#
7# This program is free software; you can redistribute it and/or modify
8# it under the terms of the GNU General Public License as published by
9# the Free Software Foundation; version 2 of the License.
10#
11# This program is distributed in the hope that it will be useful,
12# but WITHOUT ANY WARRANTY; without even the implied warranty of
13# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14# GNU General Public License for more details.
15#
16# You should have received a copy of the GNU General Public License
17# along with this program or from the site that you downloaded it
18# from; if not, write to the Free Software Foundation, Inc., 59 Temple
19# Place, Suite 330, Boston, MA  02111-1307   USA
20#
21set -e
22
23#
24# To avoid localizations hassles
25#
26export LANG=C
27
28##
29## Defining used files, directories and program
30##
31ETC_DIR=/etc/fuss-server/
32CONF_FILE=$ETC_DIR/fuss-server.conf
33SERV_FUNC=$ETC_DIR/service-functions
34CONF_CMD=/usr/sbin/fuss-server-config
35CA_DIR=$ETC_DIR/Credentials
36TEMPL_DIR=/usr/share/fuss-server/templates
37SCRIPT_DIR=/usr/share/fuss-server/scripts
38TEMP_DIR=/tmp/fuss-server
39
40FUSS_SER_VERS=$(dpkg -l fuss-server | grep fuss-server| awk '{print $3}')
41echo "Running fuss-server $FUSS_SER_VERS"
42
43#
44# define an exit function with "cannot handle" message
45#
46unhandle_exit () {
47    echo "This package cannot handle this happening, stopping"
48    exit 1
49}
50
51# Service functions, they must be present
52if [ -f "$SERV_FUNC" ]; then
53    . "$SERV_FUNC"
54else
55    echo "Something wrong, missing service functions file $SERV_FUNC"
56    echo "you need to purge and reinstall the package"
57    exit 1
58fi
59
60case "$1" in
61    create)
62    ##
63    ## Read and check configuration variables, they mut be defined
64    ##
65    if [ -f "$CONF_FILE" ]; then
66        . "$CONF_FILE"
67    else
68        echo "Something wrong, missing configuration file $CONF_FILE"
69        echo "try a fuss-server purge or reintall the package"
70        exit 1
71    fi
72    # checking mandatory configuration variables
73    while [ -z "$LOCALNET" ]; do
74        echo "Variable LOCALNET must be configured, please enter value"
75        $CONF_CMD
76        . "$CONF_FILE"
77    done
78    while [ -z "$DOMAIN" ]; do
79        echo "Variable DOMAIN must be configured, please enter value"
80        $CONF_CMD
81        . "$CONF_FILE"
82    done
83    while [ -z "$WORKGROUP" ]; do
84        echo "Variable WORKGROUP must be configured, please enter value"
85        $CONF_CMD
86        . "$CONF_FILE"
87    done
88    if [ -z "$MASTER_PASS" ]; then
89        echo "Variable MASTER_PASS must be configured, please enter value"
90        $CONF_CMD
91        . "$CONF_FILE"
92    fi
93    while [ -z "$GEOPLACE" ]; do
94        echo "Variable GEOPLACE must be configured, please enter value"
95        $CONF_CMD
96        . "$CONF_FILE"
97    done
98    while [ -z "$DHCP_RANGE" ]; do
99        echo "Variable DHCP_RANGE must be configured, please enter value"
100        $CONF_CMD
101        . "$CONF_FILE"
102    done
103    # check correctness of values
104    cidr_check $LOCALNET
105    if [ "$OK" = no ]; then
106        echo "Error on LOCALNET variable: $LOCALNET"
107        resetconf LOCALNET
108        $CONF_CMD
109        . "$CONF_FILE"
110    fi
111    for i in $DHCP_RANGE; do
112        ip_check $i
113        if [ "$OK" = no ]; then
114            echo "Error on DHCP_RANGE variable: $DHCP_RANGE"
115            resetconf DHCP_RANGE
116            $CONF_CMD
117            . "$CONF_FILE"
118            break
119        fi
120    done
121    if ! echo $DOMAIN | grep -E "^[[:alnum:]]+\.[[:alnum:]]+$" >/dev/null; then
122        resetconf DOMAIN
123        $CONF_CMD
124        . "$CONF_FILE"
125    fi
126    if echo $WORKGROUP | grep -E "[^[:alnum:]]" > /dev/null; then
127        resetconf WORKGROUP
128        $CONF_CMD
129        . "$CONF_FILE"
130    fi
131    # check for "prolematic" chars
132    if echo $MASTER_PASS | grep '/' > /dev/null; then
133        resetconf MASTER_PASS
134        $CONF_CMD
135        . "$CONF_FILE"
136    fi
137
138    # check internal that interfaces definition is coerent with LAN
139    for i in $LOCALNET; do
140        INT_IF=$(ip route | grep "$i" | awk '{print $3}')
141        if [ -z "$INT_IF" ]; then
142            echo "No interface found for $i network"
143            exit 1
144        fi
145        if ! echo "$INTERN_IFACES" | grep "$INT_IF"; then
146            echo "Configured internal interface $INTERN_IFACES do not"
147            echo "match LAN address $i on interface $INT_IF"
148            exit 1
149        fi
150    done
151
152    ######################
153    ## Initial settings ##
154    ######################
155    #
156    # Setting other variables for configuration
157    #
158    BASE=`echo $DOMAIN |
159       awk -F"." '{OFS=""; ORS=","; for (i=1; i <= NF; i++) print "dc=",$i}' |
160       sed -re 's/,$//g'`
161    DOM=`echo $BASE | cut -d'=' -f2| cut -d, -f1`
162    HOST=`hostname`
163    FQDN=`hostname`'.'$DOMAIN
164    # define master password for LDAP, services and CA
165    export PASS="$MASTER_PASS"
166    # create uuencoded password for LDAP
167    NEWPASS=`slappasswd -s $PASS`
168    TODAY=`date +%F-%X`
169    export TODAY
170    echo "Dominio $DOMAIN, Base $BASE, Workgroup $WORKGROUP"
171    if [ ! -d $TEMP_DIR ]; then
172        mkdir -p $TEMP_DIR
173        chmod 700 $TEMP_DIR
174    fi
175
176
177    ###############################
178    ## Network LAN configuration ##
179    ###############################
180    #
181    # check if configured as static, otherwise remove configs
182    #
183#    if ! grep -E "iface.+$INTERN_IFACES.+static" /etc/network/interfaces; then
184#       backfile /etc/network/interfaces
185#       # remove previous config, if is there
186#       sed -r -e "/^iface.+$INTERN_IFACES.*/,/(^iface|^$)/{d}" \
187#           > $TEMP_DIR/interfaces
188#       # append new config
189#       echo -e "iface $INTERN_IFACES inet static" >> $TEMP_DIR/interfaces
190#       IP=$(netmask -r )
191#       echo -e "" >> $TEMP_DIR/interfaces
192       
193
194    ############################
195    ## Firewall configuration ##
196    ############################
197
198    # adding to runlevel
199    echo "Configuring Firewall, local net is $LOCALNET"
200    if [ -x  /etc/init.d/firewall ]; then
201        update-rc.d firewall defaults 41 80 >/dev/null
202        if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
203                invoke-rc.d firewall start
204        else
205                /etc/init.d/firewall start || exit 0
206        fi
207    fi
208
209    #############################
210    ## Filesever configuration ##
211    #############################
212    ##
213    ## CA configuration
214    ##
215    # to do just the first time, leave as is if already exists
216    if [ ! -d "$CA_DIR/demoCA" ]; then
217        echo "#####################################"
218        echo "#   Creating CA and Certificates    #"
219        echo "#####################################"
220        mkdir -p $CA_DIR
221        chmod 700 $CA_DIR
222        cd $CA_DIR 
223        rm -f *.pem
224        cat $TEMPL_DIR/certif \
225            | sed -e "s/Firenze/$GEOPLACE/g" \
226            | sed -e "s/<WORKGRP>/$WORKGROUP/g" \
227            | sed -e "s/FQDN/$FQDN/g" \
228            > $CA_DIR/certif
229        echo "Generating CA certificate"
230        export SSLEAY_CONFIG="-config $TEMPL_DIR/openssl.cnf"
231        $SCRIPT_DIR/CA.sh -newca <<EOF
232
233IT
234FI
235Firenze
236Truelite Srl
237Truelite Srl CA
238ca.truelite.it
239info@truelite.it
240
241
242
243EOF
244        echo "Generating server certificate"
245        $SCRIPT_DIR/CA.sh -newreq <<EOF
246IT
247Italia
248$GEOPLACE
249$WORKGROUP
250File Server
251$FQDN
252root@localhost
253
254
255
256EOF
257        echo "Signing server certificate"
258        $SCRIPT_DIR/CA.sh -sign <<EOF
259y
260y
261EOF
262        echo "Unlock server certificate key"
263        if [ -e newkey.pem ]; then
264            chmod 600 $CA_DIR/newkey.pem
265            openssl rsa -passin env:PASS < newkey.pem > nopasskey.pem
266        else
267            chmod 600 $CA_DIR/newreq.pem
268            openssl rsa -passin env:PASS < newreq.pem > nopasskey.pem
269        fi
270        # copying certificates and keys
271        backfile /etc/ssl/certs/cacert.pem
272        backfile /etc/ssl/certs/fuss-server-cert.pem
273        backfile /etc/ssl/private/fuss-server-key.pem
274
275        cp -af $CA_DIR/demoCA/cacert.pem /etc/ssl/certs/cacert.pem
276        cp -af $CA_DIR/newcert.pem /etc/ssl/certs/fuss-server-cert.pem
277        cp -af $CA_DIR/nopasskey.pem /etc/ssl/private/fuss-server-key.pem
278        chmod 640 /etc/ssl/private/fuss-server-key.pem
279        chgrp ssl-cert /etc/ssl/private/fuss-server-key.pem
280    fi
281
282    ##
283    ## LDAP configuration
284    ##
285    echo "##########################################"
286    echo "#   Configuring LDAP server and client   #"
287    echo "##########################################"
288    # Source the init script configuration
289    if [ -f "/etc/default/slapd" ]; then
290        . /etc/default/slapd
291    fi
292    # stop nslcd service if installed (to avoid timeouts on slapd down)
293    if [ -x /etc/init.d/nslcd ]; then
294        if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
295            invoke-rc.d nslcd stop
296        else
297            /etc/init.d/nslcd stop || exit 0
298        fi
299    fi
300    # stop slapd service
301    if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
302        invoke-rc.d slapd stop
303    else
304        /etc/init.d/slapd stop || exit 0
305    fi
306    echo "SLAPD stopped"
307
308    # previous LDAP DB backup
309    LDAP_BACK="/var/backups/old-ldap_backup-$TODAY"
310    umask 0077
311    if ! slapcat > $LDAP_BACK ; then
312        echo "WARNING: cannot backup old LDAP tree"
313        echo "OLD DB will be reused, if BASE or PASSWORD has been changed"
314        echo "there will be troubles and installation will probably fails"
315    else
316        echo "LDAP tree backup saved in $LDAP_BACK"
317    fi
318    umask 0022
319
320    # setup the default location of the slapd config file
321    if [ -z "$SLAPD_CONF" ]; then
322        SLAPD_CONF="/etc/ldap/slapd.conf"
323    fi
324
325    if [ -e $SLAPD_CONF ]; then
326        # check multiple database
327        if [ $(grep ^database $SLAPD_CONF|wc -l) -ne 1 ]; then
328            echo "There are multiple databases!"
329            unhandle_exit
330         fi
331        # check multiple tree
332        if [ $(grep ^suffix $SLAPD_CONF|wc -l) -ne 1 ]; then
333            echo "There are multiple LDAP trees! "
334            unhandle_exit
335        fi     
336    else
337        echo "WARNING: cannot find $SLAPD_CONF"
338        if [ -d /etc/ldap/slapd.d ]; then
339            echo "Use the new idiot cn=config thing removing it"
340            mv /etc/ldap/slapd.d /etc/ldap/slapd.d-dpgk-inst
341        else
342            echo "Cannot try to backup the LDAP DB"
343            unhandle_exit
344        fi
345    fi
346
347    # install Samba schema if not present
348    if [ ! -f /etc/ldap/schema/samba.schema ]; then
349        echo "Installing Samba schema"
350        zcat /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz \
351            > /etc/ldap/schema/samba.schema
352    else
353        echo "Something wrong, cannot find Samba schema "
354    fi
355
356    # backup previous config and set the new one
357    backfile /etc/default/slapd
358    add_var_def /etc/default/slapd SLAPD_SERVICES "ldap://127.0.0.1 ldaps://"
359
360    echo "Using $BASE as tree suffix"
361    backfile $SLAPD_CONF
362    cat $TEMPL_DIR/slapd.conf \
363        | sed -re "s/(.*)(dc=domain,dc=local)(.*)/\1$BASE\3/g" \
364        > $SLAPD_CONF
365    if [ $? -ne 0 ] ; then
366        echo "Error on LDAP configuration file creation"
367        echo "Using suffix $BASE, dc=$DOM and password $PASS"
368        unhandle_exit
369    else
370        echo "LDAP configuration created"
371    fi
372
373    # permission correction
374    if [ -n "$SLAPD_USER" ] && [ -n "$SLAPD_GROUP" ] ; then
375        chmod 640  "$SLAPD_CONF"
376        chgrp "$SLAPD_GROUP" "$SLAPD_CONF"
377        if ! getent group|grep ssl-cert|cut -d: -f4| grep -q "$SLAPD_USER"; then
378            adduser "$SLAPD_USER" ssl-cert
379        fi
380    fi
381
382#
383# function noisy_slapadd: run slapadd and output the ldif file if
384# something goes wrong. Taken from slapd postinst script
385#
386# Usage: noisy_slapadd < ldif-file
387#
388noisy_slapadd() {
389        local ldif_tmp
390
391        ldif_tmp=$(tempfile -d $TEMP_DIR -p trlpkg)
392        cat > "$ldif_tmp"
393        if ! slapadd "$@" < "$ldif_tmp"; then
394                echo >&2 "Failed to slapadd this data: "
395                cat >&2  < "$ldif_tmp"
396                rm "$ldif_tmp"
397                exit 1
398        fi
399        rm "$ldif_tmp"
400}
401
402
403
404# create initial tree structure
405echo "Initial install: erasing previous LDAP data if present"
406
407# get data dir from configuration
408LDAP_DATA_DIR=$(grep ^directory $SLAPD_CONF | awk '{print $2}'| tr -d \"\')
409
410
411# create uuencoded password value for initial LDAP tree
412NEWPASS=`slappasswd -s $PASS`
413if [ -d "$LDAP_DATA_DIR" ]; then
414    rm -f $LDAP_DATA_DIR/*
415    cp -f $TEMPL_DIR/DB_CONFIG $LDAP_DATA_DIR
416    echo "Installing inital DB using suffix $BASE on $LDAP_DATA_DIR"
417    # add data, use slapd postinst script method (beware of starting tab!)
418    cat <<-EOF | noisy_slapadd
419        dn: $BASE
420        objectClass: top
421        objectClass: dcObject
422        objectClass: organization
423        o: $WORKGROUP
424        dc: $DOM
425
426        dn: cn=admin,$BASE
427        objectClass: simpleSecurityObject
428        objectClass: organizationalRole
429        cn: admin
430        description: LDAP administrator
431        userPassword: $NEWPASS
432
433        EOF
434    # permission correction
435    if [ -n "$SLAPD_USER" ] || [ -n "$SLAPD_GROUP" ]; then
436        echo -n "chowning database directory ($SLAPD_USER:$SLAPD_GROUP)... "
437        [ -z "$SLAPD_USER" ] || chown -R "$SLAPD_USER" "$LDAP_DATA_DIR"
438        [ -z "$SLAPD_GROUP" ] || chgrp -R "$SLAPD_GROUP" "$LDAP_DATA_DIR"
439        echo "done";
440    fi
441    echo "Initial tree for LDAP created"
442fi
443
444
445
446    # server restart
447    if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
448        invoke-rc.d slapd start
449    else
450        /etc/init.d/slapd start || exit 0
451    fi
452
453
454    ##
455    ## Create LDAP client library config file
456    ##
457    LDAP_LIB_CFG=${LDAP_LIB_CFG:-/etc/ldap/ldap.conf}
458    backfile $LDAP_LIB_CFG
459
460    cat $TEMPL_DIR/ldap.conf \
461        | sed -re "s/(.*)(dc=domain,dc=local)(.*)/\1$BASE\3/g" \
462        > $LDAP_LIB_CFG
463
464    if [ $? -ne 0 ] ; then
465        echo "Error on LDAP client configuration creation"
466        echo "Using suffix $BASE"
467    else
468        echo "New LDAP client configuration created"
469    fi
470
471    ##
472    ## Config LDAP user authentication
473    ##
474    # config nsswitch
475    backfile /etc/nsswitch.conf
476    cp -f $TEMPL_DIR/nsswitch.conf /etc/nsswitch.conf
477   
478
479    # create nslcd.conf (new access method, valid for Squeeze)
480    NSS_LDAPD=${NSS_LDAPD:-/etc/nslcd.conf}
481    if [ -f "$NSS_LDAPD" ]; then
482        backfile $NSS_LDAPD
483        cat $TEMPL_DIR/nslcd.conf  \
484            | sed -re "s/(.*)(dc=truelite,dc=srl)(.*)/\1$BASE\3/g" \
485            > $NSS_LDAPD
486    fi
487
488    # put LDAP in common-* to enable PAM using it
489    backfile /etc/pam.d/common-account
490    backfile /etc/pam.d/common-password
491    backfile /etc/pam.d/common-session
492    backfile /etc/pam.d/common-auth
493    cp $TEMPL_DIR/common-* /etc/pam.d/
494
495    # restart nscd service if installed
496    if [ -x /etc/init.d/nscd ]; then
497        if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
498            invoke-rc.d nscd restart
499        else
500            /etc/init.d/nscd restart || exit 0
501        fi
502    fi
503
504
505    ##
506    ## SAMBA configuration
507    ##
508
509    # creating Samba directories
510    SAMBADIR=/home/samba
511    PROFILES=$SAMBADIR/profiles
512    NETLOGON=$SAMBADIR/netlogon
513    if [ ! -d "SAMBDIR"  ]; then
514        if [ ! -d $PROFILES ] ; then
515            mkdir -p $PROFILES
516            chmod 1777 $PROFILES
517            echo "Created profile directory $PROFILES"
518        fi
519        if [ ! -d $NETLOGON ] ; then
520            mkdir -p $NETLOGON
521            echo "Created profile directory $NETLOGON"
522        fi
523    fi
524
525    echo "Stopping Samba for reconfiguration"   
526    /etc/init.d/samba stop
527    # creating Samba config file
528    backfile /etc/samba/smb.conf
529    cat $TEMPL_DIR/smb.conf \
530        | sed -re "s/(.*)TRUELITE/\1 $WORKGROUP/g" \
531        | sed -re "s/(.*)(dc=domain,dc=local)(.*)/\1$BASE\3/g" \
532        > /etc/samba/smb.conf
533    if [ $? -ne 0 ] ; then
534        echo "Error on Samba configuration creation"
535        echo "Using workgroup $WORKGROUP and suffix $BASE"
536    else
537        echo "New Samba config created for domain $WORKGROUP"
538    fi
539    # clearing previuos data
540    rm -fR /var/lib/samba/*
541    echo "Setting LDAP passwd"
542    smbpasswd -w $PASS
543
544    echo "Starting Samba after configuration"
545    /etc/init.d/samba start || echo "Samba restart failed"
546
547    # configuring IDEALX script
548    SID=`net getlocalsid | cut -d: -f2 | awk '{print $1}'`
549    echo "Setting IDEALX scripts, SID is: $SID"
550    backfile /etc/smbldap-tools/smbldap_bind.conf
551    cat $TEMPL_DIR/smbldap_bind.conf \
552        | sed -re "s/(.*)(dc=domain,dc=local)(.*)/\1$BASE\3/g" \
553        | sed -re "s/(.*)(<PASSWORD>)(.*)/\1$PASS\3/g" \
554        > /etc/smbldap-tools/smbldap_bind.conf
555    chmod 600 /etc/smbldap-tools/smbldap_bind.conf
556
557    backfile /etc/smbldap-tools/smbldap.conf
558    cat $TEMPL_DIR/smbldap.conf \
559        | sed -re "s/#SID.*/SID=\"$SID\"/g" \
560        | sed -re "s/(.*)(dc=domain,dc=local)(.*)/\1$BASE\3/g" \
561        | sed -re "s/(.*)TRUELITE/\1$WORKGROUP/g" \
562        | sed -re "s/(.*)domain.local/\1$DOMAIN/g" \
563        > /etc/smbldap-tools/smbldap.conf
564
565    echo "Populate LDAP tree"
566    # select smbldap-tool version, > 0.8, use $1
567    VERSION=`dpkg -l|grep smbldap|awk '{print $3}'`
568    VAL=`echo $VERSION | awk -F"." '{print ($1>0, $2>8)}'`
569    WIN_ADM="admin"
570    if [ "$VAL" = "0 0" ]; then
571        echo "Old (<0.8) smbldap-populate version"
572        /usr/sbin/smbldap-populate -a $WIN_ADM -u 2000 -g 2000
573        /usr/sbin/smbldap-usermod -u 0 $WIN_ADM
574        /usr/sbin/smbldap-passwd $WIN_ADM <<EOF
575$PASS
576$PASS
577EOF
578    else
579        echo "New (>0.8) smbldap-populate version"
580        /usr/sbin/smbldap-populate -a $WIN_ADM -u 2000 -g 2000 <<EOF
581$PASS
582$PASS
583EOF
584    fi
585
586    # Samba defaults for italian privacy laws
587    #pdbedit -P "maximum password age" -C $(( 175 * 86400 )) # 175 giorni
588    #pdbedit -P "password history"     -C 3
589    #pdbedit -P "min password length"  -C 9
590
591    ##
592    ## APACHE config for exporting client config files
593    ##
594    # generating LDAP configuration files for clients
595    echo "Generating client configs with ldaps://$FQDN"
596    DATA_CONF=/var/www/fuss-data-conf
597    mkdir -p $DATA_CONF
598    cp -a /etc/ssl/certs/cacert.pem $DATA_CONF/
599    cat /etc/ldap/ldap.conf \
600        | sed -re "/^host/I d" \
601        | sed -re "/^uri/I d" \
602        | sed -re "/^#uri/I a uri   ldaps://$FQDN" \
603        > $DATA_CONF/ldap.conf
604    # generating root user SSH key for clusterssh use
605    echo "#############################################"
606    echo "## Generating SSH root key for cluster ssh ##"
607    echo "#############################################"
608    backfile /root/.ssh/id_dsa
609    backfile /root/.ssh/id_dsa.pub
610    rm -f /root/.ssh/id_dsa*
611    ssh-keygen -t dsa -P "" -f /root/.ssh/id_dsa
612    cp /root/.ssh/id_dsa.pub $DATA_CONF/
613    cp /root/.ssh/id_dsa* $CA_DIR/
614
615
616    # recreating Apache default virtual host (to enable SSL)
617    backfile /etc/apache2/sites-available/default
618    cp -f $TEMPL_DIR/apache_default \
619        /etc/apache2/sites-available/default
620    echo "Enabling SSL for Apache2"
621    a2enmod ssl
622    echo "Set Apache2 listening on ports 80 e 443"
623    backfile /etc/apache2/ports.conf
624    backfile /etc/default/apache2
625    echo -e "Listen 80\nListen 443" > /etc/apache2/ports.conf
626    echo "NO_START=0" > /etc/default/apache2
627    echo "Apache2 restart after setup:"
628    apache2ctl restart || echo "Apache restart failed"
629
630    ##
631    ## Modify /etc/fstab to enable ACL support
632    ##
633    backfile /etc/fstab
634    if [ ! -z "`mount | grep /home`" ]; then
635        if [ ! -z "`mount | grep /home | grep acl`" ]; then
636            echo "ACL attive"
637        else
638            if [ ! -z "`mount | grep /home | grep ext3`" ]; then
639                echo "Attivo le ACL per la partizione /home"
640                TEMP_FILE=$(tempfile -d $TEMP_DIR -p fstab)
641                cat /etc/fstab \
642                | sed -re "s|(^[^#].*)(/home)([ \t]+[^ \t]+[ \t]+[^ \t]+)(.*)|\1\2\3,acl\4|g" \
643                > $TEMP_FILE
644                if [ -s "$TEMP_FILE" ]; then
645                    cp -f $TEMP_FILE /etc/fstab
646                    rm -f $TEMP_FILE
647                    mount -o remount /home
648                else
649                    echo "Produced an empty fstab file, doing nothing"
650                fi
651            else
652                echo "ACL support is working for ext3 filesystem"
653                echo "Please use a better supported filesystem"
654            fi
655        fi
656    else
657        echo "###############################################"
658        echo "##                                           ##"
659        echo "## /home inside /, cannot activate ACL       ##"
660        echo "##                                           ##"
661        echo "###############################################"
662    fi
663
664    ##
665    ## NFS configuration
666    ##
667    NFSON="true"
668    if [ $NFSON = "true" ]; then
669        echo "Configuring NFS"
670        # server restart
671        if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
672            invoke-rc.d nfs-kernel-server stop
673            invoke-rc.d portmap stop
674        else
675            /etc/init.d/nfs-kernel-server stop
676            /etc/init.d/portmap stop || exit 0
677        fi
678        backfile /etc/exports
679        cat $TEMPL_DIR/exports \
680            | sed -e "s|<localnet>|$LOCALNET|g" \
681            > /etc/exports
682        if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
683            invoke-rc.d portmap start
684            invoke-rc.d nfs-kernel-server start
685        else
686            /etc/init.d/portmap start
687            /etc/init.d/nfs-kernel-server start
688        fi
689        /usr/sbin/exportfs -a
690        echo "NFS configured"
691    fi
692
693    # Interface list, better having it from configuration
694    if [ ! -z "$INTERN_IFACES" ]; then
695        IFACES=$INTERN_IFACES
696    else
697        IFACES=$(ip route | grep "scope link" \
698            | grep -v `ip route | grep default | awk '{print $5}'` \
699            | awk '{print $3}')
700    fi
701    echo "Configured $IFACES, configuration is $INTERN_IFACES"
702
703    #  Creating DNS e DHCP
704    echo "Generating DNS/DHCP key"
705    cd $CA_DIR
706    if [ ! -e Ktruelite*.private ]; then
707        echo "Key file not found, recreate it"
708        echo "this will take some time, you can shorten it"
709        echo "by increasing system entropy: press some key, ecc."
710        dnssec-keygen -a HMAC-MD5 -b 512 -n HOST truelite
711    fi
712    CHIAVE=$(cat Ktruelite*.private|grep Key: | cut -d" " -f2)
713
714    ##
715    ## BIND configuration
716    ##
717    echo "Starting DNS configuration, stopping service"
718    if which invoke-rc.d >/dev/null 2>&1; then
719        invoke-rc.d bind9 stop
720    else
721        /etc/init.d/bind9 stop
722    fi
723
724    # key file creation
725    backfile /etc/bind/rndc.key
726    echo "Using Key $CHIAVE"
727    cat $TEMPL_DIR/rndc.key \
728        | sed -e "s|<chiave>|$CHIAVE|g" \
729        > /etc/bind/rndc.key
730   
731    # direct local zone creation
732    MAINIF=$(echo $IFACES | cut -d " " -f 1)
733    SERVERIP=$(ip addr show $MAINIF|grep "inet "|awk '{print $2}'|cut -d/ -f1|head -n1)
734    NIP=$(ip addr show $MAINIF|grep "inet "|awk '{print $2}'|cut -d/ -f1|wc -l)
735    if [ "$NIP" -gt 1 ]; then
736        echo "Found multiple IP on $MAINIF, using $SERVERIP"
737    fi
738    echo "Interfaces $IFACES, main interface $MAINIF, server IP is $SERVERIP"
739    cat $TEMPL_DIR/db.local \
740        | sed -e "s/domain.local/$DOMAIN/g" \
741        | sed -e "s/<FQDN>/$FQDN/g" \
742        | sed -e "s/<HOST>/$HOST/g" \
743        | sed -e "s/<server-ip>/$SERVERIP/g" \
744        > /var/cache/bind/db.local
745    echo "Created local zone"
746    # insert A records
747    for i in $IFACES; do
748        ADDR=$(ip addr show $i | grep "inet " | awk '{print $2}' | cut -d/ -f1)
749        for j in $ADDR; do
750            # adding A records to direct zone
751            echo -e "$HOST \t IN \t A \t $j" >> /var/cache/bind/db.local
752        done
753    done
754    # create bind configs for local zones
755    backfile /etc/bind/named.conf.local
756    cat $TEMPL_DIR/named.conf.local \
757        | sed -e "s/domain.local/$DOMAIN/g" \
758        | sed -e "s/<FQDN>/$FQDN/g" \
759        | sed -e "s|<chiave>|$CHIAVE|g" \
760        > /etc/bind/named.conf.local
761
762    # configs on internal interfaces
763    for i in $IFACES; do
764        NETS=$(/sbin/ip route | grep -v default |grep $i | awk '{print $1}')
765        for j in $NETS; do
766            reverse $j
767            # reverse zone creation
768            cat $TEMPL_DIR/db.reverse \
769                | sed -e "s/domain.local/$DOMAIN/g" \
770                | sed -e "s/<FQDN>/$FQDN/g" \
771                > /var/cache/bind/db.$NET
772            # adding zone to bind config
773            cat $TEMPL_DIR/named.conf.reverse \
774                | sed -e "s/<FQDN>/$FQDN/g" \
775                | sed -e "s/<reverse>/$ZONE/g" \
776                | sed -e "s/<revfile>/$NET/g" \
777                >> /etc/bind/named.conf.local
778            # adding PTR records to reverse zone
779            ADDR=$(ip addr show $i | grep $NET |awk '{print $2}' | cut -d/ -f1)
780            for k in $ADDR; do
781                revip $k
782                echo -e "$REVIP\t IN\t PTR\t $FQDN." >> /var/cache/bind/db.$NET
783            done
784        done
785    done
786
787    # clearing temporary files
788    rm -f /var/cache/bind/db.*.jnl
789    # clearing permissions
790    chmod 2775 /var/cache/bind/
791    chgrp bind /var/cache/bind/
792    chown bind:bind /var/cache/bind/db.*
793    if which invoke-rc.d >/dev/null 2>&1; then
794        invoke-rc.d bind9 start
795    else
796        /etc/init.d/bind9 start
797    fi
798
799    # use localhost as local DNS
800    backfile /etc/resolv.conf
801    cat $TEMPL_DIR/resolv.conf \
802        | sed -e "s/DOMINIO/$DOMAIN/g" \
803        > /etc/resolv.conf
804   
805    ##
806    ## DHCP configuration
807    ##   
808    echo "Starting DHCP configuration, stopping server"
809    if which invoke-rc.d >/dev/null 2>&1; then
810        invoke-rc.d isc-dhcp-server stop
811    else
812        /etc/init.d/isc-dhcp-server stop
813    fi
814    # setup /etc/default/dhcp3-server
815    echo "Setting default interfaces for DHCP"
816    backfile /etc/default/isc-dhcp-server
817    cat $TEMPL_DIR/dhcpd.default \
818        | sed -e "s/<ifaces>/$IFACES/g" \
819        > /etc/default/isc-dhcp-server
820
821    # create base default config for DHCP
822    echo "Creating base configuration"
823    backfile /etc/dhcp/dhcpd.conf
824    cat $TEMPL_DIR/dhcpd.conf \
825        | sed -e "s/<dominio>/$DOMAIN/g" \
826        | sed -e "s/<FQDN>/$FQDN/g" \
827        | sed -e "s|<chiave>|$CHIAVE|g" \
828        > /etc/dhcp/dhcpd.conf
829
830    #
831    # Loop for interfaces configuration
832    #
833    echo "Configuring iface $IFACES"
834    NIF=$(echo $IFACES|wc -w)
835    if [ "$NIF" -gt 1 ]; then
836        echo "We have $NIF different LAN interfaces, experimental setup,"
837        echo "we cannot use the IP range given on the configuration request"
838        echo "Be sure to check the results !!!"
839    fi
840    for i in $IFACES; do
841        DNSIP=$(
842            ip addr show $i | grep "inet " | head -n1 |
843            awk '{print $2}' | cut -d/ -f1
844        )
845        NIP=$(ip addr show $i|grep "inet "|awk '{print $2}'|cut -d/ -f1|wc -l)
846        if [ "$NIP" -gt 1 ]; then
847            echo "Found multiple IP on $i, using $DNSIP"
848        fi
849        NETS=$(ip route | grep -v default |grep $DNSIP | awk '{print $1}')
850        NETMASK=$(netmask -s $NETS | cut -d/ -f2)
851        SUBNET=$(netmask -s $NETS | cut -d/ -f1)
852        if ip route | grep default | grep $i; then
853            ROUTER=$(ip route | grep default | grep $i | awk '{print $3}')
854        else
855            ROUTER=$DNSIP
856        fi
857        # compute range for DHCP
858        ADDR=$( echo $NETS | cut -d/ -f1)
859        SIZE=$(( 1 << ( 32 - $(echo $NETS|cut -d/ -f2) ) ))
860        if [ $SIZE -gt 256 ]; then
861            SIZE=256
862        fi
863        INIT=$(echo $ADDR | cut -d. -f 1-3).$(( $SIZE / 4 ))
864        END=$(echo $ADDR | cut -d. -f 1-3).$(( $SIZE / 4 + $SIZE / 2 ))
865
866        reverse $NETS
867
868        # using given range only with a single interface
869        if [ "$NIF" -eq 1 ]; then
870            if [ ! -z "$DHCP_RANGE" ]; then
871                RANGE=$DHCP_RANGE
872            else
873                RANGE="$INIT $END"
874            fi
875        else
876            RANGE="$INIT $END"
877        fi
878
879        # creo configurazione specifica per ciascuna interfaccia
880        echo "subn $SUBNET, nmask $NETMASK"
881        echo "range $RANGE, router $ROUTER, DNS $DNSIP, "
882        cat $TEMPL_DIR/dhcpd.iface \
883            | sed -e "s/<dns-ip>/$DNSIP/g" \
884            | sed -e "s/<router-ip>/$ROUTER/g" \
885            | sed -e "s/<subnet>/$SUBNET/g" \
886            | sed -e "s/<netmask>/$NETMASK/g" \
887            | sed -e "s/<range>/$RANGE/g" \
888            | sed -e "s/<dominio>/$DOMAIN/g" \
889            | sed -e "s/<FQDN>/$FQDN/g" \
890            | sed -e "s/<reverse>/$ZONE/g" \
891            >> /etc/dhcp/dhcpd.conf
892    done
893    # configuration completed, restart server
894    echo "Restarting DHCP server"
895    if which invoke-rc.d >/dev/null 2>&1; then
896        invoke-rc.d isc-dhcp-server start || echo "DHCP restart failed"
897    else
898        /etc/init.d/isc-dhcp-server start || echo "DHCP restart failed"
899    fi
900
901    ##
902    ## SQUID configuration
903    ##
904    echo "Changing squid configuration..."
905    if which invoke-rc.d >/dev/null 2>&1; then
906        invoke-rc.d squid stop
907    else
908        /etc/init.d/squid stop
909    fi
910
911    # computer memory and disk sizes on avalaible resources
912    MEMSIZE=$(( $(free | grep Mem:| awk '{print $2}') / 4096 ))
913    DISKSIZE=$(( $(df -m /var/spool/squid | tail -n1 | awk '{print $2}') / 4 ))
914
915    echo "Setting host=$HOST and net=$LOCALNET, mem=$MEMSIZE, disk=$DISKSIZE"
916    backfile /etc/squid/squid.conf
917    cat $TEMPL_DIR/squid.conf \
918        | sed -e "s/<HOSTNAME>/$HOST/g" \
919        | sed -e "s/<DOMINIO>/$DOMAIN/g" \
920        | sed -e "s/dc=domain,dc=local/$BASE/g" \
921        | sed -e "s/<MEMSIZE>/$MEMSIZE/g" \
922        | sed -e "s/<DISKSIZE>/$DISKSIZE/g" \
923        | sed -e "s/<SERVER-IP>/$SERVERIP/g" \
924        | sed -e "s|<localnet>|$LOCALNET|g" \
925        > /etc/squid/squid.conf
926
927    echo "restarting squid with new configuration..."
928    squid -z
929    if which invoke-rc.d >/dev/null 2>&1; then
930        invoke-rc.d squid start
931    else
932        /etc/init.d/squid start
933    fi
934    # add internet group for access control
935    addgroup --system internet
936
937    ##
938    ## DansGuardian configuration
939    ##
940    echo "changing dansguardian configuration..."
941    if [ -f /var/run/dansguardian.pid ]; then
942        if ps ax | grep $(cat /var/run/dansguardian.pid) > /dev/null; then
943            if which invoke-rc.d >/dev/null 2>&1; then
944                invoke-rc.d dansguardian stop
945            else
946                /etc/init.d/dansguardian stop
947            fi
948        fi
949    fi
950    DANSCONF=/etc/dansguardian/
951    cd $DANSCONF
952    # backup and create configuration
953    backfile dansguardian.conf
954    cat $TEMPL_DIR/dansguardian.conf \
955        | sed -e "s/<SERVER-IP>/$SERVERIP/g" \
956        | sed -e "s/<FQDN>/$FQDN/g" \
957        > $DANSCONF/dansguardian.conf
958    # backup old configs
959    backfile dansguardianf1.conf
960    cp -f $TEMPL_DIR/dansguardianf1.conf $DANSCONF/
961    DANSLIST=/etc/dansguardian/lists
962    cd $DANSLIST
963    backfile bannedextensionlist
964    backfile bannedmimetypelist
965    backfile exceptionsitelist
966    # coping other templates
967    cd $TEMPL_DIR/
968    cp -f bannedextensionlist $DANSLIST/
969    cp -f bannedmimetypelist  $DANSLIST/
970    cp -f exceptionsitelist   $DANSLIST/
971
972    if which invoke-rc.d >/dev/null 2>&1; then
973        invoke-rc.d dansguardian start
974    else
975        /etc/init.d/dansguardian start
976    fi
977
978    #
979    # Forced reset of permissions, just to be sure
980    #
981    chmod 600 /etc/smbldap-tools/smbldap_bind.conf*
982
983    #
984    # Remove old fuss-server unused files
985    #
986    rm -f /etc/init.d/firewall.sh*
987    rm -f /etc/rcS.d/firewall.sh*
988    rm -f /etc/init.d/purgezone
989    rm -f /etc/rc0.d/purgezone
990
991    unset PASS
992    echo "FUSS Server configurations ended"
993
994    ;;
995
996    purge)
997        echo "Removing all previuos configuration from $ETC_DIR"
998        BACKDIR=/var/backups/fuss-server
999        if [ -d $CA_DIR ]; then
1000            tar -f $BACKDIR/Credential$TODAY -r $CA_DIR
1001            rm -fR $CA_DIR
1002        fi
1003        cp -f $TEMPL_DIR/fuss-server.conf $CONF_FILE
1004    ;;
1005
1006    *)
1007        echo "fuss-server called with unknown argument \`$1'" >&2
1008        echo "     fuss-server create -  install configuration"
1009        echo "     fuss-server purge  -  clean $ETC_DIR dir"
1010        exit 1
1011    ;;
1012esac
1013
1014exit 0
Note: See TracBrowser for help on using the browser.