@@ -115,155 +115,6 @@ done
115115# only for image builds
116116[[ ! -f /.ncp-image ]] && {
117117
118- # log adjustment for wizard
119- test -f /home/www/ncp-launcher.sh && \
120- cat > /home/www/ncp-launcher.sh << 'EOF '
121- #!/bin/bash
122- DIR=/usr/local/etc/nextcloudpi-config.d
123- test -f $DIR/$1 || { echo "File not found"; exit 1; }
124- source /usr/local/etc/library.sh
125- cd $DIR
126- touch /run/ncp.log
127- chmod 640 /run/ncp.log
128- chown root:www-data /run/ncp.log
129- launch_script $1 &> /run/ncp.log
130- RET=$?
131-
132- # clean log for the next PHP backend call to start clean,
133- # but wait until everything from current execution is read
134- sleep 0.5 && echo "" > /run/ncp.log
135-
136- exit $RET
137- EOF
138-
139- # 2 days to avoid very big backups requests to timeout
140- test -f /etc/apache2/sites-available/ncp.conf && {
141- grep -q TimeOut /etc/apache2/sites-available/ncp.conf || \
142- sed -i ' /SSLCertificateKeyFile/aTimeOut 172800'
143- } || echo " Warning. File /etc/apache2/sites-available/ncp.conf not found on your ncp."
144-
145- # relocate noip2 config
146- mkdir -p /usr/local/etc/noip2
147-
148- # redis
149- REDIS_CONF=/etc/redis/redis.conf
150- sysctl vm.overcommit_memory=1 & > /dev/null
151- grep -q APCu /var/www/nextcloud/config/config.php && {
152- echo " installing redis..."
153- apt-get update
154- apt-get install -y --no-install-recommends redis-server php7.0-redis
155-
156- sed -i ' /memcache/d'
157- sed -i ' $d'
158-
159- cat >> /var/www/nextcloud/config/config.php << 'EOF '
160- 'memcache.local' => '\OC\Memcache\Redis',
161- 'memcache.locking' => '\OC\Memcache\Redis',
162- 'redis' =>
163- array (
164- 'host' => '/var/run/redis/redis.sock',
165- 'port' => 0,
166- 'timeout' => 0.0,
167- ),
168- );
169- EOF
170-
171- REDIS_MEM=3gb
172- sed -i " s|# unixsocket .*|unixsocket /var/run/redis/redis.sock|" $REDIS_CONF
173- sed -i " s|# unixsocketperm .*|unixsocketperm 770|" $REDIS_CONF
174- sed -i " s|port.*|port 0|" $REDIS_CONF
175- echo " maxmemory ${REDIS_MEM} " >> $REDIS_CONF
176- echo ' vm.overcommit_memory = 1' >> /etc/sysctl.conf
177-
178- sudo usermod -a -G redis www-data
179-
180- systemctl restart redis-server
181- systemctl enable redis-server
182-
183- # need to restart php
184- bash -c " sleep 3
185- systemctl stop php7.0-fpm
186- systemctl stop mysqld
187- sleep 0.5
188- systemctl start php7.0-fpm
189- systemctl start mysqld
190- " & > /dev/null &
191- }
192- sed -i ' s|^logfile.*|logfile /var/log/redis/redis-server.log|' $REDIS_CONF
193-
194- # fix redis update bug
195- grep -q sock700 $REDIS_CONF && {
196- sed -i ' /unixsocket/d' $REDIS_CONF
197- echo " unixsocket /var/run/redis/redis.sock" >> $REDIS_CONF
198- echo " unixsocketperm 770" >> $REDIS_CONF
199- systemctl restart redis-server
200- }
201- grep -q unixsocketperm $REDIS_CONF || echo unixsocketperm 770 >> $REDIS_CONF
202-
203- # fix unattended
204- NUSER=$( grep USER_ /usr/local/etc/nextcloudpi-config.d/nc-notify-updates.sh | head -1 | cut -f2 -d= )
205- cat > /usr/local/bin/ncp-notify-unattended-upgrade << EOF
206- #!/bin/bash
207-
208- LOGFILE=/var/log/unattended-upgrades/unattended-upgrades.log
209- STAMPFILE=/var/run/.ncp-notify-unattended-upgrades
210- VERFILE=/usr/local/etc/ncp-version
211-
212- test -e "\$ LOGFILE" || { echo "\$ LOGFILE not found"; exit 1; }
213-
214- # find lines with package updates
215- LINE=\$ ( grep "INFO Packages that will be upgraded:" "\$ LOGFILE" )
216-
217- [[ "\$ LINE" == "" ]] && { echo "no new upgrades"; exit 0; }
218-
219- # extract package names
220- PKGS=\$ ( sed 's|^.*Packages that will be upgraded: ||' <<< "\$ LINE" | tr '\\ n' ' ' )
221-
222- # mark lines as read
223- sed -i 's|INFO Packages that will be upgraded:|INFO Packages that will be upgraded :|' \$ LOGFILE
224-
225- echo -e "Packages automatically upgraded: \$ PKGS\\ n"
226-
227- # notify
228- sudo -u www-data php /var/www/nextcloud/occ notification:generate \
229- $NUSER "NextCloudPi Unattended Upgrades" \
230- -l "Packages automatically upgraded \$ PKGS"
231- EOF
232- chmod +x /usr/local/bin/ncp-notify-unattended-upgrade
233-
234- # fix modsecurity uploads
235- sed -i ' s|^SecRequestBodyLimit .*|#SecRequestBodyLimit 13107200|'
236-
237- # fix ramlogs
238- [[ $( grep " ^ACTIVE_" | cut -f2 -d' =' ) == " yes" && {
239- mkdir -p /usr/lib/systemd/system
240- cat > /usr/lib/systemd/system/ramlogs.service << 'EOF '
241- [Unit]
242- Description=Populate ramlogs dir
243- Requires=network.target
244- Before=redis-server apache2 mysqld
245-
246- [Service]
247- ExecStart=/bin/bash /usr/local/bin/ramlog-dirs.sh
248-
249- [Install]
250- WantedBy=multi-user.target
251- EOF
252-
253- cat > /usr/local/bin/ramlog-dirs.sh << 'EOF '
254- #!/bin/bash
255- mkdir -p /var/log/myslq
256- chown mysql /var/log/mysql
257-
258- mkdir -p /var/log/apache2
259- chown apache2 /var/log/apache2
260-
261- mkdir -p /var/log/redis
262- chown redis /var/log/redis
263- EOF
264- systemctl enable ramlogs
265- }
266-
267118 # fix automount in latest images
268119 test -f /etc/udev/rules.d/90-qemu.rules && {
269120 rm -f /etc/udev/rules.d/90-qemu.rules
276127 apt-get update
277128 apt-get install -y --no-install-recommends btrfs-tools
278129 }
130+
131+ # harden security
132+
133+ # # harden redis
134+ REDIS_CONF=/etc/redis/redis.conf
135+ REDISPASS=$( grep " ^requirepass" | cut -d' ' )
136+ [[ " $REDISPASS " == " " && REDISPASS=$( openssl rand -base64 32 )
137+ sed -i ' s|# rename-command CONFIG ""|rename-command CONFIG ""|' $REDIS_CONF
138+ sed -i " s|# requirepass .*|requirepass $REDISPASS |" $REDIS_CONF
139+
140+ grep -q " 'password'" || \
141+ sed -i " /timeout/a'password' => '$REDISPASS ',"
142+
143+ # # harden postfix
144+ sed -i ' s|^smtpd_banner .*|smtpd_banner = $myhostname ESMTP|'
145+ sed -i ' s|^disable_vrfy_command .*|disable_vrfy_command = yes|'
146+
147+ # # harden SSH
148+ sed -i ' s|^#AllowTcpForwarding .*|AllowTcpForwarding no|'
149+ sed -i ' s|^#ClientAliveCountMax .*|ClientAliveCountMax 2|'
150+ sed -i ' s|^#MaxAuthTries .*|MaxAuthTries 2|'
151+ sed -i ' s|^#MaxSessions .*|MaxSessions 2|'
152+ sed -i ' s|^#PermitRootLogin .*|PermitRootLogin no|'
153+ sed -i ' s|^#TCPKeepAlive .*|TCPKeepAlive no|'
154+ sed -i ' s|^#X11Forwarding .*|X11Forwarding no|'
155+ sed -i ' s|^#AllowAgentForwarding .*|AllowAgentForwarding no|'
156+
157+ # # harden kernel
158+ grep -q protected_hardlinks=1 /etc/sysctl.conf || cat >> /etc/sysctl.conf << EOF
159+ fs.protected_hardlinks=1
160+ fs.protected_symlinks=1
161+ kernel.core_uses_pid=1
162+ kernel.dmesg_restrict=1
163+ kernel.kptr_restrict=2
164+ kernel.sysrq=0
165+ net.ipv4.conf.all.accept_redirects=0
166+ net.ipv4.conf.all.log_martians=1
167+ net.ipv4.conf.all.rp_filter=1
168+ net.ipv4.conf.all.send_redirects=0
169+ net.ipv4.conf.default.accept_redirects=0
170+ net.ipv4.conf.default.accept_source_route=0
171+ net.ipv4.conf.default.log_martians=1
172+ net.ipv4.tcp_timestamps=0
173+ EOF
279174}
280175
281176exit 0
0 commit comments