adminconf/nas-server
Archived
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Remove TLS for FTP, and add encrypted disk config

Browse Source
This commit is contained in:
Alexandre CATTEAU 2021-11-15 17:58:52 +01:00
parent 6d13bd9aa8
commit 195a70e752
2 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
setup.sh
View File

@ -11,7 +11,7 @@
# Functions # Functions
init() { init() {
echo "Starting initialization" echo "Starting initialization"
echo $hostname > /etc/hostname echo $fqdn > /etc/hostname
sed -i -e "s/$default_hostname/$fqdn $hostname/g" /etc/hosts sed -i -e "s/$default_hostname/$fqdn $hostname/g" /etc/hosts
localectl set-keymap $keymap localectl set-keymap $keymap
timedatectl set-timezone $timezone timedatectl set-timezone $timezone
@ -23,12 +23,12 @@ install_packages() {
sed -i -e "s/$deb_apt_default_repo/$deb_apt_repo/g" /etc/apt/sources.list sed -i -e "s/$deb_apt_default_repo/$deb_apt_repo/g" /etc/apt/sources.list
apt update apt update
apt upgrade -y apt upgrade -y
apt install -y vim tree tmux neofetch vsftpd cryptsetup apt install -y vim tree tmux neofetch vsftpd cryptsetup clevis clevis-luks
} }
add_users() { add_users() {
echo "Adding users" echo "Adding users"
useradd -N -g users -G sudo -m -s /bin/bash $user useradd -N -g users -G sudo -m -s /bin/bash $user # still not sure why users group and not -U...
chmod 700 /home/$user chmod 700 /home/$user
} }
@ -36,7 +36,9 @@ get_conf() {
echo "Getting configuration" echo "Getting configuration"
sudo -H -u $user mkdir $sync_directory_path sudo -H -u $user mkdir $sync_directory_path
cp $run_directory_path/conf-sync.sh $sync_directory_path/ cp $run_directory_path/conf-sync.sh $sync_directory_path/
chown $user:users $sync_directory_path/conf-sync.sh chown $user:users $sync_directory_path/conf-sync.sh # group
cp $run_directory_path/nas.mount $sync_directory_path/
chown $user:users $sync_directory_path/nas.mount # group
sudo -H -u $user chmod u+x $sync_directory_path/conf-sync.sh sudo -H -u $user chmod u+x $sync_directory_path/conf-sync.sh
sudo -H -u $user $sync_directory_path/conf-sync.sh sudo -H -u $user $sync_directory_path/conf-sync.sh
} }
@ -70,10 +72,14 @@ ssh_pubkey() {
set_vsftpd() { set_vsftpd() {
echo "Setting vsftpd config" echo "Setting vsftpd config"
mkdir $nas_root
chown $user:users $nas_root
echo "nascrypt /dev/sda none noauto" >> /etc/crypttab
sed -i -e "s/#write_enable=YES/write_enable=YES/g" /etc/vsftpd.conf sed -i -e "s/#write_enable=YES/write_enable=YES/g" /etc/vsftpd.conf
sed -i -e "s/#utf8_filesystem=YES/utf8_filesystem=YES/g" /etc/vsftpd.conf sed -i -e "s/#utf8_filesystem=YES/utf8_filesystem=YES/g" /etc/vsftpd.conf
sed -i -e "s/ssl_enable=NO/ssl_enable=YES/g" /etc/vsftpd.conf # The two lines below set up TLS wrapping with a self-signed certificate, which causes issues with clients
openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/ssl-cert-snakeoil.key -out /etc/ssl/certs/ssl-cert-snakeoil.pem -subj "/C=/ST=/L=/O=/OU=/CN=" #sed -i -e "s/ssl_enable=NO/ssl_enable=YES/g" /etc/vsftpd.conf
#openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/ssl-cert-snakeoil.key -out /etc/ssl/certs/ssl-cert-snakeoil.pem -subj "/C=/ST=/L=/O=/OU=/CN="
} }
# Only run if the user is root # Only run if the user is root
@ -97,6 +103,7 @@ sync_directory_path="/home/$user/.sync"
systemd_units_path='/etc/systemd/system' systemd_units_path='/etc/systemd/system'
remote_pubkey_location='https://keys.kto.black' remote_pubkey_location='https://keys.kto.black'
remote_pubkey='home.pub' remote_pubkey='home.pub'
nas_root='/srv/nas'
# Main process # Main process
# You should comment below what you do not want to happen # You should comment below what you do not want to happen
@ -122,5 +129,6 @@ echo "* remove password for sudo" # TODO we should automate that, with a flag
echo "* use below commands to edit SSH config:" echo "* use below commands to edit SSH config:"
echo " sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config" echo " sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config"
echo " sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config" echo " sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config"
echo "* register an encrypted volume to a tang server"
exit 0 exit 0

10
srv-nas.mount Normal file
View File

@ -0,0 +1,10 @@
[Unit]
Description=Mount NAS Volume
# Below Requisite could be a Wants
Wants=systemd-cryptsetup@nascrypt.service
After=systemd-cryptsetup@nascrypt.service
[Mount]
What=/dev/mapper/nascrypt
Where=/srv/nas
Options=rw,relatime