adminconf/nas-server
Archived
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Remove TLS for FTP, and add encrypted disk config

Browse Source
This commit is contained in:
Alexandre CATTEAU 2021-11-15 17:58:52 +01:00
parent 6d13bd9aa8
commit 195a70e752
2 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
setup.sh
View File

@ -11,7 +11,7 @@
# Functions
init() {
echo "Starting initialization"
echo $hostname > /etc/hostname
echo $fqdn > /etc/hostname
sed -i -e "s/$default_hostname/$fqdn $hostname/g" /etc/hosts
localectl set-keymap $keymap
timedatectl set-timezone $timezone
@ -23,12 +23,12 @@ install_packages() {
sed -i -e "s/$deb_apt_default_repo/$deb_apt_repo/g" /etc/apt/sources.list
apt update
apt upgrade -y
apt install -y vim tree tmux neofetch vsftpd cryptsetup
apt install -y vim tree tmux neofetch vsftpd cryptsetup clevis clevis-luks
}
add_users() {
echo "Adding users"
useradd -N -g users -G sudo -m -s /bin/bash $user
useradd -N -g users -G sudo -m -s /bin/bash $user # still not sure why users group and not -U...
chmod 700 /home/$user
}
@ -36,7 +36,9 @@ get_conf() {
echo "Getting configuration"
sudo -H -u $user mkdir $sync_directory_path
cp $run_directory_path/conf-sync.sh $sync_directory_path/
chown $user:users $sync_directory_path/conf-sync.sh
chown $user:users $sync_directory_path/conf-sync.sh # group
cp $run_directory_path/nas.mount $sync_directory_path/
chown $user:users $sync_directory_path/nas.mount # group
sudo -H -u $user chmod u+x $sync_directory_path/conf-sync.sh
sudo -H -u $user $sync_directory_path/conf-sync.sh
}
@ -70,10 +72,14 @@ ssh_pubkey() {
set_vsftpd() {
echo "Setting vsftpd config"
mkdir $nas_root
chown $user:users $nas_root
echo "nascrypt /dev/sda none noauto" >> /etc/crypttab
sed -i -e "s/#write_enable=YES/write_enable=YES/g" /etc/vsftpd.conf
sed -i -e "s/#utf8_filesystem=YES/utf8_filesystem=YES/g" /etc/vsftpd.conf
sed -i -e "s/ssl_enable=NO/ssl_enable=YES/g" /etc/vsftpd.conf
openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/ssl-cert-snakeoil.key -out /etc/ssl/certs/ssl-cert-snakeoil.pem -subj "/C=/ST=/L=/O=/OU=/CN="
# The two lines below set up TLS wrapping with a self-signed certificate, which causes issues with clients
#sed -i -e "s/ssl_enable=NO/ssl_enable=YES/g" /etc/vsftpd.conf
#openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/ssl-cert-snakeoil.key -out /etc/ssl/certs/ssl-cert-snakeoil.pem -subj "/C=/ST=/L=/O=/OU=/CN="
}
# Only run if the user is root
@ -97,6 +103,7 @@ sync_directory_path="/home/$user/.sync"
systemd_units_path='/etc/systemd/system'
remote_pubkey_location='https://keys.kto.black'
remote_pubkey='home.pub'
nas_root='/srv/nas'
# Main process
# You should comment below what you do not want to happen
@ -122,5 +129,6 @@ echo "* remove password for sudo" # TODO we should automate that, with a flag
echo "* use below commands to edit SSH config:"
echo " sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config"
echo " sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config"
echo "* register an encrypted volume to a tang server"
exit 0

10
srv-nas.mount Normal file
View File

@ -0,0 +1,10 @@
[Unit]
Description=Mount NAS Volume
# Below Requisite could be a Wants
Wants=systemd-cryptsetup@nascrypt.service
After=systemd-cryptsetup@nascrypt.service
[Mount]
What=/dev/mapper/nascrypt
Where=/srv/nas
Options=rw,relatime