mirror of
https://git.valherun.com/valherun/pxe_boot_alma.git
synced 2026-10-16 23:52:03 -04:00
refactor: move tree under homelab/, add alma10 hardening and kickstart docs
- restructure boot/kickstarts/scripts/docs into homelab/ - docs: alma9->10 breaking changes, CIS hardening, kickstart changes - add find_cron_entries.sh helper and codex running memory notes Co-Authored-By: Claude Fable 5 <[email protected]>
This commit is contained in:
andersenandClaude Fable 5 committed
1 parent
c44e450fb4
commit
6d398b826a
1703 files changed
+713908
-90
No files matched your search
@@ -0,0 +1,5 @@
|
||||
<pre>
|
||||
This box is the property of iGLASS NETWORKS.
|
||||
Access by non-iGLASS NETWORKS employees is strictly forbidden.
|
||||
|
||||
</pre>
|
||||
Whitespace-only changes.
@@ -0,0 +1 @@
|
||||
NetworkManager-config-server
|
||||
@@ -0,0 +1 @@
|
||||
NetworkManager-config-server
|
||||
@@ -0,0 +1,152 @@
|
||||
@Server
|
||||
@Development Tools
|
||||
@Security Tools
|
||||
@Container Management
|
||||
@Console Internet Tools
|
||||
@Headless Management
|
||||
@Legacy UNIX Compatibility
|
||||
@System Tools
|
||||
kexec-tools
|
||||
policycoreutils-restorecond
|
||||
ruby-libs
|
||||
libcmpiCppImpl0
|
||||
cim-schema
|
||||
libwsman1
|
||||
sblim-sfcb
|
||||
sblim-sfcc
|
||||
libnet
|
||||
nmap
|
||||
dos2unix
|
||||
openssl-devel
|
||||
perl-Scalar-List-Utils
|
||||
perl-ExtUtils-MakeMaker
|
||||
perl-ExtUtils-CBuilder
|
||||
perl-URI
|
||||
perl-IO-Socket-SSL
|
||||
perl-CGI
|
||||
perl-FCGI
|
||||
perl-Digest-MD5
|
||||
perl-threads-shared
|
||||
perl-threads
|
||||
perl-CPAN
|
||||
perl-YAML
|
||||
perl-Test-Simple
|
||||
perl-LWP-Protocol-https
|
||||
perl-Mozilla-CA
|
||||
perl-HTTP-Cookies
|
||||
perl-HTTP-Message
|
||||
perl-HTTP-Date
|
||||
perl-HTTP-Negotiate
|
||||
perl-Sys-Syslog
|
||||
perl-File-Listing
|
||||
perl-Compress-Raw-Bzip2
|
||||
perl-Compress-Raw-Zlib
|
||||
perl-IO-Compress
|
||||
perl-LWP-MediaTypes
|
||||
perl-Net-HTTP
|
||||
perl-WWW-RobotRules
|
||||
perl-libwww-perl
|
||||
perl-Module-CoreList
|
||||
perl-Locale-Maketext
|
||||
perl-Module-Metadata
|
||||
perl-Module-Build
|
||||
perl-Module-Load
|
||||
perl-Module-Load-Conditional
|
||||
perl-IPC-Cmd
|
||||
perl-Params-Check
|
||||
perl-CPAN-Meta-YAML
|
||||
perl-Text-Soundex
|
||||
perl-JSON
|
||||
perl-XML-Simple
|
||||
perl-XML-LibXML
|
||||
perl-XML-SAX
|
||||
perl-Digest-HMAC
|
||||
perl-MailTools
|
||||
perl-Socket
|
||||
perl-Socket6
|
||||
perl-GSSAPI
|
||||
perl-Authen-SASL
|
||||
perl-Storable
|
||||
perl-DBI
|
||||
unixODBC
|
||||
uuid
|
||||
unbound
|
||||
libuuid-devel
|
||||
samba
|
||||
samba-client
|
||||
samba-winbind
|
||||
samba-winbind-clients
|
||||
lshw
|
||||
traceroute
|
||||
gmp-devel
|
||||
net-snmp
|
||||
net-snmp-utils
|
||||
net-snmp-perl
|
||||
net-snmp-devel
|
||||
ipmitool
|
||||
aide
|
||||
libxml2
|
||||
-initial-setup
|
||||
-initial-setup-gui
|
||||
-gnome-initial-setup
|
||||
tmpwatch
|
||||
mariadb
|
||||
net-tools
|
||||
ipa-client
|
||||
krb5-workstation
|
||||
krb5-devel
|
||||
libreswan
|
||||
-fprintd
|
||||
-fprintd-pam
|
||||
-gdm-plugin-fingerprint
|
||||
libicu
|
||||
perl-App-cpanminus
|
||||
libXaw
|
||||
libxslt
|
||||
xdg-utils
|
||||
alsa-lib
|
||||
libaio
|
||||
tcpdump
|
||||
liberation-fonts
|
||||
liberation-mono-fonts
|
||||
liberation-sans-fonts
|
||||
liberation-fonts-common
|
||||
liberation-narrow-fonts
|
||||
liberation-serif-fonts
|
||||
tmux
|
||||
clang
|
||||
clang-devel
|
||||
clang-tools-extra
|
||||
cmake-filesystem
|
||||
libicu-devel
|
||||
llvm
|
||||
llvm-devel
|
||||
jq
|
||||
exchange-bmc-os-info
|
||||
-PackageKit-command-not-found
|
||||
-cockpit
|
||||
-abrt
|
||||
-abrt-addon-ccpp
|
||||
-abrt-addon-kerneloops
|
||||
-abrt-addon-pstoreoops
|
||||
-abrt-addon-python
|
||||
-abrt-addon-vmcore
|
||||
-abrt-addon-xorg
|
||||
-abrt-cli
|
||||
-abrt-console-notification
|
||||
-abrt-dbus
|
||||
-abrt-desktop
|
||||
-abrt-gui
|
||||
-abrt-gui-libs
|
||||
-abrt-libs
|
||||
-abrt-python
|
||||
-abrt-retrace-client
|
||||
-abrt-tui
|
||||
-mlocate
|
||||
yum-utils
|
||||
lz4
|
||||
ipcalc
|
||||
setools-console
|
||||
glibc-langpack-en
|
||||
s-nail
|
||||
postfix
|
||||
@@ -0,0 +1,16 @@
|
||||
# DISKTYPE = sd, hd, or hdc
|
||||
DISKTYPE=
|
||||
INTERACTIVE=n
|
||||
TZ=America/New_York
|
||||
# python -c "import crypt,getpass; print crypt.crypt(getpass.getpass(), \"\$6\$$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)\")"
|
||||
MD5PASS='$6$SUoLupc1M1hqE63G$QeJmvis441Nwruw88Q0/8a2Q1V0nQA.qE/We7VN3IfDWaSym3.VjUGLQ664UFlZJiHIWlU8KgGLNY31pbIfaK/'
|
||||
# grub2-mkpasswd-pbkdf2
|
||||
GRUB2=grub.pbkdf2.sha512.10000.E3FA14561B8830F9034B3D3F259658BA1D00EAFFBC505C2C9DC31C585765DB0834776E4E29BF7DE5C8CE209A90B1348E8BDEA9CB589E361EE26998546CDCFC2B.D5ED4872522909DF2A2D18E48CDC5DA47D5E6660276C44D62066072F1A3AA7165B28471FBE97E4B70083AF1A65341653D0E184D532E958FE06FD198863C8D1B0
|
||||
NOCPASS='$6$eZmWKt/UxYZVe.Jb$XwwjHjXvBhDxrEiWNQ6yCUw90och0V1SpRnasYKvPf/fOfHPQcJauSl1vo5p3gXTinSV..WJljtfIVucM.Ogi0'
|
||||
FIREWALL=n
|
||||
SELINUX=enforcing
|
||||
REBOOT=y
|
||||
PRE=y
|
||||
POST=y
|
||||
POSTNR=y
|
||||
FOO=BAR
|
||||
Binary file not shown.
@@ -0,0 +1,31 @@
|
||||
<pre>
|
||||
This box is the property of iGLASS NETWORKS.
|
||||
Access by non-iGLASS NETWORKS employees is strictly forbidden.
|
||||
|
||||
iGlass Network KickStart config files:
|
||||
|
||||
Naming syntax = SDDDT-discription
|
||||
|
||||
S, Stage:
|
||||
P Pre
|
||||
S Post with chroot
|
||||
N Post no chroot
|
||||
|
||||
DDD Order
|
||||
|
||||
T, Type
|
||||
A All
|
||||
P Probe +A
|
||||
D DS +A
|
||||
S Server +A
|
||||
G Plug -A
|
||||
V Virtual/Remote -A
|
||||
|
||||
For Virtual/Remote:
|
||||
|
||||
obelisk$ sudo ssh -R localhost:8080:localhost:80 noc@vmhost
|
||||
obelisk$ sudo ssh -R localhost:8081:localhost:22 noc@vmhost
|
||||
wget -q -O - http://localhost:8080/KickStart/cfg/ks.cgi?TYPE=VM
|
||||
|
||||
|
||||
</pre>
|
||||
@@ -0,0 +1,14 @@
|
||||
echo "Trying to start up sshd in post NO chroot" #LOG
|
||||
|
||||
mkdir -p /var/empty/sshd
|
||||
grep sshd /mnt/sysimage/etc/passwd >> /etc/passwd
|
||||
grep root /mnt/sysimage/etc/shadow >> /etc/shadow
|
||||
grep sshd /mnt/sysimage/etc/shadow >> /etc/shadow
|
||||
ln -s /mnt/sysimage/etc/ssh/ /etc/
|
||||
ln -s /usr/bin/bash /bin/bash
|
||||
ln -s /mnt/sysimage/var/log/ /var/log
|
||||
ln -s /mnt/sysimage/var/run/utmp /var/run/
|
||||
|
||||
/mnt/sysimage/usr/sbin/sshd -4 -p 222 -o "PermitRootLogin yes" -o "UsePAM no" -o "UseDNS no" 2>&1 #LOG
|
||||
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
|
||||
mkdir /mnt/sysimage/root/ks
|
||||
cp -af /tmp/ks* /mnt/sysimage/root/ks/
|
||||
@@ -0,0 +1,11 @@
|
||||
SLEEP='5d'
|
||||
|
||||
echo "Setting hostname..." #LOG
|
||||
if [ -e "/etc/sysconfig/network" ]; then
|
||||
. /etc/sysconfig/network
|
||||
hostname $HOSTNAME #LOG
|
||||
fi
|
||||
|
||||
echo "Waiting $SLEEP for whatever..." #LOG
|
||||
|
||||
bash -c "sleep $SLEEP"
|
||||
@@ -0,0 +1,7 @@
|
||||
|
||||
# wget -q -O - http://$KSRV/KickStart/cfg/ksid.py | python #LOG
|
||||
|
||||
# This is just for debuging very early stuff (disk partitioning)
|
||||
# Disable as its an open root login
|
||||
echo "Starting sshd" #LOG
|
||||
/sbin/sshd -f /etc/ssh/sshd_config.anaconda
|
||||
@@ -0,0 +1,11 @@
|
||||
echo "Use local display or VNC connect back."
|
||||
read -t 5 -p "--Continue with local display? [n] " VNC
|
||||
if [ "$VNC" = "" -o "${VNC:0:1}" = "n" -o "${VNC:0:1}" = "N" ]; then
|
||||
$LOGGER Starting VNC connect back
|
||||
echo "vnc --host $KSRV --port 5500 --password=kickMe" > /tmp/vnc.cfg
|
||||
else
|
||||
$LOGGER Using local dislpay
|
||||
echo "# VNC bypassed using local display " > /tmp/vnc.cfg
|
||||
fi
|
||||
|
||||
|
||||
@@ -0,0 +1,182 @@
|
||||
KSPART=/tmp/ks-diskpart.cfg
|
||||
|
||||
BOOT=1024 # MB
|
||||
EFI=600
|
||||
#OPTIG=250 # MB
|
||||
#OPTIG=61440 # MB = 57G
|
||||
# Different sizes below
|
||||
OPTIG=51200 # MB
|
||||
|
||||
SMALL=
|
||||
DEVA=
|
||||
DEVB=
|
||||
|
||||
for DSK in $(cd /sys/block; ls -d sd* 2>/dev/null; ls -d hd* 2>/dev/null; ls -d nvme* 2>/dev/null; ls -d vd* 2>/dev/null); do
|
||||
|
||||
RMBL=$(cat /sys/block/$DSK/removable)
|
||||
DSIZE=$(( $(blockdev --getsize64 /dev/$DSK) / 1000000 )) # MB
|
||||
MODEL=$(cat /sys/block/$DSK/device/model)
|
||||
|
||||
if [ $RMBL -eq 1 ]; then
|
||||
echo "Disk $DSK is removable, skipping." #LOG
|
||||
|
||||
elif [ -z "$DSIZE" ]; then
|
||||
echo "Error: Size for disk $DSK could not be found, skipping." #LOG
|
||||
|
||||
elif [ -z "$DEVA" ]; then
|
||||
|
||||
if [ $DSIZE -lt 70000 -a "$PTYPE" != "server" ]; then
|
||||
echo "Warning: Size for disk $DSK ($DSIZE) is to small but ok!" #LOG
|
||||
SMALL=1
|
||||
OPTIG=5120 # MB
|
||||
elif [ $DSIZE -gt 400000 -a "$PTYPE" != "server" ]; then
|
||||
echo "Big disk 2: Size for disk $DSK ($DSIZE)" #LOG
|
||||
OPTIG=256000 # MB
|
||||
elif [ $DSIZE -gt 200000 -a "$PTYPE" != "server" ]; then
|
||||
echo "Big disk 1: Size for disk $DSK ($DSIZE)" #LOG
|
||||
OPTIG=102400 # MB
|
||||
fi
|
||||
|
||||
DEVA=$DSK
|
||||
|
||||
elif [ -z "$DEVB" ]; then
|
||||
|
||||
DEVB=$DSK
|
||||
|
||||
else
|
||||
|
||||
echo "Skipping disk $DSK ($MODEL) of size $DSIZE because already have $DEVA and $DEVB" #LOG
|
||||
|
||||
fi
|
||||
|
||||
#This doesn't appear to be installed yet. Added later
|
||||
#tune4fs -c 0 -i 0 /dev/sda4 #LOG
|
||||
|
||||
done
|
||||
|
||||
if [ -z "$DEVA" ]; then
|
||||
echo "Error: No Disks Found!!!" #LOG
|
||||
else
|
||||
|
||||
echo "Partitioning first disk $DEVA ($MODEL) of size $DSIZE swap at $SWAP" #LOG
|
||||
|
||||
# NVMe devices use 'p' before the partition number (e.g. nvme0n1p1 not nvme0n11)
|
||||
DEVAP=""; [[ "$DEVA" == nvme* ]] && DEVAP="p"
|
||||
DEVBP=""; [[ "$DEVB" == nvme* ]] && DEVBP="p"
|
||||
|
||||
dd if=/dev/zero of=/dev/$DEVA bs=512 count=1
|
||||
|
||||
SWAP=$(( ($(cat /proc/meminfo | awk '{ if ($1 ~ /^MemTotal/) print $2}') / 1024) + 100 )) # MB
|
||||
|
||||
PRT=1;
|
||||
START=1;
|
||||
if [ -d "/sys/firmware/efi" ]; then
|
||||
parted -s /dev/$DEVA mklabel gpt
|
||||
STOP=$EFI
|
||||
echo "Writing /boot/efi on ${DEVA}${DEVAP}$PRT" #LOG
|
||||
parted -a optimal -s /dev/$DEVA mkpart '"EFI system partition"' $START $STOP #LOG
|
||||
parted /dev/$DEVA set 1 esp on #LOG
|
||||
parted /dev/$DEVA set 1 boot on #LOG
|
||||
#sfdisk --part-type /dev/$DEVA $PRT 1 #LOG
|
||||
echo "part /boot/efi --fstype=efi --onpart=${DEVA}${DEVAP}$PRT" >> $KSPART
|
||||
|
||||
PRT=$(( $PRT + 1 ))
|
||||
START=$STOP; STOP=$(( $START + $BOOT ))
|
||||
|
||||
parted -a optimal -s /dev/$DEVA mkpart boot $START $STOP #LOG
|
||||
echo "Writing $KSPART for KS pre-install formating default xfs" #LOG
|
||||
echo "part /boot --fstype=xfs --onpart=${DEVA}${DEVAP}$PRT" >> $KSPART
|
||||
|
||||
if [ "$PTYPE" != "server" ]; then
|
||||
START=$STOP; STOP=$(( $START + $OPTIG ))
|
||||
parted -a optimal -s /dev/$DEVA mkpart iglass $START $STOP #LOG
|
||||
PRT=$(( $PRT + 1 ))
|
||||
#sfdisk --part-type /dev/$DEVA $PRT da #LOG
|
||||
echo "# /opt/iglass will be ${DEVA}${DEVAP}$PRT" >> $KSPART
|
||||
fi
|
||||
|
||||
#if [ -n "$SMALL" -a -n "$DEVB" ]; then
|
||||
# echo "Swap on second disk as first is small" #LOG
|
||||
|
||||
#else
|
||||
START=$STOP; STOP=$(( $START + $SWAP ))
|
||||
parted -a optimal -s /dev/$DEVA mkpart swap linux-swap $START $STOP #LOG
|
||||
PRT=$(( $PRT + 1 ))
|
||||
#sfdisk --part-type /dev/$DEVA $PRT 82 #LOG
|
||||
echo "part swap --onpart=${DEVA}${DEVAP}$PRT" >> $KSPART
|
||||
#fi
|
||||
|
||||
START=$STOP; STOP=$DSIZE
|
||||
parted -a optimal -s /dev/$DEVA mkpart root $START 100% #LOG
|
||||
PRT=$(( $PRT + 1 ))
|
||||
echo "part / --onpart=${DEVA}${DEVAP}$PRT" >> $KSPART
|
||||
|
||||
parted -s /dev/$DEVA unit mb print free #LOG
|
||||
|
||||
else
|
||||
parted -s /dev/$DEVA mklabel msdos
|
||||
STOP=$BOOT
|
||||
|
||||
parted -a optimal -s /dev/$DEVA mkpart primary $START $STOP #LOG
|
||||
PRT=1;
|
||||
echo "Writing $KSPART for KS pre-install formating default xfs" #LOG
|
||||
echo "part /boot --onpart=${DEVA}${DEVAP}$PRT" >> $KSPART
|
||||
|
||||
if [ "$PTYPE" != "server" ]; then
|
||||
START=$STOP; STOP=$(( $START + $OPTIG ))
|
||||
parted -a optimal -s /dev/$DEVA mkpart primary $START $STOP #LOG
|
||||
PRT=$(( $PRT + 1 ))
|
||||
sfdisk --change-id /dev/$DEVA $PRT da #LOG
|
||||
echo "# /opt/iglass will be ${DEVA}${DEVAP}$PRT" >> $KSPART
|
||||
fi
|
||||
|
||||
if [ -n "$SMALL" -a -n "$DEVB" ]; then
|
||||
echo "Swap on second disk as first is small" #LOG
|
||||
|
||||
else
|
||||
START=$STOP; STOP=$(( $START + $SWAP ))
|
||||
parted -a optimal -s /dev/$DEVA mkpart primary linux-swap $START $STOP #LOG
|
||||
PRT=$(( $PRT + 1 ))
|
||||
echo "part swap --onpart=${DEVA}${DEVAP}$PRT" >> $KSPART
|
||||
fi
|
||||
|
||||
START=$STOP; STOP=$DSIZE
|
||||
parted -a optimal -s /dev/$DEVA -- mkpart primary $START -1 #LOG
|
||||
PRT=$(( $PRT + 1 ))
|
||||
echo "part / --onpart=${DEVA}${DEVAP}$PRT" >> $KSPART
|
||||
|
||||
parted -s /dev/$DEVA unit mb print free #LOG
|
||||
|
||||
fi
|
||||
|
||||
if [ -n "$DEVB" ]; then
|
||||
|
||||
echo "Partitioning additional disk $DEVB ($MODEL) of size $DSIZE" #LOG
|
||||
|
||||
if [ -b /dev/$DEVB ]; then
|
||||
dd if=/dev/zero of=/dev/$DEVB bs=512 count=1
|
||||
parted -s /dev/$DEVB mklabel gpt
|
||||
|
||||
START=1;
|
||||
PRT=1;
|
||||
if [ -n "$SMALL" ]; then
|
||||
echo "Partitioning swap on /dev/$DEVB:" #LOG
|
||||
STOP=$(( $START + $SWAP ))
|
||||
parted -a optimal -s /dev/$DEVB mkpart swap linux-swap $START $STOP #LOG
|
||||
START=$STOP
|
||||
echo "part swap --onpart=${DEVB}${DEVBP}$PRT" >> $KSPART
|
||||
PRT=$(( $PRT + 1 ))
|
||||
fi
|
||||
echo "Partitioning /export on /dev/$DEVB:" #LOG
|
||||
parted -a optimal -s /dev/$DEVB mkpart export $START 100% #LOG
|
||||
echo "part /export --onpart=${DEVB}${DEVBP}$PRT" >> $KSPART
|
||||
fi
|
||||
|
||||
echo "## START $KSPART ##" #LOG
|
||||
cat $KSPART #LOG
|
||||
echo "## END $KSPART ##" #LOG
|
||||
|
||||
|
||||
|
||||
fi
|
||||
fi
|
||||
@@ -0,0 +1,30 @@
|
||||
# Fire up syslog and send everything to obelisk first so logging will work.
|
||||
|
||||
if [ -x /usr/sbin/dmidecode ]; then
|
||||
ST=`dmidecode -s system-serial-number`
|
||||
else
|
||||
ST=$(ip -o link show | grep -v '\blo\b' | perl -ne 'if (/link\/ether\s+(\S+)/) { print "$1\n"; last }')
|
||||
fi
|
||||
|
||||
cp -a /etc/resolv.conf /etc/resolv.conf.orig
|
||||
|
||||
SYSCONF=/dev/shm/rsyslog.conf
|
||||
cp /etc/rsyslog.conf $SYSCONF
|
||||
echo -e "*.* \t\t\t @$KSRV" >> $SYSCONF
|
||||
|
||||
ps -efw |grep syslog #LOG
|
||||
pkill rsyslogd #LOG
|
||||
/sbin/rsyslogd -f $SYSCONF -i /dev/shm/kslog.pid #LOG
|
||||
echo "Just attempted rsyslog restart in post chroot" #LOG
|
||||
|
||||
# Start up sshd
|
||||
echo "Trying to start up sshd in post chroot" #LOG
|
||||
|
||||
/usr/bin/ssh-keygen -A #LOG
|
||||
|
||||
if [ ! -e /dev/pts ]; then
|
||||
/bin/mount /dev/pts #LOG
|
||||
fi
|
||||
/usr/sbin/sshd -4 -o "PermitRootLogin yes" -o "UseDNS no" #LOG
|
||||
|
||||
#echo 'proxy=http://10.1.1.1:3128' >> /etc/dnf/dnf.conf
|
||||
@@ -0,0 +1,13 @@
|
||||
# Install librdkafka for Kafka integration (Net::Kafka Perl module)
|
||||
#
|
||||
# RHEL 10 ships librdkafka in standard repos — no Confluent repo needed:
|
||||
# librdkafka — AppStream (runtime, 2.1.1)
|
||||
# librdkafka-devel — CRB (headers for Net::Kafka build, 2.1.1)
|
||||
#
|
||||
# Confluent platform repo (rpm/8.2) is still deployed via etc.tgz for
|
||||
# potential future use but is NOT required for librdkafka on RHEL 10.
|
||||
|
||||
# Enable CRB (required for librdkafka-devel)
|
||||
dnf config-manager --set-enabled crb #LOG
|
||||
|
||||
dnf install -y librdkafka librdkafka-devel #LOG
|
||||
@@ -0,0 +1 @@
|
||||
S104P-confluent
|
||||
@@ -0,0 +1,150 @@
|
||||
|
||||
echo "Enabling EPEL repo" #LOG
|
||||
dnf -y config-manager --set-enabled crb #LOG
|
||||
dnf -y install epel-release #LOG
|
||||
crb enable #LOG
|
||||
|
||||
# Perl are in InstallPerlmods
|
||||
EPELPKGS='freetds freetds-devel freetds-libs perl-NetAddr-IP perl-Net-DNS perl-Regexp-Common perl-WWW-Mechanize perl-Protocol-WebSocket perl-Crypt-Rijndael perl-Net-SSH-Perl'
|
||||
|
||||
dnf -y install $EPELPKGS #LOG
|
||||
|
||||
if dnf -q group list --available hidden ids | grep -Fqx 'xfce'; then
|
||||
dnf -y install '@xfce' #LOG
|
||||
else
|
||||
echo "Skipping optional Xfce group; not available on $DIST" #LOG
|
||||
fi
|
||||
|
||||
|
||||
echo "Installing Perl Modules" #LOG
|
||||
|
||||
#export ALL_PROXY=http://10.1.1.1:3128
|
||||
|
||||
PERLPKGS='perl-PerlIO-gzip perl-Net-SNMP perl-URI-Encode perl-Net-Netmask perl-Proc-ProcessTable perl-Path-Class perl-IO-Socket-INET6 perl-Expect perl-LDAP perl-Text-CSV perl-Crypt-CBC perl-IO-FDPass perl-DBD-MariaDB perl-IPC-Run'
|
||||
|
||||
dnf -y install $PERLPKGS #LOG
|
||||
|
||||
export PERL_MM_USE_DEFAULT=1
|
||||
|
||||
# WWW::[email protected] ? mcpani ?
|
||||
## 2026-03-06 - Chris A - Removed Net::SNMP \
|
||||
|
||||
|
||||
cpanm -n \
|
||||
Net::Syslog \
|
||||
Date::Handler \
|
||||
Thread::Queue::Any \
|
||||
Parse::RPN \
|
||||
HTML::Query \
|
||||
HTML::Restrict \
|
||||
Net::SMTP_auth \
|
||||
Mail::POP3Client \
|
||||
Mail::IMAPClient \
|
||||
Cache::FastMmap \
|
||||
UUID \
|
||||
Net::INET6Glue \
|
||||
Net::Address::IP::Local \
|
||||
Net::Ping::External \
|
||||
Net::SIP \
|
||||
Net::SSH \
|
||||
Net::Telnet \
|
||||
Net::Azure::StorageClient \
|
||||
MongoDB \
|
||||
Asterisk::AMI \
|
||||
XML::LibXML::PrettyPrint \
|
||||
Forks::Queue #LOG
|
||||
|
||||
# Net::Kafka requires librdkafka-devel (installed by S104P from CRB).
|
||||
cpanm -n Net::Kafka #LOG
|
||||
|
||||
echo "Installing Chrome" #LOG
|
||||
rpm --import https://dl.google.com/linux/linux_signing_key.pub #LOG
|
||||
dnf -y install https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm #LOG
|
||||
|
||||
echo "Installing MS SQL tools and PowerShell" #LOG
|
||||
export ACCEPT_EULA=Y
|
||||
curl -fsSL -o /etc/yum.repos.d/microsoft.repo https://packages.microsoft.com/config/rhel/10/prod.repo #LOG
|
||||
# Note: package renamed mssql-tools → mssql-tools18 in RHEL 10 Microsoft repo
|
||||
dnf -y install --assumeyes mssql-tools18 msodbcsql18 #LOG
|
||||
|
||||
# PowerShell is not in the RHEL 10 MS repo — install from GitHub release.
|
||||
# TODO: Verify RHEL 10 compatible RPM when available.
|
||||
# Ref: https://github.com/PowerShell/PowerShell/releases
|
||||
dnf -y install --assumeyes https://github.com/PowerShell/PowerShell/releases/download/v7.3.4/powershell-7.3.4-1.rh.x86_64.rpm #LOG
|
||||
|
||||
# DNF AppStream modules removed in RHEL 10 — nodejs is a regular package.
|
||||
# RHEL 10 AppStream ships nodejs 22 by default.
|
||||
echo "Installing nodejs" #LOG
|
||||
dnf -y install nodejs #LOG
|
||||
|
||||
echo "Updating all rpms" #LOG
|
||||
dnf -y update #LOG
|
||||
|
||||
TMP=$(tmpdir)
|
||||
|
||||
if [ $? -eq 0 -a -d $TMP ]; then
|
||||
cd $TMP
|
||||
|
||||
echo "Getting Amozon awscli bundle" #LOG
|
||||
AWSCLI=awscli-exe-linux-x86_64.zip
|
||||
wget -nv http://$KSRV/KickStart/cfg/$DIST/share/pkgs/$AWSCLI #LOG
|
||||
if [ -s $AWSCLI ]; then
|
||||
unzip -q $AWSCLI #LOG
|
||||
./aws/install #LOG
|
||||
/usr/local/bin/aws --version #LOG
|
||||
else
|
||||
echo "Not able to get Amozon awscli bundle" #LOG
|
||||
fi
|
||||
|
||||
#NODEV="v18.15.0"
|
||||
#echo "Getting node $NODEV bundle" #LOG
|
||||
#wget -nv http://$KSRV/KickStart/cfg/$DIST/share/pkgs/node-${NODEV}-linux-x64.tar.xz #LOG
|
||||
|
||||
#(echo -n "I start in "; pwd) #LOG
|
||||
#ls -l node-${NODEV}-linux-x64.tar.xz #LOG
|
||||
|
||||
#if [ -s node-${NODEV}-linux-x64.tar.xz ]; then
|
||||
# cd "/usr/local" #LOG
|
||||
# (echo -n "Now I am in "; pwd) #LOG
|
||||
# tar xJf $TMP/node-${NODEV}-linux-x64.tar.xz #LOG
|
||||
# ln -s node-${NODEV}-linux-x64 node #LOG
|
||||
# cd $TMP
|
||||
#else
|
||||
# echo "Not able to get node $NODEV bundle" #LOG
|
||||
#fi
|
||||
|
||||
VMWARE="VMware-vSphere-Perl-SDK-7.0.0-17698549.x86_64.tar.gz"
|
||||
echo "Getting $VMWARE bundle" #LOG
|
||||
wget -nv http://$KSRV/KickStart/cfg/$DIST/share/pkgs/${VMWARE} #LOG
|
||||
|
||||
if [ -s $VMWARE ]; then
|
||||
tar xf $VMWARE #LOG
|
||||
# Makefile.PL lives inside the extracted distrib dir, not at $TMP root
|
||||
cd vmware-vsphere-cli-distrib
|
||||
perl Makefile.PL #LOG
|
||||
make -s #LOG
|
||||
make -s install #LOG
|
||||
cd "$TMP"
|
||||
else
|
||||
echo "Not able to get $VMWARE bundle" #LOG
|
||||
fi
|
||||
|
||||
|
||||
cd /
|
||||
# rm -rf $TMP
|
||||
|
||||
else
|
||||
echo "Could not create src dir $TMP" #LOG
|
||||
fi
|
||||
|
||||
echo "Updating Net::SNMP USM.pm for more recent auth and priv protocols" #LOG
|
||||
cp -a /usr/share/perl5/vendor_perl/Net/SNMP/Security/USM.pm /usr/share/perl5/vendor_perl/Net/SNMP/Security/USM.pm.orig
|
||||
#cp -a /usr/local/share/perl5/5.32/Net/SNMP/Security/USM.pm /usr/local/share/perl5/5.32/Net/SNMP/Security/USM.pm.orig
|
||||
wget -q -O - http://$KSRV/KickStart/cfg/$DIST/share/pkgs/USM.pm > /usr/share/perl5/vendor_perl/Net/SNMP/Security/USM.pm #LOG
|
||||
#cp /usr/share/perl5/vendor_perl/Net/SNMP/Security/USM.pm /usr/local/share/perl5/5.32/Net/SNMP/Security/USM.pm #LOG
|
||||
|
||||
|
||||
if [ ! -e /etc/ld.so.conf.d/usr-local.conf ]; then
|
||||
echo "/usr/local/lib" > /etc/ld.so.conf.d/usr-local.conf
|
||||
ldconfig #LOG
|
||||
fi
|
||||
@@ -0,0 +1 @@
|
||||
S105A-extra-pkgs
|
||||
@@ -0,0 +1,29 @@
|
||||
# Minimal stage-0 customization for staged bring-up.
|
||||
|
||||
echo "Creating baseline noc account and SSH access" #LOG
|
||||
|
||||
getent group noc >/dev/null 2>&1 || groupadd -g 1108 noc #LOG
|
||||
id noc >/dev/null 2>&1 || \
|
||||
useradd -c "NOC Account" -d /home/noc -u 1108 -g 1108 -s /bin/bash -p "$NOCPASS" noc #LOG
|
||||
|
||||
for _user in root noc; do
|
||||
_home=/root
|
||||
[ "$_user" = "noc" ] && _home=/home/noc
|
||||
|
||||
install -d -m 700 -o "$_user" -g "$_user" "$_home/.ssh" #LOG
|
||||
wget -q -O "$_home/.ssh/authorized_keys" \
|
||||
"http://$KSRV/KickStart/cfg/$DIST/share/ssh/authorized_keys" #LOG
|
||||
chown "$_user":"$_user" "$_home/.ssh/authorized_keys" #LOG
|
||||
chmod 600 "$_home/.ssh/authorized_keys" #LOG
|
||||
done
|
||||
|
||||
cat > /etc/ssh/sshd_config.d/10-stage-baseline.conf <<'EOF' #LOG
|
||||
PubkeyAuthentication yes
|
||||
PasswordAuthentication yes
|
||||
PermitRootLogin no
|
||||
Match Address 10.1.1.1,10.1.1.254
|
||||
PermitRootLogin yes
|
||||
EOF
|
||||
|
||||
restorecon -RF /root/.ssh /home/noc/.ssh /etc/ssh/sshd_config.d 2>/dev/null || true #LOG
|
||||
systemctl enable sshd.service #LOG
|
||||
@@ -0,0 +1,65 @@
|
||||
# description: Change /etc/issue & skel
|
||||
|
||||
|
||||
if [ "$PTYPE" == "server" ]; then
|
||||
|
||||
echo "Creating Server configs and setup scripts" #LOG
|
||||
|
||||
echo "### Copying server /etc files" #LOG
|
||||
cd / && wget -q -O - http://$KSRV/KickStart/cfg/$DIST/share/etc-srv.tgz | tar xvzf - --no-same-owner --no-same-permissions #LOG
|
||||
|
||||
cd / && wget -q -O - http://$KSRV/KickStart/cfg/$DIST/share/etc.tgz | tar xvzf - --no-same-owner --no-same-permissions ./etc/firewalld/ #LOG
|
||||
restorecon -RF /etc/firewalld 2>/dev/null || true #LOG
|
||||
|
||||
echo "### Installing root SSH test access key" #LOG
|
||||
install -d -m 700 /root/.ssh #LOG
|
||||
wget -q -O /root/.ssh/authorized_keys http://$KSRV/KickStart/cfg/$DIST/share/ssh/authorized_keys #LOG
|
||||
chmod 600 /root/.ssh/authorized_keys #LOG
|
||||
restorecon -RF /root/.ssh #LOG
|
||||
|
||||
echo "Setting sebool use_nfs_home_dirs=1" #LOG
|
||||
setsebool -P use_nfs_home_dirs=1 #LOG
|
||||
|
||||
mkdir /customers
|
||||
|
||||
else
|
||||
|
||||
echo "### Modifing /etc/issue" #LOG
|
||||
|
||||
echo > /etc/issue
|
||||
echo "This box is the property of iGLASS NETWORKS." >> /etc/issue
|
||||
echo "Access by non-iGLASS NETWORKS employees is strictly forbidden." >> /etc/issue
|
||||
echo >> /etc/issue
|
||||
|
||||
ln -f /etc/issue /etc/issue.net
|
||||
|
||||
ln -f /bin/bash /bin/rbash
|
||||
rm -f /etc/profile.d/colorls.*
|
||||
|
||||
|
||||
echo "### Copying /etc files" #LOG
|
||||
|
||||
cd / && wget -q -O - http://$KSRV/KickStart/cfg/$DIST/share/etc.tgz | tar xvzf - --no-same-owner --no-same-permissions #LOG
|
||||
restorecon -RF /etc 2>/dev/null || true #LOG
|
||||
|
||||
cp -vf /etc/skel/.bashrc /root/.bashrc
|
||||
|
||||
echo "### Installing root SSH test access key" #LOG
|
||||
install -d -m 700 /root/.ssh #LOG
|
||||
wget -q -O /root/.ssh/authorized_keys http://$KSRV/KickStart/cfg/$DIST/share/ssh/authorized_keys #LOG
|
||||
chmod 600 /root/.ssh/authorized_keys #LOG
|
||||
restorecon -RF /root/.ssh #LOG
|
||||
|
||||
fi
|
||||
|
||||
|
||||
#echo -e 'DESKTOP="GNOME"\nDISPLAYMANAGER="GNOME"' >> /etc/sysconfig/desktop
|
||||
#echo "autospawn = no" >> /etc/pulse/client.conf
|
||||
|
||||
#mkdir -p /root/.config/systemd/user/
|
||||
#ln -s /dev/null /root/.config/systemd/user/pulseaudio.socket
|
||||
#ln -s /dev/null /root/.config/systemd/user/pulseaudio.service
|
||||
|
||||
systemctl --user mask pulseaudio 2>/dev/null || true #LOG
|
||||
systemctl --user disable pulseaudio.socket 2>/dev/null || true #LOG
|
||||
systemctl --user disable pulseaudio.service 2>/dev/null || true #LOG
|
||||
@@ -0,0 +1 @@
|
||||
S150A-etc-mod
|
||||
@@ -0,0 +1,84 @@
|
||||
# description: Turn off unwanted services
|
||||
|
||||
echo "### Locking down services" #LOG
|
||||
|
||||
has_unit_file() {
|
||||
systemctl list-unit-files --full --all --no-legend 2>/dev/null | awk '{print $1}' | grep -Fxq "$1"
|
||||
}
|
||||
|
||||
disable_if_present() {
|
||||
if has_unit_file "$1"; then
|
||||
systemctl disable "$1" #LOG
|
||||
else
|
||||
echo "Skipping absent unit $1" #LOG
|
||||
fi
|
||||
}
|
||||
|
||||
stop_disable_if_present() {
|
||||
if has_unit_file "$1"; then
|
||||
systemctl --no-reload stop "$1" #LOG
|
||||
systemctl --no-reload disable "$1" #LOG
|
||||
else
|
||||
echo "Skipping absent unit $1" #LOG
|
||||
fi
|
||||
}
|
||||
|
||||
mask_if_present() {
|
||||
if has_unit_file "$1"; then
|
||||
systemctl mask "$1" #LOG
|
||||
else
|
||||
echo "Skipping absent unit $1" #LOG
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
systemctl enable postfix
|
||||
|
||||
for _svc in initial-setup-graphical.service initial-setup-reconfiguration.service \
|
||||
initial-setup-text.service initial-setup.service; do
|
||||
systemctl disable "$_svc" 2>/dev/null && echo "Disabled $_svc" #LOG || true
|
||||
done
|
||||
# GDM may not be installed on DVD minimal-environment; guard before editing
|
||||
if [ -f /etc/gdm/custom.conf ]; then
|
||||
perl -spi -e 's/\[daemon\]/\[daemon\]\nInitialSetupEnable=False/' /etc/gdm/custom.conf #LOG
|
||||
fi
|
||||
|
||||
# Don't start X
|
||||
systemctl set-default multi-user.target #LOG
|
||||
|
||||
|
||||
disable_if_present avahi-daemon.socket
|
||||
disable_if_present avahi-daemon.service
|
||||
|
||||
|
||||
if [ "$PTYPE" != "server" ]; then
|
||||
disable_if_present crond.service
|
||||
fi
|
||||
|
||||
disable_if_present cups.service
|
||||
|
||||
#ln -s /dev/null /etc/systemd/system/nfs.target
|
||||
disable_if_present nfs.target
|
||||
stop_disable_if_present rpcbind.socket
|
||||
disable_if_present rpcbind.service
|
||||
mask_if_present rpcbind.service
|
||||
|
||||
disable_if_present libvirtd.service
|
||||
|
||||
disable_if_present ksmtuned.service
|
||||
disable_if_present ksm.service
|
||||
#echo 2 >/sys/kernel/mm/ksm/run
|
||||
|
||||
disable_if_present bluetooth.service
|
||||
|
||||
systemctl enable snmpd.service #LOG
|
||||
systemctl enable snmptrapd.service #LOG
|
||||
echo 'OPTIONS="-LS w6"' >> /etc/sysconfig/snmpd
|
||||
echo 'OPTIONS="-OQ -t -LS w3"' >> /etc/sysconfig/snmptrapd
|
||||
|
||||
disable_if_present dnf-makecache.timer
|
||||
|
||||
#echo "Setting python3 as default" #LOG
|
||||
#alternatives --set python /usr/bin/python3 #LOG
|
||||
|
||||
echo "install libiscsi /bin/true" >> /etc/modprobe.d/disable-libiscsi.conf
|
||||
@@ -0,0 +1 @@
|
||||
S200A-systemctl
|
||||
@@ -0,0 +1,26 @@
|
||||
# description: Sync box time
|
||||
|
||||
if [ -f "/usr/share/zoneinfo/$TZ" ]; then
|
||||
echo "Setting Time Zone = $TZ" #LOG
|
||||
else
|
||||
export TZ="America/New_York" #LOG
|
||||
echo "No Time Zone set. Using $TZ" #LOG
|
||||
fi
|
||||
|
||||
rm -f /etc/localtime #LOG
|
||||
ln -s "/usr/share/zoneinfo/$TZ" /etc/localtime #LOG
|
||||
if command -v timedatectl >/dev/null 2>&1; then
|
||||
timedatectl set-timezone "$TZ" || echo "timedatectl timezone update unavailable during stage apply" #LOG
|
||||
fi
|
||||
|
||||
perl -spi -e 's/^(pool.*)$/# $1\nserver ntp.iglass.net iburst/' /etc/chrony.conf
|
||||
|
||||
systemctl enable chronyd.service #LOG
|
||||
systemctl start chronyd.service || echo "chronyd start unavailable during stage apply" #LOG
|
||||
chronyc -a makestep || echo "chronyc makestep unavailable during stage apply" #LOG
|
||||
|
||||
/sbin/hwclock --systohc --utc || echo "hwclock sync unavailable during stage apply" #LOG
|
||||
|
||||
if command -v timedatectl >/dev/null 2>&1; then
|
||||
timedatectl set-local-rtc 0 || echo "timedatectl local-rtc update unavailable during stage apply" #LOG
|
||||
fi
|
||||
@@ -0,0 +1 @@
|
||||
S350A-chrony
|
||||
@@ -0,0 +1,330 @@
|
||||
# description: Setup noc account & iglass dir
|
||||
|
||||
###
|
||||
# Setup noc Account
|
||||
###
|
||||
|
||||
CPP1=/dev/shm/pkey.txt
|
||||
|
||||
#IDENTITY="$IG_HOME/conf/tunnel/probe-id"
|
||||
NOCHOME=/home/noc
|
||||
echo "NOCHOME=$NOCHOME" #LOG
|
||||
|
||||
if [ "$PTYPE" = "VM" ]; then
|
||||
CRYPTEDDEV=
|
||||
|
||||
elif [ -b /dev/mapper/vga-iGlassOpt ]; then
|
||||
CRYPTEDDEV="/dev/mapper/vga-iGlassOpt"
|
||||
|
||||
elif [ -b "/dev/$DISK" ] && [ "$(sfdisk --part-type /dev/$DISK 2 2>/dev/null)" = "da" ]; then
|
||||
CRYPTEDDEV="/dev/${DISK}2"
|
||||
|
||||
elif [ -b "/dev/$DISK" ] && parted -s /dev/$DISK print list 2>/dev/null | grep -qE "^\s+3\s.+iglass"; then
|
||||
CRYPTEDDEV="/dev/${DISK}3"
|
||||
|
||||
else
|
||||
|
||||
CRYPTEDDEV=
|
||||
fi
|
||||
|
||||
DECRYPTEDMAP="crypt-iGlassOpt"
|
||||
|
||||
common_opt() {
|
||||
|
||||
#mkdir -vp /home #LOG
|
||||
if [ -L /home ]; then
|
||||
rm -f /home #LOG
|
||||
elif [ -d /home ] && [ -z "$(ls -A /home 2>/dev/null)" ]; then
|
||||
rmdir /home #LOG
|
||||
elif [ -d /home ]; then
|
||||
echo "Warning /home not empty, leaving existing directory in place" #LOG
|
||||
fi
|
||||
|
||||
mkdir $IG_HOME/home #LOG
|
||||
if [ ! -e /home ]; then
|
||||
ln -s $IG_HOME/home /home #LOG
|
||||
fi
|
||||
|
||||
/usr/sbin/groupadd -g 106 noc #LOG
|
||||
/usr/sbin/useradd -c "NOC Account" -d $NOCHOME -u 1108 -g 106 -s /bin/bash -p $NOCPASS noc #LOG
|
||||
|
||||
mkdir $IG_HOME/bin #LOG
|
||||
mkdir $IG_HOME/lib #LOG
|
||||
mkdir $IG_HOME/conf #LOG
|
||||
mkdir $IG_HOME/sync #LOG
|
||||
mkdir $IG_HOME/data #LOG
|
||||
|
||||
mkdir $IG_HOME/data/ps #LOG
|
||||
mkdir $IG_HOME/sync/backup #LOG
|
||||
mkdir -p $IG_HOME/sync/logs/messages #LOG
|
||||
mkdir $IG_HOME/sync/logs/iglass #LOG
|
||||
mkdir $IG_HOME/sync/logs/customer #LOG
|
||||
|
||||
install -d -m 755 "$IG_HOME/conf" "$IG_HOME/conf/db" #LOG
|
||||
wget -q -O "$IG_HOME/conf/billing.properties" http://$KSRV/KickStart/cfg/$DIST/share/iglass/conf/billing.properties #LOG
|
||||
wget -q -O "$IG_HOME/conf/cpeInfo.properties" http://$KSRV/KickStart/cfg/$DIST/share/iglass/conf/cpeInfo.properties #LOG
|
||||
wget -q -O "$IG_HOME/conf/events.conf" http://$KSRV/KickStart/cfg/$DIST/share/iglass/conf/events.conf #LOG
|
||||
wget -q -O "$IG_HOME/conf/oui.txt" http://$KSRV/KickStart/cfg/$DIST/share/iglass/conf/oui.txt #LOG
|
||||
wget -q -O "$IG_HOME/conf/poller.properties" http://$KSRV/KickStart/cfg/$DIST/share/iglass/conf/poller.properties #LOG
|
||||
wget -q -O "$IG_HOME/conf/db/pg_service.conf" http://$KSRV/KickStart/cfg/$DIST/share/iglass/conf/db/pg_service.conf #LOG
|
||||
|
||||
#wget -q -O - http://$KSRV/KickStart/iglass-releases/$IGRELEASE | /bin/tar xvzf - #LOG
|
||||
rpm --import http://$KSRV/KickStart/iglass-releases/RPM-GPG-KEY-pmanager #LOG
|
||||
rpm -ivh --nodeps http://$KSRV/KickStart/iglass-releases/$IGRELEASE #LOG
|
||||
|
||||
#cat >> /etc/yum.repos.d/iGlass.repo <<EOF
|
||||
#[iGlass-Networks]
|
||||
#name=iGlass Networks
|
||||
#baseurl=https://repo.iglass.net/
|
||||
#enabled=0
|
||||
#gpgcheck = 0
|
||||
#gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-iGlass-release
|
||||
#sslverify = 1
|
||||
#sslcacert = /opt/iglass/conf/pki/iGlassCA.crt
|
||||
#sslclientkey = /opt/iglass/conf/pki/probe.key
|
||||
#sslclientcert = /opt/iglass/conf/pki/probe.crt
|
||||
#EOF
|
||||
|
||||
/bin/chown -RL noc:noc $IG_HOME #LOG
|
||||
/bin/chown -R 0.0 $IG_HOME/bin #LOG
|
||||
/bin/chown -R 0.0 $IG_HOME/lib #LOG
|
||||
/bin/chown -R 0.0 $IG_HOME/sql #LOG
|
||||
/bin/chown -R 0.0 $IG_HOME/home #LOG
|
||||
|
||||
/bin/chmod 775 $IG_HOME #LOG
|
||||
/bin/chmod g+s $IG_HOME #LOG
|
||||
|
||||
chmod 775 $IG_HOME/data $IG_HOME/sync #LOG
|
||||
chmod g+s $IG_HOME/data $IG_HOME/sync #LOG
|
||||
|
||||
#chmod 770 $IG_HOME/conf/pki #LOG
|
||||
#chmod 600 $IG_HOME/conf/pki/iGlassCA.crt #LOG
|
||||
|
||||
install -d -m 700 -o noc -g noc $IG_HOME/.aws
|
||||
install -d -m 600 -o noc -g noc /dev/null $IG_HOME/.aws/credentials.stub
|
||||
ln -sf /dev/null $IG_HOME/.aws/config #LOG
|
||||
ln -sf /dev/null $IG_HOME/.aws/credentials #LOG
|
||||
|
||||
# Install iGlass systemd unit files (RPM ships them in /opt/iglass/systemd/system/)
|
||||
if [ -d "$IG_HOME/systemd/system" ]; then
|
||||
echo "Installing iGlass systemd unit files" #LOG
|
||||
for f in "$IG_HOME"/systemd/system/*.service "$IG_HOME"/systemd/system/*.timer; do
|
||||
[ -f "$f" ] || continue
|
||||
/bin/cp -f "$f" /etc/systemd/system/ #LOG
|
||||
done
|
||||
systemctl daemon-reload #LOG
|
||||
else
|
||||
echo "WARNING: No iGlass systemd unit files found at $IG_HOME/systemd/system" #LOG
|
||||
fi
|
||||
|
||||
#/bin/mkdir $IG_HOME/conf/tunnel #LOG
|
||||
|
||||
#echo "Creating root probe key" #LOG
|
||||
|
||||
ST=`/usr/sbin/dmidecode -s system-serial-number | sed 's/\s*//g'`
|
||||
#ssh-keygen -t rsa -N "" -C "tunnel@$ST" -f $IDENTITY #LOG
|
||||
|
||||
#/bin/chown -R 0.0 $IG_HOME/conf/tunnel/ #LOG
|
||||
|
||||
restorecon -R $IG_HOME #LOG
|
||||
chcon unconfined_u:object_r:home_root_t:s0 $IG_HOME/home #LOG
|
||||
|
||||
#echo "Creating tunnel Account" #LOG
|
||||
#/usr/sbin/groupadd -g 107 tun #LOG
|
||||
#/usr/sbin/useradd -c "iGlass Tunnel Account" -d /home/tunnel -o -u 0 -g 107 -s /bin/rbash tunnelXX #LOG
|
||||
|
||||
#if [ "$PTYPE" = "ds" -o "$PTYPE" = "VM" ]; then
|
||||
# echo "OPTIONS=\"-q -x -y\"" > "$IG_ETC/tunnel.options"
|
||||
#else
|
||||
# echo "OPTIONS=\"-q -x -R -p\"" > "$IG_ETC/tunnel.options"
|
||||
#fi
|
||||
#echo "216.134.202.53" > "$IG_ETC/key_host"
|
||||
|
||||
echo "Setting up noc and iglass directory structure" #LOG
|
||||
mkdir $NOCHOME/.ssh #LOG
|
||||
mkdir $NOCHOME/.gnupg #LOG
|
||||
mkdir $NOCHOME/.aws #LOG
|
||||
mkdir $NOCHOME/.aws/credentials.d #LOG
|
||||
#mkdir $NOCHOME/.postgresql #LOG
|
||||
|
||||
wget -q -O - http://$KSRV/KickStart/cfg/$DIST/share/noc/pgpass > $NOCHOME/.pgpass
|
||||
chmod 600 $NOCHOME/.pgpass #LOG
|
||||
cp --preserve=mode,timestamps $NOCHOME/.pgpass /root/ #LOG
|
||||
|
||||
chmod 755 $NOCHOME #LOG
|
||||
chmod g+s $NOCHOME #LOG
|
||||
mkdir $NOCHOME/tmp #LOG
|
||||
echo "Fixing ssh for noc" #LOG
|
||||
|
||||
# Do authorized_keys via ipa now
|
||||
# wget -nv -nH -r -P$NOCHOME/.ssh --cut-dirs 6 --follow-tags a -R "*.html*" -np http://$KSRV/KickStart/cfg/$DIST/share/noc/ssh/
|
||||
|
||||
wget -q -O "$NOCHOME/.gnupg/gpg.conf" http://$KSRV/KickStart/cfg/$DIST/share/noc/gnupg/gpg.conf #LOG
|
||||
wget -q -O "$NOCHOME/.gnupg/pubring.gpg" http://$KSRV/KickStart/cfg/$DIST/share/noc/gnupg/pubring.gpg #LOG
|
||||
wget -q -O "$NOCHOME/.gnupg/secring.gpg" http://$KSRV/KickStart/cfg/$DIST/share/noc/gnupg/secring.gpg #LOG
|
||||
wget -q -O "$NOCHOME/.gnupg/random_seed" http://$KSRV/KickStart/cfg/$DIST/share/noc/gnupg/random_seed #LOG
|
||||
wget -q -O "$NOCHOME/.gnupg/trustdb.gpg" http://$KSRV/KickStart/cfg/$DIST/share/noc/gnupg/trustdb.gpg #LOG
|
||||
wget -q -O "$NOCHOME/.aws/config" http://$KSRV/KickStart/cfg/$DIST/share/noc/aws/config #LOG
|
||||
wget -q -O "$NOCHOME/.aws/credentials" http://$KSRV/KickStart/cfg/$DIST/share/noc/aws/credentials #LOG
|
||||
|
||||
#mkdir -p $NOCHOME/.config/systemd/user/
|
||||
## systemctl --user mask pulseaudio.socket
|
||||
## systemctl --user mask pulseaudio.service
|
||||
#ln -s /dev/null $NOCHOME/.config/systemd/user/pulseaudio.socket
|
||||
#ln -s /dev/null $NOCHOME/.config/systemd/user/pulseaudio.service
|
||||
#ln -s /dev/null $NOCHOME/.config/systemd/user/grub-boot-success.service
|
||||
#ln -s /dev/null $NOCHOME/.config/systemd/user/grub-boot-success.timer
|
||||
|
||||
sudo -iu noc systemctl --user mask pulseaudio #LOG
|
||||
sudo -iu noc systemctl --user disable pulseaudio.socket #LOG
|
||||
sudo -iu noc systemctl --user disable pulseaudio.service #LOG
|
||||
|
||||
chown -Rh noc.noc $NOCHOME #LOG
|
||||
|
||||
chmod 0700 $NOCHOME/.ssh #LOG
|
||||
#chmod 644 $NOCHOME/.ssh/known_hosts* #LOG
|
||||
#chmod 600 $NOCHOME/.ssh/authorized_keys* #LOG
|
||||
|
||||
chmod 0700 $NOCHOME/.gnupg #LOG
|
||||
chmod 600 $NOCHOME/.gnupg/* #LOG
|
||||
|
||||
chown -Rh noc.noc $NOCHOME/.aws #LOG
|
||||
chmod 0700 $NOCHOME/.aws #LOG
|
||||
chmod 600 $NOCHOME/.aws/* #LOG
|
||||
ln -s /home/noc/.aws /root/ #LOG
|
||||
|
||||
if [ -d "/etc/sudoers.d/" ]; then
|
||||
|
||||
cat >> /etc/sudoers.d/noc-default <<EOF
|
||||
|
||||
Cmnd_Alias NOC = /sbin/ipa-client-install "", /etc/iglass/mount-iglass.sh
|
||||
|
||||
noc ALL=(root) NOC
|
||||
|
||||
Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin
|
||||
EOF
|
||||
|
||||
else
|
||||
echo "Where is /etc/sudoers.d/ ?" #LOG
|
||||
fi
|
||||
|
||||
chmod 440 /etc/sudoers.d/noc-default
|
||||
restorecon -F /etc/sudoers.d/noc-default
|
||||
}
|
||||
|
||||
|
||||
if [ -e "$CRYPTEDDEV" ]; then
|
||||
|
||||
echo "Setting up crypted iglass partition on $CRYPTEDDEV" #LOG
|
||||
|
||||
#echo -n `wget -q -O - --no-check-certificate https://$KSRV/cgi-bin/keygen.pl` > $CPP1
|
||||
#echo -n $(od -An -x /dev/urandom | head -1) > $CPP1
|
||||
|
||||
openssl rand -base64 30 | head -c30 > $CPP1
|
||||
|
||||
if [ -z "$CPP1" ]; then
|
||||
|
||||
echo "WARNING! Could not generate crypt key" #LOG
|
||||
|
||||
else
|
||||
|
||||
/sbin/swapoff -av #LOG
|
||||
|
||||
#sfdisk --change-id /dev/sda 2 da
|
||||
|
||||
sed -ie "/iGlassOpt/d" /etc/fstab #LOG
|
||||
|
||||
if [ "$DISKTYPE" != "ssd" ]; then
|
||||
# These are slow and I don't think valid for SSDs
|
||||
|
||||
echo "Randomizing drive before encrypting" #LOG
|
||||
|
||||
#dd if=/dev/urandom of=$CRYPTEDDEV bs=1M #LOG
|
||||
|
||||
openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64)" -nosalt < /dev/zero | dd of=$CRYPTEDDEV #LOG
|
||||
|
||||
# openssl rand can't do bigger than 754G
|
||||
# openssl rand $(</proc/partitions awk '$4=="sda2" {print $3*1024}') >/dev/sda
|
||||
|
||||
# shred -v -n 1 $CRYPTEDDEV #LOG
|
||||
fi
|
||||
|
||||
echo "Trying to load kernel mods" #LOG
|
||||
modprobe -v dm_mod #LOG
|
||||
modprobe -v dm_crypt #LOG
|
||||
#modprobe -v cryptoloop #LOG
|
||||
|
||||
echo "Running luksFormat" #LOG
|
||||
echo "cryptsetup -q luksFormat $CRYPTEDDEV $CPP1"
|
||||
cryptsetup -q luksFormat $CRYPTEDDEV $CPP1 #LOG
|
||||
|
||||
echo "Running luksOpen" #LOG
|
||||
cryptsetup --key-file $CPP1 open --type luks $CRYPTEDDEV $DECRYPTEDMAP #LOG
|
||||
|
||||
if [ -e /dev/mapper/$DECRYPTEDMAP ]; then
|
||||
|
||||
#mkfs.ext3 /dev/mapper/$DECRYPTEDMAP #LOG
|
||||
mkfs.ext4 /dev/mapper/$DECRYPTEDMAP #LOG
|
||||
|
||||
cryptsetup -v luksDump $CRYPTEDDEV #LOG
|
||||
|
||||
echo "Creating encrypted IG_HOME($IG_HOME) and noc account " #LOG
|
||||
mkdir -vp $IG_HOME #LOG
|
||||
|
||||
mkdir -vp $IG_ETC #LOG
|
||||
chown 0.0 $IG_ETC #LOG
|
||||
chmod 755 $IG_ETC #LOG
|
||||
|
||||
mount -v /dev/mapper/$DECRYPTEDMAP $IG_HOME #LOG
|
||||
|
||||
if [ ! -d /export ]; then
|
||||
ONEDISK=1 # This is so I don't move pg here
|
||||
echo "Looks like just 1 disk, no /export. Creating directory." #LOG
|
||||
mkdir /export #LOG
|
||||
|
||||
fi
|
||||
|
||||
if [ "$PTYPE" != "ds" ] && [ "$PTYPE" != "plug" ]; then
|
||||
echo "Not a DS probe, setting up crypttab"
|
||||
#cp -af $CPP1 $IG_ETC/igpp #LOG
|
||||
#chown 0.0 $IG_ETC/igpp #LOG
|
||||
#chmod 600 $IG_ETC/igpp #LOG
|
||||
#echo "$DECRYPTEDMAP $CRYPTEDDEV $IG_ETC/igpp" >> /etc/crypttab
|
||||
#echo "$DECRYPTEDMAP UUID=$(blkid -o value -s UUID $CRYPTEDDEV) none noauto" >> /etc/crypttab
|
||||
echo "$DECRYPTEDMAP $CRYPTEDDEV none noauto" >> /etc/crypttab
|
||||
#echo "/dev/mapper/$DECRYPTEDMAP $IG_HOME ext3 defaults 1 2" >> /etc/fstab
|
||||
echo "/dev/mapper/$DECRYPTEDMAP $IG_HOME ext4 rw,nosuid,dev,exec,noauto,nouser,async" >> /etc/fstab
|
||||
fi
|
||||
|
||||
common_opt
|
||||
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
elif [ "$PTYPE" = "VM" ]; then
|
||||
echo "No partition to crypt, VM" #LOD
|
||||
echo "Creating non-encrypted IG_HOME($IG_HOME) and noc account " #LOG
|
||||
mkdir -vp $IG_HOME #LOG
|
||||
|
||||
mkdir -vp $IG_ETC #LOG
|
||||
chown 0.0 $IG_ETC #LOG
|
||||
chmod 700 $IG_ETC #LOG
|
||||
|
||||
common_opt
|
||||
|
||||
elif [ -b /dev/vda ] || [ -d /sys/block/vda ] || systemd-detect-virt --quiet; then
|
||||
echo "No partition to crypt, virtualized test system" #LOG
|
||||
echo "Creating non-encrypted IG_HOME($IG_HOME) and noc account " #LOG
|
||||
mkdir -vp $IG_HOME #LOG
|
||||
|
||||
mkdir -vp $IG_ETC #LOG
|
||||
chown 0.0 $IG_ETC #LOG
|
||||
chmod 700 $IG_ETC #LOG
|
||||
|
||||
common_opt
|
||||
else
|
||||
|
||||
echo "ERROR: No partition to encrypt" #LOG
|
||||
|
||||
fi
|
||||
@@ -0,0 +1,31 @@
|
||||
# description: Setup noc account & iglass dir
|
||||
|
||||
###
|
||||
# Setup noc Account
|
||||
###
|
||||
|
||||
echo "Creating noc Account (IG_HOME = $IG_HOME)" #LOG
|
||||
mkdir -vp /home #LOG
|
||||
|
||||
/usr/sbin/groupadd -g 106 noc #LOG
|
||||
/usr/sbin/useradd -c "NOC Account" -d /home/noc -u 1108 -g 106 -s /bin/bash -p $NOCPASS noc #LOG
|
||||
|
||||
echo "Setting up noc and iglass directory structure" #LOG
|
||||
/bin/mkdir /home/noc/.ssh #LOG
|
||||
/bin/chmod 755 /home/noc #LOG
|
||||
/bin/chmod g+s /home/noc #LOG
|
||||
/bin/mkdir /home/noc/tmp #LOG
|
||||
|
||||
/bin/mkdir $IG_HOME #LOG
|
||||
|
||||
echo "Fixing ssh for noc" #LOG
|
||||
/bin/cp /mnt/tmp/custom/ssh/* /home/noc/.ssh/ #LOG
|
||||
/bin/chown -R noc.noc /home/noc #LOG
|
||||
/bin/chmod 0700 /home/noc/.ssh #LOG
|
||||
/bin/chmod 644 /home/noc/.ssh/known_hosts* #LOG
|
||||
/bin/chmod 600 /home/noc/.ssh/authorized_keys* #LOG
|
||||
|
||||
/usr/bin/perl -spi -e 's/^Defaults\s+requiretty/Defaults \!requiretty/' /etc/sudoers #LOG
|
||||
echo '%eye ALL= /bin/su - noc' >> /etc/sudoers
|
||||
echo '%eye ALL= /bin/su - tomcat' >> /etc/sudoers
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
S400P-noc-iglass
|
||||
@@ -0,0 +1,182 @@
|
||||
# description: Setup Postgres
|
||||
|
||||
###
|
||||
# Postgres Setup
|
||||
###
|
||||
#
|
||||
echo "Setting up and installing PostgreSQL" #LOG
|
||||
|
||||
if rpm -q postgresql14-server >/dev/null; then
|
||||
echo "PostgreSQL already installed" #LOG
|
||||
else
|
||||
dnf -y install https://download.postgresql.org/pub/repos/yum/reporpms/EL-10-x86_64/pgdg-redhat-repo-latest.noarch.rpm #LOG
|
||||
|
||||
dnf -y install postgresql14 postgresql14-devel postgresql14-server postgresql14-contrib postgresql14-libs #LOG
|
||||
fi
|
||||
|
||||
[ -z "$IG_HOME" ] && export IG_HOME="/opt/iglass"
|
||||
[ -z "$DIST" ] && export DIST="AlmaLinux-10.1-x86_64"
|
||||
|
||||
PGHOME=$(ls -vd /usr/pgsql* | tail -1)
|
||||
|
||||
if [ -d "$PGHOME" ]; then
|
||||
PGDATA=/opt/iglass/pgdata/data${PGHOME/#\/usr\/pgsql}/
|
||||
|
||||
echo "Setting up Postgres from $PGHOME [$PGDATA]" #LOG
|
||||
|
||||
ln -sf $IG_HOME/conf/db/pg_service.conf /etc/sysconfig/pgsql/pg_service.conf #LOG
|
||||
ln -sf $IG_HOME/conf/db/pg_service.conf /etc/pg_service.conf #LOG
|
||||
mkdir /etc/pgsql #LOG
|
||||
ln -s /opt/iglass/conf/db/pg_service.conf /etc/pgsql/ #LOG
|
||||
|
||||
|
||||
POSTID=$(id -u postgres 2>/dev/null)
|
||||
if [ -z "$POSTID" ]; then
|
||||
echo "Creating postgres account" #LOG
|
||||
/usr/sbin/groupadd -g 26 postgres
|
||||
/usr/sbin/useradd -N -r -c "Postgres Account" -d /home/postgres -m -u 26 -g 26 -G 106 -s /bin/bash postgres #LOG
|
||||
else
|
||||
echo "Postgres account already exists, setting home." #LOG
|
||||
/usr/sbin/usermod -d /home/postgres postgres #LOG
|
||||
if [ ! -d /home/postgres ]; then
|
||||
mkdir /home/postgres
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -d "/home/KickStart/cfg/$DIST/share/pgsql" ]; then
|
||||
WGET="cat /home/KickStart/cfg/$DIST/share/pgsql"
|
||||
. "/home/KickStart/cfg/$DIST/ks.d/functions"
|
||||
else
|
||||
WGET="wget -qO - http://$KSRV/KickStart/cfg/$DIST/share/pgsql"
|
||||
fi
|
||||
echo "WGET=$WGET" #LOG
|
||||
|
||||
if [ -d "$PGDATA" ]; then
|
||||
echo "$PGDATA already exists" #LOG
|
||||
exit
|
||||
fi
|
||||
mkdir -p $PGDATA #LOG
|
||||
chown -R postgres:postgres $PGDATA #LOG
|
||||
chown -R postgres:postgres /home/postgres #LOG
|
||||
|
||||
#setsebool -PV postgresql_can_rsync on #LOG
|
||||
|
||||
# data dir must be empty
|
||||
export LANG="en_US.UTF-8"
|
||||
echo "Running initdb with LANG=$LANG" #LOG
|
||||
sudo -u postgres $PGHOME/bin/initdb --locale="$LANG" -D $PGDATA #LOG
|
||||
|
||||
mkdir -p $PGDATA/iglass #LOG
|
||||
chown -R postgres:postgres $PGDATA #LOG
|
||||
chmod 0700 $PGDATA #LOG
|
||||
|
||||
TMP=$(tmpdir)
|
||||
if [ $? -eq 0 ]; then
|
||||
for _pgfile in 01iglass.conf pg_hba.conf; do
|
||||
wget -q -O "$TMP/$_pgfile" "http://$KSRV/KickStart/cfg/$DIST/share/pgsql/iglass/$_pgfile" #LOG
|
||||
done
|
||||
chmod 600 $TMP/*
|
||||
/bin/cp -f $TMP/* $PGDATA/iglass/
|
||||
/bin/rm -rf $TMP
|
||||
else
|
||||
echo ERROR: Could not create tmp directory for postgres data/iglass configs
|
||||
fi
|
||||
|
||||
rm -f $PGDATA/pg_hba.conf
|
||||
|
||||
echo "include = 'iglass/01iglass.conf'" >> $PGDATA/postgresql.conf
|
||||
echo "hba_file = '${PGDATA}/iglass/pg_hba.conf'" >> $PGDATA/postgresql.conf
|
||||
|
||||
echo "Generating DH parameters" #LOG
|
||||
openssl dhparam -out $PGDATA/iglass/dhparams.pem 2048 2>/dev/null #LOG
|
||||
|
||||
TMP=$(tmpdir)
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Running postgres finish script" #LOG
|
||||
$WGET/pg-openssl.cnf > $TMP/pg-openssl.cnf
|
||||
chown -R postgres:postgres $TMP
|
||||
cd $TMP
|
||||
#(echo export PGPASS=$($WGET/pg-openssl.pw); echo export OPENSSL_CONF=$TMP/pg-openssl.cnf; $WGET/finish.sh) | sudo -u postgres -s
|
||||
cat <<EOF | sudo -u postgres -s
|
||||
export PGPASS=$($WGET/pg-openssl.pw);
|
||||
export OPENSSL_CONF=$TMP/pg-openssl.cnf;
|
||||
PGDATA=$PGDATA
|
||||
openssl req -new -text -out cert.req
|
||||
openssl rsa -in privkey.pem -out cert.pem -passin env:PGPASS
|
||||
openssl req -sha256 -x509 -days 365 -in cert.req -text -key cert.pem -out cert.cert
|
||||
cp cert.pem $PGDATA/iglass/server.key
|
||||
cp cert.cert $PGDATA/iglass/server.crt
|
||||
chmod 600 $PGDATA/iglass/server.*
|
||||
rm -f cert.* *.pem
|
||||
EOF
|
||||
cd /
|
||||
/bin/rm -rf $TMP
|
||||
else
|
||||
echo ERROR: Could not create tmp dir for postgres finish.sh
|
||||
fi
|
||||
|
||||
chown -R postgres:postgres $PGDATA #LOG
|
||||
|
||||
cd /
|
||||
|
||||
# if [ -f "$IG_HOME/bin/pgMemTweak" ]; then
|
||||
# $IG_HOME/bin/pgMemTweak >> /etc/sysctl.conf
|
||||
# SHMALL=`$IG_HOME/bin/pgMemTweak shmall`
|
||||
# if [ "$SHMALL" != "" ]; then
|
||||
# echo "$SHMALL" > /proc/sys/kernel/shmall
|
||||
#
|
||||
# SHMMAX=`$IG_HOME/bin/pgMemTweak shmmax`
|
||||
# if [ "$SHMMAX" != "" ]; then
|
||||
# echo "$SHMMAX" > /proc/sys/kernel/shmmax
|
||||
# fi
|
||||
# fi
|
||||
# else
|
||||
# echo "iGlass software must be installed first for pgMemTweak"
|
||||
# fi
|
||||
|
||||
# sysctl -w $(grep kernel.shmmax /etc/sysctl.conf | sed 's/\s*//g') #LOG
|
||||
# sysctl -w $(grep kernel.shmall /etc/sysctl.conf | sed 's/\s*//g') #LOG
|
||||
|
||||
PGSRV=$(basename $(ls /usr/lib/systemd/system/postgresql* | tail -1))
|
||||
|
||||
if [ -z "$PGSRV" ]; then
|
||||
echo "No postgres.service found! Can't start it." #LOG
|
||||
else
|
||||
echo "Starting postgres to create iglass user" #LOG
|
||||
#perl -spi -e "s|^(Environment=PGDATA=)(.+)|#\$1\$2\n\$1$PGDATA|" "/usr/lib/systemd/system/$PGSRV"
|
||||
mkdir /etc/systemd/system/${PGSRV}.d/ #LOG
|
||||
echo -e "[Service]\nEnvironment=PGDATA=$PGDATA\n" > /etc/systemd/system/${PGSRV}.d/pgdata.conf
|
||||
|
||||
systemctl enable $PGSRV #LOG
|
||||
|
||||
# This doesn't work with systemd in chroot
|
||||
#systemctl start $PGSRV #LOG
|
||||
su - postgres -c "$PGHOME/bin/pg_ctl -D $PGDATA -l logfile start" #LOG
|
||||
|
||||
sleep 5
|
||||
|
||||
$WGET/dbmod.sql | sudo -u postgres /usr/bin/psql -U postgres -d template1 #LOG
|
||||
|
||||
|
||||
su - postgres -c "$PGHOME/bin/pg_ctl -D $PGDATA -l logfile stop" #LOG
|
||||
fi
|
||||
|
||||
/sbin/restorecon -r $PGDATA
|
||||
|
||||
else
|
||||
echo " Error: Postgres does not look like its installed" #LOG
|
||||
fi
|
||||
|
||||
|
||||
echo "Installing DBD::Pg Perl Module" #LOG
|
||||
PGHOME=$(ls -dtr /usr/pgsql* | tail -1)
|
||||
|
||||
if [ -n "$PGHOME" -a -d "$PGHOME" ]; then
|
||||
echo "Setting POSTGRES_HOME=$PGHOME" #LOG
|
||||
export POSTGRES_HOME=$PGHOME
|
||||
export POSTGRES_LIB="$POSTGRES_HOME/lib -lssl -lcrypto"
|
||||
cpanm -n DBD::Pg #LOG
|
||||
else
|
||||
echo "Could not find psql version" #LOG
|
||||
fi
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
S570A-Postgres
|
||||
@@ -0,0 +1,25 @@
|
||||
# description: Install crontabs
|
||||
|
||||
###
|
||||
# Crontab Entries
|
||||
###
|
||||
|
||||
WGET="wget -qO - http://$KSRV/KickStart/cfg/$DIST/share/crontab"
|
||||
|
||||
if [ "$PTYPE" != "server" ]; then
|
||||
echo "Installing crontabs" #LOG
|
||||
|
||||
$WGET/root.crontab | /usr/bin/crontab -u root - #LOG
|
||||
$WGET/postgres.crontab | /usr/bin/crontab -u postgres - #LOG
|
||||
$WGET/noc.crontab | /usr/bin/crontab -u noc - #LOG
|
||||
|
||||
else
|
||||
|
||||
echo "Installing server crontabs" #LOG
|
||||
|
||||
WGET="${WGET}-server"
|
||||
|
||||
$WGET/root.crontab | /usr/bin/crontab -u root - #LOG
|
||||
$WGET/postgres.crontab | /usr/bin/crontab -u postgres - #LOG
|
||||
$WGET/noc.crontab | /usr/bin/crontab -u noc - #LOG
|
||||
fi
|
||||
@@ -0,0 +1 @@
|
||||
S650A-Crontabs
|
||||
@@ -0,0 +1,169 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Description: Setup chroot & iglass (formally as400) account
|
||||
# Default user/group to lock down to
|
||||
CRU='iglass'
|
||||
#CRUID='1109'
|
||||
CRUID='2222'
|
||||
CRG='iglass'
|
||||
CRGID='222'
|
||||
|
||||
umask 0022
|
||||
|
||||
# NEXTUID=$(cat /etc/passwd | grep -v nfsnobody | cut -d: -f 3 | sort -g | tail -1)
|
||||
|
||||
if [ -n "$IG_HOME" ]; then
|
||||
PATH="$PATH:$IG_HOME/bin"
|
||||
fi
|
||||
|
||||
while getopts "u:i:g:k:d" optionName; do
|
||||
case "$optionName" in
|
||||
u) CRU="$OPTARG";;
|
||||
i) CRUID="$OPTARG";;
|
||||
g) CRG="$OPTARG";;
|
||||
k) CRGID="$OPTARG";;
|
||||
d) DEBUG=1;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [ -z "$IG_HOME" ]; then
|
||||
PATH="$PATH:/opt/iglass/bin"
|
||||
echo Looks like you are not running from KickStart?
|
||||
echo
|
||||
echo "Usage: $0 [-u <user>] [-i <uid>] [-g <grp>] [-k <grpid>]"
|
||||
echo
|
||||
echo "Default: $0 -u $CRU -i $CRUID -g $CRG -k $CRGID"
|
||||
echo
|
||||
read -t 60 -p "Continue? [no]" OK
|
||||
if shopt -q nocasematch; then
|
||||
NC=1
|
||||
fi
|
||||
shopt -s nocasematch
|
||||
if [ "$OK" != "y" -a "$OK" != "yes" ]; then
|
||||
echo bye bye
|
||||
exit 1
|
||||
fi
|
||||
if [ -n "$NC" ]; then
|
||||
shopt -s nocasematch
|
||||
fi
|
||||
fi
|
||||
|
||||
MKJAIL=$(which mkjail.pl)
|
||||
ME=`whoami`
|
||||
|
||||
if ! grep -qE '^VERSION="(9|10)' /etc/os-release; then
|
||||
echo "This script is for AlmaLinux 9 or 10" #LOG
|
||||
|
||||
elif [ -z "$MKJAIL" -o ! -e "$MKJAIL" ]; then
|
||||
echo "No valid mkjail found!" #LOG
|
||||
|
||||
elif [ $ME != 'root' ]; then
|
||||
echo "Please run as root!";
|
||||
|
||||
else
|
||||
|
||||
CRDIR=/home/chroot-$CRU
|
||||
mkdir -vp $CRDIR/home/$CRU #LOG
|
||||
|
||||
echo "Creating $CRU($CRG) Account" #LOG
|
||||
groupadd -g $CRGID $CRG #LOG
|
||||
|
||||
#useradd -c "$CRU restricted account" -d $CRDIR/$CRU -m -u $CRUID -g $CRGID -s /usr/bin/rssh $CRU #LOG
|
||||
useradd -c "$CRU restricted account" -M -d /home/./$CRU -u $CRUID -g $CRGID -s /sbin/nologin $CRU #LOG
|
||||
|
||||
chown $CRU:$CRG $CRDIR/home/$CRU
|
||||
chmod 750 $CRDIR/home/$CRU
|
||||
|
||||
|
||||
cat /dev/null > $CRDIR/home/$CRU/.bash_profile
|
||||
cat /dev/null > $CRDIR/home/$CRU/.bash_logout
|
||||
cat /dev/null > $CRDIR/home/$CRU/.bashrc
|
||||
chown root.root $CRDIR/home/$CRU/.bash_profile
|
||||
chown root.root $CRDIR/home/$CRU/.bash_logout
|
||||
chown root.root $CRDIR/home/$CRU/.bashrc
|
||||
|
||||
mkdir $CRDIR/home/$CRU/.ssh
|
||||
chmod 700 $CRDIR/home/$CRU/.ssh
|
||||
touch $CRDIR/home/$CRU/.ssh/authorized_keys
|
||||
chmod 600 $CRDIR/home/$CRU/.ssh/authorized_keys
|
||||
chown -R $CRU.$CRG $CRDIR/home/$CRU/.ssh
|
||||
|
||||
mkdir -p $CRDIR/home/$CRU/.config/systemd/user/
|
||||
ln -s /dev/null $CRDIR/home/.config/systemd/user/pulseaudio.socket
|
||||
ln -s /dev/null $CRDIR/home/.config/systemd/user/pulseaudio.service
|
||||
chown -R $CRU.$CRG $CRDIR/home/.config
|
||||
|
||||
mkdir $CRDIR/home/$CRU/work
|
||||
chown -R noc.$CRG $CRDIR/home/$CRU/work
|
||||
chmod 770 $CRDIR/home/$CRU/work
|
||||
|
||||
cd /home
|
||||
ln -s chroot-$CRU/home/$CRU .
|
||||
|
||||
if grep -Eq 'userlist_deny=NO' /etc/vsftpd/user_list; then
|
||||
echo "vsftpd user_list already modified"
|
||||
else
|
||||
cp -af /etc/vsftpd/user_list /etc/vsftpd/user_list.orig
|
||||
echo "# userlist_deny=NO So only allow users in this file" > /etc/vsftpd/user_list
|
||||
fi
|
||||
echo "$CRU" >> /etc/vsftpd/user_list
|
||||
|
||||
if ! grep -Eq '^cmds_denied=' /etc/vsftpd/vsftpd.conf; then
|
||||
cat >> /etc/vsftpd/vsftpd.conf <<EOF
|
||||
|
||||
userlist_deny=NO
|
||||
reverse_lookup_enable=NO
|
||||
syslog_enable=YES
|
||||
chroot_local_user=YES
|
||||
passwd_chroot_enable=YES
|
||||
max_clients=5
|
||||
cmds_denied=mkdir,rmdir,rename
|
||||
EOF
|
||||
else
|
||||
echo "vsftpd conf already modified"
|
||||
fi
|
||||
|
||||
$MKJAIL $CRU #LOG
|
||||
|
||||
usermod -a -G $CRU noc #LOG
|
||||
|
||||
groupadd -g 2002 sftpusers
|
||||
usermod -G sftpusers $CRU #LOG
|
||||
|
||||
if ! grep -Eq '^Subsystem\s+sftp\s+internal-sftp' /etc/ssh/sshd_config; then
|
||||
echo "Configuring sshd for internal-sftp"
|
||||
perl -spi -e 's/^(Subsystem.+)$/#$1\nSubsystem sftp internal\-sftp \-u 0022/' /etc/ssh/sshd_config
|
||||
else
|
||||
echo "sshd already configured for internal-sftp"
|
||||
fi
|
||||
|
||||
if ! grep -Eq '^Match\s+Group\s+sftpusers' /etc/ssh/sshd_config; then
|
||||
echo "Configuring sshd for sftpusers group"
|
||||
echo -e "Match Group sftpusers\n\tChrootDirectory /home/chroot-%u" >> /etc/ssh/sshd_config
|
||||
#echo -e "Match Group sftpusers\n\tChrootDirectory /home/chroot-%u\n\tForceCommand internal-sftp" >> /etc/ssh/sshd_config
|
||||
else
|
||||
echo "sshd already configured for sftpusers group"
|
||||
fi
|
||||
|
||||
cd $CRDIR/bin
|
||||
if [ ! -e rbash ]; then
|
||||
mv -f bash rbash #LOG
|
||||
fi
|
||||
rm -f bash #LOG
|
||||
|
||||
#usermod -s /bin/rbash $CRU #LOG
|
||||
if ! grep -q rbash /etc/shells; then
|
||||
echo "/bin/rbash" >> /etc/shells
|
||||
echo "/sbin/nologin" >> /etc/shells
|
||||
fi
|
||||
|
||||
#setsebool -P ftp_home_dir=1
|
||||
#setsebool -P ftpd_full_access on
|
||||
setsebool -P ftpd_connect_all_unreserved 1
|
||||
|
||||
if [ -z "$IG_HOME" ]; then
|
||||
echo
|
||||
echo "REMINDER: Set password with 'passwd $CRU'"
|
||||
echo
|
||||
fi
|
||||
fi
|
||||
@@ -0,0 +1 @@
|
||||
S700P-chroot-as400
|
||||
@@ -0,0 +1,168 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Description: Setup chroot & iglass (formally as400) account
|
||||
# Default user/group to lock down to
|
||||
CRU='maps'
|
||||
CRUID='2228'
|
||||
CRG='maps'
|
||||
CRGID='228'
|
||||
|
||||
umask 0022
|
||||
|
||||
# NEXTUID=$(cat /etc/passwd | grep -v nfsnobody | cut -d: -f 3 | sort -g | tail -1)
|
||||
|
||||
if [ -n "$IG_HOME" ]; then
|
||||
PATH="$PATH:$IG_HOME/bin"
|
||||
fi
|
||||
|
||||
while getopts "u:i:g:k:d" optionName; do
|
||||
case "$optionName" in
|
||||
u) CRU="$OPTARG";;
|
||||
i) CRUID="$OPTARG";;
|
||||
g) CRG="$OPTARG";;
|
||||
k) CRGID="$OPTARG";;
|
||||
d) DEBUG=1;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [ -z "$IG_HOME" ]; then
|
||||
PATH="$PATH:/opt/iglass/bin"
|
||||
echo Looks like you are not running from KickStart?
|
||||
echo
|
||||
echo "Usage: $0 [-u <user>] [-i <uid>] [-g <grp>] [-k <grpid>]"
|
||||
echo
|
||||
echo "Default: $0 -u $CRU -i $CRUID -g $CRG -k $CRGID"
|
||||
echo
|
||||
read -t 60 -p "Continue? [no]" OK
|
||||
if shopt -q nocasematch; then
|
||||
NC=1
|
||||
fi
|
||||
shopt -s nocasematch
|
||||
if [ "$OK" != "y" -a "$OK" != "yes" ]; then
|
||||
echo bye bye
|
||||
exit 1
|
||||
fi
|
||||
if [ -n "$NC" ]; then
|
||||
shopt -s nocasematch
|
||||
fi
|
||||
fi
|
||||
|
||||
MKJAIL=$(which mkjail.pl)
|
||||
ME=`whoami`
|
||||
|
||||
if ! grep -qE '^VERSION="(9|10)' /etc/os-release; then
|
||||
echo "This script is for AlmaLinux 9 or 10" #LOG
|
||||
|
||||
elif [ -z "$MKJAIL" -o ! -e "$MKJAIL" ]; then
|
||||
echo "No valid mkjail found!" #LOG
|
||||
|
||||
elif [ $ME != 'root' ]; then
|
||||
echo "Please run as root!";
|
||||
|
||||
else
|
||||
|
||||
CRDIR=/home/chroot-$CRU
|
||||
mkdir -vp $CRDIR/home/$CRU #LOG
|
||||
|
||||
echo "Creating $CRU($CRG) Account" #LOG
|
||||
groupadd -g $CRGID $CRG #LOG
|
||||
|
||||
#useradd -c "$CRU restricted account" -d $CRDIR/$CRU -m -u $CRUID -g $CRGID -s /usr/bin/rssh $CRU #LOG
|
||||
useradd -c "$CRU restricted account" -M -d /home/./$CRU -u $CRUID -g $CRGID -s /sbin/nologin $CRU #LOG
|
||||
|
||||
chown $CRU:$CRG $CRDIR/home/$CRU
|
||||
chmod 750 $CRDIR/home/$CRU
|
||||
|
||||
|
||||
cat /dev/null > $CRDIR/home/$CRU/.bash_profile
|
||||
cat /dev/null > $CRDIR/home/$CRU/.bash_logout
|
||||
cat /dev/null > $CRDIR/home/$CRU/.bashrc
|
||||
chown root.root $CRDIR/home/$CRU/.bash_profile
|
||||
chown root.root $CRDIR/home/$CRU/.bash_logout
|
||||
chown root.root $CRDIR/home/$CRU/.bashrc
|
||||
|
||||
mkdir $CRDIR/home/$CRU/.ssh
|
||||
chmod 700 $CRDIR/home/$CRU/.ssh
|
||||
touch $CRDIR/home/$CRU/.ssh/authorized_keys
|
||||
chmod 600 $CRDIR/home/$CRU/.ssh/authorized_keys
|
||||
chown -R $CRU.$CRG $CRDIR/home/$CRU/.ssh
|
||||
|
||||
mkdir -p $CRDIR/home/$CRU/.config/systemd/user/
|
||||
ln -s /dev/null $CRDIR/home/.config/systemd/user/pulseaudio.socket
|
||||
ln -s /dev/null $CRDIR/home/.config/systemd/user/pulseaudio.service
|
||||
chown -R $CRU.$CRG $CRDIR/home/.config
|
||||
|
||||
mkdir $CRDIR/home/$CRU/work
|
||||
chown -R noc.$CRG $CRDIR/home/$CRU/work
|
||||
chmod 770 $CRDIR/home/$CRU/work
|
||||
|
||||
cd /home
|
||||
ln -s chroot-$CRU/home/$CRU .
|
||||
|
||||
if grep -Eq 'userlist_deny=NO' /etc/vsftpd/user_list; then
|
||||
echo "vsftpd user_list already modified"
|
||||
else
|
||||
cp -af /etc/vsftpd/user_list /etc/vsftpd/user_list.orig
|
||||
echo "# userlist_deny=NO So only allow users in this file" > /etc/vsftpd/user_list
|
||||
fi
|
||||
echo "$CRU" >> /etc/vsftpd/user_list
|
||||
|
||||
if ! grep -Eq '^cmds_denied=' /etc/vsftpd/vsftpd.conf; then
|
||||
cat >> /etc/vsftpd/vsftpd.conf <<EOF
|
||||
|
||||
userlist_deny=NO
|
||||
reverse_lookup_enable=NO
|
||||
syslog_enable=YES
|
||||
chroot_local_user=YES
|
||||
passwd_chroot_enable=YES
|
||||
max_clients=5
|
||||
cmds_denied=mkdir,rmdir,rename
|
||||
EOF
|
||||
else
|
||||
echo "vsftpd conf already modified"
|
||||
fi
|
||||
|
||||
$MKJAIL $CRU #LOG
|
||||
|
||||
usermod -a -G $CRU noc #LOG
|
||||
|
||||
groupadd -g 2002 sftpusers
|
||||
usermod -G sftpusers $CRU #LOG
|
||||
|
||||
if ! grep -Eq '^Subsystem\s+sftp\s+internal-sftp' /etc/ssh/sshd_config; then
|
||||
echo "Configuring sshd for internal-sftp"
|
||||
perl -spi -e 's/^(Subsystem.+)$/#$1\nSubsystem sftp internal\-sftp \-u 0022/' /etc/ssh/sshd_config
|
||||
else
|
||||
echo "sshd already configured for internal-sftp"
|
||||
fi
|
||||
|
||||
if ! grep -Eq '^Match\s+Group\s+sftpusers' /etc/ssh/sshd_config; then
|
||||
echo "Configuring sshd for sftpusers group"
|
||||
echo -e "Match Group sftpusers\n\tChrootDirectory /home/chroot-%u" >> /etc/ssh/sshd_config
|
||||
#echo -e "Match Group sftpusers\n\tChrootDirectory /home/chroot-%u\n\tForceCommand internal-sftp" >> /etc/ssh/sshd_config
|
||||
else
|
||||
echo "sshd already configured for sftpusers group"
|
||||
fi
|
||||
|
||||
cd $CRDIR/bin
|
||||
if [ ! -e rbash ]; then
|
||||
mv -f bash rbash #LOG
|
||||
fi
|
||||
rm -f bash #LOG
|
||||
|
||||
#usermod -s /bin/rbash $CRU #LOG
|
||||
if ! grep -q rbash /etc/shells; then
|
||||
echo "/bin/rbash" >> /etc/shells
|
||||
echo "/sbin/nologin" >> /etc/shells
|
||||
fi
|
||||
|
||||
#setsebool -P ftp_home_dir=1
|
||||
#setsebool -P ftpd_full_access on
|
||||
setsebool -P ftpd_connect_all_unreserved 1
|
||||
|
||||
if [ -z "$IG_HOME" ]; then
|
||||
echo
|
||||
echo "REMINDER: Set password with 'passwd $CRU'"
|
||||
echo
|
||||
fi
|
||||
fi
|
||||
@@ -0,0 +1 @@
|
||||
S701A-chroot-maps
|
||||
@@ -0,0 +1 @@
|
||||
S701A-chroot-maps
|
||||
@@ -0,0 +1,45 @@
|
||||
# description: Setup serial console login
|
||||
|
||||
echo "# /proc/tty/driver/serial:" #LOG
|
||||
cat /proc/tty/driver/serial #LOG
|
||||
|
||||
TTYS=$(perl -ne 'if (/^(\d):.+uart:16550A/) { print "ttyS$1\n"; last }' /proc/tty/driver/serial)
|
||||
|
||||
if [ -e "/dev/$TTYS" ]; then
|
||||
echo "Modifing grub for sol with $TTYS" #LOG
|
||||
|
||||
perl -spi -e 's/^(GRUB_TIMEOUT=)\d+$/${1}2/' /etc/default/grub
|
||||
|
||||
echo "Adding console for BMC" #LOG
|
||||
# The elevator is the I/O scheduler, nothing to do with the console login but since we're changing it here...
|
||||
#TTYS=$TTYS perl -spi -e 's/^(GRUB_CMDLINE_LINUX=.+) rhgb quiet(.*)$/$1 elevator=noop console=tty0 console=$ENV{TTYS},115200$2/' /etc/default/grub
|
||||
# TODO: RHEL 10 may not include 'rhgb quiet' in GRUB_CMDLINE_LINUX by default.
|
||||
# If the pattern doesn't match, console= params are silently not added.
|
||||
# Verify grub defaults on first RHEL 10 physical probe build and adjust regex if needed.
|
||||
TTYS=$TTYS perl -spi -e 's/^(GRUB_CMDLINE_LINUX=.+) rhgb quiet(.*)$/$1 console=tty0 console=$ENV{TTYS},115200$2/' /etc/default/grub
|
||||
|
||||
if [ -d /sys/firmware/efi ]; then
|
||||
echo "UEFI" #LOG
|
||||
if [ -d /boot/efi/EFI/almalinux ]; then
|
||||
grub2-mkconfig -o /boot/efi/EFI/almalinux/grub.cfg #LOG
|
||||
else
|
||||
grub2-mkconfig -o /boot/efi/EFI/centos/grub.cfg #LOG
|
||||
fi
|
||||
else
|
||||
echo "BIOS" #LOG
|
||||
grub2-mkconfig -o /boot/grub2/grub.cfg #LOG
|
||||
fi
|
||||
|
||||
systemctl start serial-getty@$TTYS.service
|
||||
systemctl enable serial-getty@$TTYS.service
|
||||
|
||||
# TODO: /etc/securetty was removed in RHEL 9.2+ and does not exist in RHEL 10.
|
||||
# PAM no longer uses it. This block is a no-op on RHEL 10 but harmless if guarded.
|
||||
if [ -f /etc/securetty ] && ! grep -q "$TTYS" /etc/securetty; then
|
||||
echo "$TTYS" >> /etc/securetty
|
||||
fi
|
||||
|
||||
else
|
||||
echo "No console tty found" #LOG
|
||||
fi
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
# description: Configure box snmp
|
||||
|
||||
echo "Adding snmp configuration" #LOG
|
||||
|
||||
echo "Extracting MIBs" #LOG
|
||||
rm -f /usr/share/snmp/mibs/* #LOG
|
||||
mkdir -p /usr/share/snmp/mibs #LOG
|
||||
wget -q -O - http://$KSRV/KickStart/cfg/$DIST/share/mibs.tgz | tar xzf - -C /usr/share/snmp/mibs #LOG
|
||||
|
||||
echo "Setting MIBs ownership to noc" #LOG
|
||||
chown -R 1108:106 /usr/share/snmp/mibs #LOG
|
||||
restorecon -R /usr/share/snmp/mibs #LOG
|
||||
|
||||
chown 1108:106 /etc/snmp/snmpd.conf #LOG
|
||||
|
||||
ln -s /etc/sysconfig/snmpd /etc/snmp/snmpd.options
|
||||
ln -s /etc/sysconfig/snmptrapd /etc/snmp/snmptrapd.options
|
||||
|
||||
restorecon -R /etc/snmp
|
||||
restorecon -R /etc/sysconfig
|
||||
@@ -0,0 +1 @@
|
||||
S800A-netsnmp
|
||||
@@ -0,0 +1,103 @@
|
||||
# description: Install Dell OpenManage
|
||||
|
||||
if systemd-detect-virt --quiet; then
|
||||
echo "Skipping Dell OpenManage on virtualized test system" #LOG
|
||||
else
|
||||
|
||||
echo "Installing Dell OpenManage" #LOG
|
||||
|
||||
wget -q -O - https://linux.dell.com/repo/hardware/dsu/bootstrap.cgi | bash #LOG
|
||||
|
||||
dnf -y install dell-system-update #LOG
|
||||
dnf -y install srvadmin-all #LOG
|
||||
dnf -y install srvadmin-selinux #LOG
|
||||
dnf -y install srvadmin-idracadm7 #LOG
|
||||
|
||||
echo "Done installing Dell OpenManage Services" #LOG
|
||||
|
||||
# srvadmin-services.sh start
|
||||
|
||||
export PATH=$PATH:/opt/dell/srvadmin/bin:/opt/dell/srvadmin/sbin
|
||||
|
||||
systemctl disable dsm_om_connsvc #LOG
|
||||
systemctl enable dsm_sa_datamgrd.service #LOG
|
||||
systemctl enable dsm_sa_eventmgrd.service #LOG
|
||||
systemctl enable dsm_sa_snmpd.service #LOG
|
||||
|
||||
echo "BIOS boot setup before:" #LOG
|
||||
ipmitool chassis bootdev disk options=persistent #LOG
|
||||
|
||||
#BOOTINFO=/dev/shm/boot.info
|
||||
#omreport chassis biossetup display=shortnames </dev/null | perl -ne 'if (/^BootSeq\s*$/) {$p=1;next} elsif (/^s*$/) {$p=0} if ($p) {print};' | tee $BOOTINFO #LOG
|
||||
#
|
||||
#if ! grep -q Error $BOOTINFO; then
|
||||
#
|
||||
# HDD0=$(grep HardDisk $BOOTINFO | head -1 | awk '{ print $4 }')
|
||||
# NIC0=$(grep NIC $BOOTINFO | head -1 | awk '{ print $4 }')
|
||||
# OPT0=$(grep Optical $BOOTINFO | head -1 | awk '{ print $4 }')
|
||||
#
|
||||
# # Drives seemed to be swapped during kickstart?
|
||||
# if [ -n "$HDD0" ]; then
|
||||
# if [ -n "$NIC0" ]; then
|
||||
# if [ -n "$OPT0" ]; then
|
||||
# omconfig chassis biossetup attribute=BootSeq sequence=$HDD0,$OPT0,$NIC0 </dev/null #LOG
|
||||
# echo "Set BIOS disk order to $HDD0,$OPT0,$NIC0" #LOG
|
||||
# else
|
||||
# omconfig chassis biossetup attribute=BootSeq sequence=$HDD0,$NIC0 </dev/null #LOG
|
||||
# echo "Set BIOS disk order to $HDD0,$NIC0" #LOG
|
||||
# fi
|
||||
# else
|
||||
# if [ -n "$OPT0" ]; then
|
||||
# omconfig chassis biossetup attribute=BootSeq sequence=$HDD0,$OPT0 </dev/null #LOG
|
||||
# echo "Set BIOS disk order to $HDD0,$OPT0 [No PXE NIC found]" #LOG
|
||||
# else
|
||||
# omconfig chassis biossetup attribute=BootSeq sequence=$HDD0 </dev/null #LOG
|
||||
# echo "Set BIOS disk order to $HDD0 [No PXE NIC found]" #LOG
|
||||
# fi
|
||||
# fi
|
||||
# else
|
||||
# omconfig chassis biossetup attribute=BootSeq sequence=HardDisk.List.1-1 </dev/null #LOG
|
||||
# echo "Guessing! Set BIOS disk order to HardDisk.List.1-1 [No HDD found]" #LOG
|
||||
# fi
|
||||
#
|
||||
#else
|
||||
# echo "Skipped OpenManage boot order setup due to previous error" #LOG
|
||||
#
|
||||
#fi
|
||||
|
||||
echo "Setting iDRAC ssh access:" #LOG
|
||||
racadm set iDRAC.IPv4.Enable Enabled #LOG
|
||||
racadm set iDRAC.Nic.Enable 1 #LOG
|
||||
racadm set iDRAC.NIC.Selection LOM1 #LOG
|
||||
racadm set iDRAC.SSH.Enable 1 #LOG
|
||||
|
||||
echo "Setting Power Recovery:" #LOG
|
||||
#omconfig chassis biossetup attribute=AcPwrRcvry setting=On #LOG
|
||||
#omconfig chassis biossetup attribute=AcPwrRcvryDelay setting=Immediate #LOG
|
||||
ipmitool chassis policy always-on #LOG
|
||||
|
||||
#echo "Setting CPU Virtualization Support" #LOG
|
||||
#omconfig chassis biossetup attribute=cpuvt setting=enabled #LOG
|
||||
|
||||
#echo "Setting redirect of bios/bootup to com2/ttyS1" #LOG
|
||||
#omconfig chassis biossetup attribute=SerialComm setting=OnConRedirCom2 #LOG
|
||||
|
||||
echo "Enabling IPMI Over LAN" #LOG
|
||||
#omconfig chassis remoteaccess config=nic enableipmi=true #LOG
|
||||
ipmitool sol set enabled true 1 #LOG
|
||||
|
||||
echo "Setting BMC Remote Access IP Address" #LOG
|
||||
#omconfig chassis remoteaccess config=nic ipaddress=10.1.1.99 subnet=255.255.255.0 ipsource=static gateway=10.1.1.1 #LOG
|
||||
ipmitool lan set 1 ipsrc static #LOG
|
||||
ipmitool lan set 1 ipaddr 10.1.1.99 #LOG
|
||||
ipmitool lan set 1 netmask 255.255.255.0 #LOG
|
||||
ipmitool lan set 1 defgw ipaddr 10.1.1.1 #LOG
|
||||
|
||||
echo "Setting BMC Remote Access User" #LOG
|
||||
#omconfig chassis remoteaccess config=user id=2 newpw=nocnoc confirmnewpw=nocnoc #LOG
|
||||
ipmitool user set password 2 nocnoc #LOG
|
||||
|
||||
echo "BMC remote access settings" #LOG
|
||||
#omreport chassis remoteaccess |grep -A20 "Remote Access Device" #LOG
|
||||
ipmitool lan print 1 #LOG
|
||||
fi
|
||||
@@ -0,0 +1,92 @@
|
||||
# description: Setup network for local DHCP
|
||||
# AlmaLinux 10: dhclient removed; ifcfg format removed.
|
||||
# DNS overrides now use NetworkManager keyfile (via Python configparser).
|
||||
# NTP is handled by S350A-chrony.
|
||||
|
||||
echo "Network configuration." #LOG
|
||||
|
||||
export ST=`/usr/sbin/dmidecode -s system-serial-number`
|
||||
echo "Service Code = $ST" #LOG
|
||||
|
||||
if [ "$PTYPE" == "server" ]; then
|
||||
hostnamectl set-hostname server${ST}.iglass.net
|
||||
echo "server$ST.iglass.net" > /etc/hostname
|
||||
else
|
||||
hostnamectl set-hostname iprobe${ST}.iglass.net
|
||||
echo "iprobe$ST.iglass.net" > /etc/hostname
|
||||
fi
|
||||
|
||||
echo "Disabling ipv6" #LOG
|
||||
cat >> /etc/sysctl.d/10-ipv6.conf <<EOF
|
||||
# Turn off IPv6
|
||||
net.ipv6.conf.all.disable_ipv6 = 1
|
||||
net.ipv6.conf.default.disable_ipv6 = 1
|
||||
EOF
|
||||
|
||||
sysctl -p /etc/sysctl.d/10-ipv6.conf #LOG
|
||||
|
||||
echo "Disabling link-local autoconf" #LOG
|
||||
cat >> /etc/sysctl.d/11-autoconf.conf <<EOF
|
||||
net.ipv6.conf.all.autoconf = 0
|
||||
net.ipv6.conf.default.autoconf = 0
|
||||
EOF
|
||||
|
||||
sysctl -p /etc/sysctl.d/11-autoconf.conf #LOG
|
||||
|
||||
FIRST=
|
||||
for I in $(cd /sys/class/net/; ls -d eth* em* eno* p* enp* 2>/dev/null); do
|
||||
[ "$I" = "lo" ] && continue
|
||||
[ -z "$FIRST" ] && export FIRST=$I
|
||||
echo "Found interface $I" #LOG
|
||||
done
|
||||
|
||||
if [ "$PTYPE" = "server" ]; then
|
||||
echo "Not configuring probe DNS overrides on server type" #LOG
|
||||
|
||||
elif [ -n "$FIRST" ]; then
|
||||
|
||||
echo "Configuring NM DNS overrides for probe on $FIRST" #LOG
|
||||
|
||||
# AlmaLinux 10: dhclient is removed. Set DNS via NetworkManager keyfile.
|
||||
# The installer creates connection profiles in /etc/NetworkManager/system-connections/.
|
||||
# We use Python configparser to inject iglass DNS ahead of DHCP-provided DNS.
|
||||
NM_CON_DIR=/etc/NetworkManager/system-connections
|
||||
|
||||
python3 - "$NM_CON_DIR" "$FIRST" <<'PYEOF'
|
||||
import configparser, os, sys, glob
|
||||
|
||||
condir, first = sys.argv[1], sys.argv[2]
|
||||
|
||||
# Prefer a profile matching the interface name; fall back to any ethernet profile
|
||||
candidates = (
|
||||
glob.glob(os.path.join(condir, first + '.nmconnection')) +
|
||||
glob.glob(os.path.join(condir, '*.nmconnection'))
|
||||
)
|
||||
|
||||
for path in candidates:
|
||||
cfg = configparser.RawConfigParser()
|
||||
cfg.optionxform = str # preserve case
|
||||
cfg.read(path)
|
||||
|
||||
if not cfg.has_section('ipv4'):
|
||||
continue
|
||||
if cfg.get('ipv4', 'method', fallback='') not in ('auto', 'dhcp'):
|
||||
continue
|
||||
|
||||
# Prepend iglass DNS; negative priority means ours ranks above DHCP-provided DNS
|
||||
cfg.set('ipv4', 'dns', '192.168.194.102;192.168.226.102;')
|
||||
cfg.set('ipv4', 'dns-search', 'iglass.net;')
|
||||
cfg.set('ipv4', 'dns-priority', '-100')
|
||||
|
||||
with open(path, 'w') as fh:
|
||||
cfg.write(fh)
|
||||
os.chmod(path, 0o600)
|
||||
print(f"Updated NM profile: {path}")
|
||||
break
|
||||
else:
|
||||
print(f"WARNING: No DHCP ethernet NM profile found under {condir}", file=sys.stderr)
|
||||
PYEOF
|
||||
|
||||
else
|
||||
echo "WARNING: No network interfaces found" #LOG
|
||||
fi
|
||||
@@ -0,0 +1,13 @@
|
||||
echo "Setting up unbound" #LOG
|
||||
|
||||
echo "Telling NetworkManager not to override DNS" #LOG
|
||||
perl -spi -e 's/^(\[main\].*)$/$1\ndns=none/' /etc/NetworkManager/NetworkManager.conf #LOG
|
||||
|
||||
echo "Making sure selinux perms are restored" #LOG
|
||||
restorecon -FR /etc/systemd
|
||||
|
||||
echo "reloading/restarting NetworkManager and Unbound" #LOG
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now unbound.service #LOG
|
||||
systemctl restart NetworkManager
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
S856A-unbound
|
||||
@@ -0,0 +1,26 @@
|
||||
# This is a bug when IPv6 is turned off X forwarding will not try IPv4 localhost if no IPv6 localhost
|
||||
#perl -spi -e 's/(#?AddressFamily\s+.+)$/$1\nAddressFamily inet/' /etc/ssh/sshd_config
|
||||
|
||||
#perl -spi -e 's/^(#MaxSessions 10.*)/$1\nMaxSessions 20/' /etc/ssh/sshd_config
|
||||
echo "MaxSessions 20" >> /etc/ssh/sshd_config.d/90-authnz.conf
|
||||
|
||||
echo "" >> /etc/ssh/sshd_config.d/90-authnz.conf
|
||||
|
||||
#perl -spi -e 's/^\s*PermitRootLogin\s+yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
echo "PermitRootLogin no" >> /etc/ssh/sshd_config.d/90-authnz.conf
|
||||
echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config.d/90-authnz.conf
|
||||
cat >> /etc/ssh/sshd_config.d/90-authnz.conf <<'EOF'
|
||||
|
||||
Match Address 10.1.1.1,10.1.1.254
|
||||
PermitRootLogin prohibit-password
|
||||
EOF
|
||||
|
||||
# sshd -T |grep -iE 'cipher|mac|algorithm'
|
||||
# sshd -t # test config
|
||||
|
||||
echo 'KexAlgorithms=curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512' > /etc/ssh/sshd_config.d/30-crypto-policy-override.conf
|
||||
#echo '[email protected],[email protected],aes256-ctr,[email protected],aes128-ctr' >> /etc/ssh/sshd_config.d/30-crypto-policy-override.conf
|
||||
echo '[email protected],aes256-ctr,[email protected],aes128-ctr' >> /etc/ssh/sshd_config.d/30-crypto-policy-override.conf
|
||||
|
||||
|
||||
restorecon -F /etc/ssh/sshd_config.d/*
|
||||
@@ -0,0 +1 @@
|
||||
S870A-sshd
|
||||
@@ -0,0 +1,14 @@
|
||||
|
||||
|
||||
systemctl enable firewalld.service #LOG
|
||||
|
||||
cat >> /etc/sysctl.d/15-fw-console.conf <<EOF
|
||||
# Turn off below warn(4) to not log firewall messages to console
|
||||
kernel.printk = 4 4 1 7
|
||||
EOF
|
||||
|
||||
##perl -spi -e 's/^DefaultZone=.+$/DefaultZone=external/' /etc/firewalld/firewalld.conf
|
||||
perl -spi -e 's/^DefaultZone=.+$/DefaultZone=block/' /etc/firewalld/firewalld.conf
|
||||
##perl -spi -e 's/^LogDenied=.+$/LogDenied=all/' /etc/firewalld/firewalld.conf
|
||||
perl -spi -e 's/^LogDenied=.+$/LogDenied=unicast/' /etc/firewalld/firewalld.conf
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
S875A-firewall
|
||||
@@ -0,0 +1 @@
|
||||
S900S-rmlogrotate
|
||||
@@ -0,0 +1,16 @@
|
||||
echo "remove logrotate" #LOG
|
||||
|
||||
# Disable cron-based logrotate (RHEL 9 and earlier)
|
||||
if [ -f /etc/cron.daily/logrotate ]; then
|
||||
sed -i '2s/^/exit\n/' /etc/cron.daily/logrotate #LOG
|
||||
fi
|
||||
|
||||
# Disable timer-based logrotate (RHEL 10+)
|
||||
systemctl disable --now logrotate.timer 2>/dev/null || true #LOG
|
||||
rm -f /etc/systemd/system/timers.target.wants/logrotate.timer #LOG
|
||||
|
||||
if [ "$PTYPE" != "server" ]; then
|
||||
touch /var/log/iglass.log
|
||||
touch /var/log/customer.log
|
||||
fi
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
S900S-rmlogrotate
|
||||
@@ -0,0 +1,4 @@
|
||||
echo "Allow hosts" #LOG
|
||||
|
||||
chgrp 106 /etc/hosts #LOG
|
||||
chmod g+w /etc/hosts #LOG
|
||||
@@ -0,0 +1 @@
|
||||
S910P-chmodHosts
|
||||
@@ -0,0 +1,58 @@
|
||||
TMPCRON=/dev/shm/tmp.root.tab
|
||||
/usr/bin/crontab -u root -l | grep -vE hwclock >> $TMPCRON
|
||||
|
||||
/usr/bin/crontab -u root $TMPCRON #LOG
|
||||
rm -f $TMPCRON #LOG
|
||||
|
||||
|
||||
# dhclient removed in RHEL 10 — dhclient.conf migration no longer needed
|
||||
|
||||
|
||||
mv -f /etc/rsyslog.d/50-events.conf.on /etc/rsyslog.d/50-events.conf
|
||||
rm -rf /etc/systemd/system/syslog.service.d/
|
||||
systemctl daemon-reload #LOG
|
||||
systemctl restart rsyslog #LOG
|
||||
|
||||
# Quiet VM-only boot noise from hardware-specific services/configs that are not
|
||||
# relevant to lab PXE validation.
|
||||
mkdir -p /etc/modules-load.d
|
||||
ln -sfn /dev/null /etc/modules-load.d/fwupd-msr.conf #LOG
|
||||
systemctl disable systemd-network-generator.service 2>/dev/null || true #LOG
|
||||
systemctl disable NetworkManager-wait-online.service 2>/dev/null || true #LOG
|
||||
|
||||
if [ -t 0 ]; then
|
||||
read -r -p 'Customer: ' CUST
|
||||
read -r -p 'Hostname/Probe: ' HOST
|
||||
else
|
||||
CUST=${VM_CUST:-}
|
||||
HOST=${VM_HOST:-}
|
||||
echo "No interactive tty available; skipping Customer/Hostname prompts" #LOG
|
||||
fi
|
||||
|
||||
if [ -n "$CUST" ]; then
|
||||
echo "Setting customer to $CUST"
|
||||
date +"%s:$CUST:" > /opt/iglass/conf/.probe-config
|
||||
else
|
||||
echo "No customer supplied"
|
||||
fi
|
||||
|
||||
if [ -n "$HOST" ]; then
|
||||
if ! [[ "$HOST" =~ ".iglass.net"$ ]]; then
|
||||
HOST="$HOST.iglass.net"
|
||||
fi
|
||||
echo "Setting hostname to $HOST"
|
||||
hostnamectl set-hostname $HOST
|
||||
else
|
||||
echo "No host supplied"
|
||||
fi
|
||||
|
||||
rm -f /etc/firewalld/zones/ks.xml #LOG
|
||||
systemctl restart firewalld.service #LOG
|
||||
systemctl restart rsyslog.service #LOG
|
||||
|
||||
echo "CHECK firewalld config!" #LOG
|
||||
[ -e "/etc/firewalld/zones/public.xml" ] && echo "public zone exists!" #LOG
|
||||
#echo -n "etho0: "; grep ZONE /etc/sysconfig/network-scripts/ifcfg-eth0
|
||||
echo "firewall-cmd --get-active-zones:" #LOG
|
||||
firewall-cmd --get-active-zones #LOG
|
||||
echo
|
||||
@@ -0,0 +1,15 @@
|
||||
|
||||
# usbguard-selinux scriptlet crashes the anaconda RPM transaction on AlmaLinux 10.
|
||||
# Install here post-boot instead of via %packages.
|
||||
echo "Installing usbguard post-boot" #LOG
|
||||
dnf install -y usbguard 2>&1 #LOG
|
||||
|
||||
if [ -e /bin/usbguard ]; then
|
||||
echo "Generating usbguard rules but leaving disabled" #LOG
|
||||
/bin/usbguard generate-policy > /etc/usbguard/rules.conf
|
||||
perl -spi -e 's/ImplicitPolicyTarget=\S+/ImplicitPolicyTarget=reject/' /etc/usbguard/usbguard-daemon.conf
|
||||
systemctl disable usbguard.service #LOG
|
||||
else
|
||||
echo "WARNING: usbguard install failed, skipping setup" #LOG
|
||||
fi
|
||||
|
||||
@@ -0,0 +1,283 @@
|
||||
# description: CIS Benchmark Level 1 hardening for AlmaLinux 10
|
||||
# Ref: CIS AlmaLinux OS 10 Benchmark (tracks RHEL 10)
|
||||
#
|
||||
# Scope of this script:
|
||||
# 1.1.1 Disable unused filesystem kernel modules
|
||||
# 1.6 Disable core dumps
|
||||
# 3.3 Network sysctl hardening
|
||||
# 4.x Auditd — audit rules and kernel boot flag
|
||||
# 5.3 sudo hardening
|
||||
# 5.4.1 Password quality (pwquality)
|
||||
# 5.4.3 Account lockout (pam_faillock settings)
|
||||
#
|
||||
# Intentionally deferred / excluded:
|
||||
# 1.1.2 /tmp as separate partition or tmpfs
|
||||
# — deferred pending dev review of /var/tmp exec requirements
|
||||
# 5.4.2 Password aging
|
||||
# — no expiration policy for any accounts in this environment
|
||||
# authselect profile change
|
||||
# — ipa-client-install owns the authselect profile; run
|
||||
# `authselect enable-feature with-faillock` after IPA enrolment
|
||||
# squashfs module blacklist
|
||||
# — left enabled; containers (Docker/Podman) require it
|
||||
# udf module blacklist
|
||||
# — left enabled; not prohibited in this environment
|
||||
# AIDE cron
|
||||
# — managed centrally, not locally
|
||||
|
||||
echo "### CIS Level 1 hardening" #LOG
|
||||
|
||||
# ── 1.1.1 Disable unused filesystem modules ───────────────────────────────────
|
||||
echo "CIS 1.1.1: Blacklisting unused filesystem modules" #LOG
|
||||
|
||||
cat > /etc/modprobe.d/cis-fs-blacklist.conf <<EOF
|
||||
# CIS 1.1.1 — disable unused legacy filesystem drivers
|
||||
install cramfs /bin/true
|
||||
install freevxfs /bin/true
|
||||
install hfs /bin/true
|
||||
install hfsplus /bin/true
|
||||
install jffs2 /bin/true
|
||||
blacklist cramfs
|
||||
blacklist freevxfs
|
||||
blacklist hfs
|
||||
blacklist hfsplus
|
||||
blacklist jffs2
|
||||
EOF
|
||||
|
||||
# ── 1.6 Core dump restrictions ────────────────────────────────────────────────
|
||||
echo "CIS 1.6: Disabling core dumps" #LOG
|
||||
|
||||
cat > /etc/security/limits.d/cis-coredump.conf <<EOF
|
||||
# CIS 1.6.1
|
||||
* hard core 0
|
||||
EOF
|
||||
|
||||
cat > /etc/sysctl.d/20-cis-coredump.conf <<EOF
|
||||
# CIS 1.6.1 — disable setuid core dumps
|
||||
fs.suid_dumpable = 0
|
||||
EOF
|
||||
|
||||
mkdir -p /etc/systemd/coredump.conf.d
|
||||
cat > /etc/systemd/coredump.conf.d/cis.conf <<EOF
|
||||
[Coredump]
|
||||
Storage=none
|
||||
ProcessSizeMax=0
|
||||
EOF
|
||||
|
||||
# ── 3.3 Network kernel parameter hardening ────────────────────────────────────
|
||||
echo "CIS 3.3: Applying network sysctl hardening" #LOG
|
||||
|
||||
cat > /etc/sysctl.d/30-cis-network.conf <<EOF
|
||||
# CIS 3.3.1 — disable IP forwarding (probes/servers are not routers)
|
||||
net.ipv4.ip_forward = 0
|
||||
net.ipv6.conf.all.forwarding = 0
|
||||
|
||||
# CIS 3.3.2 — disable packet redirect sending
|
||||
net.ipv4.conf.all.send_redirects = 0
|
||||
net.ipv4.conf.default.send_redirects = 0
|
||||
|
||||
# CIS 3.3.3 — refuse source-routed packets
|
||||
net.ipv4.conf.all.accept_source_route = 0
|
||||
net.ipv4.conf.default.accept_source_route = 0
|
||||
net.ipv6.conf.all.accept_source_route = 0
|
||||
net.ipv6.conf.default.accept_source_route = 0
|
||||
|
||||
# CIS 3.3.4 — refuse ICMP redirects
|
||||
net.ipv4.conf.all.accept_redirects = 0
|
||||
net.ipv4.conf.default.accept_redirects = 0
|
||||
net.ipv6.conf.all.accept_redirects = 0
|
||||
net.ipv6.conf.default.accept_redirects = 0
|
||||
|
||||
# CIS 3.3.5 — refuse secure ICMP redirects
|
||||
net.ipv4.conf.all.secure_redirects = 0
|
||||
net.ipv4.conf.default.secure_redirects = 0
|
||||
|
||||
# CIS 3.3.6 — log martian packets
|
||||
net.ipv4.conf.all.log_martians = 1
|
||||
net.ipv4.conf.default.log_martians = 1
|
||||
|
||||
# CIS 3.3.7 — ignore broadcast ICMP echo requests
|
||||
net.ipv4.icmp_echo_ignore_broadcasts = 1
|
||||
|
||||
# CIS 3.3.8 — ignore bogus ICMP error responses
|
||||
net.ipv4.icmp_ignore_bogus_error_responses = 1
|
||||
|
||||
# CIS 3.3.9 — enable TCP SYN cookies
|
||||
net.ipv4.tcp_syncookies = 1
|
||||
|
||||
# CIS 3.3.10 — disable IPv6 router advertisements
|
||||
net.ipv6.conf.all.accept_ra = 0
|
||||
net.ipv6.conf.default.accept_ra = 0
|
||||
|
||||
# Kernel ASLR
|
||||
kernel.randomize_va_space = 2
|
||||
EOF
|
||||
|
||||
sysctl -p /etc/sysctl.d/30-cis-network.conf #LOG
|
||||
|
||||
# ── 5.3 sudo hardening ────────────────────────────────────────────────────────
|
||||
echo "CIS 5.3: sudo hardening" #LOG
|
||||
|
||||
cat > /etc/sudoers.d/cis-sudo <<EOF
|
||||
# CIS 5.3.2 — require pty (prevents background sudo abuse)
|
||||
Defaults use_pty
|
||||
# CIS 5.3.3 — log all sudo usage
|
||||
Defaults logfile=/var/log/sudo.log
|
||||
# Limit credential caching to 5 minutes
|
||||
Defaults timestamp_timeout=5
|
||||
EOF
|
||||
chmod 440 /etc/sudoers.d/cis-sudo
|
||||
|
||||
# ── 5.4.1 Password quality ────────────────────────────────────────────────────
|
||||
echo "CIS 5.4.1: pwquality settings" #LOG
|
||||
|
||||
cat > /etc/security/pwquality.conf.d/cis.conf <<EOF
|
||||
# CIS 5.4.1 — password complexity requirements
|
||||
minlen = 14
|
||||
minclass = 4
|
||||
dcredit = -1
|
||||
ucredit = -1
|
||||
ocredit = -1
|
||||
lcredit = -1
|
||||
maxrepeat = 3
|
||||
maxsequence = 3
|
||||
EOF
|
||||
|
||||
# ── 5.4.3 Account lockout via pam_faillock ────────────────────────────────────
|
||||
echo "CIS 5.4.3: pam_faillock configuration" #LOG
|
||||
|
||||
# Write faillock settings — these take effect once authselect enables the
|
||||
# with-faillock feature. Run after IPA enrolment:
|
||||
# authselect enable-feature with-faillock
|
||||
cat > /etc/security/faillock.conf <<EOF
|
||||
# CIS 5.4.3 — lock after 5 failures in a 15-minute window
|
||||
deny = 5
|
||||
fail_interval = 900
|
||||
unlock_time = 900
|
||||
even_deny_root
|
||||
root_unlock_time = 60
|
||||
EOF
|
||||
|
||||
# ── 4.x Audit daemon configuration ───────────────────────────────────────────
|
||||
echo "CIS 4.x: Configuring auditd" #LOG
|
||||
|
||||
VM_DMI_SIGNATURE="$(
|
||||
cat /sys/class/dmi/id/sys_vendor /sys/class/dmi/id/product_name /sys/class/dmi/id/product_version 2>/dev/null \
|
||||
| tr '\n' ' '
|
||||
)"
|
||||
VM_KS_HINT=0
|
||||
if [ "$PTYPE" = "VM" ] || [ -b /dev/vda ] || [ -d /sys/block/vda ]; then
|
||||
VM_KS_HINT=1
|
||||
fi
|
||||
|
||||
if [ "$VM_KS_HINT" -eq 1 ] || systemd-detect-virt --quiet || echo "$VM_DMI_SIGNATURE" | grep -Eiq 'qemu|kvm|vmware|virtualbox|standard pc'; then
|
||||
AUDITD_VM_SKIP=1
|
||||
echo "Skipping boot-time auditd enablement on virtualized test system" #LOG
|
||||
mkdir -p /etc/systemd/system/dbus-broker.service.d
|
||||
cat > /etc/systemd/system/dbus-broker.service.d/10-no-audit.conf <<'EOF'
|
||||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/usr/bin/dbus-broker-launch --scope system
|
||||
EOF
|
||||
else
|
||||
AUDITD_VM_SKIP=0
|
||||
# 4.1.3 — Ensure auditing for processes that start prior to auditd
|
||||
grubby --update-kernel=ALL --args="audit=1 audit_backlog_limit=8192" #LOG
|
||||
fi
|
||||
|
||||
# 4.1.4–4.1.17 — Static audit rules
|
||||
mkdir -p /etc/audit/rules.d
|
||||
cat > /etc/audit/rules.d/cis.rules <<'AUDITRULES'
|
||||
## CIS AlmaLinux 10 Level 1 — Section 4 audit rules
|
||||
## Generated by kickstart S940A-cis-hardening
|
||||
|
||||
# 4.1.4 — Date/time changes
|
||||
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
|
||||
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
|
||||
-a always,exit -F arch=b64 -S clock_settime -k time-change
|
||||
-a always,exit -F arch=b32 -S clock_settime -k time-change
|
||||
-w /etc/localtime -p wa -k time-change
|
||||
|
||||
# 4.1.5 — User/group identity changes
|
||||
-w /etc/group -p wa -k identity
|
||||
-w /etc/passwd -p wa -k identity
|
||||
-w /etc/gshadow -p wa -k identity
|
||||
-w /etc/shadow -p wa -k identity
|
||||
-w /etc/security/opasswd -p wa -k identity
|
||||
|
||||
# 4.1.6 — Network environment changes
|
||||
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
|
||||
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
|
||||
-w /etc/issue -p wa -k system-locale
|
||||
-w /etc/issue.net -p wa -k system-locale
|
||||
-w /etc/hosts -p wa -k system-locale
|
||||
-w /etc/NetworkManager/ -p wa -k system-locale
|
||||
|
||||
# 4.1.7 — MAC policy (SELinux)
|
||||
-w /etc/selinux/ -p wa -k MAC-policy
|
||||
-w /usr/share/selinux/ -p wa -k MAC-policy
|
||||
|
||||
# 4.1.8 — Login/logout events
|
||||
-w /var/log/faillog -p wa -k logins
|
||||
-w /var/log/lastlog -p wa -k logins
|
||||
-w /var/log/tallylog -p wa -k logins
|
||||
|
||||
# 4.1.9 — Session initiation
|
||||
-w /var/run/utmp -p wa -k session
|
||||
-w /var/log/wtmp -p wa -k logins
|
||||
-w /var/log/btmp -p wa -k logins
|
||||
|
||||
# 4.1.10 — Permission modification events
|
||||
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
||||
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
||||
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
||||
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
||||
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
||||
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
||||
|
||||
# 4.1.11 — Unauthorized file access attempts
|
||||
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
|
||||
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
|
||||
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
|
||||
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
|
||||
|
||||
# 4.1.13 — File system mounts
|
||||
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
|
||||
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
|
||||
|
||||
# 4.1.14 — File deletion by users
|
||||
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
|
||||
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
|
||||
|
||||
# 4.1.15 — sudoers scope changes
|
||||
-w /etc/sudoers -p wa -k scope
|
||||
-w /etc/sudoers.d/ -p wa -k scope
|
||||
|
||||
# 4.1.16 — sudo log
|
||||
-w /var/log/sudo.log -p wa -k actions
|
||||
|
||||
# 4.1.17 — Kernel module loading/unloading
|
||||
-w /sbin/insmod -p x -k modules
|
||||
-w /sbin/rmmod -p x -k modules
|
||||
-w /sbin/modprobe -p x -k modules
|
||||
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules
|
||||
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules
|
||||
AUDITRULES
|
||||
|
||||
# 4.1.12 — Privileged command auditing (generated dynamically)
|
||||
find / -xdev \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null \
|
||||
| awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged"}' \
|
||||
>> /etc/audit/rules.d/cis.rules #LOG
|
||||
|
||||
# 4.1.18 — Make rules immutable (requires reboot to change)
|
||||
echo "-e 2" >> /etc/audit/rules.d/cis.rules
|
||||
|
||||
# 4.1.2 — Enable auditd service
|
||||
if [ "$AUDITD_VM_SKIP" -eq 0 ]; then
|
||||
systemctl enable auditd #LOG
|
||||
else
|
||||
systemctl disable auditd 2>/dev/null || true #LOG
|
||||
systemctl daemon-reload #LOG
|
||||
fi
|
||||
|
||||
echo "CIS hardening complete" #LOG
|
||||
@@ -0,0 +1,16 @@
|
||||
# Selinux relabel the filesystem
|
||||
#
|
||||
echo "Setting up local rules for selinux" #LOG
|
||||
|
||||
wget -qO /root/local.avc http://$KSRV/KickStart/cfg/$DIST/share/selinux/local.avc
|
||||
|
||||
echo 'cd /root/; audit2allow -M local -i local.avc; semodule -i local.pp; cd -' > /root/sefix.sh
|
||||
sh /root/sefix.sh
|
||||
|
||||
echo "/usr/share/snmp/mibs/.index" >> /etc/selinux/restorecond.conf
|
||||
|
||||
# Do this before aide
|
||||
echo "Restoring any incorrect context labels" #LOG
|
||||
#touch /.autorelabel
|
||||
fixfiles -F restore / #LOG
|
||||
#restorecon -r / #LOG
|
||||
@@ -0,0 +1 @@
|
||||
S960A-selinux
|
||||
@@ -0,0 +1,19 @@
|
||||
|
||||
if [ -x /sbin/aide ]; then
|
||||
|
||||
echo "Creating initial aide reference db" #LOG
|
||||
/usr/sbin/aide --init #LOG
|
||||
if [ -e /var/lib/aide/aide.db.new.gz ]; then
|
||||
mv -f /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz #LOG
|
||||
elif [ -e /var/lib/aide/aide.db.new ]; then
|
||||
mv -f /var/lib/aide/aide.db.new /var/lib/aide/aide.db #LOG
|
||||
else
|
||||
echo "WARNING: AIDE did not create a reference database" #LOG
|
||||
fi
|
||||
|
||||
else
|
||||
echo "No aide package found" #LOG
|
||||
fi
|
||||
|
||||
# NOTE: 'enumerate = true' was removed in RHEL 10 for AD/IdM SSSD providers.
|
||||
# Setting it would produce a warning and be ignored. Removed 2026-03-27.
|
||||
@@ -0,0 +1 @@
|
||||
S980A-monitor
|
||||
@@ -0,0 +1,293 @@
|
||||
# Tell me when and where I'm done
|
||||
|
||||
# Copy these to mem for mailem and not cat them via the script to be on the safe side.
|
||||
|
||||
TMP=$(tmpdir)
|
||||
if [ $? -eq 0 ]; then
|
||||
|
||||
SSHDIR="$TMP/ssh"
|
||||
mkdir $SSHDIR
|
||||
|
||||
chmod -R 700 $TMP #LOG
|
||||
|
||||
ME='[email protected]'
|
||||
HOME=/root
|
||||
SAVEDIR="/home/KickStart/ks-logs"
|
||||
|
||||
# IDENTITY from SXXXP-noc-iglass
|
||||
|
||||
MAIL_FILE="kickstart.info"
|
||||
SSHID="obelisk_rsa"
|
||||
SSHCFG="$SSHDIR/ssh.cfg"
|
||||
|
||||
wget -nv -r -P$TMP/ssh -l 1 -nd --follow-tags a -A "$SSHID*" http://$KSRV/KickStart/ks/probe/ #LOG
|
||||
|
||||
chmod 600 $SSHDIR/$SSHID
|
||||
chmod 644 $SSHDIR/${SSHID}.pub
|
||||
|
||||
if [ -z "$SSHPORT" ]; then
|
||||
echo "WARNING: No ssh options defined" #LOG
|
||||
SSHPORT=22
|
||||
fi
|
||||
|
||||
echo "Host *
|
||||
User ks
|
||||
IdentityFile $SSHDIR/$SSHID
|
||||
StrictHostKeyChecking no
|
||||
UserKnownHostsFile $TMP/ssh/known_hosts
|
||||
CheckHostIP no
|
||||
VerifyHostKeyDNS no
|
||||
BatchMode yes
|
||||
|
||||
Port $SSHPORT
|
||||
ForwardX11 no" > $SSHCFG
|
||||
|
||||
chmod 664 $SSHCFG
|
||||
|
||||
SSHOPT="-F $SSHCFG"
|
||||
|
||||
if ! getent ahostsv4 "$SSHHOST" >/dev/null 2>&1; then
|
||||
echo "WARNING: SSHHOST $SSHHOST is not resolvable, skipping remote notification steps" #LOG
|
||||
exit 0
|
||||
fi
|
||||
|
||||
#ST=`/usr/sbin/dmidecode |perl -ne 'if (/Serial Number:\s*(.+)/) { print "$1\n"; last;}'`
|
||||
#MD=`/usr/sbin/dmidecode |perl -ne 'if (/Product Name:\s*(.+)/) { print "$1\n"; last;}'`
|
||||
|
||||
ST=`/usr/sbin/dmidecode -s system-serial-number | sed 's/\s*//g'`
|
||||
MD=`/usr/sbin/dmidecode -s system-product-name`
|
||||
#FP=`/usr/bin/ssh-keygen -l -f $IDENTITY 2> /dev/null | awk '{ print $2 }'`
|
||||
|
||||
#if [ -z "$ST" -a $(uname -r | grep -c amz) -eq 1 ]; then
|
||||
# wget -q -O- http://s3.amazonaws.com/ec2metadata/ec2-metadata > /usr/local/bin/ec2-metadata
|
||||
# chmod 755 /usr/local/bin/ec2-metadata
|
||||
# /usr/local/bin/ec2-metadata --instance-id
|
||||
|
||||
if [ "$PTYPE" = "VM" ]; then
|
||||
if [ -z "$ST" ]; then
|
||||
ST=$(wget -q -O- http://169.254.169.254/latest/meta-data/instance-id)
|
||||
fi
|
||||
if [ -z "$MD" ]; then
|
||||
MD=$(wget -q -O- http://169.254.169.254/latest/meta-data/instance-type)
|
||||
fi
|
||||
fi
|
||||
|
||||
KEY="NA"
|
||||
# CRYPTEDDEV should be previously setup if kickstarted
|
||||
if [ -e "$CRYPTEDDEV" ]; then
|
||||
KEY=`cryptsetup luksUUID $CRYPTEDDEV 2> /dev/null`
|
||||
fi
|
||||
|
||||
# Detect primary NIC — try legacy names first, fall back to first non-loopback
|
||||
ETH=
|
||||
for _candidate in eth0 em1 p1p1 eno1; do
|
||||
if [ -e "/sys/class/net/$_candidate" ]; then
|
||||
ETH="$_candidate"
|
||||
break
|
||||
fi
|
||||
done
|
||||
if [ -z "$ETH" ]; then
|
||||
ETH=$(ip -o link show | awk -F': ' '!/lo/{print $2; exit}')
|
||||
fi
|
||||
if [ -z "$ETH" ]; then
|
||||
echo "ERROR: No primary network interface found" #LOG
|
||||
fi
|
||||
|
||||
MAC=$(ip -o addr show $ETH | perl -ne 'if (/link\/ether\s+(\S+)/) { print "$1\n"; }')
|
||||
|
||||
if [ -n "$ST" ]; then
|
||||
SAVEDIR="$SAVEDIR/$ST"
|
||||
elif [ -n "$MAC" ]; then
|
||||
ST="$MAC"
|
||||
SAVEDIR="$SAVEDIR/$MAC"
|
||||
else
|
||||
SAVEDIR="$SAVEDIR/`date +%s`"
|
||||
fi
|
||||
|
||||
ssh $SSHOPT $SSHHOST mkdir $SAVEDIR #LOG
|
||||
ssh $SSHOPT $SSHHOST chmod 700 $SAVEDIR/ #LOG
|
||||
|
||||
if [ -e "$CPP1" ]; then
|
||||
OP=`cat $CPP1`
|
||||
fi
|
||||
|
||||
echo "Creating email to $ME" #LOG
|
||||
|
||||
echo "Date: `date`" > $TMP/$MAIL_FILE
|
||||
echo "Product Name: $MD" >> $TMP/$MAIL_FILE
|
||||
echo "Service Tag: $ST" >> $TMP/$MAIL_FILE
|
||||
echo "Distribution: $DIST" >> $TMP/$MAIL_FILE
|
||||
echo "iGlass Version: "$(echo $IGRELEASE | awk -F . '{print $1}') >> $TMP/$MAIL_FILE
|
||||
echo "Type: $PTYPE" >> $TMP/$MAIL_FILE
|
||||
ip -4 -o addr show | perl -ne 'if (/\d+:\s+(\S+)\s+inet\s+([\d\.]+)/ && ($1 !~ /^lo/)) { print "Address $1: $2\n"; }' >> $TMP/$MAIL_FILE
|
||||
echo "Install Time: `uptime | perl -ne 'if (/^\s*\S+\s+up\s+([^,]+),/) { print $1; }'`" >> $TMP/$MAIL_FILE
|
||||
|
||||
cat $TMP/$MAIL_FILE #LOG
|
||||
|
||||
#echo "Opt Pass: $OP" >> $TMP/$MAIL_FILE
|
||||
if [ "$PTYPE" != "server" -a "$PTYPE" != "VM" ]; then
|
||||
if [ -n "$OP" ]; then
|
||||
echo "Opt Pass: OK" >> $TMP/$MAIL_FILE
|
||||
else
|
||||
echo " !!!!!!!!!!!" >> $TMP/$MAIL_FILE
|
||||
echo "Opt Pass: !!! BAD !!!" >> $TMP/$MAIL_FILE
|
||||
echo " !!!!!!!!!!!" >> $TMP/$MAIL_FILE
|
||||
fi
|
||||
fi
|
||||
echo "Host Key: $KEY" >> $TMP/$MAIL_FILE
|
||||
if [ -n "$IDENTITY" ] && [ -e "${IDENTITY}.pub" ]; then
|
||||
scp $SSHOPT ${IDENTITY}.pub $SSHHOST:$SAVEDIR/probe-id.pub #LOG
|
||||
else
|
||||
echo "WARNING: No probe identity public key available to upload" #LOG
|
||||
fi
|
||||
#echo "Public key: Attached" >> $TMP/$MAIL_FILE
|
||||
# ATTACH="-a $SAVEDIR/probe-id.pub"
|
||||
echo >> $TMP/$MAIL_FILE
|
||||
echo "Total Memory: `perl -ne 'if (/^MemTotal:\s+(.+)$/) { print $1; }' /proc/meminfo`" >> $TMP/$MAIL_FILE
|
||||
lshw -C memory | perl -ne 'if (/\*\-bank/) { $ok=1; print; } elsif ( $ok && (/description|slot|size/) ) { print; }' >> $TMP/$MAIL_FILE
|
||||
echo "Disk Info:" >> $TMP/$MAIL_FILE
|
||||
lshw -C disk | perl -ne 'if (/\*\-|description|product|vendor|serial|size/) { print; }' >> $TMP/$MAIL_FILE
|
||||
echo >> $TMP/$MAIL_FILE
|
||||
echo "SCSI Info [`perl -ne 'if (/^\s+\d+\s+\d+\s+(sd\w+)/) { push @s, $1 } END { print join(" ",@s) }' /proc/diskstats`]:" >> $TMP/$MAIL_FILE
|
||||
cat /proc/scsi/scsi >> $TMP/$MAIL_FILE
|
||||
echo >> $TMP/$MAIL_FILE
|
||||
echo "Network Interfaces:" >> $TMP/$MAIL_FILE
|
||||
ip -o -f link addr show |grep ether >> $TMP/$MAIL_FILE
|
||||
echo >> $TMP/$MAIL_FILE
|
||||
echo "Bios Setup:" >> $TMP/$MAIL_FILE
|
||||
# /opt/dell/srvadmin/bin/omreport chassis biossetup |grep -E 'Boot Sequence|Virtualization|Power Recovery' 2>&1 >> $TMP/$MAIL_FILE
|
||||
ipmitool chassis bootparam get 5 | grep Boot\ Device 2>&1 >> $TMP/$MAIL_FILE
|
||||
# dmidecode -t processor | grep VME
|
||||
echo >> $TMP/$MAIL_FILE
|
||||
#/opt/dell/srvadmin/bin/omreport chassis remoteaccess |grep -A20 "Remote Access Device" >> $TMP/$MAIL_FILE
|
||||
#/opt/dell/srvadmin/bin/omreport chassis remoteaccess 2>&1 >> $TMP/$MAIL_FILE
|
||||
ipmitool lan print 1 |grep -A8 "IP Address Source" 2>&1 >> $TMP/$MAIL_FILE
|
||||
|
||||
scp $SSHOPT $TMP/$MAIL_FILE $SSHHOST:$SAVEDIR/ #LOG
|
||||
|
||||
for to in $ME; do
|
||||
echo "Sending email to $to" #LOG
|
||||
#ssh $SSHOPT $SSHHOST "mutt -s 'KickStart $MD $ST done' $ATTACH $to < $SAVEDIR/$MAIL_FILE" #LOG
|
||||
ssh $SSHOPT $SSHHOST "mail -s 'KickStart $MD $ST done' $ATTACH $to < $SAVEDIR/$MAIL_FILE" #LOG
|
||||
done
|
||||
echo "Mailed setup to $ME" #LOG
|
||||
|
||||
scp $SSHOPT /root/*.cfg /root/*log $SSHHOST:$SAVEDIR/ #LOG
|
||||
|
||||
if [ -a /var/lib/aide/aide.db.gz ]; then
|
||||
# Copy over base aide file integrity db from S980A-aide
|
||||
scp $SSHOPT /var/lib/aide/aide.db.gz $SSHHOST:$SAVEDIR/ #LOG
|
||||
fi
|
||||
|
||||
if [ "$PTYPE" != "server" ]; then
|
||||
|
||||
if [ -n "$IDENTITY" ] && [ -e "${IDENTITY}.pub" ]; then
|
||||
PK=`cat ${IDENTITY}.pub | perl -ne 'if (/^(.+)\s+\S+\@\S+$/) { print "$1\n"; } else { print; }'`
|
||||
else
|
||||
PK="NA"
|
||||
fi
|
||||
|
||||
WEEK=604800
|
||||
WEEK2=1209600
|
||||
WEEK4=2419200
|
||||
EPOCH='1969-12-31 19:00:00-05'
|
||||
|
||||
THERE=`ssh $SSHOPT $SSHHOST "PGSERVICE=iglass2 psql -U noc -Aqtc \"SELECT service_tag FROM probes_auth WHERE service_tag = '$ST' LIMIT 1\""`
|
||||
|
||||
if [ "$ST" = "$THERE" ]; then
|
||||
DATA="(hostkey, optpass, optexpire, expire, publickey)"
|
||||
if [ "$PTYPE" = "ds" ]; then
|
||||
VALUES="('$KEY', '$OP', (now() + '$WEEK'), (now() + '$WEEK4'), '$PK')"
|
||||
echo "Updating probe auth: ('$KEY', <OP>, (now() + '$WEEK'), (now() + '$WEEK4'), <PK>) FOR '$ST'" #LOG
|
||||
else
|
||||
VALUES="('$KEY', '$OP', '$EPOCH', '$EPOCH', '$PK')"
|
||||
echo "Updating probe auth: ('$KEY', <OP>, $EPOCH, $EPOCH, <PK>) FOR '$ST'" #LOG
|
||||
fi
|
||||
|
||||
QUERY="UPDATE probes_auth SET $DATA = $VALUES WHERE service_tag = '$ST'"
|
||||
|
||||
#elif [ "$PTYPE" = "ds" -o "$PTYPE" = "VM" ]; then
|
||||
elif false; then
|
||||
NEWDEV=`ssh $SSHOPT $SSHHOST PGSERVICE=iglass2 psql -U noc -Aqtc \"SELECT tun_r_device FROM probes_auth WHERE tun_r_device like \'tun%\' ORDER BY probes_authid\" | perl -ne 'if (/^tun(\d+)$/) { if ( !defined $i ) { $i = $1; } elsif ( $1 > $i ) { $i = $1 } } END { if (defined $i) { print "\x27tun",($i+1),"\x27\n"; } else { print "NULL\n"; } }'`
|
||||
|
||||
NEWADDR=$(ssh $SSHOPT $SSHHOST PGSERVICE=iglass2 psql -U noc -Aqtc \"SELECT tun_l_addr FROM probes_auth WHERE tun_l_addr IS NOT NULL ORDER BY probes_authid\" | perl -ne 'if (/^(\d+\.\d+\.\d+\.)(\d+)$/) { if ( !defined $i ) { $i = $2; } elsif ( $2 > $i ) { $i = $2 } $j=$1 } END { if (defined $i) { print "\x27$j",($i+1),"\x27\n"; } else { print "NULL\n"; } }')
|
||||
|
||||
NEWRADDR=$(echo $NEWADDR | perl -ne 'if (/(\d+\.\d+\.\d+\.)(\d+)/) { print $1.(100+$2) } else { print }')
|
||||
|
||||
echo "Found next tunnel device to be $NEWDEV and addr $NEWADDR" #LOG
|
||||
|
||||
DATA="hostkey, service_tag, optpass, optexpire, expire, tun_r_device, tun_l_addr, tun_r_addr, publickey"
|
||||
#VALUES="'$KEY', '$ST', '$OP', (now() + '$WEEK'), (now() + '$WEEK4'), $NEWDEV, $NEWADDR, '$NEWRADDR', '$PK'"
|
||||
VALUES="'$KEY', '$ST', '$OP', '1969-12-31 19:00:00-05', '1969-12-31 19:00:00-05', $NEWDEV, $NEWADDR, '$NEWRADDR', '$PK'"
|
||||
|
||||
if [ "$PTYPE" = "VM" ]; then
|
||||
RADDR=$(wget -qO - https://noc.iglass.net/login/whoami.cgi)
|
||||
DATA="$DATA, r_addr"
|
||||
VALUES="$VALUES, '$RADDR'"
|
||||
fi
|
||||
|
||||
|
||||
QUERY="INSERT INTO probes_auth ($DATA) VALUES ($VALUES)"
|
||||
|
||||
TUNCFG="$IG_HOME/conf/tunnel/tunnel.cfg"
|
||||
echo "Creating $TUNCFG" #LOG
|
||||
echo "HOME_ADDR=216.134.202.55" > $TUNCFG
|
||||
echo "TUN_REMOTE_DEVICE=$NEWDEV" >> $TUNCFG
|
||||
echo "TUN_REMOTE_ADDR=$NEWRADDR" >> $TUNCFG
|
||||
echo "TUN_LOCAL_ADDR=$NEWADDR" >> $TUNCFG
|
||||
echo "TUN_NETMASK=255.255.255.0" >> $TUNCFG
|
||||
echo "LOCAL_ROUTES=\"192.168.175.0/24 192.168.176.0/24 192.168.177.0/24 192.168.185.112/28\"" >> $TUNCFG
|
||||
|
||||
echo "Adding DS probe auth: ('$KEY', '$ST', 'OP', (now() + '$WEEK'), (now() + '$WEEK4'), $NEWDEV, $NEWADDR, $NEWRADDR, 'PK')" #LOG
|
||||
|
||||
else
|
||||
|
||||
DATA="(hostkey, service_tag, optpass, optexpire, expire, tun_r_device, publickey)"
|
||||
VALUES="('$KEY', '$ST', '$OP', '$EPOCH', '$EPOCH', 'NA', '$PK')"
|
||||
|
||||
QUERY="INSERT INTO probes_auth $DATA VALUES $VALUES"
|
||||
|
||||
echo "Adding probe auth: ('$KEY', '$ST', 'OP', 'PK')" #LOG
|
||||
|
||||
fi
|
||||
fi
|
||||
|
||||
ssh $SSHOPT $SSHHOST PGSERVICE=iglass2 psql -U noc -c \"$QUERY\" #LOG
|
||||
|
||||
# SHM=/dev/shm
|
||||
# # This relies on P010A-1passwd and R010P-1passwd as well
|
||||
# # Think this would be better in probe-config
|
||||
# if [ -f $SHM/user.1pw -a -f $SHM/pw.1pw ]; then
|
||||
# OPUSER=$(cat $SHM/user.1pw)
|
||||
# OPMPW=$(cat $SHM/pw.1pw)
|
||||
#
|
||||
# OPDOMAIN="iglassnetworks"
|
||||
# OPVAULT="Private"
|
||||
# OPTITLE="iprobe [$ST]"
|
||||
#
|
||||
# echo "For 1passord to work $(ssh $SSHOPT $SSHHOST id -un) must sign in first with: op signin $OPDOMAIN.1password.com $OPUSER <secretkey> [<masterpassword>] --output=raw" #LOG
|
||||
#
|
||||
#
|
||||
# echo -n "Creating 1password entry for $OPTITLE: " #LOG
|
||||
# # ssh -F /dev/shm/tmp.qCxU3EDdeR/ssh/ssh.cfg kserver.iglass.net eval ; PWENCODED=$(echo {"notesPlain":"Service Tag: HPYWHL2","sections":[],"passwordHistory":[],"password":"1w8ipN7zGAT6/Bc9uM2gdwiyVD2cpV"} | op encode); op create item Password --title="iprobe [HPYWHL2]" --vault=Private --tags="probe passphrases"; op signout OP_SESSION_iglassnetworks"
|
||||
#
|
||||
# #eval "\
|
||||
# echo "\
|
||||
# ssh $SSHOPT $SSHHOST eval \$(op signin $OPDOMAIN $OPMPW); \
|
||||
# PWENCODED=\$(echo '{\"notesPlain\":\"Service Tag: $ST\",\"sections\":[],\"passwordHistory\":[],\"password\":\"$OP\"}' | op encode); \
|
||||
# op create item Password \$PWENCODED --title=\"$OPTITLE\" --vault=$OPVAULT --tags=\"probe passphrases\"; \
|
||||
# op signout OP_SESSION_$OPDOMAIN\"" #LOG
|
||||
#
|
||||
# # It will created duplicates with different uuids
|
||||
# #if op get item \"$OPTITLE\" --vault=Private &> /dev/null; then echo 1password entry created; else echo Could not create 1password entry; fi \"" #LOG
|
||||
#
|
||||
#
|
||||
# else
|
||||
# echo ERROR: Master password for 1password not found #LOG
|
||||
# fi
|
||||
|
||||
rm -rf $TMP
|
||||
|
||||
else
|
||||
echo ERROR: Could not create tmp dir for mailme probe setup #LOG
|
||||
fi
|
||||
@@ -0,0 +1 @@
|
||||
S990A-mailme
|
||||
@@ -0,0 +1,82 @@
|
||||
|
||||
cd /root
|
||||
|
||||
VM_DMI_SIGNATURE="$(
|
||||
cat /sys/class/dmi/id/sys_vendor /sys/class/dmi/id/product_name /sys/class/dmi/id/product_version 2>/dev/null \
|
||||
| tr '\n' ' '
|
||||
)"
|
||||
VM_KS_HINT=0
|
||||
if [ "$PTYPE" = "VM" ] || [ -b /dev/vda ] || [ -d /sys/block/vda ]; then
|
||||
VM_KS_HINT=1
|
||||
fi
|
||||
|
||||
if [ "$VM_KS_HINT" -eq 1 ] || systemd-detect-virt --quiet || echo "$VM_DMI_SIGNATURE" | grep -Eiq 'qemu|kvm|vmware|virtualbox|standard pc'; then
|
||||
echo "Applying late VM boot fixes and skipping firmware lookup on virtualized test system" #LOG
|
||||
|
||||
mkdir -p /etc/systemd/system/dbus-broker.service.d
|
||||
cat > /etc/systemd/system/dbus-broker.service.d/10-no-audit.conf <<'EOF'
|
||||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/usr/bin/dbus-broker-launch --scope system
|
||||
EOF
|
||||
|
||||
mkdir -p /etc/modules-load.d
|
||||
ln -sfn /dev/null /etc/modules-load.d/fwupd-msr.conf #LOG
|
||||
|
||||
systemctl disable auditd.service audit-rules.service 2>/dev/null || true #LOG
|
||||
systemctl mask auditd.service audit-rules.service 2>/dev/null || true #LOG
|
||||
systemctl disable systemd-network-generator.service 2>/dev/null || true #LOG
|
||||
systemctl disable NetworkManager-wait-online.service 2>/dev/null || true #LOG
|
||||
rm -f /etc/systemd/system/multi-user.target.wants/auditd.service #LOG
|
||||
|
||||
mkdir -p /root/kickstart-debug
|
||||
cat > /root/kickstart-debug/vm-boot-fixes.txt <<EOF
|
||||
late_vm_boot_fixes=1
|
||||
date=$(date -Is)
|
||||
vm_dmi_signature=$VM_DMI_SIGNATURE
|
||||
EOF
|
||||
|
||||
systemctl daemon-reload #LOG
|
||||
else
|
||||
|
||||
MD=$(/usr/sbin/dmidecode -s system-product-name | sed -e 's/ /_/g')
|
||||
|
||||
wget -nv "http://$KSRV/KickStart/cfg/$DIST/share/firmware/BIOS-$MD.BIN" #LOG
|
||||
wget -nv "http://$KSRV/KickStart/cfg/$DIST/share/firmware/RAC-$MD.BIN" #LOG
|
||||
|
||||
# TODO: Firmware update support is currently disabled (wrapped in 'if false').
|
||||
# When re-enabling: verify Dell DSU / iDRAC firmware BIN format is still supported
|
||||
# on RHEL 10, update paths if needed, and test on physical hardware before enabling.
|
||||
if false; then
|
||||
echo skip
|
||||
if [ -e "BIOS-$MD.BIN" ]; then
|
||||
if sh BIOS-$MD.BIN -qc #LOG
|
||||
then
|
||||
echo "Attempting bios update" #LOG
|
||||
sh "BIOS-$MD.BIN" -q #LOG
|
||||
else
|
||||
echo "Not attempting bios update" #LOG
|
||||
fi
|
||||
rm -f "BIOS-$MD.BIN" #LOG
|
||||
else
|
||||
echo "No bios update for $MD found." #LOG
|
||||
fi
|
||||
|
||||
if [ -e "RAC-$MD.BIN" ]; then
|
||||
if sh RAC-$MD.BIN -qc #LOG
|
||||
then
|
||||
echo "Attempting RAC update" #LOG
|
||||
sh "RAC-$MD.BIN" -q #LOG
|
||||
ipmitool mc reset cold #LOG
|
||||
else
|
||||
echo "Not attempting RAC update" #LOG
|
||||
fi
|
||||
rm -f "RAC-$MD.BIN" #LOG
|
||||
else
|
||||
echo "No RAC update for $MD found." #LOG
|
||||
fi
|
||||
|
||||
else
|
||||
echo "Firmware uploaded"
|
||||
fi
|
||||
fi
|
||||
@@ -0,0 +1,8 @@
|
||||
|
||||
# This messes up DNS in containers and already set with authselct
|
||||
#echo "Setting dns to resolver" #LOG
|
||||
#rm -f /etc/resolv.conf
|
||||
#ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf #LOG
|
||||
|
||||
#echo "Removing dnf kickstart proxy" #LOG
|
||||
#perl -spi -e 's/^(proxy=.+)$/# $1/' /etc/dnf/dnf.conf
|
||||
@@ -0,0 +1,18 @@
|
||||
|
||||
tmpdir() {
|
||||
local RETVAL=1
|
||||
local TMP=
|
||||
|
||||
if [ -d /dev/shm ]; then
|
||||
TMP=$(mktemp -d -p /dev/shm)
|
||||
else
|
||||
TMP=$(mktemp -d -p /tmp)
|
||||
fi
|
||||
|
||||
if [ -n "$TMP" -a -d "$TMP" ]; then
|
||||
echo $TMP
|
||||
RETVAL=0
|
||||
fi
|
||||
|
||||
return $RETVAL
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
|
||||
exec < /dev/tty6 > /dev/tty6 2> /dev/tty6
|
||||
chvt 6
|
||||
|
||||
[email protected]
|
||||
|
||||
echo
|
||||
echo "Please enter 1password credentials for saving /opt/iglass key."
|
||||
echo
|
||||
|
||||
read -p "Email address [$OPUSER]: " TMPU
|
||||
|
||||
[ -n "$TMPU" ] && OPUSER="$TMPU"
|
||||
|
||||
#while [ -z "$OPMPW" -a "$OPMPW" -ne "$OPMPW2"]; do
|
||||
while [ -z "$OPMPW" ]; do
|
||||
#read -s -p "Master password for $OPUSER: " OPMPW
|
||||
#read -s -p "Re-enter Master password: " OPMPW2
|
||||
read -p "Master password for $OPUSER: " OPMPW
|
||||
echo
|
||||
# Add verify and get key here to know if login is correct?
|
||||
clear
|
||||
done
|
||||
|
||||
SHM=/dev/shm
|
||||
if [ -d $SHM ]; then
|
||||
echo -n "$OPUSER" > $SHM/user.1pw
|
||||
echo -n "$OPMPW" > $SHM/pw.1pw
|
||||
$LOGGER "Master password for 1password user $OPUSER saved"
|
||||
else
|
||||
$LOGGER "Could not save master password for 1password user $OPUSER"
|
||||
fi
|
||||
|
||||
chvt 1
|
||||
exec < /dev/tty1 > /dev/tty1 2> /dev/tty1
|
||||
@@ -0,0 +1,12 @@
|
||||
echo "Moving 1password files" #LOG
|
||||
|
||||
if [ -d /mnt/sysimage/dev/shm/ ]; then
|
||||
mv -f /dev/shm/user.1pw /mnt/sysimage/dev/shm/ #LOG
|
||||
mv -f /dev/shm/pw.1pw /mnt/sysimage/dev/shm/ #LOG
|
||||
if [ ! -f /mnt/sysimage/dev/shm/user.1pw ]; then
|
||||
echo "Could not move 1password" #LOG
|
||||
fi
|
||||
else
|
||||
echo "No chroot /dev/shm found" #LOG
|
||||
fi
|
||||
|
||||
@@ -0,0 +1,6 @@
|
||||
echo "Reducing swapiness" #LOG
|
||||
cat >> /etc/sysctl.d/20-swappiness.conf <<EOF
|
||||
# Reduce swapiness
|
||||
vm.swappiness=1
|
||||
vm.vfs_cache_pressure=50
|
||||
EOF
|
||||
@@ -0,0 +1,26 @@
|
||||
|
||||
if [ "$PTYPE" = "VM" ]; then
|
||||
SCHEDULER="mq-deadline"
|
||||
# WWID=$(udevadm info --attribute-walk --name=/dev/nvme0n1 | grep wwid)
|
||||
echo "VM disks: $(cd /sys/block; ls)"
|
||||
else
|
||||
SCHEDULER="none"
|
||||
WWID=$(udevadm info --attribute-walk --name=/dev/sda | grep wwid)
|
||||
fi
|
||||
|
||||
|
||||
if [ -n "$WWID" ]; then
|
||||
echo "Setting disk $WWID scheduler to none" #LOG
|
||||
|
||||
cat >> /etc/udev/rules.d/99-scheduler.rules <<EOF
|
||||
ACTION=="add|change", SUBSYSTEM=="block", $WWID, ATTR{queue/scheduler}="$SCHEDULER"
|
||||
EOF
|
||||
|
||||
udevadm control --reload-rules #LOG
|
||||
udevadm trigger --type=devices --action=change #LOG
|
||||
|
||||
else
|
||||
echo "No WWID found on /dev/sda for scheduler" #LOG
|
||||
fi
|
||||
|
||||
echo "Scheduler set to: $(cat /sys/block/sda/queue/scheduler)"
|
||||
@@ -0,0 +1,37 @@
|
||||
echo "Setting up systemd-resolved" #LOG
|
||||
|
||||
mkdir /etc/systemd/resolved.conf.d
|
||||
|
||||
cat >> /etc/systemd/resolved.conf.d/10-local.conf <<EOF
|
||||
[Resolve]
|
||||
DNS=192.168.194.102 192.168.226.102
|
||||
FallbackDNS=192.168.176.2
|
||||
Domains=iglass.net
|
||||
DNSStubListener=true
|
||||
LLMNR=false
|
||||
MulticastDNS=false
|
||||
DNSSEC=false
|
||||
EOF
|
||||
|
||||
#mv -f /etc/resolv.conf /etc/resolv.conf.old #LOG
|
||||
# This is done at the very end in S998A-last
|
||||
#ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf #LOG
|
||||
|
||||
mkdir /etc/systemd/system/systemd-resolved.service.d #LOG
|
||||
cat >> /etc/systemd/system/systemd-resolved.service.d/restart.conf <<EOF
|
||||
[Service]
|
||||
RestartSec=200ms
|
||||
EOF
|
||||
|
||||
restorecon -FR /etc/systemd
|
||||
|
||||
perl -spi -e 's/^(\[main\].*)$/$1\ndns=none/' /etc/NetworkManager/NetworkManager.conf #LOG
|
||||
|
||||
perl -spi -e 's/^(hosts:\s+files)\s+(.+)$/$1 resolve \[!UNAVAIL=return\] $2/' /etc/authselect/user-nsswitch.conf
|
||||
authselect apply-changes
|
||||
|
||||
# systemctl daemon-reload
|
||||
|
||||
systemctl enable systemd-resolved.service #LOG
|
||||
# systemctl restart systemd-resolved.service #LOG
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
cd /
|
||||
#sleep 864000
|
||||
perl -e 'my $i=864000; $0="sleeping until ".scalar localtime(time+$i)."\n"; while ($i>=0) { $i -= 10; sleep 10; }'
|
||||
@@ -0,0 +1,8 @@
|
||||
#!/bin/bash -x
|
||||
#cd /home/KickStart/CentOS/custom
|
||||
rm -f etc.tgz
|
||||
tar czf etc.tgz --owner=0 --group=0 --numeric-owner -C . etc
|
||||
tar czf etc-srv.tgz --owner=0 --group=0 --numeric-owner -C . etc-server
|
||||
chgrp apache etc.tgz etc-srv.tgz 2>/dev/null || true
|
||||
chmod 640 etc.tgz etc-srv.tgz
|
||||
ls -lh etc.tgz etc-srv.tgz
|
||||
@@ -0,0 +1,6 @@
|
||||
##### Log Release #####
|
||||
0 8 * * 1 /opt/iglass/bin/checkColoRelease.pl
|
||||
|
||||
# IGLASS 2 Archive
|
||||
#1-59/2 * * * * /opt/iglass/bin/iArchive.pl -all
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
MAILTO=root
|
||||
@@ -0,0 +1,3 @@
|
||||
0 * * * * /usr/sbin/logrotate /etc/logrotate.conf
|
||||
|
||||
0 2 * * * /bin/tar cz --totals -C / --files-from=/etc/backup-list --file /opt/iglass/sync/srvBackup/backup-$(/bin/hostname).tgz 2>&1 |/usr/bin/logger -i -p local3.err -t tar_backups
|
||||
@@ -0,0 +1,46 @@
|
||||
PGGSSENCMODE=disable
|
||||
|
||||
# Database backup
|
||||
#15 0 * * * /opt/iglass/bin/dbBackup.pl
|
||||
|
||||
# Push release info
|
||||
#13 7 * * * /opt/iglass/bin/checkRelease.pl
|
||||
|
||||
# Route verifier
|
||||
#10 8 * * 1-5 /opt/iglass/bin/routeVerify.pl
|
||||
|
||||
### Network Polling
|
||||
# iGLASS Machine Polling
|
||||
#*/5 * * * * /opt/iglass/bin/iCollector.pl
|
||||
#*/2 * * * * sudo /opt/iglass/bin/iPoller.pl --type=avail
|
||||
#*/5 * * * * sudo /opt/iglass/bin/iPoller.pl --type=avail-lite
|
||||
#*/5 * * * * /opt/iglass/bin/iPoller.pl --type=data
|
||||
#*/15 * * * * /opt/iglass/bin/iPoller.pl --type=data-lite
|
||||
|
||||
### CPE/iGO Billing Crons
|
||||
# Install billing information
|
||||
#30 9 * * * /opt/iglass/bin/loadBilling.pl --allboxtypes
|
||||
|
||||
### CPE/iGO Polling Crons
|
||||
# AutoDiscover
|
||||
#7 7 * * * /opt/iglass/bin/autoDiscoverQPSK.pl
|
||||
#13 7 * * * /opt/iglass/bin/autoDiscoverQAM.pl
|
||||
|
||||
# iGO Monitoring
|
||||
#5 0 * * * /opt/iglass/bin/iGO_purge.pl
|
||||
#5 1 * * * /opt/iglass/bin/iGO_purge.pl --validate
|
||||
#25 6 * * * /opt/iglass/bin/iGO_purge.pl --grp2src
|
||||
#30 0 * * * /opt/iglass/bin/iGO_healthExport.pl
|
||||
|
||||
### DHCT Crons
|
||||
# DHCT
|
||||
#0,30 * * * * sudo /opt/iglass/bin/dhctVerify.pl --cleanup
|
||||
#*/5 * * * * /opt/iglass/bin/iGO_grpPoller.pl --name=dhct
|
||||
#30 2 * * * /opt/iglass/bin/iGO_srcPoller.pl --name=dhct --collect
|
||||
|
||||
### DOCSIS Crons
|
||||
#40 7 * * * /opt/iglass/bin/docsisBatteryPoller.pl
|
||||
#*/5 * * * * /opt/iglass/bin/iGO_grpPoller.pl --name=docsis
|
||||
|
||||
# Purge docsis traps that are not assigned to port
|
||||
#15 4 * * * PGSERVICE=overview /usr/bin/psql -q -f /opt/iglass/sql/cust-overview/docsisTrapPurge.sql
|
||||
@@ -0,0 +1 @@
|
||||
MAILTO=root
|
||||
@@ -0,0 +1,2 @@
|
||||
0 * * * * /usr/sbin/logrotate /etc/logrotate.conf
|
||||
0 6 * * * (tar cz --totals -C / --files-from=/etc/backup-list --file /opt/iglass/sync/backup/backup-$(/bin/hostname).tgz 2>&1) | logger -i -p local3.err -t tar_backups
|
||||
@@ -0,0 +1,99 @@
|
||||
#
|
||||
# Copyright 2017-2018 Amazon.com, Inc. and its affiliates. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the MIT License. See the LICENSE accompanying this file
|
||||
# for the specific language governing permissions and limitations under
|
||||
# the License.
|
||||
#
|
||||
|
||||
[DEFAULT]
|
||||
logging_level = INFO
|
||||
logging_max_bytes = 1048576
|
||||
logging_file_count = 10
|
||||
# mode for /var/run/efs and subdirectories in octal
|
||||
state_file_dir_mode = 750
|
||||
|
||||
[mount]
|
||||
#dns_name_format = {az}.{fs_id}.efs.{region}.{dns_name_suffix}
|
||||
dns_name_format = {fs_id}.efs.{region}a.iglass.net
|
||||
|
||||
dns_name_suffix = amazonaws.com
|
||||
#The region of the file system when mounting from on-premises or cross region.
|
||||
#region = us-east-1
|
||||
stunnel_debug_enabled = false
|
||||
#Uncomment the below option to save all stunnel logs for a file system to the same file
|
||||
#stunnel_logs_file = /var/log/amazon/efs/{fs_id}.stunnel.log
|
||||
stunnel_cafile = /etc/amazon/efs/efs-utils.crt
|
||||
|
||||
# Validate the certificate hostname on mount. This option is not supported by certain stunnel versions.
|
||||
stunnel_check_cert_hostname = false
|
||||
|
||||
# Use OCSP to check certificate validity. This option is not supported by certain stunnel versions.
|
||||
stunnel_check_cert_validity = false
|
||||
|
||||
# Set to true to use FIPS-mode for stunnel. Enabling this will change the AWS SDK client to use FIPS as well.
|
||||
fips_mode_enabled = false
|
||||
|
||||
# Define the port range that the TLS tunnel will choose from
|
||||
port_range_lower_bound = 20049
|
||||
port_range_upper_bound = 21049
|
||||
|
||||
# Optimize read_ahead_kb for Linux 5.4+
|
||||
optimize_readahead = true
|
||||
|
||||
# By default, we enable the feature to fallback to mount with mount target ip address when dns name cannot be resolved
|
||||
fall_back_to_mount_target_ip_address_enabled = true
|
||||
|
||||
# By default, we use IMDSv2 to get the instance metadata, set this to true if you want to disable IMDSv2 usage
|
||||
disable_fetch_ec2_metadata_token = false
|
||||
|
||||
# By default, we enable efs-utils to retry failed mount.nfs command that due to (1) connection reset by peer (2) the
|
||||
# mount.nfs is not finished within 'retry_nfs_mount_command_timeout_sec'. If the retry count is set as N, initial N - 1
|
||||
# mount attempts will timeout if the command does not finish within 'retry_nfs_mount_command_timeout_sec' sec.
|
||||
# The last mount attempt will keep the existing behavior of mount.nfs.
|
||||
#
|
||||
retry_nfs_mount_command = true
|
||||
retry_nfs_mount_command_count = 3
|
||||
retry_nfs_mount_command_timeout_sec = 15
|
||||
|
||||
[mount.cn-north-1]
|
||||
dns_name_suffix = amazonaws.com.cn
|
||||
|
||||
|
||||
[mount.cn-northwest-1]
|
||||
dns_name_suffix = amazonaws.com.cn
|
||||
|
||||
|
||||
[mount.us-iso-east-1]
|
||||
dns_name_suffix = c2s.ic.gov
|
||||
stunnel_cafile = /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
|
||||
|
||||
[mount.us-iso-west-1]
|
||||
dns_name_suffix = c2s.ic.gov
|
||||
stunnel_cafile = /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
|
||||
|
||||
[mount.us-isob-east-1]
|
||||
dns_name_suffix = sc2s.sgov.gov
|
||||
stunnel_cafile = /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
|
||||
|
||||
[mount-watchdog]
|
||||
enabled = true
|
||||
poll_interval_sec = 1
|
||||
unmount_count_for_consistency = 5
|
||||
unmount_grace_period_sec = 30
|
||||
|
||||
# Set client auth/access point certificate renewal rate. Minimum value is 1 minute.
|
||||
tls_cert_renewal_interval_min = 60
|
||||
|
||||
# Periodically check the health of stunnel to make sure the connection is fully established
|
||||
stunnel_health_check_enabled = true
|
||||
stunnel_health_check_interval_min = 5
|
||||
stunnel_health_check_command_timeout_sec = 30
|
||||
|
||||
[cloudwatch-log]
|
||||
# enabled = true
|
||||
log_group_name = /aws/efs/utils
|
||||
|
||||
# Possible values are : 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653
|
||||
# Comment this config to prevent log deletion
|
||||
retention_in_days = 14
|
||||
@@ -0,0 +1,2 @@
|
||||
etc
|
||||
var/spool/cron
|
||||
@@ -0,0 +1 @@
|
||||
# customer.conf
|
||||
@@ -0,0 +1,18 @@
|
||||
server:
|
||||
interface: 127.0.0.1
|
||||
cache-max-negative-ttl: 1
|
||||
prefetch: yes
|
||||
serve-expired: yes
|
||||
serve-expired-ttl: 300
|
||||
serve-expired-ttl-reset: yes
|
||||
|
||||
forward-zone:
|
||||
name: "."
|
||||
forward-tls-upstream: no
|
||||
forward-addr: 192.168.194.102
|
||||
forward-addr: 192.168.226.102
|
||||
forward-addr: 192.168.177.2
|
||||
forward-addr: 192.168.176.2
|
||||
|
||||
remote-control:
|
||||
control-enable: no
|
||||
+5
@@ -0,0 +1,5 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<entry>18.216.95.119</entry>
|
||||
<entry>52.37.22.190</entry>
|
||||
</ipset>
|
||||
@@ -0,0 +1,5 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<entry>18.191.99.0</entry>
|
||||
<entry>52.36.25.237</entry>
|
||||
</ipset>
|
||||
+8
@@ -0,0 +1,8 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:ip">
|
||||
<entry>74.113.229.130</entry>
|
||||
<entry>74.113.229.131</entry>
|
||||
<entry>74.113.229.132</entry>
|
||||
<entry>74.113.229.133</entry>
|
||||
<entry>74.113.229.134</entry>
|
||||
</ipset>
|
||||
+9
@@ -0,0 +1,9 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<entry>192.168.160.0/24</entry>
|
||||
<entry>192.168.175.0/24</entry>
|
||||
<entry>192.168.176.0/24</entry>
|
||||
<entry>192.168.177.0/24</entry>
|
||||
<entry>192.168.192.0/19</entry>
|
||||
<entry>192.168.224.0/20</entry>
|
||||
</ipset>
|
||||
@@ -0,0 +1,8 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet6"/>
|
||||
<entry>2600:1f16:25e:be00::/56</entry>
|
||||
<entry>2600:1f14:eeb:f500::/56</entry>
|
||||
<entry>fe80::/56</entry>
|
||||
<entry>2607:9700:0:2::2</entry>
|
||||
</ipset>
|
||||
@@ -0,0 +1,4 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<entry>10.1.1.1/32</entry>
|
||||
</ipset>
|
||||
+9
@@ -0,0 +1,9 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:ip">
|
||||
<entry>70.62.110.170</entry>
|
||||
<entry>70.62.110.171</entry>
|
||||
<entry>70.62.110.172</entry>
|
||||
<entry>70.62.110.173</entry>
|
||||
<entry>70.62.110.174</entry>
|
||||
<entry>70.62.110.169</entry>
|
||||
</ipset>
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<service>
|
||||
<port protocol="tcp" port="5502"/>
|
||||
</service>
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<service>
|
||||
<short>netflow</short>
|
||||
<port protocol="tcp" port="9991"/>
|
||||
<port protocol="udp" port="9991"/>
|
||||
</service>
|
||||
+9
@@ -0,0 +1,9 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<zone>
|
||||
<source ipset="aws-ssh"/>
|
||||
<source ipset="aws-ipsec"/>
|
||||
<source ipset="twc-office-external"/>
|
||||
<source ipset="celito-office-external"/>
|
||||
<service name="ssh"/>
|
||||
<service name="ipsec"/>
|
||||
</zone>
|
||||
+9
@@ -0,0 +1,9 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<zone>
|
||||
<source ipset="iGlass-internal"/>
|
||||
<service name="postgresql"/>
|
||||
<service name="ssh"/>
|
||||
<service name="snmp"/>
|
||||
<service name="ipsec"/>
|
||||
<service name="dhcpv6-client"/>
|
||||
</zone>
|
||||
@@ -0,0 +1,6 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<zone>
|
||||
<source ipset="ks"/>
|
||||
<service name="postgresql"/>
|
||||
<service name="ssh"/>
|
||||
</zone>
|
||||
@@ -0,0 +1,38 @@
|
||||
/var/log/maillog
|
||||
/var/log/messages
|
||||
/var/log/secure
|
||||
{
|
||||
daily
|
||||
missingok
|
||||
create 0644 root root
|
||||
rotate 5
|
||||
compress
|
||||
sharedscripts
|
||||
postrotate
|
||||
|
||||
POST=/opt/iglass/lib/srv-syslog-postrotate.sh
|
||||
|
||||
if [ ! -e $POST ]; then
|
||||
echo "No syslog postrotate script found"
|
||||
elif [ $(/usr/bin/stat --format=%a%u $POST) -ne 6440 ]; then
|
||||
echo "Untrusted $POST";
|
||||
else
|
||||
/bin/sh $POST -c -s -t syslog messages maillog secure
|
||||
fi
|
||||
|
||||
endscript
|
||||
}
|
||||
|
||||
/var/log/spooler
|
||||
/var/log/cron
|
||||
/var/log/firewall.log
|
||||
/var/log/postgresql
|
||||
{
|
||||
weekly
|
||||
rotate 5
|
||||
missingok
|
||||
sharedscripts
|
||||
postrotate
|
||||
/usr/bin/systemctl -s HUP kill rsyslog.service >/dev/null 2>&1 || true
|
||||
endscript
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
/usr/local/tomcat/logs/catalina.out {
|
||||
daily
|
||||
sharedscripts
|
||||
rotate 4
|
||||
compress
|
||||
copytruncate
|
||||
missingok
|
||||
postrotate
|
||||
PATH=/bin:/usr/bin:/opt/iglass/bin
|
||||
|
||||
LOGS="catalina.out jglass.log tomcat.log iwnpw.log"
|
||||
SDIR=/customers/iss/sync/srvlogs/`hostname`-tomcat
|
||||
JLOG=/usr/local/tomcat/logs
|
||||
|
||||
if [ -d "$JLOG" ]; then
|
||||
|
||||
Die() { logger -s -t "logrotate[$$]" -p local3.err "$*"; exit 1; }
|
||||
|
||||
YEST=`perl -e '@d=localtime($^T-86400); printf "%s-%02s-%02s\n",$d[5]+=1900,++$d[4],$d[3]'`
|
||||
|
||||
cd $JLOG || Die "Could not change directory '$JLOG'"
|
||||
|
||||
[ ! -d OLD ] && mkdir OLD
|
||||
|
||||
for F in $LOGS ; do
|
||||
if [ -e "$F.1" ]; then
|
||||
gzip -c $F.1 > OLD/$F.$YEST.gz
|
||||
|
||||
elif LS=`ls $F* | grep -E "\.[[:digit:]\-]{10}$"`; then
|
||||
for L in $LS ; do
|
||||
gzip $L
|
||||
mv -f $L.gz OLD/
|
||||
done
|
||||
|
||||
elif [ -e "$F" ]; then
|
||||
gzip -c $F > OLD/$F.$YEST.gz
|
||||
cat /dev/null > $F
|
||||
|
||||
elif runPrimary ; then
|
||||
Die "No $JLOG/$F log found."
|
||||
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
[ ! -d $SDIR ] && mkdir $SDIR && chown noc.noc $SDIR
|
||||
su - noc -c "rsync -rtp $JLOG/OLD/ $SDIR/"
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
endscript
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
# These could be used by sendmail, but are not part of the default install.
|
||||
# To use them you will have to generate your own sendmail.cf with
|
||||
# FEATURE('whatever')
|
||||
#
|
||||
POSSIBLE += $(shell test -f bitdomain && echo bitdomain.db)
|
||||
POSSIBLE += $(shell test -f uudomain && echo uudomain.db)
|
||||
POSSIBLE += $(shell test -f genericstable && echo genericstable.db)
|
||||
POSSIBLE += $(shell test -f userdb && echo userdb.db)
|
||||
POSSIBLE += $(shell test -f authinfo && echo authinfo.db)
|
||||
CFFILES = sendmail.cf submit.cf
|
||||
|
||||
|
||||
all: ${CFFILES} ${POSSIBLE} virtusertable.db access.db domaintable.db mailertable.db
|
||||
|
||||
userdb.db: userdb
|
||||
@makemap btree $@ < $<
|
||||
|
||||
%.db: %
|
||||
@makemap hash $@ < $<
|
||||
|
||||
%.cf: %.mc
|
||||
@if test -f /usr/share/sendmail-cf/m4/cf.m4; then \
|
||||
umask 022; \
|
||||
mv -f $@ $@.bak; \
|
||||
m4 $< > $@; \
|
||||
else \
|
||||
echo -e "WARNING: '$<' is modified. Please install package sendmail-cf to update your configuration."; \
|
||||
fi
|
||||
|
||||
clean:
|
||||
rm -f *.db *~
|
||||
|
||||
start:
|
||||
service sendmail start
|
||||
|
||||
stop:
|
||||
service sendmail stop
|
||||
|
||||
restart:
|
||||
service sendmail restart
|
||||
|
||||
@@ -0,0 +1,67 @@
|
||||
# Check the /usr/share/doc/sendmail/README.cf file for a description
|
||||
# of the format of this file. (search for access_db in that file)
|
||||
# The /usr/share/doc/sendmail/README.cf is part of the sendmail-doc
|
||||
# package.
|
||||
#
|
||||
# by default we allow relaying from localhost...
|
||||
iglass.net RELAY
|
||||
localhost.localdomain RELAY
|
||||
localhost RELAY
|
||||
127.0.0.1 RELAY
|
||||
istructure.com RELAY
|
||||
iglassnetworks.com RELAY
|
||||
192.168 RELAY
|
||||
66.192.95.35 RELAY
|
||||
GreetPause:192.168 0
|
||||
# Bolden Home
|
||||
10.1.2 RELAY
|
||||
10.1.4 RELAY
|
||||
10.0.0 RELAY
|
||||
# temp for tim
|
||||
198.18.180.43 RELAY
|
||||
# verizon.net verification
|
||||
206.46.252.137 OK
|
||||
206.46.252.138 OK
|
||||
206.46.252.139 OK
|
||||
206.46.252.140 OK
|
||||
206.46.252.141 OK
|
||||
206.46.252.142 OK
|
||||
206.46.252.143 OK
|
||||
206.46.252.144 OK
|
||||
206.46.252.145 OK
|
||||
206.46.252.146 OK
|
||||
206.46.252.147 OK
|
||||
206.46.252.148 OK
|
||||
206.46.252.149 OK
|
||||
206.46.252.150 OK
|
||||
206.46.252.151 OK
|
||||
206.46.252.152 OK
|
||||
206.46.252.153 OK
|
||||
206.46.252.154 OK
|
||||
206.46.252.155 OK
|
||||
206.46.252.156 OK
|
||||
206.46.252.157 OK
|
||||
206.46.252.158 OK
|
||||
206.46.252.159 OK
|
||||
206.46.252.160 OK
|
||||
206.46.252.161 OK
|
||||
206.46.252.162 OK
|
||||
206.46.252.163 OK
|
||||
206.46.252.164 OK
|
||||
# iContact relays for Nizen newsletters
|
||||
216.27.93.125 OK
|
||||
216.27.93.124 OK
|
||||
216.27.93.123 OK
|
||||
216.27.93.122 OK
|
||||
216.27.93.121 OK
|
||||
216.27.93.120 OK
|
||||
216.27.93.119 OK
|
||||
216.27.93.118 OK
|
||||
216.27.93.117 OK
|
||||
216.27.93.116 OK
|
||||
216.27.93.115 OK
|
||||
216.27.93.114 OK
|
||||
216.27.93.113 OK
|
||||
216.27.93.112 OK
|
||||
# Can't get off this
|
||||
24.75.44.226 REJECT
|
||||
@@ -0,0 +1,112 @@
|
||||
# local-host-names - include all aliases for your machine here.
|
||||
iglass.net
|
||||
pager.istructure.com
|
||||
pager.iglass.net
|
||||
noc.istructure.com
|
||||
noc.iglass.net
|
||||
iglass.iglass.net
|
||||
spider01.iglass.net
|
||||
spider02.iglass.net
|
||||
spider03.iglass.net
|
||||
sponge01.iglass.net
|
||||
sponge02.iglass.net
|
||||
sponge03.iglass.net
|
||||
sponge04.iglass.net
|
||||
sponge05.iglass.net
|
||||
sponge06.iglass.net
|
||||
brain01.iglass.net
|
||||
brain02.iglass.net
|
||||
brain03.iglass.net
|
||||
brain04.iglass.net
|
||||
brain05.iglass.net
|
||||
lynx01.iglass.net
|
||||
lynx02.iglass.net
|
||||
warehouse01.iglass.net
|
||||
warehouse02.iglass.net
|
||||
warehouse03.iglass.net
|
||||
istorage001.iglass.net
|
||||
iprobe001.iglass.net
|
||||
iprobe002.iglass.net
|
||||
iprobe003.iglass.net
|
||||
iprobe004.iglass.net
|
||||
iprobe005.iglass.net
|
||||
iprobe006.iglass.net
|
||||
iprobe007.iglass.net
|
||||
iprobe008.iglass.net
|
||||
iprobe009.iglass.net
|
||||
iprobe010.iglass.net
|
||||
iprobe011.iglass.net
|
||||
iprobe012.iglass.net
|
||||
iprobe013.iglass.net
|
||||
iprobe014.iglass.net
|
||||
iprobe015.iglass.net
|
||||
iprobe016.iglass.net
|
||||
iprobe017.iglass.net
|
||||
iprobe018.iglass.net
|
||||
iprobe019.iglass.net
|
||||
iprobe020.iglass.net
|
||||
iprobe021.iglass.net
|
||||
iprobe022.iglass.net
|
||||
iprobe023.iglass.net
|
||||
iprobe024.iglass.net
|
||||
iprobe025.iglass.net
|
||||
iprobe026.iglass.net
|
||||
iprobe027.iglass.net
|
||||
iprobe028.iglass.net
|
||||
iprobe029.iglass.net
|
||||
iprobe030.iglass.net
|
||||
iprobe031.iglass.net
|
||||
iprobe032.iglass.net
|
||||
iprobe033.iglass.net
|
||||
iprobe034.iglass.net
|
||||
iprobe035.iglass.net
|
||||
iprobe036.iglass.net
|
||||
iprobe037.iglass.net
|
||||
iprobe038.iglass.net
|
||||
iprobe039.iglass.net
|
||||
iprobe040.iglass.net
|
||||
iprobe041.iglass.net
|
||||
iprobe042.iglass.net
|
||||
iprobe043.iglass.net
|
||||
iprobe044.iglass.net
|
||||
iprobe045.iglass.net
|
||||
iprobe046.iglass.net
|
||||
iprobe047.iglass.net
|
||||
iprobe048.iglass.net
|
||||
iprobe049.iglass.net
|
||||
iprobe050.iglass.net
|
||||
iprobe051.iglass.net
|
||||
iprobe052.iglass.net
|
||||
iprobe053.iglass.net
|
||||
iprobe054.iglass.net
|
||||
iprobe055.iglass.net
|
||||
iprobe056.iglass.net
|
||||
iprobe057.iglass.net
|
||||
iprobe058.iglass.net
|
||||
iprobe059.iglass.net
|
||||
iprobe060.iglass.net
|
||||
iprobe061.iglass.net
|
||||
iprobe062.iglass.net
|
||||
iprobe063.iglass.net
|
||||
iprobe064.iglass.net
|
||||
iprobe065.iglass.net
|
||||
iprobe066.iglass.net
|
||||
iprobe067.iglass.net
|
||||
iprobe068.iglass.net
|
||||
iprobe069.iglass.net
|
||||
iprobe070.iglass.net
|
||||
iprobe071.iglass.net
|
||||
iprobe072.iglass.net
|
||||
iprobe073.iglass.net
|
||||
iprobe074.iglass.net
|
||||
iprobe075.iglass.net
|
||||
iprobe076.iglass.net
|
||||
iprobe077.iglass.net
|
||||
iprobe078.iglass.net
|
||||
iprobe079.iglass.net
|
||||
iprobe080.iglass.net
|
||||
iprobe081.iglass.net
|
||||
iprobe082.iglass.net
|
||||
iprobe083.iglass.net
|
||||
iprobe084.iglass.net
|
||||
iprobe085.iglass.net
|
||||
Loaded 100 of 1703 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user