mailgw: use gentoo kernel (hardened is unsupported), updates

This commit is contained in:
Joerg Deckert 2019-01-27 09:43:27 +01:00
parent a491bffa5f
commit d9006564ab
10 changed files with 353 additions and 270 deletions

View File

@ -20,6 +20,7 @@ preinstall:
postinstall: timesyncd.conf firstboot.start postinstall: timesyncd.conf firstboot.start
# Konfigurationen anpassen # Konfigurationen anpassen
cp timesyncd.conf $(CHROOT)/etc/systemd/timesyncd.conf cp timesyncd.conf $(CHROOT)/etc/systemd/timesyncd.conf
mkdir -p $(CHROOT)/etc/local.d
cp firstboot.start $(CHROOT)/etc/local.d/firstboot.start cp firstboot.start $(CHROOT)/etc/local.d/firstboot.start
touch $(CHROOT)/firstboot touch $(CHROOT)/firstboot
sed -i 's/# %wheel ALL=(ALL) ALL/%wheel ALL=(ALL) ALL/' $(CHROOT)/etc/sudoers sed -i 's/# %wheel ALL=(ALL) ALL/%wheel ALL=(ALL) ALL/' $(CHROOT)/etc/sudoers

3
mailgw/firstboot.start Normal file → Executable file
View File

@ -11,9 +11,6 @@ localectl --no-convert set-keymap de-latin1-nodeadkeys
echo 'Activate services...' echo 'Activate services...'
timedatectl set-ntp true timedatectl set-ntp true
echo 'Setting hardened...'
paxctl-ng -m /usr/bin/python2.7
# variables # variables
LABEL="DATA" LABEL="DATA"
DATABASE_PASS="Di1sgMySQLPwd." DATABASE_PASS="Di1sgMySQLPwd."

File diff suppressed because it is too large Load Diff

View File

@ -1,6 +1,6 @@
##HOSTNAME = $(APPLIANCE) ##HOSTNAME = $(APPLIANCE)
##TIMEZONE = UTC ##TIMEZONE = UTC
##DISK_SIZE = 6.0G DISK_SIZE = 8.0G
##SWAP_SIZE = 30 ##SWAP_SIZE = 30
##SWAP_FILE = $(CHROOT)/.swap ##SWAP_FILE = $(CHROOT)/.swap
##ARCH = amd64-hardened ##ARCH = amd64-hardened
@ -11,7 +11,7 @@
##SOFTWARE = 1 ##SOFTWARE = 1
##PKGLIST = 0 ##PKGLIST = 0
##RSYNC_MIRROR = rsync://rsync15.de.gentoo.org/gentoo/ ##RSYNC_MIRROR = rsync://rsync15.de.gentoo.org/gentoo/
KERNEL_PKG = hardened-sources ##KERNEL_PKG = gentoo-sources
KERNEL_CONFIG = appliances/$(APPLIANCE)/kernel.config KERNEL_CONFIG = appliances/$(APPLIANCE)/kernel.config
ENABLE_SSHD = YES ENABLE_SSHD = YES
TIMEZONE=Europe/Berlin TIMEZONE=Europe/Berlin

View File

@ -1,7 +1,8 @@
CFLAGS="-O2 -pipe" CFLAGS="-O2 -pipe"
CXXFLAGS="-O2 -pipe" CXXFLAGS="-O2 -pipe"
USE="hardened justify pax_kernel pie ssp urandom xattr xtpax -fortran -jit -orc -pch -pic -prelink -profile -tcc" USE="hardened justify pie ssp urandom xattr xtpax -fortran -jit -orc -pch -pic -prelink -profile -tcc"
MAKEOPTS="-j5" MAKEOPTS="-j5"
ACCEPT_LICENSE="*" ACCEPT_LICENSE="*"
PYTHON_TARGETS="python2_7" PYTHON_TARGETS="python2_7 python3_6"
PYTHON_SINGLE_TARGET="python2_7" PYTHON_SINGLE_TARGET="python2_7"
VIDEO_CARDS="vmware"

View File

@ -1,5 +1,4 @@
# /etc/mysql/my.cnf: The global mysql configuration file. # /etc/mysql/my.cnf: The global mysql configuration file.
# $Id$
# The following options will be passed to all MySQL clients # The following options will be passed to all MySQL clients
[client] [client]
@ -8,34 +7,38 @@ port = 3306
socket = /var/run/mysqld/mysqld.sock socket = /var/run/mysqld/mysqld.sock
[mysql] [mysql]
character-sets-dir=/usr/share/mysql/charsets character-sets-dir=/usr/share/mariadb/charsets
default-character-set=utf8 default-character-set=utf8
[mysqladmin] [mysqladmin]
character-sets-dir=/usr/share/mysql/charsets character-sets-dir=/usr/share/mariadb/charsets
default-character-set=utf8 default-character-set=utf8
[mysqlcheck] [mysqlcheck]
character-sets-dir=/usr/share/mysql/charsets character-sets-dir=/usr/share/mariadb/charsets
default-character-set=utf8 default-character-set=utf8
[mysqldump] [mysqldump]
character-sets-dir=/usr/share/mysql/charsets character-sets-dir=/usr/share/mariadb/charsets
default-character-set=utf8 default-character-set=utf8
[mysqlimport] [mysqlimport]
character-sets-dir=/usr/share/mysql/charsets character-sets-dir=/usr/share/mariadb/charsets
default-character-set=utf8 default-character-set=utf8
[mysqlshow] [mysqlshow]
character-sets-dir=/usr/share/mysql/charsets character-sets-dir=/usr/share/mariadb/charsets
default-character-set=utf8 default-character-set=utf8
[myisamchk] [myisamchk]
character-sets-dir=/usr/share/mysql/charsets character-sets-dir=/usr/share/mariadb/charsets
[myisampack] [myisampack]
character-sets-dir=/usr/share/mysql/charsets character-sets-dir=/usr/share/mariadb/charsets
# use [safe_mysqld] with mysql-3
[mysqld_safe]
err-log = /var/log/mysql/mysql.err
# add a section [mysqld-4.1] or [mysqld-5.0] for specific configurations # add a section [mysqld-4.1] or [mysqld-5.0] for specific configurations
[mysqld] [mysqld]
@ -56,7 +59,7 @@ net_buffer_length = 16K
read_buffer_size = 256K read_buffer_size = 256K
read_rnd_buffer_size = 512K read_rnd_buffer_size = 512K
myisam_sort_buffer_size = 8M myisam_sort_buffer_size = 8M
lc_messages_dir = /usr/share/mysql lc_messages_dir = /usr/share/mariadb
#Set this to your desired error message language #Set this to your desired error message language
lc_messages = en_US lc_messages = en_US

View File

@ -1,9 +1,6 @@
# Grundsystem # Grundsystem
app-admin/paxtest ~amd64 ~x86
app-emulation/open-vm-tools ~amd64 ~x86 app-emulation/open-vm-tools ~amd64 ~x86
sys-auth/pam_ssh_agent_auth ~amd64 ~x86 sys-auth/pam_ssh_agent_auth ~amd64 ~x86
sys-kernel/gentoo-sources ~amd64 ~x86
sys-kernel/hardened-sources ~amd64 ~x86
# ASSP # ASSP
dev-perl/Archive-Extract dev-perl/Archive-Extract

View File

@ -1 +0,0 @@
sys-kernel/hardened-sources

View File

@ -3,7 +3,8 @@ app-editors/nano ncurses
app-emulation/open-vm-tools pic -modules app-emulation/open-vm-tools pic -modules
app-misc/mc -slang app-misc/mc -slang
dev-lang/python ssl threads xml dev-lang/python ssl threads xml
dev-libs/libpcre cxx dev-libs/libpcre cxx jit
dev-libs/libpcre2 jit
dev-util/pkgconfig internal-glib dev-util/pkgconfig internal-glib
net-misc/openssh ssl net-misc/openssh ssl
net-misc/wget ssl net-misc/wget ssl
@ -14,7 +15,6 @@ sys-apps/portage ipc
sys-auth/pambase nullok sha512 sys-auth/pambase nullok sha512
sys-devel/gcc cxx nptl sys-devel/gcc cxx nptl
sys-kernel/gentoo-sources symlink sys-kernel/gentoo-sources symlink
sys-kernel/hardened-sources symlink
# Monitoring # Monitoring
net-analyzer/zabbix agent net-analyzer/zabbix agent

View File

@ -1,13 +1,9 @@
app-admin/logrotate app-admin/logrotate
app-admin/paxtest
app-admin/sudo app-admin/sudo
app-emulation/open-vm-tools app-emulation/open-vm-tools
app-misc/mc app-misc/mc
app-misc/screenservice app-misc/screenservice
net-analyzer/zabbix net-analyzer/zabbix
sys-apps/elfix
sys-apps/gradm
sys-apps/paxctl
sys-auth/pam_ssh_agent_auth sys-auth/pam_ssh_agent_auth
sys-fs/mdadm sys-fs/mdadm
sys-power/acpid sys-power/acpid