MailGw: erste Version

mailgw/00-eth0.network

@@ -0,0 +1,22 @@
+# Beispiel für feste IP-Adreß-Konfiguration:
+# Anpassen und als 00-eth0.network nach /etc/systemd/network verschieben
+# (s. "man systemd.network", "man systemd-resolved")
+#
+# NICHT VERGESSEN: entsprechende Einträge in /etc/hosts hinzufügen
+#  <IPv4> <FQDN> <Hostname>
+#  <IPv6> <FQDN> <Hostname>
+
+[Match]
+Name=eth0
+
+[Network]
+Description=1. Netzwerk-Port
+Address=192.168.1.2/24
+Address=fdb5:78b:64cc:0:f8c0::2/64
+Gateway=192.168.1.1
+Gateway=fdb5:78b:64cc:0:f8c0::1
+DNS=192.168.1.3
+DNS=fdb5:78b:64cc:0:f8c0::3
+NTP=192.168.1.4
+NTP=fdb5:78b:64cc:0:f8c0::4
+Domains=privacyidea.de

mailgw/Makefile

@@ -0,0 +1,52 @@
+preinstall:
+	# switch to hardened, build hardened toolchain, rebuild everything
+	mkdir -p $(CHROOT)/etc/portage/profile
+	echo "-hardened" >> $(CHROOT)/etc/portage/profile/use.mask
+	$(inroot) $(EMERGE) $(USEPKG) --oneshot gcc
+	$(inroot) $(EMERGE) $(USEPKG) --oneshot binutils virtual/libc
+	-$(gcc_config)
+	$(inroot) $(EMERGE) $(USEPKG) --emptytree @world
+	$(inroot) bash -c 'yes YES | etc-update --automode -9'
+	# ASSP: Perl wurde auf ithreads umgestellt -> Module neu bauen
+	$(inroot) $(EMERGE) $(USEPKG) --oneshot dev-lang/perl
+	$(inroot) perl-cleaner --reallyall
+
+	# Unitas-Portage-Overlay einbinden
+	$(inroot) $(EMERGE) -n $(USEPKG) app-portage/layman
+	sed -i 's/check_official : Yes/check_official : No/' $(CHROOT)/etc/layman/layman.cfg
+	wget -P $(CHROOT)/etc/layman/overlays http://dev.unitas-network.de/raw/Gentoo/Unitas.git/master/unitas-overlays.xml
+	$(inroot) layman -l | grep -q unitas || $(inroot) layman -La unitas
+
+postinstall: timesyncd.conf firstboot.start
+	# Konfigurationen anpassen
+	cp timesyncd.conf $(CHROOT)/etc/systemd/timesyncd.conf
+	cp firstboot.start $(CHROOT)/etc/local.d/firstboot.start
+	touch $(CHROOT)/firstboot
+	sed -i 's/# %wheel ALL=(ALL) ALL/%wheel ALL=(ALL) ALL/' $(CHROOT)/etc/sudoers
+	$(inroot) useradd -m -G users,wheel -s /bin/bash admin
+	$(inroot) passwd -d admin; $(inroot) passwd -e admin
+	$(inroot) systemctl enable screen@adm.service
+
+	# Beispiel feste IP-Adresse
+	cp 00-eth0.network $(CHROOT)/00-eth0.network.example
+
+	# MariaDB-Konfiguration
+	cp mariadb/my.cnf $(CHROOT)/etc/mysql/my.cnf
+	cp mariadb/my.cnf.root $(CHROOT)/root/.my.cnf
+	chmod 0600 $(CHROOT)/root/.my.cnf
+	rm -rf $(CHROOT)/var/lib/mysql/*
+	$(inroot) bash -c 'yes gentoo | emerge --config dev-db/mariadb'
+
+	# ASSP
+	$(inroot) usermod -aG clamav assp
+	cp system/50-assp-ulimit.conf $(CHROOT)/etc/security/limits.d/
+	sed -i 's/smtp      inet  n       -       n       -       -       smtpd/127.0.0.1:125 inet  n       -       n       -       -       smtpd/' $(CHROOT)/etc/postfix/master.cf
+	$(inroot) systemctl enable assp.service
+	$(inroot) systemctl enable freshclamd.service
+	$(inroot) systemctl enable clamd.service
+	$(inroot) systemctl enable postfix.service
+	$(inroot) systemctl enable pdns-recursor.service
+	# für clamav-unofficial-sigs (kann in nächster Gentoo-Version wohl weg)
+	$(inroot) ln -s /usr/lib/systemd /lib/systemd
+
+clean:

mailgw/README.md

@@ -0,0 +1,6 @@
+Erstkonfiguration
+=================
+
+- für variable Daten (MySQL/MariaDB, Konfiguration) muß eine mit ext4 formatierte Datenpartition mit dem Label "DATA" vorhanden sein. Diese wird nach /DATA gemountet.
+- feste IP-Adresse und /etc/hosts konfigurieren
+- unter VMware evtl. open-vm-tools aktivieren

mailgw/firstboot.start

@@ -0,0 +1,65 @@
+#!/bin/bash
+
+# base settings
+set -e
+
+[ -e /firstboot ] || exit 0
+
+echo 'Setting defaults...'
+localectl --no-convert set-keymap de-latin1-nodeadkeys
+
+echo 'Activate services...'
+timedatectl set-ntp true
+
+echo 'Setting hardened...'
+paxctl-ng -m /usr/bin/python2.7
+
+# variables
+LABEL="DATA"
+DATABASE_PASS="Di1sgMySQLPwd."
+
+# Data partition
+echo 'Mount data partition...'
+mkdir -p /$LABEL
+if [ ! -L "/dev/disk/by-label/$LABEL" ]; then
+    echo 'ERROR: Data partition not found!'
+    echo "Please create a data partition with ext4 filesystem and label \"$LABEL\":"
+    echo "# cfdisk /dev/<disk> (use GPT label, create linux partition)"
+    echo "# mkfs.ext4 -L $LABEL /dev/<partition>"
+    exit 1
+fi
+if ! grep -Fq "LABEL=$LABEL" /etc/fstab; then
+    echo "LABEL=$LABEL  /$LABEL  ext4  noatime  0 1" >> /etc/fstab
+fi
+mount -a
+if ! mount | grep /$LABEL > /dev/null; then
+    echo "ERROR: Could not mount data partition!"
+    exit 1
+fi
+
+if [ ! -d "/$LABEL/var/lib/mysql/assp" ]; then
+    echo 'Initialize MariaDB...'
+    systemctl stop mariadb
+    mkdir -p /$LABEL/var/lib/mysql
+    rm -rf /$LABEL/var/lib/mysql/*
+    cp -a /var/lib/mysql/. /$LABEL/var/lib/mysql
+    sed -i "s:^datadir.*:datadir = /$LABEL/var/lib/mysql:" /etc/mysql/my.cnf
+    systemctl start mariadb
+
+    echo 'Create ASSP database...'
+    mysql -u root -e "CREATE USER 'assp'@'localhost' IDENTIFIED BY '$DATABASE_PASS'"
+    mysql -u root -e "CREATE DATABASE assp;"
+    mysql -u root -e "GRANT ALL PRIVILEGES ON assp.* TO 'assp'@'localhost' IDENTIFIED by '$DATABASE_PASS';"
+    mysql -u root -e "FLUSH PRIVILEGES;"
+else
+    echo 'Start MariaDB...'
+    sed -i "s:^datadir.*:datadir = /$LABEL/var/lib/mysql:" /etc/mysql/my.cnf
+    systemctl start mariadb
+fi
+echo 'Enable database...'
+systemctl enable mariadb
+
+# Perl (und damit ASSP) darf auch Ports unter 1024 öffnen
+setcap CAP_NET_BIND_SERVICE=+eip /usr/bin/perl
+
+rm /firstboot

mailgw/mailgw.cfg

@@ -0,0 +1,18 @@
+##HOSTNAME = $(APPLIANCE)
+##TIMEZONE = UTC
+##DISK_SIZE = 6.0G
+##SWAP_SIZE = 30
+##SWAP_FILE = $(CHROOT)/.swap
+##ARCH = amd64-hardened
+##MAKEOPTS = -j10 -l10
+##PRUNE_CRITICAL = NO
+##CHANGE_PASSWORD = YES
+##HEADLESS = NO
+##SOFTWARE = 1
+##PKGLIST = 0
+##RSYNC_MIRROR = rsync://rsync15.de.gentoo.org/gentoo/
+KERNEL_PKG = hardened-sources
+KERNEL_CONFIG = appliances/$(APPLIANCE)/kernel.config
+ENABLE_SSHD = YES
+TIMEZONE=Europe/Berlin
+LOCALE=de_DE.utf8

mailgw/make.conf

@@ -0,0 +1,7 @@
+CFLAGS="-O2 -pipe"
+CXXFLAGS="-O2 -pipe"
+USE="hardened justify pax_kernel pie ssp urandom xattr xtpax -fortran -jit -orc -pch -pic -prelink -profile -tcc"
+MAKEOPTS="-j5"
+ACCEPT_LICENSE="*"
+PYTHON_TARGETS="python2_7"
+PYTHON_SINGLE_TARGET="python2_7"

mailgw/mariadb/my.cnf

@@ -0,0 +1,139 @@
+# /etc/mysql/my.cnf: The global mysql configuration file.
+# $Id$
+
+# The following options will be passed to all MySQL clients
+[client]
+#password					= your_password
+port						= 3306
+socket						= /var/run/mysqld/mysqld.sock
+
+[mysql]
+character-sets-dir=/usr/share/mysql/charsets
+default-character-set=utf8
+
+[mysqladmin]
+character-sets-dir=/usr/share/mysql/charsets
+default-character-set=utf8
+
+[mysqlcheck]
+character-sets-dir=/usr/share/mysql/charsets
+default-character-set=utf8
+
+[mysqldump]
+character-sets-dir=/usr/share/mysql/charsets
+default-character-set=utf8
+
+[mysqlimport]
+character-sets-dir=/usr/share/mysql/charsets
+default-character-set=utf8
+
+[mysqlshow]
+character-sets-dir=/usr/share/mysql/charsets
+default-character-set=utf8
+
+[myisamchk]
+character-sets-dir=/usr/share/mysql/charsets
+
+[myisampack]
+character-sets-dir=/usr/share/mysql/charsets
+
+# add a section [mysqld-4.1] or [mysqld-5.0] for specific configurations
+[mysqld]
+character-set-server		= utf8
+user 						= mysql
+port 						= 3306
+socket 						= /var/run/mysqld/mysqld.sock
+pid-file 					= /var/run/mysqld/mysqld.pid
+log-error 					= /var/log/mysql/mysqld.err
+basedir 					= /usr
+datadir 					= /var/lib/mysql
+skip-external-locking
+key_buffer_size				= 16M
+max_allowed_packet 			= 4M
+table_open_cache 			= 400
+sort_buffer_size 			= 512K
+net_buffer_length 			= 16K
+read_buffer_size 			= 256K
+read_rnd_buffer_size 		= 512K
+myisam_sort_buffer_size 	= 8M
+lc_messages_dir			= /usr/share/mysql
+#Set this to your desired error message language
+lc_messages			= en_US
+
+# security:
+# using "localhost" in connects uses sockets by default
+# skip-networking
+bind-address				= 127.0.0.1
+
+##log-bin
+server-id 					= 1
+
+# point the following paths to different dedicated disks
+tmpdir 						= /tmp/
+#log-update 				= /path-to-dedicated-directory/hostname
+
+# you need the debug USE flag enabled to use the following directives,
+# if needed, uncomment them, start the server and issue
+# #tail -f /tmp/mysqld.sql /tmp/mysqld.trace
+# this will show you *exactly* what's happening in your server ;)
+
+#log						= /tmp/mysqld.sql
+#gdb
+#debug						= d:t:i:o,/tmp/mysqld.trace
+#one-thread
+
+# the rest of the innodb config follows:
+# don't eat too much memory, we're trying to be safe on 64Mb boxes
+# you might want to bump this up a bit on boxes with more RAM
+innodb_buffer_pool_size = 128M
+#
+# i'd like to use /var/lib/mysql/innodb, but that is seen as a database :-(
+# and upstream wants things to be under /var/lib/mysql/, so that's the route
+# we have to take for the moment
+#innodb_data_home_dir		= /var/lib/mysql/
+#innodb_log_arch_dir		= /var/lib/mysql/
+#innodb_log_group_home_dir	= /var/lib/mysql/
+# you may wish to change this size to be more suitable for your system
+# the max is there to avoid run-away growth on your machine
+innodb_data_file_path = ibdata1:10M:autoextend:max:128M
+# we keep this at around 25% of of innodb_buffer_pool_size
+# sensible values range from 1MB to (1/innodb_log_files_in_group*innodb_buffer_pool_size)
+innodb_log_file_size = 48M
+# this is the default, increase it if you have very large transactions going on
+innodb_log_buffer_size = 8M
+# this is the default and won't hurt you
+# you shouldn't need to tweak it
+innodb_log_files_in_group=2
+# see the innodb config docs, the other options are not always safe
+innodb_flush_log_at_trx_commit = 1
+innodb_lock_wait_timeout = 50
+innodb_file_per_table
+
+# Uncomment this to get FEDERATED engine support
+#plugin-load=federated=ha_federated.so
+loose-federated
+
+[mysqldump]
+quick
+max_allowed_packet 			= 16M
+
+[mysql]
+# uncomment the next directive if you are not familiar with SQL
+#safe-updates
+
+[isamchk]
+key_buffer_size				= 20M
+sort_buffer_size 			= 20M
+read_buffer 				= 2M
+write_buffer 				= 2M
+
+[myisamchk]
+key_buffer_size				= 20M
+sort_buffer_size 			= 20M
+read_buffer_size			= 2M
+write_buffer_size			= 2M
+
+[mysqlhotcopy]
+interactive-timeout
+
+[mariadb]

mailgw/mariadb/my.cnf.root

@@ -0,0 +1,7 @@
+[mysqladmin]
+user        = root
+password    = gentoo
+
+[mysql]
+user        = root
+password    = gentoo

mailgw/package.keywords

@@ -0,0 +1,22 @@
+# Grundsystem
+app-admin/paxtest ~amd64 ~x86
+app-emulation/open-vm-tools ~amd64 ~x86
+sys-auth/pam_ssh_agent_auth ~amd64 ~x86
+sys-kernel/gentoo-sources ~amd64 ~x86
+sys-kernel/hardened-sources ~amd64 ~x86
+
+# ASSP
+dev-perl/Archive-Extract
+dev-perl/Email-Address-XS
+dev-perl/Email-MIME
+dev-perl/Email-MIME-ContentType
+dev-perl/Email-Simple
+dev-perl/File-Scan-ClamAV
+dev-perl/HTML-Strip
+dev-perl/Unicode-LineBreak
+dev-perl/Crypt-SMIME
+sys-libs/db:6.0
+virtual/perl-Encode
+
+# ClamAV Zusatz-Signaturen
+app-antivirus/clamav-unofficial-sigs

mailgw/package.unmask

@@ -0,0 +1 @@
+sys-kernel/hardened-sources

mailgw/package.use

@@ -0,0 +1,30 @@
+app-admin/sudo -sendmail
+app-editors/nano ncurses
+app-emulation/open-vm-tools pic -modules
+app-misc/mc -slang
+dev-lang/python ssl threads xml
+dev-libs/libpcre cxx
+dev-util/pkgconfig internal-glib
+net-misc/openssh ssl
+net-misc/wget ssl
+sys-apps/hwids udev
+sys-apps/kmod tools
+sys-apps/net-tools hostname
+sys-apps/portage ipc
+sys-auth/pambase nullok sha512
+sys-devel/gcc cxx nptl
+sys-kernel/gentoo-sources symlink
+sys-kernel/hardened-sources symlink
+
+# Monitoring
+net-analyzer/zabbix agent
+
+# ASSP
+app-text/ghostscript-gpl cups
+app-text/tesseract tiff
+dev-lang/perl ithreads
+media-libs/leptonica tiff
+x11-libs/cairo X
+mail-filter/assp arc berkdb clamav dcc fakemx ldap ocr mysql razor sasl snmp spf srs ssl syslog
+mail-mta/postfix cdb dovecot-sasl ldap mysql
+net-mail/dovecot ldap lucene managesieve mysql sieve

mailgw/system/50-assp-ulimit.conf

@@ -0,0 +1,2 @@
+*               hard    nofile          65536
+*               soft    nofile          32768

mailgw/timesyncd.conf

@@ -0,0 +1,12 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+#
+# See timesyncd.conf(5) for details.
+
+[Time]
+NTP=0.de.pool.ntp.org 1.de.pool.ntp.org 2.de.pool.ntp.org 3.de.pool.ntp.org
+FallbackNTP=0.gentoo.pool.ntp.org 1.gentoo.pool.ntp.org 2.gentoo.pool.ntp.org 3.gentoo.pool.ntp.org

mailgw/world

@@ -0,0 +1,22 @@
+app-admin/logrotate
+app-admin/paxtest
+app-admin/sudo
+app-emulation/open-vm-tools
+app-misc/mc
+app-misc/screenservice
+net-analyzer/zabbix
+sys-apps/elfix
+sys-apps/gradm
+sys-apps/paxctl
+sys-auth/pam_ssh_agent_auth
+sys-fs/mdadm
+sys-power/acpid
+app-antivirus/clamav
+app-antivirus/clamav-unofficial-sigs
+app-arch/libarchive
+mail-filter/assp
+mail-mta/postfix
+net-dns/pdns-recursor
+net-mail/dovecot
+net-misc/netkit-telnetd
+net-nds/openldap