MailGw: erste Version
This commit is contained in:
Joerg Deckert
parent
7eba45264d
commit
dda36ca375
|
|
@ -0,0 +1,22 @@
|
|||
# Beispiel für feste IP-Adreß-Konfiguration:
|
||||
# Anpassen und als 00-eth0.network nach /etc/systemd/network verschieben
|
||||
# (s. "man systemd.network", "man systemd-resolved")
|
||||
#
|
||||
# NICHT VERGESSEN: entsprechende Einträge in /etc/hosts hinzufügen
|
||||
# <IPv4> <FQDN> <Hostname>
|
||||
# <IPv6> <FQDN> <Hostname>
|
||||
|
||||
[Match]
|
||||
Name=eth0
|
||||
|
||||
[Network]
|
||||
Description=1. Netzwerk-Port
|
||||
Address=192.168.1.2/24
|
||||
Address=fdb5:78b:64cc:0:f8c0::2/64
|
||||
Gateway=192.168.1.1
|
||||
Gateway=fdb5:78b:64cc:0:f8c0::1
|
||||
DNS=192.168.1.3
|
||||
DNS=fdb5:78b:64cc:0:f8c0::3
|
||||
NTP=192.168.1.4
|
||||
NTP=fdb5:78b:64cc:0:f8c0::4
|
||||
Domains=privacyidea.de
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
preinstall:
|
||||
# switch to hardened, build hardened toolchain, rebuild everything
|
||||
mkdir -p $(CHROOT)/etc/portage/profile
|
||||
echo "-hardened" >> $(CHROOT)/etc/portage/profile/use.mask
|
||||
$(inroot) $(EMERGE) $(USEPKG) --oneshot gcc
|
||||
$(inroot) $(EMERGE) $(USEPKG) --oneshot binutils virtual/libc
|
||||
-$(gcc_config)
|
||||
$(inroot) $(EMERGE) $(USEPKG) --emptytree @world
|
||||
$(inroot) bash -c 'yes YES | etc-update --automode -9'
|
||||
# ASSP: Perl wurde auf ithreads umgestellt -> Module neu bauen
|
||||
$(inroot) $(EMERGE) $(USEPKG) --oneshot dev-lang/perl
|
||||
$(inroot) perl-cleaner --reallyall
|
||||
|
||||
# Unitas-Portage-Overlay einbinden
|
||||
$(inroot) $(EMERGE) -n $(USEPKG) app-portage/layman
|
||||
sed -i 's/check_official : Yes/check_official : No/' $(CHROOT)/etc/layman/layman.cfg
|
||||
wget -P $(CHROOT)/etc/layman/overlays http://dev.unitas-network.de/raw/Gentoo/Unitas.git/master/unitas-overlays.xml
|
||||
$(inroot) layman -l | grep -q unitas || $(inroot) layman -La unitas
|
||||
|
||||
postinstall: timesyncd.conf firstboot.start
|
||||
# Konfigurationen anpassen
|
||||
cp timesyncd.conf $(CHROOT)/etc/systemd/timesyncd.conf
|
||||
cp firstboot.start $(CHROOT)/etc/local.d/firstboot.start
|
||||
touch $(CHROOT)/firstboot
|
||||
sed -i 's/# %wheel ALL=(ALL) ALL/%wheel ALL=(ALL) ALL/' $(CHROOT)/etc/sudoers
|
||||
$(inroot) useradd -m -G users,wheel -s /bin/bash admin
|
||||
$(inroot) passwd -d admin; $(inroot) passwd -e admin
|
||||
$(inroot) systemctl enable screen@adm.service
|
||||
|
||||
# Beispiel feste IP-Adresse
|
||||
cp 00-eth0.network $(CHROOT)/00-eth0.network.example
|
||||
|
||||
# MariaDB-Konfiguration
|
||||
cp mariadb/my.cnf $(CHROOT)/etc/mysql/my.cnf
|
||||
cp mariadb/my.cnf.root $(CHROOT)/root/.my.cnf
|
||||
chmod 0600 $(CHROOT)/root/.my.cnf
|
||||
rm -rf $(CHROOT)/var/lib/mysql/*
|
||||
$(inroot) bash -c 'yes gentoo | emerge --config dev-db/mariadb'
|
||||
|
||||
# ASSP
|
||||
$(inroot) usermod -aG clamav assp
|
||||
cp system/50-assp-ulimit.conf $(CHROOT)/etc/security/limits.d/
|
||||
sed -i 's/smtp inet n - n - - smtpd/127.0.0.1:125 inet n - n - - smtpd/' $(CHROOT)/etc/postfix/master.cf
|
||||
$(inroot) systemctl enable assp.service
|
||||
$(inroot) systemctl enable freshclamd.service
|
||||
$(inroot) systemctl enable clamd.service
|
||||
$(inroot) systemctl enable postfix.service
|
||||
$(inroot) systemctl enable pdns-recursor.service
|
||||
# für clamav-unofficial-sigs (kann in nächster Gentoo-Version wohl weg)
|
||||
$(inroot) ln -s /usr/lib/systemd /lib/systemd
|
||||
|
||||
clean:
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
Erstkonfiguration
|
||||
=================
|
||||
|
||||
- für variable Daten (MySQL/MariaDB, Konfiguration) muß eine mit ext4 formatierte Datenpartition mit dem Label "DATA" vorhanden sein. Diese wird nach /DATA gemountet.
|
||||
- feste IP-Adresse und /etc/hosts konfigurieren
|
||||
- unter VMware evtl. open-vm-tools aktivieren
|
||||
|
|
@ -0,0 +1,65 @@
|
|||
#!/bin/bash
|
||||
|
||||
# base settings
|
||||
set -e
|
||||
|
||||
[ -e /firstboot ] || exit 0
|
||||
|
||||
echo 'Setting defaults...'
|
||||
localectl --no-convert set-keymap de-latin1-nodeadkeys
|
||||
|
||||
echo 'Activate services...'
|
||||
timedatectl set-ntp true
|
||||
|
||||
echo 'Setting hardened...'
|
||||
paxctl-ng -m /usr/bin/python2.7
|
||||
|
||||
# variables
|
||||
LABEL="DATA"
|
||||
DATABASE_PASS="Di1sgMySQLPwd."
|
||||
|
||||
# Data partition
|
||||
echo 'Mount data partition...'
|
||||
mkdir -p /$LABEL
|
||||
if [ ! -L "/dev/disk/by-label/$LABEL" ]; then
|
||||
echo 'ERROR: Data partition not found!'
|
||||
echo "Please create a data partition with ext4 filesystem and label \"$LABEL\":"
|
||||
echo "# cfdisk /dev/<disk> (use GPT label, create linux partition)"
|
||||
echo "# mkfs.ext4 -L $LABEL /dev/<partition>"
|
||||
exit 1
|
||||
fi
|
||||
if ! grep -Fq "LABEL=$LABEL" /etc/fstab; then
|
||||
echo "LABEL=$LABEL /$LABEL ext4 noatime 0 1" >> /etc/fstab
|
||||
fi
|
||||
mount -a
|
||||
if ! mount | grep /$LABEL > /dev/null; then
|
||||
echo "ERROR: Could not mount data partition!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -d "/$LABEL/var/lib/mysql/assp" ]; then
|
||||
echo 'Initialize MariaDB...'
|
||||
systemctl stop mariadb
|
||||
mkdir -p /$LABEL/var/lib/mysql
|
||||
rm -rf /$LABEL/var/lib/mysql/*
|
||||
cp -a /var/lib/mysql/. /$LABEL/var/lib/mysql
|
||||
sed -i "s:^datadir.*:datadir = /$LABEL/var/lib/mysql:" /etc/mysql/my.cnf
|
||||
systemctl start mariadb
|
||||
|
||||
echo 'Create ASSP database...'
|
||||
mysql -u root -e "CREATE USER 'assp'@'localhost' IDENTIFIED BY '$DATABASE_PASS'"
|
||||
mysql -u root -e "CREATE DATABASE assp;"
|
||||
mysql -u root -e "GRANT ALL PRIVILEGES ON assp.* TO 'assp'@'localhost' IDENTIFIED by '$DATABASE_PASS';"
|
||||
mysql -u root -e "FLUSH PRIVILEGES;"
|
||||
else
|
||||
echo 'Start MariaDB...'
|
||||
sed -i "s:^datadir.*:datadir = /$LABEL/var/lib/mysql:" /etc/mysql/my.cnf
|
||||
systemctl start mariadb
|
||||
fi
|
||||
echo 'Enable database...'
|
||||
systemctl enable mariadb
|
||||
|
||||
# Perl (und damit ASSP) darf auch Ports unter 1024 öffnen
|
||||
setcap CAP_NET_BIND_SERVICE=+eip /usr/bin/perl
|
||||
|
||||
rm /firstboot
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,18 @@
|
|||
##HOSTNAME = $(APPLIANCE)
|
||||
##TIMEZONE = UTC
|
||||
##DISK_SIZE = 6.0G
|
||||
##SWAP_SIZE = 30
|
||||
##SWAP_FILE = $(CHROOT)/.swap
|
||||
##ARCH = amd64-hardened
|
||||
##MAKEOPTS = -j10 -l10
|
||||
##PRUNE_CRITICAL = NO
|
||||
##CHANGE_PASSWORD = YES
|
||||
##HEADLESS = NO
|
||||
##SOFTWARE = 1
|
||||
##PKGLIST = 0
|
||||
##RSYNC_MIRROR = rsync://rsync15.de.gentoo.org/gentoo/
|
||||
KERNEL_PKG = hardened-sources
|
||||
KERNEL_CONFIG = appliances/$(APPLIANCE)/kernel.config
|
||||
ENABLE_SSHD = YES
|
||||
TIMEZONE=Europe/Berlin
|
||||
LOCALE=de_DE.utf8
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
CFLAGS="-O2 -pipe"
|
||||
CXXFLAGS="-O2 -pipe"
|
||||
USE="hardened justify pax_kernel pie ssp urandom xattr xtpax -fortran -jit -orc -pch -pic -prelink -profile -tcc"
|
||||
MAKEOPTS="-j5"
|
||||
ACCEPT_LICENSE="*"
|
||||
PYTHON_TARGETS="python2_7"
|
||||
PYTHON_SINGLE_TARGET="python2_7"
|
||||
|
|
@ -0,0 +1,139 @@
|
|||
# /etc/mysql/my.cnf: The global mysql configuration file.
|
||||
# $Id$
|
||||
|
||||
# The following options will be passed to all MySQL clients
|
||||
[client]
|
||||
#password = your_password
|
||||
port = 3306
|
||||
socket = /var/run/mysqld/mysqld.sock
|
||||
|
||||
[mysql]
|
||||
character-sets-dir=/usr/share/mysql/charsets
|
||||
default-character-set=utf8
|
||||
|
||||
[mysqladmin]
|
||||
character-sets-dir=/usr/share/mysql/charsets
|
||||
default-character-set=utf8
|
||||
|
||||
[mysqlcheck]
|
||||
character-sets-dir=/usr/share/mysql/charsets
|
||||
default-character-set=utf8
|
||||
|
||||
[mysqldump]
|
||||
character-sets-dir=/usr/share/mysql/charsets
|
||||
default-character-set=utf8
|
||||
|
||||
[mysqlimport]
|
||||
character-sets-dir=/usr/share/mysql/charsets
|
||||
default-character-set=utf8
|
||||
|
||||
[mysqlshow]
|
||||
character-sets-dir=/usr/share/mysql/charsets
|
||||
default-character-set=utf8
|
||||
|
||||
[myisamchk]
|
||||
character-sets-dir=/usr/share/mysql/charsets
|
||||
|
||||
[myisampack]
|
||||
character-sets-dir=/usr/share/mysql/charsets
|
||||
|
||||
# add a section [mysqld-4.1] or [mysqld-5.0] for specific configurations
|
||||
[mysqld]
|
||||
character-set-server = utf8
|
||||
user = mysql
|
||||
port = 3306
|
||||
socket = /var/run/mysqld/mysqld.sock
|
||||
pid-file = /var/run/mysqld/mysqld.pid
|
||||
log-error = /var/log/mysql/mysqld.err
|
||||
basedir = /usr
|
||||
datadir = /var/lib/mysql
|
||||
skip-external-locking
|
||||
key_buffer_size = 16M
|
||||
max_allowed_packet = 4M
|
||||
table_open_cache = 400
|
||||
sort_buffer_size = 512K
|
||||
net_buffer_length = 16K
|
||||
read_buffer_size = 256K
|
||||
read_rnd_buffer_size = 512K
|
||||
myisam_sort_buffer_size = 8M
|
||||
lc_messages_dir = /usr/share/mysql
|
||||
#Set this to your desired error message language
|
||||
lc_messages = en_US
|
||||
|
||||
# security:
|
||||
# using "localhost" in connects uses sockets by default
|
||||
# skip-networking
|
||||
bind-address = 127.0.0.1
|
||||
|
||||
##log-bin
|
||||
server-id = 1
|
||||
|
||||
# point the following paths to different dedicated disks
|
||||
tmpdir = /tmp/
|
||||
#log-update = /path-to-dedicated-directory/hostname
|
||||
|
||||
# you need the debug USE flag enabled to use the following directives,
|
||||
# if needed, uncomment them, start the server and issue
|
||||
# #tail -f /tmp/mysqld.sql /tmp/mysqld.trace
|
||||
# this will show you *exactly* what's happening in your server ;)
|
||||
|
||||
#log = /tmp/mysqld.sql
|
||||
#gdb
|
||||
#debug = d:t:i:o,/tmp/mysqld.trace
|
||||
#one-thread
|
||||
|
||||
# the rest of the innodb config follows:
|
||||
# don't eat too much memory, we're trying to be safe on 64Mb boxes
|
||||
# you might want to bump this up a bit on boxes with more RAM
|
||||
innodb_buffer_pool_size = 128M
|
||||
#
|
||||
# i'd like to use /var/lib/mysql/innodb, but that is seen as a database :-(
|
||||
# and upstream wants things to be under /var/lib/mysql/, so that's the route
|
||||
# we have to take for the moment
|
||||
#innodb_data_home_dir = /var/lib/mysql/
|
||||
#innodb_log_arch_dir = /var/lib/mysql/
|
||||
#innodb_log_group_home_dir = /var/lib/mysql/
|
||||
# you may wish to change this size to be more suitable for your system
|
||||
# the max is there to avoid run-away growth on your machine
|
||||
innodb_data_file_path = ibdata1:10M:autoextend:max:128M
|
||||
# we keep this at around 25% of of innodb_buffer_pool_size
|
||||
# sensible values range from 1MB to (1/innodb_log_files_in_group*innodb_buffer_pool_size)
|
||||
innodb_log_file_size = 48M
|
||||
# this is the default, increase it if you have very large transactions going on
|
||||
innodb_log_buffer_size = 8M
|
||||
# this is the default and won't hurt you
|
||||
# you shouldn't need to tweak it
|
||||
innodb_log_files_in_group=2
|
||||
# see the innodb config docs, the other options are not always safe
|
||||
innodb_flush_log_at_trx_commit = 1
|
||||
innodb_lock_wait_timeout = 50
|
||||
innodb_file_per_table
|
||||
|
||||
# Uncomment this to get FEDERATED engine support
|
||||
#plugin-load=federated=ha_federated.so
|
||||
loose-federated
|
||||
|
||||
[mysqldump]
|
||||
quick
|
||||
max_allowed_packet = 16M
|
||||
|
||||
[mysql]
|
||||
# uncomment the next directive if you are not familiar with SQL
|
||||
#safe-updates
|
||||
|
||||
[isamchk]
|
||||
key_buffer_size = 20M
|
||||
sort_buffer_size = 20M
|
||||
read_buffer = 2M
|
||||
write_buffer = 2M
|
||||
|
||||
[myisamchk]
|
||||
key_buffer_size = 20M
|
||||
sort_buffer_size = 20M
|
||||
read_buffer_size = 2M
|
||||
write_buffer_size = 2M
|
||||
|
||||
[mysqlhotcopy]
|
||||
interactive-timeout
|
||||
|
||||
[mariadb]
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
[mysqladmin]
|
||||
user = root
|
||||
password = gentoo
|
||||
|
||||
[mysql]
|
||||
user = root
|
||||
password = gentoo
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
# Grundsystem
|
||||
app-admin/paxtest ~amd64 ~x86
|
||||
app-emulation/open-vm-tools ~amd64 ~x86
|
||||
sys-auth/pam_ssh_agent_auth ~amd64 ~x86
|
||||
sys-kernel/gentoo-sources ~amd64 ~x86
|
||||
sys-kernel/hardened-sources ~amd64 ~x86
|
||||
|
||||
# ASSP
|
||||
dev-perl/Archive-Extract
|
||||
dev-perl/Email-Address-XS
|
||||
dev-perl/Email-MIME
|
||||
dev-perl/Email-MIME-ContentType
|
||||
dev-perl/Email-Simple
|
||||
dev-perl/File-Scan-ClamAV
|
||||
dev-perl/HTML-Strip
|
||||
dev-perl/Unicode-LineBreak
|
||||
dev-perl/Crypt-SMIME
|
||||
sys-libs/db:6.0
|
||||
virtual/perl-Encode
|
||||
|
||||
# ClamAV Zusatz-Signaturen
|
||||
app-antivirus/clamav-unofficial-sigs
|
||||
|
|
@ -0,0 +1 @@
|
|||
sys-kernel/hardened-sources
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
app-admin/sudo -sendmail
|
||||
app-editors/nano ncurses
|
||||
app-emulation/open-vm-tools pic -modules
|
||||
app-misc/mc -slang
|
||||
dev-lang/python ssl threads xml
|
||||
dev-libs/libpcre cxx
|
||||
dev-util/pkgconfig internal-glib
|
||||
net-misc/openssh ssl
|
||||
net-misc/wget ssl
|
||||
sys-apps/hwids udev
|
||||
sys-apps/kmod tools
|
||||
sys-apps/net-tools hostname
|
||||
sys-apps/portage ipc
|
||||
sys-auth/pambase nullok sha512
|
||||
sys-devel/gcc cxx nptl
|
||||
sys-kernel/gentoo-sources symlink
|
||||
sys-kernel/hardened-sources symlink
|
||||
|
||||
# Monitoring
|
||||
net-analyzer/zabbix agent
|
||||
|
||||
# ASSP
|
||||
app-text/ghostscript-gpl cups
|
||||
app-text/tesseract tiff
|
||||
dev-lang/perl ithreads
|
||||
media-libs/leptonica tiff
|
||||
x11-libs/cairo X
|
||||
mail-filter/assp arc berkdb clamav dcc fakemx ldap ocr mysql razor sasl snmp spf srs ssl syslog
|
||||
mail-mta/postfix cdb dovecot-sasl ldap mysql
|
||||
net-mail/dovecot ldap lucene managesieve mysql sieve
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
* hard nofile 65536
|
||||
* soft nofile 32768
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
# This file is part of systemd.
|
||||
#
|
||||
# systemd is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU Lesser General Public License as published by
|
||||
# the Free Software Foundation; either version 2.1 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# See timesyncd.conf(5) for details.
|
||||
|
||||
[Time]
|
||||
NTP=0.de.pool.ntp.org 1.de.pool.ntp.org 2.de.pool.ntp.org 3.de.pool.ntp.org
|
||||
FallbackNTP=0.gentoo.pool.ntp.org 1.gentoo.pool.ntp.org 2.gentoo.pool.ntp.org 3.gentoo.pool.ntp.org
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
app-admin/logrotate
|
||||
app-admin/paxtest
|
||||
app-admin/sudo
|
||||
app-emulation/open-vm-tools
|
||||
app-misc/mc
|
||||
app-misc/screenservice
|
||||
net-analyzer/zabbix
|
||||
sys-apps/elfix
|
||||
sys-apps/gradm
|
||||
sys-apps/paxctl
|
||||
sys-auth/pam_ssh_agent_auth
|
||||
sys-fs/mdadm
|
||||
sys-power/acpid
|
||||
app-antivirus/clamav
|
||||
app-antivirus/clamav-unofficial-sigs
|
||||
app-arch/libarchive
|
||||
mail-filter/assp
|
||||
mail-mta/postfix
|
||||
net-dns/pdns-recursor
|
||||
net-mail/dovecot
|
||||
net-misc/netkit-telnetd
|
||||
net-nds/openldap
|
||||
Reference in New Issue