-
Notifications
You must be signed in to change notification settings - Fork 5
/
base_sys_setup.sh
343 lines (274 loc) · 11.6 KB
/
base_sys_setup.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
#!/bin/bash
# Authenticate sudo perms before script execution to avoid timeouts or errors
sudo -l > /dev/null 2>&1
# Set Colour Vars
GREEN='\033[0;32m'
RED='\033[0;31m'
NC='\033[0m' # No Color
FUNC_VARS(){
## VARIABLE / PARAMETER DEFINITIONS
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#source sample.vars
source ~/"plinode_$(hostname -f)".vars
}
FUNC_VALUE_CHECK(){
echo -e "${GREEN}#########################################################################${NC}"
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN} GoPlugin 2.0 Validator Node Deployment Script - Pre Checks${NC}"
echo
echo -e "${GREEN}#########################################################################${NC}"
echo -e "${GREEN}#########################################################################${NC}"
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## CONFIRM SCRIPTS VARIABLE DEFINITIONS HAVE BEEN UPDATED...${NC}"
echo
# Ask the user acc for login details (comment out to disable)
while true; do
read -r -p "please confirm that you have updated this script with your values ? (y/n) " _input
case $_input in
[Yy][Ee][Ss]|[Yy]* )
#FUNC_BASE_SETUP
break
;;
[Nn][Oo]|[Nn]* )
FUNC_EXIT
;;
* ) echo "Please answer (y)es or (n)o.";;
esac
done
}
FUNC_PKG_CHECK(){
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## CHECK NECESSARY PACKAGES HAVE BEEN INSTALLED...${NC}"
echo
for i in "${BASE_SYS_PACKAGES[@]}"
do
hash $i &> /dev/null
if [ $? -eq 1 ]; then
echo >&2 "package "$i" not found. installing...."
sudo apt install -y "$i"
fi
echo "packages "$i" exist. proceeding...."
done
}
FUNC_SETUP_OS(){
#FUNC_VARS;
#echo -e "${GREEN}#########################################################################"
#echo -e "${GREEN}#########################################################################"
#echo -e "${GREEN}"
#echo -e "${GREEN} Script Deployment menthod"
#echo -e "${GREEN}"
#echo -e "${GREEN}#########################################################################"
#echo -e "${GREEN}#########################################################################${NC}"
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## Base Setup: System updates...${NC}"
echo
sudo apt update -y && sudo apt upgrade -y
#echo -e "${GREEN}#########################################################################"
#echo
#echo -e "${GREEN}## Setup: Install necessary apps...${NC}"
#echo
#sudo apt install net-tools git curl locate ufw whois -y
#FUNC_PKG_CHECK;
#sudo updatedb
sleep 1s
}
FUNC_SETUP_USER(){
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## Base Setup: Add new local admin account with sudo access...${NC}"
echo
# Generate the encrypted password to be passed as follows;
# root@plitest:/# mkpasswd -m sha256crypt testpassword
# $5$HFpQR/kzgOONS$Uf6BwLbssmhByLLJFje/WV/vMT1TeGwH8CnLnoQV4XD
# root@plitest:/#
sleep 1s
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## Provide user details...${NC}"
echo
# Ask the user acc for login details (comment out to disable - See Definitions section to hard code)
read -p 'Enter Username: ' VAR_USERNAME
read -sp 'Enter Password: ' VAR_PASSWORD
encVAR_PASSWORD=$(mkpasswd -m sha256crypt $VAR_PASSWORD)
sleep 2s
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## Base Setup: Creating the new acc user & group & adds to sudoers...${NC}"
echo
sudo groupadd $VAR_USERNAME
sudo useradd -p "$encVAR_PASSWORD" "$VAR_USERNAME" -m -s /bin/bash -g "$VAR_USERNAME" -G sudo
echo -e "${GREEN}## Verify user account...${NC}"
echo
sudo cat /etc/passwd | grep $VAR_USERNAME
echo
echo
echo -e "${GREEN}## Verify user group...${NC}"
echo
sudo cat /etc/group | grep $VAR_USERNAME
sleep 1s
echo
echo
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## Base Setup: Creating SSH keys for new acc user ${NC}"
echo
cd /home/$VAR_USERNAME
sudo mkdir -p .ssh
sudo touch .ssh/authorized_keys && sudo chmod 777 .ssh/authorized_keys
# create private & public keys -- no user interaction -- comment added
# to aid in identifying key usage/purpose. To add as password to private
# key, simply remote the '-P ""' at the end of the command.
# su $VAR_USERNAME
sudo ssh-keygen -t rsa -b 4096 -f .ssh/id_rsa_$VAR_USERNAME -C "pli_node $VAR_USERNAME" -q -P ""
sudo cat .ssh/id_rsa_$VAR_USERNAME.pub >> .ssh/authorized_keys
sudo chown $VAR_USERNAME:$VAR_USERNAME -R .ssh && sudo chmod 700 .ssh
sudo chmod 600 .ssh/authorized_keys
echo
echo -e "${RED}## IMPORTANT: Be sure to copy the private key to your local machine${NC}"
echo -e "${RED}## IMPORTANT: where you will admin the node from & delete the private${NC}"
echo -e "${RED}## IMPORTANT: key file from the PLI node${NC}"
echo
# The ssh keys should ideally be generated on your local linux/mac workstation and then the
# public key file uploaded to the PLI node. The following code has been tested on this basis;
# change the below values to suit your requirements - the publiy key is for the account you are
# logging in with - in this case testuser123
#
# NOTE: This method depends on the ability to logon with Password Authentication enabled
#
### ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_testuser123 -C "pli_node testuser123" -q -P ""
### cat id_rsa_testuser123.pub | ssh [email protected] "mkdir -p ~/.ssh && chmod \
### 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
###
sleep 3s
}
FUNC_SETUP_UFW_PORTS(){
echo
echo
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## Base Setup: Configure Firewall...${NC}"
echo
# Get current SSH port number
CPORT=$(sudo ss -tlpn | grep sshd | awk '{print$4}' | cut -d ':' -f 2 -s)
#echo $CPORT
sudo ufw allow $CPORT/tcp
## default ssh & non-standard ssh port
#sudo ufw allow $PLI_SSH_DEF_PORT/tcp
## node local job server http/https ports
sudo ufw allow $PLI_HTTP_PORT/tcp && sudo ufw allow $PLI_HTTPS_PORT/tcp
sudo ufw status verbose
sleep 2s
}
FUNC_ENABLE_UFW(){
echo
echo
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## Base Setup: Change UFW logging to ufw.log only${NC}"
echo
# source: https://handyman.dulare.com/ufw-block-messages-in-syslog-how-to-get-rid-of-them/
sudo sed -i -e 's/\#& stop/\& stop/g' /etc/rsyslog.d/20-ufw.conf
sudo cat /etc/rsyslog.d/20-ufw.conf | grep '& stop'
echo
echo
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## Setup: Enable Firewall...${NC}"
echo
sudo systemctl start ufw && sudo systemctl status ufw
sleep 2s
echo "y" | sudo ufw enable
#sudo ufw enable
sudo ufw status verbose
}
FUNC_SETUP_SECURE_SSH(){
echo
echo
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## Base Setup: Change SSH port & Secure Authentication methods...${NC}"
echo
echo -e "${RED}# !! IMPORTANT: DO NOT close your existing ssh session..."
echo -e "${RED}# !! Open a second connection to the new port with your existing ADMIN "
echo -e "${RED}# !! or ROOT account - PASSWORD AUTH will be disabled from this point. ${NC}"
sleep 3
#read -p 'Enter New SSH Port to use: ' vNEW_SSH_PORT
sudo sed -i.bak 's/#Port '"$PLI_SSH_DEF_PORT"'/Port '"$PLI_SSH_NEW_PORT"'/g' $SSH_CONFIG_PATH
sudo sed -i.bak -e 's/\#PasswordAuthentication yes/PasswordAuthentication no/g' $SSH_CONFIG_PATH
sudo sed -i.bak -e 's/PasswordAuthentication yes/PasswordAuthentication no/g' $SSH_CONFIG_PATH
sudo sed -i.bak -e 's/UsePAM yes/UsePAM no/g' $SSH_CONFIG_PATH
echo
echo
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## Base Setup: Add new SSH port to firewall...${NC}"
echo
sudo ufw allow $PLI_SSH_NEW_PORT/tcp
echo
echo -e "${GREEN}#########################################################################${NC}"
echo
echo -e "${GREEN}## Base Setup: Restart SSH service for port change to take effect...${NC}"
echo
sudo systemctl restart sshd && sudo systemctl status sshd
sudo netstat -tpln | grep $PLI_SSH_NEW_PORT
echo
echo -e "${GREEN}#### Base System Setup Finished ####${NC}"
}
FUNC_EXIT(){
exit 0
}
FUNC_BASE_SETUP(){
#FUNC_VALUE_CHECK;
FUNC_SETUP_OS;
FUNC_PKG_CHECK;
FUNC_SETUP_UFW_PORTS;
FUNC_ENABLE_UFW;
FUNC_EXIT;
}
FUNC_VARS;
case "$1" in
-D)
FUNC_BASE_SETUP
;;
-os)
FUNC_SETUP_OS
;;
-user)
FUNC_SETUP_USER
;;
-ports)
FUNC_SETUP_UFW_PORTS
;;
-ufw)
FUNC_ENABLE_UFW
;;
-S)
FUNC_SETUP_SECURE_SSH
;;
*)
echo
echo "Usage: $0 {function}"
echo
echo "where {function} is one of the following;"
echo
echo " -D == performs a normal base setup (excludes User acc & Securing SSH)"
echo " -- this assumes you are installing under your current admin session (preferably not root)"
echo
echo " -os == perform OS updates & installs required packages (see sample.vars 'BASE_SYS_PACKAGES')"
echo " -user == Adds a new admin account (to install the plugin node under) & SSH keys"
echo " -ports == Adds required ports to UFW config (see sample.vars for 'PORT' variables )"
echo " -ufw == Starts the UFW process, sets the logging to 'ufw.log' only & enables UFW service"
echo
echo " -S == Secures the SSH service: "
echo " -- sets SSH to use port number '$PLI_SSH_NEW_PORT' "
echo " -- sets authentication method to SSH keys ONLY (Password Auth is disabled)"
echo " -- adds port number '$PLI_SSH_NEW_PORT' to UFW ruleset"
echo " -- restarts the SSH service to activate new settings (NOTE: Current session is unaffected)"
echo
echo
echo
esac