From 082b03441614dc533b009bfecb63360a10e02be6 Mon Sep 17 00:00:00 2001 From: Weberson de Sousa Pimentel <9416096+wspimentel@users.noreply.github.com> Date: Wed, 27 Feb 2019 17:50:04 -0300 Subject: [PATCH] =?UTF-8?q?Atualiza=C3=A7=C3=B5es.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- autoinstall.ini | 52 +++++++++++++ bin/systemctl | 19 +++++ etc/apache2/conf-enabled/roundcube.conf | 48 ++++++++++++ etc/apache2/conf-enabled/squirrelmail.conf | 48 ++++++++++++ etc/cron.d/awstats | 6 ++ etc/cron.daily/sql_backup.sh | 21 +++++ etc/fail2ban/filter.d/dovecot-pop3imap.conf | 3 + etc/fail2ban/filter.d/pureftpd.conf | 3 + etc/fail2ban/jail.local | 19 +++++ etc/mysql/debian.cnf | 11 +++ etc/pure-ftpd/clamav_check.sh | 3 + etc/roundcube/config.inc.php | 85 +++++++++++++++++++++ start.sh | 40 ++++++++++ supervisord.conf | 78 +++++++++++++++++++ 14 files changed, 436 insertions(+) create mode 100644 autoinstall.ini create mode 100644 bin/systemctl create mode 100644 etc/apache2/conf-enabled/roundcube.conf create mode 100644 etc/apache2/conf-enabled/squirrelmail.conf create mode 100644 etc/cron.d/awstats create mode 100644 etc/cron.daily/sql_backup.sh create mode 100644 etc/fail2ban/filter.d/dovecot-pop3imap.conf create mode 100644 etc/fail2ban/filter.d/pureftpd.conf create mode 100644 etc/fail2ban/jail.local create mode 100644 etc/mysql/debian.cnf create mode 100644 etc/pure-ftpd/clamav_check.sh create mode 100644 etc/roundcube/config.inc.php create mode 100644 start.sh create mode 100644 supervisord.conf diff --git a/autoinstall.ini b/autoinstall.ini new file mode 100644 index 0000000..f278268 --- /dev/null +++ b/autoinstall.ini @@ -0,0 +1,52 @@ +[install] +language=en +install_mode=standard +hostname=server1.dwti.com.br +mysql_hostname=localhost +mysql_root_user=root +mysql_root_password=pass +mysql_database=dbispconfig +mysql_port=3306 +mysql_charset=utf8 +http_server=apache +ispconfig_port=8080 +ispconfig_use_ssl=y +ispconfig_admin_password=admin + +[ssl_cert] +ssl_cert_country=BR +ssl_cert_state=Goias +ssl_cert_locality=Porangatu +ssl_cert_organisation=DWTI +ssl_cert_organisation_unit=Departamento de TI +ssl_cert_common_name=server1.dwti.com.br + +[expert] +mysql_ispconfig_user=admin +mysql_ispconfig_password=admin +join_multiserver_setup=n +mysql_master_hostname=localhost +mysql_master_root_user=root +mysql_master_root_password=pass +mysql_master_database=dbispconfig +configure_mail=y +configure_jailkit=y +configure_ftp=y +configure_dns=y +configure_apache=y +configure_nginx=y +configure_firewall=y +install_ispconfig_web_interface=y + +[update] +do_backup=yes +mysql_root_password=ispconfig +mysql_master_hostname=localhost +mysql_master_root_user=root +mysql_master_root_password=pass +mysql_master_database=dbispconfig +reconfigure_permissions_in_master_database=no +reconfigure_services=yes +ispconfig_port=8080 +create_new_ispconfig_ssl_cert=no +reconfigure_crontab=yes diff --git a/bin/systemctl b/bin/systemctl new file mode 100644 index 0000000..ff36823 --- /dev/null +++ b/bin/systemctl @@ -0,0 +1,19 @@ +#!/bin/bash +SERVICE=${2/%.service/} +case "$1" in + restart) + /etc/init.d/$SERVICE restart + ;; + stop) + /etc/init.d/$SERVICE stop + ;; + status) + /etc/init.d/$SERVICE status + ;; + start) + /etc/init.d/$SERVICE start + ;; + *) + command systemctloriginal "$@" + exit 1 +esac diff --git a/etc/apache2/conf-enabled/roundcube.conf b/etc/apache2/conf-enabled/roundcube.conf new file mode 100644 index 0000000..b810bb5 --- /dev/null +++ b/etc/apache2/conf-enabled/roundcube.conf @@ -0,0 +1,48 @@ +# Those aliases do not work properly with several hosts on your apache server +# Uncomment them to use it or adapt them to your configuration +# Alias /roundcube /var/lib/roundcube +Alias /webmail /var/lib/roundcube + + + Options +FollowSymLinks + # This is needed to parse /var/lib/roundcube/.htaccess. See its + # content before setting AllowOverride to None. + AllowOverride All + = 2.3> + Require all granted + + + Order allow,deny + Allow from all + + + +# Protecting basic directories: + + Options -FollowSymLinks + AllowOverride None + + + + Options -FollowSymLinks + AllowOverride None + = 2.3> + Require all denied + + + Order allow,deny + Deny from all + + + + + Options -FollowSymLinks + AllowOverride None + = 2.3> + Require all denied + + + Order allow,deny + Deny from all + + diff --git a/etc/apache2/conf-enabled/squirrelmail.conf b/etc/apache2/conf-enabled/squirrelmail.conf new file mode 100644 index 0000000..3ba6713 --- /dev/null +++ b/etc/apache2/conf-enabled/squirrelmail.conf @@ -0,0 +1,48 @@ +Alias /webmail /usr/share/squirrelmail + + + Options FollowSymLinks + + AddType application/x-httpd-php .php + php_flag magic_quotes_gpc Off + php_flag track_vars On + php_admin_flag allow_url_fopen Off + php_value include_path . + php_admin_value upload_tmp_dir /var/lib/squirrelmail/tmp + php_admin_value open_basedir /usr/share/squirrelmail:/etc/squirrelmail:/var/lib/squirrelmail:/etc/hostname:/etc/mailname + php_flag register_globals off + + + DirectoryIndex index.php + + + # access to configtest is limited by default to prevent information leak + + order deny,allow + deny from all + allow from 127.0.0.1 + + + +# users will prefer a simple URL like http://webmail.example.com +# +# DocumentRoot /usr/share/squirrelmail +# ServerName webmail.example.com +# + +# redirect to https when available (thanks omen@descolada.dartmouth.edu) +# +# Note: There are multiple ways to do this, and which one is suitable for +# your site's configuration depends. Consult the apache documentation if +# you're unsure, as this example might not work everywhere. +# +# +# +# +# RewriteEngine on +# RewriteCond %{HTTPS} !^on$ [NC] +# RewriteRule . https://%{HTTP_HOST}%{REQUEST_URI} [L] +# +# +# + diff --git a/etc/cron.d/awstats b/etc/cron.d/awstats new file mode 100644 index 0000000..342069f --- /dev/null +++ b/etc/cron.d/awstats @@ -0,0 +1,6 @@ +#MAILTO=root + +#*/10 * * * * www-data [ -x /usr/share/awstats/tools/update.sh ] && /usr/share/awstats/tools/update.sh + +# Generate static reports: +#10 03 * * * www-data [ -x /usr/share/awstats/tools/buildstatic.sh ] && /usr/share/awstats/tools/buildstatic.sh diff --git a/etc/cron.daily/sql_backup.sh b/etc/cron.daily/sql_backup.sh new file mode 100644 index 0000000..27dc8ce --- /dev/null +++ b/etc/cron.daily/sql_backup.sh @@ -0,0 +1,21 @@ +#!/bin/bash +if [ $SQL_BACKUP = 1 ] +then +MUSER=root +MPASS=pass +BACKUP=/var/backup/sql +NOW="$(date +"%d-%m-%Y_%H%M")" +OLD="$(date +"%d-%m-%Y" -d '-7 day')" +# create directory +mkdir -p "$BACKUP/sql/$NOW/" +# all databases +mysqldump -u $MUSER --password=$MPASS --all-databases --single-transaction > "$BACKUP/sql/$NOW/all_databases.sql" +# backup each base of the database +DBS="$(mysql -u $MUSER -p$MPASS -Bse 'show databases')" +for db in $DBS +do + mysqldump -u $MUSER --password=$MPASS $db --single-transaction > "$BACKUP/sql/$NOW/$db.sql" +done +# delete old sql +rm -r $BACKUP/sql/$OLD* +fi diff --git a/etc/fail2ban/filter.d/dovecot-pop3imap.conf b/etc/fail2ban/filter.d/dovecot-pop3imap.conf new file mode 100644 index 0000000..9cf93a6 --- /dev/null +++ b/etc/fail2ban/filter.d/dovecot-pop3imap.conf @@ -0,0 +1,3 @@ +[Definition] +failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=(?P\S*),.* +ignoreregex = diff --git a/etc/fail2ban/filter.d/pureftpd.conf b/etc/fail2ban/filter.d/pureftpd.conf new file mode 100644 index 0000000..7f1dc0f --- /dev/null +++ b/etc/fail2ban/filter.d/pureftpd.conf @@ -0,0 +1,3 @@ +[Definition] +failregex = .*pure-ftpd: \(.*@\) \[WARNING\] Authentication failed for user.* +ignoreregex = diff --git a/etc/fail2ban/jail.local b/etc/fail2ban/jail.local new file mode 100644 index 0000000..74fa036 --- /dev/null +++ b/etc/fail2ban/jail.local @@ -0,0 +1,19 @@ +[pure-ftpd] +enabled = true +port = ftp +filter = pure-ftpd +logpath = /var/log/syslog +maxretry = 3 + +[dovecot] +enabled = true +filter = dovecot +logpath = /var/log/mail.log +maxretry = 5 + +[postfix-sasl] +enabled = true +port = smtp +filter = postfix-sasl +logpath = /var/log/mail.log +maxretry = 3 diff --git a/etc/mysql/debian.cnf b/etc/mysql/debian.cnf new file mode 100644 index 0000000..84d588e --- /dev/null +++ b/etc/mysql/debian.cnf @@ -0,0 +1,11 @@ +[client] +host = localhost +user = root +password = pass +socket = /var/run/mysqld/mysqld.sock +[mysql_upgrade] +host = localhost +user = root +password = pass +socket = /var/run/mysqld/mysqld.sock +basedir = /usr \ No newline at end of file diff --git a/etc/pure-ftpd/clamav_check.sh b/etc/pure-ftpd/clamav_check.sh new file mode 100644 index 0000000..96a5a72 --- /dev/null +++ b/etc/pure-ftpd/clamav_check.sh @@ -0,0 +1,3 @@ +#!/bin/sh +/usr/bin/clamdscan --remove --quiet --no-summary "$1" + diff --git a/etc/roundcube/config.inc.php b/etc/roundcube/config.inc.php new file mode 100644 index 0000000..3610ac5 --- /dev/null +++ b/etc/roundcube/config.inc.php @@ -0,0 +1,85 @@ + /var/www/html/index.html + rm -r /root/ispconfig3_install +fi + +service mysql start && php -q /tmp/ispconfig3_install/install/install.php --autoinstall=/tmp/ispconfig3_install/install/autoinstall.ini + +screenfetch + +/usr/bin/supervisord -c /etc/supervisor/supervisord.conf diff --git a/supervisord.conf b/supervisord.conf new file mode 100644 index 0000000..2478191 --- /dev/null +++ b/supervisord.conf @@ -0,0 +1,78 @@ +[supervisorctl] +serverurl = unix:///tmp/supervisor.sock + +[supervisord] +logfile=/var/log/supervisor/supervisor.log ; supervisord log file +logfile_maxbytes=50MB ; maximum size of logfile before rotation +logfile_backups=10 ; number of backed up logfiles +loglevel=error ; info, debug, warn, trace +pidfile=/var/run/supervisord.pid ; pidfile location +nodaemon=true ; (start in foreground if true;default false) +minfds=1024 ; number of startup file descriptors +minprocs=200 ; number of process descriptors +user=root ; default user +childlogdir=/var/log/supervisor/ ; where child log files will live +;umask=022 ; (process file creation umask;default 022) +;identifier=supervisor ; (supervisord identifier, default is 'supervisor') +;directory=/tmp ; (default is not to cd during start) +;nocleanup=true ; (don't clean up tempfiles at start;default false) +;childlogdir=/tmp ; ('AUTO' child log dir, default $TEMP) +;environment=KEY=value ; (key value pairs to add to environment) +;strip_ansi=false ; (strip ansi escape codes in logs; default false) +logfile=/var/log/supervisor/supervisord.log ; (main log file;default $CWD/supervisord.log) +pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid) + +[program:sshd] +command=/usr/sbin/sshd -D +autorestart=true + +[program:mysql] +command=/usr/bin/pidproxy /var/run/mysqld/mysqld.pid /usr/sbin/mysqld +autorestart=true + +[program:postfix] +process_name = master +directory = /etc/postfix +command = /usr/sbin/postfix -c /etc/postfix start +startsecs = 0 +autorestart = false + +[program:rsyslogd] +command=/usr/sbin/rsyslogd -n +process_name=%(program_name)s +autostart=true +autorestart=true +user=root +directory=/ +priority=912 +stdout_logfile=/var/log/%(program_name)s-stdout.log +stderr_logfile=/var/log/%(program_name)s-stderr.log + +[program:cron] +command = /usr/sbin/cron -f +stdout_logfile = /var/log/%(program_name)s-stdout.log +stderr_logfile = /var/log/%(program_name)s-stderr.log +autorestart = true + +[program:bind9] +command=/usr/sbin/named -c /etc/bind/named.conf -u bind -f + +[program:apache2] +command=/bin/bash -c "source /etc/apache2/envvars && rm -f -r /run/apache2/* && exec /usr/sbin/apache2 -DFOREGROUND" + +[program:fail2ban] +command = /usr/bin/python /usr/bin/fail2ban-server -b -s /var/run/fail2ban/fail2ban.sock + +[program:dovecot] +command=/usr/sbin/dovecot -c /etc/dovecot/dovecot.conf -F +autorestart=true + +[program:mailman] +command=/usr/lib/mailman/bin/mailmanctl start +autorestart=true + +[program:pureftpd] +command=/usr/sbin/pure-ftpd-mysql-virtualchroot -p 30000:30009 -l mysql:/etc/pure-ftpd/db/mysql.conf -l pam -D -A -H -b -8 UTF-8 -E -u 1000 -O clf:/var/log/pure-ftpd/transfer.log +stdout_logfile=/var/log/ftpserver.log +stderr_logfile=/var/log/ftpserver.log +autorestart=true