228 lines
11 KiB
Bash
Executable File
228 lines
11 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
if [ "${EUID}" -ne 0 ]; then
|
|
echo "You must be root to run this installer."
|
|
exit
|
|
fi
|
|
|
|
# check for Ubuntu 20.04
|
|
if ! grep -q "Ubuntu 22.04" /etc/issue; then
|
|
echo "This installer is only tested on Ubuntu 22.04. If you are on a"
|
|
echo "different version of Ubuntu or a Debian/Debian based distro"
|
|
echo "and want to try running this installer open this script and"
|
|
echo "comment out the exit command below this line and re-run."
|
|
exit
|
|
fi
|
|
|
|
# check if install is already in place
|
|
if [ -f "/usr/local/bin/vhost.sh" ]; then
|
|
echo "vhost-stack is already installed, bailing out."
|
|
exit
|
|
fi
|
|
|
|
# check for existing web server software installs
|
|
if [ -d "/etc/apache2/" ] || [ -d "/etc/php/" ] || [ -d "/etc/varnish/" ]; then
|
|
echo
|
|
echo "WARNING: Apache, Varnish and/or PHP are already installed."
|
|
echo "This installer will overwrite existing configurations."
|
|
echo -e "You have five seconds to execute ctrl-c to cancel this install.\a"
|
|
echo
|
|
sleep 5
|
|
fi
|
|
|
|
apt-get update
|
|
|
|
# modify policy-rc.d so that packages automatically start/restart/stop after install/upgrade/uninstall
|
|
sed -i "s|exit 101|exit 0|g" /usr/sbin/policy-rc.d
|
|
|
|
# install pwgen, used to create random passwords
|
|
DEBIAN_FRONTEND=noninteractive apt-get -y install pwgen
|
|
|
|
# install mariadb (mysql)
|
|
if [ ! -d "/etc/mysql/" ]; then
|
|
|
|
MARIADBPWORD=`pwgen 12 1`
|
|
DEBIAN_FRONTEND=noninteractive apt-get -y install mariadb-client mariadb-server
|
|
# set unix_socket auth for root
|
|
mysql -e "GRANT ALL ON *.* TO 'root'@'localhost' IDENTIFIED VIA unix_socket WITH GRANT OPTION"
|
|
# create nagios user for monitoring server status only
|
|
mysql -e "CREATE USER 'nagios'@'localhost' IDENTIFIED WITH mysql_native_password AS '';"
|
|
mysqladmin flush-privileges
|
|
|
|
fi
|
|
|
|
# Apache w/ PHP
|
|
DEBIAN_FRONTEND=noninteractive apt-get -y install apache2 libapache2-mod-authnz-pam libwww-perl php-fpm php-cli php-ssh2 php-curl php-dev php-enchant php-mysql php-pear php-gd php-http php-imap php-intl php-mysql php-yaml php-pspell php-raphf php-ssh2 php-sqlite3 php-tidy php-xml php-xmlrpc php-zip php-mbstring php-imagick php-redis redis pwauth libapache2-mod-authnz-external
|
|
|
|
## http2 handled automatically now.
|
|
## http2 doesn't support logio, so look in to vhost log format
|
|
|
|
# force https for phpMyAdmin ??
|
|
cp etc/apache2/conf-available/* /etc/apache2/conf-available/
|
|
chmod 644 /etc/apache2/conf-available/*.conf
|
|
chown root:root /etc/apache2/conf-available/*.conf
|
|
a2enconf php8.1-fpm phpMyAdmin
|
|
cp etc/apache2/mods-available/* /etc/apache2/mods-available/
|
|
chmod 644 /etc/apache2/mods-available/*.conf
|
|
chown root:root /etc/apache2/mods-available/*.conf
|
|
# enable TLSv1.2 only
|
|
sed -i "s|SSLProtocol all -SSLv3|SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1|g" /etc/apache2/mods-available/ssl.conf
|
|
# set vhost subodmain to domain name of server, users may want to consider changing this to a custom domain.
|
|
vhostdomain=`hostname -d`
|
|
sed -i "s|.example.com|.$vhostdomain|g" /etc/apache2/mods-available/macro.conf
|
|
# a2enmod proxy_fcgi rewrite headers expires ssl http2 remoteip macro
|
|
a2enmod cgid proxy_fcgi proxy_http rewrite headers expires ssl http2 macro
|
|
# # sed -i "s|CustomLog|#CustomLog|g" /etc/apache2/sites-available/000-default.conf
|
|
sed -i "s|/var/www/html|/srv/www/html|g" /etc/apache2/sites-available/000-default.conf
|
|
# # sed -i "s|CustomLog|#CustomLog|g" /etc/apache2/sites-available/default-ssl.conf
|
|
sed -i "s|/var/www/html|/srv/www/html|g" /etc/apache2/sites-available/default-ssl.conf
|
|
## double check this next one after getting full setup going w/ haproxy & varnish
|
|
sed -i "s|%h %l %u|%a %l %u|g" /etc/apache2/apache2.conf
|
|
sed -i "s|other_vhosts_access.log|access.log|" /etc/apache2/conf-available/other-vhosts-access-log.conf
|
|
rm /var/log/apache2/other_vhosts_access.log
|
|
# configure security
|
|
echo '<Directory "/srv/www/">' >> /etc/apache2/conf-available/security.conf
|
|
echo ' AllowOverride All' >> /etc/apache2/conf-available/security.conf
|
|
echo ' Options Includes FollowSymLinks' >> /etc/apache2/conf-available/security.conf
|
|
echo ' Require all granted' >> /etc/apache2/conf-available/security.conf
|
|
echo '</Directory>' >> /etc/apache2/conf-available/security.conf
|
|
echo '<Directory "/usr/local/lib/cgi-wrap/">' >> /etc/apache2/conf-available/security.conf
|
|
echo ' AllowOverride None' >> /etc/apache2/conf-available/security.conf
|
|
echo ' Options None' >> /etc/apache2/conf-available/security.conf
|
|
echo ' Require all granted' >> /etc/apache2/conf-available/security.conf
|
|
echo '</Directory>' >> /etc/apache2/conf-available/security.conf
|
|
|
|
# configure php
|
|
sed -i "s|post_max_size = 8M|post_max_size = 256M|g" /etc/php/8.1/fpm/php.ini
|
|
sed -i "s|upload_max_filesize = 2M|upload_max_filesize = 256M|g" /etc/php/8.1/fpm/php.ini
|
|
sed -i "s|;date.timezone =|date.timezone = 'America/Los_Angeles'|g" /etc/php/8.1/fpm/php.ini
|
|
sed -i "s|;date.timezone =|date.timezone = 'America/Los_Angeles'|g" /etc/php/8.1/cli/php.ini
|
|
# Change Debian/Ubuntu session settings back to php defaults for compatability with user jails & php chroots
|
|
sed -i "s|;session.save_path = \"/var/lib/php/sessions\"|session.save_path = \"/tmp\"|g" /etc/php/8.1/fpm/php.ini
|
|
sed -i "s|;session.save_path = \"/var/lib/php/sessions\"|session.save_path = \"/tmp\"|g" /etc/php/8.1/cli/php.ini
|
|
sed -i "s|session.gc_probability = 0|session.gc_probability = 1|g" /etc/php/8.1/fpm/php.ini
|
|
sed -i "s|session.gc_probability = 0|session.gc_probability = 1|g" /etc/php/8.1/cli/php.ini
|
|
# Configure PHP-FPM to use "ondemand"
|
|
sed -i "s|pm = dynamic|pm = ondemand|g" /etc/php/8.1/fpm/pool.d/www.conf
|
|
systemctl reload apache2
|
|
## configure overrides
|
|
# sed -i "s|^user = www-data|user = $USERNAME|g" /etc/php/7.2/fpm/pool.d/www.conf
|
|
# sed -i "s|^group = www-data|group = $USERNAME|g" /etc/php/7.2/fpm/pool.d/www.conf
|
|
systemctl reload php8.1-fpm
|
|
|
|
if [ -d /srv/www ]; then
|
|
if [ -d /var/www ]; then
|
|
echo "WARNING: /srv/www & /var/www dirs both exists, skipping move of existing /var/www/ dir."
|
|
fi
|
|
else
|
|
if [ -d /var/www ]; then
|
|
mv /var/www /srv/www
|
|
else
|
|
install --owner=root --group=root --mode=755 --directory /srv/www
|
|
fi
|
|
ln -s /srv/www /var/www
|
|
fi
|
|
|
|
useradd --no-create-home --home-dir /srv/www --shell /usr/sbin/nologin --system --user-group vhost
|
|
|
|
if [ -d /srv/www/html ]; then
|
|
chown -R vhost:vhost /srv/www/html
|
|
else
|
|
install --owner=vhost --group=vhost --mode=755 --directory /srv/www/html
|
|
fi
|
|
|
|
# Webalizer
|
|
DEBIAN_FRONTEND=noninteractive apt-get -y install webalizer
|
|
cp etc/logrotate.d/apache2 /etc/logrotate.d/apache2
|
|
chmod 644 /etc/logrotate.d/apache2
|
|
rm /etc/cron.daily/webalizer
|
|
rmdir /srv/www/webalizer
|
|
cp systemd/webalizer.* /usr/lib/systemd/system/
|
|
chmod 644 /usr/lib/systemd/system/webalizer.*
|
|
systemctl enable webalizer.timer
|
|
systemctl start webalizer.timer
|
|
|
|
# install status.php
|
|
cp html/status.php /srv/www/html
|
|
chmod 644 /srv/www/html/status.php
|
|
chown vhost:vhost /srv/www/html/status.php
|
|
|
|
# phpMyAdmin
|
|
DEBIAN_FRONTEND=noninteractive apt-get -y install php-bz2 php-tcpdf
|
|
cd /usr/local/src
|
|
wget https://files.phpmyadmin.net/phpMyAdmin/5.2.0/phpMyAdmin-5.2.0-all-languages.tar.gz
|
|
tar zxf phpMyAdmin-5.2.0-all-languages.tar.gz
|
|
rm -r phpMyAdmin-5.2.0-all-languages/setup/
|
|
if [ -d "phpMyAdmin-5.2.0-all-languages/test/" ]; then
|
|
rm -r phpMyAdmin-5.2.0-all-languages/test/
|
|
fi
|
|
mv phpMyAdmin-5.2.0-all-languages /srv/www/html/phpMyAdmin
|
|
cd -
|
|
cp html/phpMyAdmin/config.inc.php /srv/www/html/phpMyAdmin/config.inc.php
|
|
blowfish_secret=`pwgen 32 -1`
|
|
sed -i "s|changeme|$blowfish_secret|g" /srv/www/html/phpMyAdmin/config.inc.php
|
|
find /srv/www/html/phpMyAdmin -type d -exec chmod 755 {} +
|
|
find /srv/www/html/phpMyAdmin -type f -exec chmod 644 {} +
|
|
chown -R vhost:vhost /srv/www/html/phpMyAdmin
|
|
|
|
# jailkit
|
|
DEBIAN_FRONTEND=noninteractive apt-get -y install jailkit
|
|
sed -i 's|paths = ssh|paths = /usr/bin/ssh*|' /etc/jailkit/jk_init.ini
|
|
sed -i "s|paths = perl, /usr/lib/perl, /usr/lib/perl5, /usr/share/perl, /usr/share/perl5|paths = /usr/bin/perl, /usr/lib/x86_64-linux-gnu/perl, /usr/lib/x86_64-linux-gnu/perl-base, /usr/share/perl, /usr/share/perl5|g" /etc/jailkit/jk_init.ini
|
|
echo "" >> /etc/jailkit/jk_init.ini
|
|
echo "[shellstack]" >> /etc/jailkit/jk_init.ini
|
|
echo "comment = full featured shell for vhost-stack jails" >> /etc/jailkit/jk_init.ini
|
|
echo "paths = curl, dircolors, du, env, git, groups, mysql, mysqldump, /etc/bash_completion, /etc/bash_completion.d/, /usr/share/bash-completion/, /etc/ssl/certs/, /etc/nanorc, /usr/local/libexec/command-not-found-handle, /usr/share/nano/, /usr/share/zoneinfo/, /usr/local/bin/composer, /usr/local/bin/wp, /usr/local/sbin/mini_sendmail" >> /etc/jailkit/jk_init.ini
|
|
echo "includesections = extendedshell, netutils, logbasics, apacheutils, php" >> /etc/jailkit/jk_init.ini
|
|
echo "" >> /etc/jailkit/jk_init.ini
|
|
echo "[php]" >> /etc/jailkit/jk_init.ini
|
|
echo "comment = php-cli and all required files" >> /etc/jailkit/jk_init.ini
|
|
echo "paths = /usr/bin/php*, /usr/bin/phar*, /etc/php/*/cli/, /etc/php/*/mods-available/, /usr/lib/php/, /usr/share/php/" >> /etc/jailkit/jk_init.ini
|
|
echo "" >> /etc/jailkit/jk_init.ini
|
|
echo "[python3]" >> /etc/jailkit/jk_init.ini
|
|
echo "comment = the python3 interpreter and libraries" >> /etc/jailkit/jk_init.ini
|
|
echo "paths = /usr/bin/python3, /usr/lib/python3, /usr/lib/python3.8, /usr/share/doc/python3, /usr/share/doc/python3-minimal, /usr/share/python3, /usr/share/man/man1/python3.1.gz" >> /etc/jailkit/jk_init.ini
|
|
echo "" >> /etc/jailkit/jk_init.ini
|
|
echo "[ruby]" >> /etc/jailkit/jk_init.ini
|
|
echo "comment = the ruby interpreter and libraries" >> /etc/jailkit/jk_init.ini
|
|
echo "paths = /usr/bin/erb. /usr/bin/gem, /usr/bin/irb, /usr/bin/rdoc, /usr/bin/ri, /usr/bin/ruby, /usr/share/doc/ruby, /usr/share/man/man1/ruby.1.gz, /usr/lib/ruby/, /usr/lib/x86_64-linux-gnu/ruby/" >> /etc/jailkit/jk_init.ini
|
|
|
|
# varnish
|
|
DEBIAN_FRONTEND=noninteractive apt-get -y install varnish
|
|
cp -a etc/varnish/* /etc/varnish/
|
|
find /etc/varnish/ -type d -exec chmod 755 {} +
|
|
find /etc/varnish/ -type f -exec chmod 644 {} +
|
|
chown -R root:root /etc/varnish/
|
|
## /usr/bin/varnishncsa
|
|
|
|
mkdir /usr/jails
|
|
if ! [ -d "/usr/local/libexec" ]; then
|
|
install --owner=root --group=root --mode=755 --directory /usr/local/libexec
|
|
fi
|
|
cp libexec/command-not-found-handle /usr/local/libexec/command-not-found-handle
|
|
chmod 755 /usr/local/libexec/command-not-found-handle
|
|
chown root:root /usr/local/libexec/command-not-found-handle
|
|
if ! [ -f "/etc/fstab.jails" ]; then
|
|
touch /etc/fstab.jails
|
|
chmod 644 /etc/fstab.jails
|
|
echo "# /etc/fstab.jails: jail bind mounts information." > /etc/fstab.jails
|
|
fi
|
|
|
|
# mini_sendmail so users can send out of jails
|
|
cd /usr/local/src
|
|
wget http://www.acme.com/software/mini_sendmail/mini_sendmail-1.3.9.tar.gz
|
|
tar zxf mini_sendmail-1.3.9.tar.gz
|
|
cd mini_sendmail-1.3.9/
|
|
make
|
|
cp mini_sendmail /usr/local/sbin
|
|
gzip mini_sendmail.8
|
|
cp mini_sendmail.8.gz /usr/local/share/man/man8
|
|
cd ../vhost-stack/
|
|
|
|
# install vhost scripts
|
|
chmod 755 bin/*
|
|
cp bin/* /usr/local/bin/
|
|
chmod 755 sbin/*
|
|
cp sbin/* /usr/local/sbin/
|
|
|