From 145668c3dd67c5271eddcb62d1e7843487d768a7 Mon Sep 17 00:00:00 2001 From: Cullum Smith Date: Tue, 15 Oct 2024 23:35:53 -0400 Subject: huge amount of fixes --- scripts/common/10-vars | 2 +- scripts/hostclass/bitwarden_server | 2 +- scripts/hostclass/cups_server | 3 + scripts/hostclass/desktop | 126 ++++++++++++++++++-------------- scripts/hostclass/freebsd_hypervisor | 3 + scripts/hostclass/idm_server/10-slapd | 15 ++++ scripts/hostclass/idm_server/90-idm | 6 +- scripts/hostclass/invidious_server | 91 +++++++++++++++++++++++ scripts/hostclass/laptop | 20 +++++ scripts/hostclass/nfs_server | 47 ++++++++++++ scripts/hostclass/pkg_repository | 10 ++- scripts/hostclass/postgresql_server | 25 ++++--- scripts/hostclass/radius_server | 56 ++++++++++++++ scripts/hostclass/smtp_server/10-rspamd | 4 +- scripts/hostclass/unifi_controller | 40 ++++++++++ scripts/hostname/nfs1 | 29 ++++++++ scripts/hostname/znc1 | 3 - scripts/os/freebsd/10-cpu | 2 + scripts/os/freebsd/10-sysctls | 2 + scripts/os/freebsd/20-zfs | 2 +- scripts/os/freebsd/50-idm | 9 ++- scripts/os/freebsd/51-autofs | 33 +++++++++ 22 files changed, 454 insertions(+), 76 deletions(-) create mode 100644 scripts/hostclass/invidious_server create mode 100644 scripts/hostclass/nfs_server create mode 100644 scripts/hostclass/radius_server create mode 100644 scripts/hostclass/unifi_controller create mode 100644 scripts/hostname/nfs1 delete mode 100644 scripts/hostname/znc1 create mode 100644 scripts/os/freebsd/51-autofs (limited to 'scripts') diff --git a/scripts/common/10-vars b/scripts/common/10-vars index cae4496..361bb7b 100644 --- a/scripts/common/10-vars +++ b/scripts/common/10-vars @@ -34,4 +34,4 @@ sudo_basedn="ou=sudo,${basedn}" dns_basedn="ou=dns,${basedn}" kdc_basedn="cn=kdc,${basedn}" -boxconf_dn="krbPrincipalName=${boxconf_username}@${realm},${robots_basedn}" +boxconf_dn="uid=${boxconf_username},${robots_basedn}" diff --git a/scripts/hostclass/bitwarden_server b/scripts/hostclass/bitwarden_server index 5e19bdd..1f025fe 100644 --- a/scripts/hostclass/bitwarden_server +++ b/scripts/hostclass/bitwarden_server @@ -6,7 +6,6 @@ : ${vaultwarden_fqdn:="$fqdn"} vaultwarden_local_username=$nginx_user -vaultwarden_uid=$(id -u "$vaultwarden_local_username") vaultwarden_https_cert="${nginx_conf_dir}/vaultwarden.crt" vaultwarden_https_key="${nginx_conf_dir}/vaultwarden.key" vaultwarden_home=/usr/local/www/vaultwarden @@ -24,6 +23,7 @@ ktadd -k "$vaultwarden_client_keytab" "$vaultwarden_username" chgrp "$vaultwarden_local_username" "$vaultwarden_client_keytab" chmod 640 "$vaultwarden_client_keytab" +vaultwarden_uid=$(id -u "$vaultwarden_local_username") install_directory -o "$vaultwarden_local_username" -m 0700 "/var/krb5/user/${vaultwarden_uid}" ln -snfv "$vaultwarden_client_keytab" "/var/krb5/user/${vaultwarden_uid}/client.keytab" diff --git a/scripts/hostclass/cups_server b/scripts/hostclass/cups_server index e3ad928..6667829 100644 --- a/scripts/hostclass/cups_server +++ b/scripts/hostclass/cups_server @@ -16,6 +16,9 @@ pkg install -y cups cups-filters install_certificate -g "$cups_user" cups "$cups_tls_cert" install_certificate_key -g "$cups_user" cups "$cups_tls_key" +# Generate CUPS pam configuration. +install_file -m 0644 /etc/pam.d/cups + # Copy CUPS configuration. install_template -o root -g "$cups_user" -m 0640 \ "${cups_conf_dir}/cupsd.conf" \ diff --git a/scripts/hostclass/desktop b/scripts/hostclass/desktop index 561fb8d..35237fd 100644 --- a/scripts/hostclass/desktop +++ b/scripts/hostclass/desktop @@ -1,75 +1,75 @@ #!/bin/sh -load_kernel_module linux linux64 acpi_ibm - -pkg install -y \ - chromium \ - compton \ - dino \ - dmenu \ - eclipse \ - firefox \ - git \ - gnupg \ - krb5 \ - i3 \ - libreoffice \ - libva-intel-media-driver \ - networkmgr \ - password-store \ - py${python_version}-pip \ - stow \ - terminus-font \ - terminus-ttf \ - tmux \ - tree \ - wireguard-tools \ - xfontsel \ - xidle \ - xorg \ - xterm +: ${desktop_access_role:='desktop-access'} +: ${desktop_access_gid:='40000'} + +: ${sddm_min_uid:='10000'} +: ${sddm_max_uid:='19999'} + +if [ "${enable_idm:-}" = false ]; then + desktop_access_role=operator +else + ldap_add "cn=${desktop_access_role},${roles_basedn}" < /dev/null 2>&1 < /dev/null || die 'failed to start sddm' ;; +esac diff --git a/scripts/hostclass/freebsd_hypervisor b/scripts/hostclass/freebsd_hypervisor index bdaa3c0..24c1da5 100644 --- a/scripts/hostclass/freebsd_hypervisor +++ b/scripts/hostclass/freebsd_hypervisor @@ -24,6 +24,9 @@ hypervisor_jail_bpf_ruleset=1000 # Required for vnet jails. set_sysctl net.link.tap.up_on_open=1 +# Required to for kerberized NFS within jails. +sysrc -v kld_list+='kgssapi kgssapi_krb5' + # https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=262189 set_sysctl vfs.zfs.vol.mode=2 diff --git a/scripts/hostclass/idm_server/10-slapd b/scripts/hostclass/idm_server/10-slapd index d108ae2..f6c9b4a 100644 --- a/scripts/hostclass/idm_server/10-slapd +++ b/scripts/hostclass/idm_server/10-slapd @@ -178,6 +178,21 @@ EOF ldap_add "$automount_basedn" < /dev/null 2>&1 < /dev/null +service postgresql restart > /dev/null 2>&1 < /dev/null || die 'failed to start postgresql' # Create boxconf admin user. -psql -c "DO +psql --quiet --no-align --echo-all --tuples-only --no-password --username=postgres --dbname=postgres -c \ +"DO \$$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${boxconf_username}') THEN @@ -74,4 +82,3 @@ BEGIN END IF; END \$$" - diff --git a/scripts/hostclass/radius_server b/scripts/hostclass/radius_server new file mode 100644 index 0000000..bde1be2 --- /dev/null +++ b/scripts/hostclass/radius_server @@ -0,0 +1,56 @@ +#!/bin/sh + +# radius_clients=client1 +# radius_client1_address='192.168.1.0/24' +# radius_client1_secret='s3cret' + +: ${radius_clients=''} + +freeradius_user=freeradius +freeradius_conf_dir=/usr/local/etc/raddb +freeradius_tls_cert="${freeradius_conf_dir}/freeradius.crt" +freeradius_tls_key="${freeradius_conf_dir}/freeradius.key" +freeradius_cache_dir=/var/cache/radiusd +freeradius_tlscache_dir="${freeradius_cache_dir}/tlscache" + +# Install packages. +pkg install -y freeradius3 + +freeradius_version=$(pkg info freeradius3 | awk '$1 == "Version" { print $3 }') + +# Generate configuration. +install_directory -m 0755 "${freeradius_conf_dir}/certs" +install_template -o "$freeradius_user" -g "$freeradius_user" -m 0640 \ + "${freeradius_conf_dir}/radiusd.conf" \ + "${freeradius_conf_dir}/mods-available/eap" +rm -f "${freeradius_conf_dir}/sites-enabled/inner-tunnel" + +# Copy TLS certificate for freeradius. +install_certificate -g "$freeradius_user" freeradius "$freeradius_tls_cert" +install_certificate_key -g "$freeradius_user" freeradius "$freeradius_tls_key" + +# Generate clients.conf. +install -Cv -o "$freeradius_user" -g "$freeradius_user" -m 0660 /dev/null "${freeradius_conf_dir}/clients.conf" +for client_name in $radius_clients; do + eval "client_address=\$radius_${client_name}_address" + eval "client_secret=\$radius_${client_name}_secret" + cat <> "${freeradius_conf_dir}/clients.conf" +client ${client_name} { + ipaddr = ${client_address} + secret = ${client_secret} +} + +EOF +done + +# Create cache directories. +install_directory -o "$freeradius_user" -g "$freeradius_user" -m 700 \ + "$freeradius_cache_dir" \ + "$freeradius_tlscache_dir" + +# Clean up tlscache with cron job. +install_template -m 0644 /etc/cron.d/freeradius + +# Enable and start daemons. +sysrc -v radiusd_enable=YES +service radiusd restart diff --git a/scripts/hostclass/smtp_server/10-rspamd b/scripts/hostclass/smtp_server/10-rspamd index 1794e04..7b1aae9 100644 --- a/scripts/hostclass/smtp_server/10-rspamd +++ b/scripts/hostclass/smtp_server/10-rspamd @@ -77,8 +77,8 @@ install_template -m 0640 -g "$rspamd_user" \ printf '%s\n' ${rspamd_domain_whitelist} | tee "${rspamd_conf_dir}/local.d/maps.d/domain-whitelist.map" # Copy DKIM keys. -for domain in $postfix_virtual_domains; do - install_file -m 0640 -g "$rspamd_user" "${rspamd_data_dir}/dkim/${domain}.key" +for _domain in $postfix_virtual_domains; do + install_file -m 0640 -g "$rspamd_user" "${rspamd_data_dir}/dkim/${_domain}.key" done # Add rspamd user to redis group, so it can write to the redis unix socket. diff --git a/scripts/hostclass/unifi_controller b/scripts/hostclass/unifi_controller new file mode 100644 index 0000000..32df063 --- /dev/null +++ b/scripts/hostclass/unifi_controller @@ -0,0 +1,40 @@ +#!/bin/sh + +unifi_user=unifi +unifi_home=/usr/local/share/java/unifi +unifi_https_cert="${unifi_home}/data/unifi.crt" +unifi_https_key="${unifi_home}/data/unifi.key" +unifi_keystore="${unifi_home}/data/keystore" + +# Install required packages. +pkg install -y unifi8 + +# Create ZFS dataset for unifi data. +create_dataset -o "mountpoint=${unifi_home}/data" "${state_dataset}/unifi" + +# Set ownership on unifi data dir. +install_directory -o "$unifi_user" -g "$unifi_user" -m 0700 "${unifi_home}/data" + +# Copy TLS certificate for unifi. +install_certificate -g "$unifi_user" unifi "$unifi_https_cert" +install_certificate_key -m 0640 -g "$unifi_user" unifi "$unifi_https_key" + +# Enable unifi. +sysrc -v unifi_enable=YES + +# Stop the unifi service. +service unifi status && service unifi stop + +# Add HTTPS certificate to unifi keystore. +[ -f "${unifi_home}/data/keystore" ] || install -Cv -o "$unifi_user" -g "$unifi_user" -m 0600 /dev/null "${unifi_home}/data/keystore" +su -m "$unifi_user" -c "java -jar ${unifi_home}/lib/ace.jar import_key_cert ${unifi_https_key} ${unifi_https_cert} ${site_cacert_path}" + +# Disable analytics. +install_directory -m 0640 -o "$unifi_user" -g "$unifi_user" \ + "${unifi_home}/data/sites" \ + "${unifi_home}/data/sites/default" +grep -xFq 'config.system_cfg.1=system.analytics.anonymous=disabled' "${unifi_home}/data/sites/default/config.properties" \ + || echo 'config.system_cfg.1=system.analytics.anonymous=disabled' | tee -a "${unifi_home}/data/sites/default/config.properties" + +# Start unifi. +service unifi start diff --git a/scripts/hostname/nfs1 b/scripts/hostname/nfs1 new file mode 100644 index 0000000..98d5bcc --- /dev/null +++ b/scripts/hostname/nfs1 @@ -0,0 +1,29 @@ +#!/bin/sh + +homedir_priv_quota=250G +homedir_pub_quota=10G + +create_dataset "${nfs_dataset}/user" +create_dataset "${nfs_dataset}/group" + +for user in ${nfs_homedirs:-}; do + create_dataset "${nfs_dataset}/user/${user}" + create_dataset "${nfs_dataset}/user/${user}/priv" + create_dataset "${nfs_dataset}/user/${user}/pub" + + zfs set "refquota=${homedir_priv_quota}" "${nfs_dataset}/user/${user}/priv" + zfs set "refquota=${homedir_pub_quota}" "${nfs_dataset}/user/${user}/pub" + + chown "${user}:${user}" \ + "${nfs_root}/user/${user}/priv" \ + "${nfs_root}/user/${user}/pub" + + chmod 700 "${nfs_root}/user/${user}/priv" + chmod 755 "${nfs_root}/user/${user}/pub" +done + + ldap_add "automountKey=*,automountMapName=auto_home,${automount_basedn}" </dev/null 2>&1; then diff --git a/scripts/os/freebsd/10-sysctls b/scripts/os/freebsd/10-sysctls index 865544a..b07a46c 100644 --- a/scripts/os/freebsd/10-sysctls +++ b/scripts/os/freebsd/10-sysctls @@ -70,6 +70,8 @@ if [ "$BOXCONF_VIRTUALIZATION_TYPE" != jail ]; then security.bsd.see_other_gids="$see_other_uids" \ security.bsd.see_other_uids="$see_other_uids" \ security.bsd.unprivileged_read_msgbuf=0 \ + vfs.nfsd.enable_locallocks=0 \ + vfs.nfsd.issue_delegations=1 \ vfs.zfs.min_auto_ashift=12 # FreeBSD automatically scales kern.maxfilesperproc with the amount of memory. diff --git a/scripts/os/freebsd/20-zfs b/scripts/os/freebsd/20-zfs index aa37c0a..1cdc465 100644 --- a/scripts/os/freebsd/20-zfs +++ b/scripts/os/freebsd/20-zfs @@ -3,7 +3,7 @@ # Every host should have a "state" dataset, which is a ZFS dataset which # persists across OS rebuilds. [ -n "${state_dataset:-}" ] || die 'state_dataset not defined!' -create_dataset "$state_dataset" +create_dataset -o mountpoint=none "$state_dataset" # If this is baremetal host or a VM, trim the zpools periodically. if [ "$BOXCONF_VIRTUALIZATION_TYPE" != jail ]; then diff --git a/scripts/os/freebsd/50-idm b/scripts/os/freebsd/50-idm index d9c2541..0a9e882 100644 --- a/scripts/os/freebsd/50-idm +++ b/scripts/os/freebsd/50-idm @@ -20,7 +20,8 @@ pkg install -y \ # Configure PAM/NSS integration. install_file -m 0644 \ /etc/nsswitch.conf \ - /etc/pam.d/sshd + /etc/pam.d/sshd \ + /etc/pam.d/sudo install_template -m 0644 \ /etc/krb5.conf \ @@ -114,7 +115,11 @@ install_file -m 0555 \ /usr/local/libexec/idm-ssh-authorized-keys # Create user for running SSH AuthorizedKeysCommand. -add_user -u "$ssh_authzkeys_uid" -g "$host_keytab_groupname" "$ssh_authzkeys_username" +add_user \ + -u "$ssh_authzkeys_uid" \ + -g "$host_keytab_groupname" \ + -d /nonexistent \ + "$ssh_authzkeys_username" # Enable and start nslcd/nscd. sysrc -v \ diff --git a/scripts/os/freebsd/51-autofs b/scripts/os/freebsd/51-autofs new file mode 100644 index 0000000..4fe3c52 --- /dev/null +++ b/scripts/os/freebsd/51-autofs @@ -0,0 +1,33 @@ +#!/bin/sh + +# NFS mounts are not supported within jails. +if [ "$BOXCONF_VIRTUALIZATION_TYPE" = jail ] || \ + [ "$BOXCONF_HOSTCLASS" = nfs_server ] || \ + [ "${enable_idm:-}" = false ] || \ + [ "${enable_autofs:-}" = false ]; then + return 0 +fi + +: ${nfsuserd_cache_size:='256'} +: ${nfsuserd_num_servers:='4'} +: ${nfsuserd_cache_timeout:='1'} + +sysrc -v \ + nfsuserd_enable=YES \ + nfsuserd_flags="-usermax ${nfsuserd_cache_size} -usertimeout ${nfsuserd_cache_timeout} ${nfsuserd_num_servers}" \ + gssd_enable=YES \ + gssd_flags='-h -s /tmp' \ + gssd_env="KRB5_KTNAME=${keytab_dir}/host.keytab" + nfs_client_enable=YES \ + nfscbd_enable=NO \ + nfscbd_flags="-p ${nfscbd_port} -P host" \ + autofs_enable=YES + +install_file -m 0644 /etc/auto_master +install_file -m 0555 /usr/local/libexec/idm-autofs-map +ln -snfv /usr/local/libexec/idm-autofs-map /etc/autofs/include + +# No nfscbd: causes kernel panics on FreeBSD 14.1 +for service in gssd nfsclient nfsuserd automount automountd autounmountd; do + service "$service" status || service "$service" start +done -- cgit v1.2.3