mailinabox/setup/system.sh

source setup/functions.sh # load our functions

# Basic System Configuration
# -------------------------

# ### Install Packages

# Update system packages to make sure we have the latest upstream versions of things from Ubuntu.

echo Updating system packages...
hide_output apt-get update
apt_get_quiet upgrade

# Install basic utilities.
#
# * haveged: Provides extra entropy to /dev/random so it doesn't stall
#	         when generating random numbers for private keys (e.g. during
#	         ldns-keygen).
# * unattended-upgrades: Apt tool to install security updates automatically.
# * cron: Runs background processes periodically.
# * ntp: keeps the system time correct
# * fail2ban: scans log files for repeated failed login attempts and blocks the remote IP at the firewall
# * git: we install some things directly from github
# * sudo: allows privileged users to execute commands as root without being root
# * coreutils: includes `nproc` tool to report number of processors
# * bc: allows us to do math to compute sane defaults

apt_install python3 python3-dev python3-pip \
	wget curl git sudo coreutils bc \
	haveged unattended-upgrades cron ntp fail2ban

# Allow apt to install system updates automatically every day.

cat > /etc/apt/apt.conf.d/02periodic <<EOF;
APT::Periodic::MaxAge "7";
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::Verbose "1";
EOF

# ### Firewall

# Various virtualized environments like Docker and some VPSs don't provide #NODOC
# a kernel that supports iptables. To avoid error-like output in these cases, #NODOC
# we skip this if the user sets DISABLE_FIREWALL=1. #NODOC
if [ -z "$DISABLE_FIREWALL" ]; then
	# Install `ufw` which provides a simple firewall configuration.
	apt_install ufw

	# Allow incoming connections to SSH.
	ufw_allow ssh;

	# ssh might be running on an alternate port. Use sshd -T to dump sshd's #NODOC
	# settings, find the port it is supposedly running on, and open that port #NODOC
	# too. #NODOC
	SSH_PORT=$(sshd -T 2>/dev/null | grep "^port " | sed "s/port //") #NODOC
	if [ ! -z "$SSH_PORT" ]; then
	if [ "$SSH_PORT" != "22" ]; then

	echo Opening alternate SSH port $SSH_PORT. #NODOC
	ufw_allow $SSH_PORT #NODOC

	fi
	fi

	ufw --force enable;
fi #NODOC

# ### Local DNS Service

# Install a local DNS server, rather than using the DNS server provided by the
# ISP's network configuration.
#
# We do this to ensure that DNS queries
# that *we* make (i.e. looking up other external domains) perform DNSSEC checks.
# We could use Google's Public DNS, but we don't want to create a dependency on
# Google per our goals of decentralization. `bind9`, as packaged for Ubuntu, has
# DNSSEC enabled by default via "dnssec-validation auto".
#
# So we'll be running `bind9` bound to 127.0.0.1 for locally-issued DNS queries
# and `nsd` bound to the public ethernet interface for remote DNS queries asking
# about our domain names. `nsd` is configured later.
#
# About the settings:
#
# * RESOLVCONF=yes will have `bind9` take over /etc/resolv.conf to tell
#   local services that DNS queries are handled on localhost.
# * Adding -4 to OPTIONS will have `bind9` not listen on IPv6 addresses
#   so that we're sure there's no conflict with nsd, our public domain
#   name server, on IPV6.
# * The listen-on directive in named.conf.options restricts `bind9` to
#   binding to the loopback interface instead of all interfaces.
apt_install bind9 resolvconf
tools/editconf.py /etc/default/bind9 \
	RESOLVCONF=yes \
	"OPTIONS=\"-u bind -4\""
if ! grep -q "listen-on " /etc/bind/named.conf.options; then
	# Add a listen-on directive if it doesn't exist inside the options block.
	sed -i "s/^}/\n\tlisten-on { 127.0.0.1; };\n}/" /etc/bind/named.conf.options
fi
if [ -f /etc/resolvconf/resolv.conf.d/original ]; then
	echo "Archiving old resolv.conf (was /etc/resolvconf/resolv.conf.d/original, now /etc/resolvconf/resolv.conf.original)." #NODOC
	mv /etc/resolvconf/resolv.conf.d/original /etc/resolvconf/resolv.conf.original #NODOC
fi

# Restart the DNS services.

restart_service bind9
restart_service resolvconf

# ### Fail2Ban Service

# Configure the Fail2Ban installation to prevent dumb bruce-force attacks against dovecot, postfix and ssh
cp conf/fail2ban/jail.local /etc/fail2ban/jail.local
cp conf/fail2ban/dovecotimap.conf /etc/fail2ban/filter.d/dovecotimap.conf

restart_service fail2ban
rename the scripts directory to setup 2014-06-03 11:12:38 +00:00			`source setup/functions.sh # load our functions`
make a bash function to use everywhere we apt-get-install (`DEBIAN_FRONTEND=noninteractive apt-get -qq -y `) ensures the output is quiet 2014-05-01 19:13:00 +00:00
more work on making the bash scripts readable 2014-10-04 21:57:26 +00:00			`# Basic System Configuration`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			`# -------------------------`

more work on making the bash scripts readable 2014-10-04 21:57:26 +00:00			`# ### Install Packages`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00
more work on making the bash scripts readable 2014-10-04 21:57:26 +00:00			`# Update system packages to make sure we have the latest upstream versions of things from Ubuntu.`
initial commit of some preliminary notes 2013-08-21 02:27:32 +00:00
hide lots of unnecessary and scary output during setup 2014-07-16 13:06:45 +00:00			`echo Updating system packages...`
			`hide_output apt-get update`
prevent apt from asking the user any questions Add additional options to really prevent apt from asking questions, which causes setup to hang because stdin/out have been redirected. fixes #270, #291 2015-02-13 13:41:52 +00:00			`apt_get_quiet upgrade`
initial commit of some preliminary notes 2013-08-21 02:27:32 +00:00
docker: re-run the start script on the container's first run because it won't know its hostname or IP address until then 2014-05-02 18:23:56 +00:00			`# Install basic utilities.`
use /dev/random for crypto-grade RNG with the help of haveged Rather than pass `-r /dev/random` to ldns-keygen (it was `-r /dev/urandom`), don't pass `-r` at all since /dev/random is the default. Merges branch 'master' of github.com:pysiak/mailinabox 2014-07-21 11:12:59 +00:00			`#`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			`# * haveged: Provides extra entropy to /dev/random so it doesn't stall`
use /dev/random for crypto-grade RNG with the help of haveged Rather than pass `-r /dev/random` to ldns-keygen (it was `-r /dev/urandom`), don't pass `-r` at all since /dev/random is the default. Merges branch 'master' of github.com:pysiak/mailinabox 2014-07-21 11:12:59 +00:00			`# when generating random numbers for private keys (e.g. during`
			`# ldns-keygen).`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			`# * unattended-upgrades: Apt tool to install security updates automatically.`
install cron in case it isn't already installed 2015-01-11 20:00:11 +00:00			`# * cron: Runs background processes periodically.`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			`# * ntp: keeps the system time correct`
			`# * fail2ban: scans log files for repeated failed login attempts and blocks the remote IP at the firewall`
upgrade to ownCloud 8.0.2 The contacts and calendar apps are now maintained outside of ownCloud core, so we now pull them in from github tags and must enable them explicitly. 2015-02-12 19:53:17 +00:00			`# * git: we install some things directly from github`
added sudo to the list not all setups have it and the miab installer depends on it 2014-11-25 15:36:34 +00:00			`# * sudo: allows privileged users to execute commands as root without being root`
set dovecot default_process_limit and fs.inotify.max_user_instances to better defaults See https://discourse.mailinabox.email/t/mailserver-limits/228. 2015-01-02 23:22:33 +00:00			# * coreutils: includes `nproc` tool to report number of processors
			`# * bc: allows us to do math to compute sane defaults`
docker: re-run the start script on the container's first run because it won't know its hostname or IP address until then 2014-05-02 18:23:56 +00:00
python3-dev is a dependency for many pip packages, including pyyaml, fixes #196 2014-09-17 21:56:09 +00:00			`apt_install python3 python3-dev python3-pip \`
upgrade to ownCloud 8.0.2 The contacts and calendar apps are now maintained outside of ownCloud core, so we now pull them in from github tags and must enable them explicitly. 2015-02-12 19:53:17 +00:00			`wget curl git sudo coreutils bc \`
install cron in case it isn't already installed 2015-01-11 20:00:11 +00:00			`haveged unattended-upgrades cron ntp fail2ban`
install Python 3, fixes #4 2014-03-16 20:50:24 +00:00
re-do allow apt to perform security updates on its own Move this into system.sh rather than anagement.sh. This reverts commit eab28c97ff4ff04b452d07dd2f7af882f76f0d33. 2014-08-23 12:31:33 +00:00			`# Allow apt to install system updates automatically every day.`
initial commit of some preliminary notes 2013-08-21 02:27:32 +00:00
re-do allow apt to perform security updates on its own Move this into system.sh rather than anagement.sh. This reverts commit eab28c97ff4ff04b452d07dd2f7af882f76f0d33. 2014-08-23 12:31:33 +00:00			`cat > /etc/apt/apt.conf.d/02periodic <<EOF;`
			`APT::Periodic::MaxAge "7";`
			`APT::Periodic::Update-Package-Lists "1";`
			`APT::Periodic::Unattended-Upgrade "1";`
			`APT::Periodic::Verbose "1";`
			`EOF`
initial commit of some preliminary notes 2013-08-21 02:27:32 +00:00
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			`# ### Firewall`
open the firewall to an alternative SSH port if set https://discourse.mailinabox.email/t/opening-up-a-custom-port-for-ssh-after-install/55/2 2014-09-20 12:25:54 +00:00
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			`# Various virtualized environments like Docker and some VPSs don't provide #NODOC`
			`# a kernel that supports iptables. To avoid error-like output in these cases, #NODOC`
			`# we skip this if the user sets DISABLE_FIREWALL=1. #NODOC`
			`if [ -z "$DISABLE_FIREWALL" ]; then`
			# Install `ufw` which provides a simple firewall configuration.
docker: disable the ufw firewall because it is not supported in a docker container and produces a lot of error output (by reverting a510e08f9e3b2714019dc7832b1bd7b7eae4ba6c and setting an environment variable) 2014-05-02 02:39:45 +00:00			`apt_install ufw`
open the firewall to an alternative SSH port if set https://discourse.mailinabox.email/t/opening-up-a-custom-port-for-ssh-after-install/55/2 2014-09-20 12:25:54 +00:00
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			`# Allow incoming connections to SSH.`
docker: disable the ufw firewall because it is not supported in a docker container and produces a lot of error output (by reverting a510e08f9e3b2714019dc7832b1bd7b7eae4ba6c and setting an environment variable) 2014-05-02 02:39:45 +00:00			`ufw_allow ssh;`
open the firewall to an alternative SSH port if set https://discourse.mailinabox.email/t/opening-up-a-custom-port-for-ssh-after-install/55/2 2014-09-20 12:25:54 +00:00
more work on making the bash scripts readable 2014-10-04 21:57:26 +00:00			`# ssh might be running on an alternate port. Use sshd -T to dump sshd's #NODOC`
			`# settings, find the port it is supposedly running on, and open that port #NODOC`
			`# too. #NODOC`
			`SSH_PORT=$(sshd -T 2>/dev/null \| grep "^port " \| sed "s/port //") #NODOC`
open the firewall to an alternative SSH port if set https://discourse.mailinabox.email/t/opening-up-a-custom-port-for-ssh-after-install/55/2 2014-09-20 12:25:54 +00:00			`if [ ! -z "$SSH_PORT" ]; then`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			`if [ "$SSH_PORT" != "22" ]; then`

more work on making the bash scripts readable 2014-10-04 21:57:26 +00:00			`echo Opening alternate SSH port $SSH_PORT. #NODOC`
			`ufw_allow $SSH_PORT #NODOC`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00
			`fi`
open the firewall to an alternative SSH port if set https://discourse.mailinabox.email/t/opening-up-a-custom-port-for-ssh-after-install/55/2 2014-09-20 12:25:54 +00:00			`fi`

docker: disable the ufw firewall because it is not supported in a docker container and produces a lot of error output (by reverting a510e08f9e3b2714019dc7832b1bd7b7eae4ba6c and setting an environment variable) 2014-05-02 02:39:45 +00:00			`ufw --force enable;`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			`fi #NODOC`
run bind9 on the loopback interface for ensuring we are using a DNSSEC-aware nameserver to resolve our own DNS queries (i.e. when sending mail) since we can't trust that the network configuration provided for us gives us a DNSSEC-aware DNS server see #71 2014-06-18 23:41:35 +00:00
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			`# ### Local DNS Service`

			`# Install a local DNS server, rather than using the DNS server provided by the`
			`# ISP's network configuration.`
			`#`
			`# We do this to ensure that DNS queries`
run bind9 on the loopback interface for ensuring we are using a DNSSEC-aware nameserver to resolve our own DNS queries (i.e. when sending mail) since we can't trust that the network configuration provided for us gives us a DNSSEC-aware DNS server see #71 2014-06-18 23:41:35 +00:00			`# that we make (i.e. looking up other external domains) perform DNSSEC checks.`
			`# We could use Google's Public DNS, but we don't want to create a dependency on`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			# Google per our goals of decentralization. `bind9`, as packaged for Ubuntu, has
run bind9 on the loopback interface for ensuring we are using a DNSSEC-aware nameserver to resolve our own DNS queries (i.e. when sending mail) since we can't trust that the network configuration provided for us gives us a DNSSEC-aware DNS server see #71 2014-06-18 23:41:35 +00:00			`# DNSSEC enabled by default via "dnssec-validation auto".`
			`#`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			# So we'll be running `bind9` bound to 127.0.0.1 for locally-issued DNS queries
			# and `nsd` bound to the public ethernet interface for remote DNS queries asking
			# about our domain names. `nsd` is configured later.
run bind9 on the loopback interface for ensuring we are using a DNSSEC-aware nameserver to resolve our own DNS queries (i.e. when sending mail) since we can't trust that the network configuration provided for us gives us a DNSSEC-aware DNS server see #71 2014-06-18 23:41:35 +00:00			`#`
			`# About the settings:`
			`#`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			# * RESOLVCONF=yes will have `bind9` take over /etc/resolv.conf to tell
run bind9 on the loopback interface for ensuring we are using a DNSSEC-aware nameserver to resolve our own DNS queries (i.e. when sending mail) since we can't trust that the network configuration provided for us gives us a DNSSEC-aware DNS server see #71 2014-06-18 23:41:35 +00:00			`# local services that DNS queries are handled on localhost.`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			# * Adding -4 to OPTIONS will have `bind9` not listen on IPv6 addresses
run bind9 on the loopback interface for ensuring we are using a DNSSEC-aware nameserver to resolve our own DNS queries (i.e. when sending mail) since we can't trust that the network configuration provided for us gives us a DNSSEC-aware DNS server see #71 2014-06-18 23:41:35 +00:00			`# so that we're sure there's no conflict with nsd, our public domain`
			`# name server, on IPV6.`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			# * The listen-on directive in named.conf.options restricts `bind9` to
run bind9 on the loopback interface for ensuring we are using a DNSSEC-aware nameserver to resolve our own DNS queries (i.e. when sending mail) since we can't trust that the network configuration provided for us gives us a DNSSEC-aware DNS server see #71 2014-06-18 23:41:35 +00:00			`# binding to the loopback interface instead of all interfaces.`
if the machine didn't have resolvconf before (my box didn't after an upgrade from Ubuntu 13.xx), make sure it has it now and archive any old resolv.conf since it should now only list 127.0.0.1 for bind9 2014-08-07 13:49:14 +00:00			`apt_install bind9 resolvconf`
run bind9 on the loopback interface for ensuring we are using a DNSSEC-aware nameserver to resolve our own DNS queries (i.e. when sending mail) since we can't trust that the network configuration provided for us gives us a DNSSEC-aware DNS server see #71 2014-06-18 23:41:35 +00:00			`tools/editconf.py /etc/default/bind9 \`
			`RESOLVCONF=yes \`
			`"OPTIONS=\"-u bind -4\""`
			`if ! grep -q "listen-on " /etc/bind/named.conf.options; then`
			`# Add a listen-on directive if it doesn't exist inside the options block.`
			`sed -i "s/^}/\n\tlisten-on { 127.0.0.1; };\n}/" /etc/bind/named.conf.options`
			`fi`
if the machine didn't have resolvconf before (my box didn't after an upgrade from Ubuntu 13.xx), make sure it has it now and archive any old resolv.conf since it should now only list 127.0.0.1 for bind9 2014-08-07 13:49:14 +00:00			`if [ -f /etc/resolvconf/resolv.conf.d/original ]; then`
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			`echo "Archiving old resolv.conf (was /etc/resolvconf/resolv.conf.d/original, now /etc/resolvconf/resolv.conf.original)." #NODOC`
			`mv /etc/resolvconf/resolv.conf.d/original /etc/resolvconf/resolv.conf.original #NODOC`
if the machine didn't have resolvconf before (my box didn't after an upgrade from Ubuntu 13.xx), make sure it has it now and archive any old resolv.conf since it should now only list 127.0.0.1 for bind9 2014-08-07 13:49:14 +00:00			`fi`
run bind9 on the loopback interface for ensuring we are using a DNSSEC-aware nameserver to resolve our own DNS queries (i.e. when sending mail) since we can't trust that the network configuration provided for us gives us a DNSSEC-aware DNS server see #71 2014-06-18 23:41:35 +00:00
first pass at making readable documentation by parsing the bash scripts 2014-09-21 17:43:21 +00:00			`# Restart the DNS services.`

hide lots of unnecessary and scary output during setup 2014-07-16 13:06:45 +00:00			`restart_service bind9`
if the machine didn't have resolvconf before (my box didn't after an upgrade from Ubuntu 13.xx), make sure it has it now and archive any old resolv.conf since it should now only list 127.0.0.1 for bind9 2014-08-07 13:49:14 +00:00			`restart_service resolvconf`
Configure fail2ban jails to prevent dumb brute-force attacks against postfix, dovecot and ssh. See #319 2015-03-08 00:13:55 +00:00
			`# ### Fail2Ban Service`

			`# Configure the Fail2Ban installation to prevent dumb bruce-force attacks against dovecot, postfix and ssh`
			`cp conf/fail2ban/jail.local /etc/fail2ban/jail.local`
			`cp conf/fail2ban/dovecotimap.conf /etc/fail2ban/filter.d/dovecotimap.conf`

			`restart_service fail2ban`