5. Appendix Code chunck

5.1. Chunck 1

function jumpto
{
label=$1
cmd=$(sed -n "/$label:/{:a;n;p;ba};" $0 | grep -v ':$')
eval "$cmd"
exit
}
function reinterfaces
{
cd /etc/network/

5.2. Chunck 2

BUF="# This file describes the network interfaces available on your system\n
        # and how to activate them. For more information, see interfaces(5).\n
        \n
        source /etc/network/interfaces.d/*\n
        \n
        # The loopback network interface\n
        auto lo\n
        iface lo inet loopback\n
        \n
        # The Primary\n
        allow-hotplug en\n
        iface en inet dhcp\n";
rm interfaces
touch interfaces
echo -e $BUF > interfaces;
}

start=${1:-"start"}
interface_sh=${2:-"interface_sh"}
step_one=${3:-"step_one"}
step_two=${4:-"step_two"}
step_three=${5:-"step_three"}

5.3. Chunck 3

export LC_ALL=ru_RU.UTF-8
FILES="steps.txt"
BUF="";
TMPS="";
COUNT=0;
DEB_VER="";
NET_EN="";
NET_WI="";
STATE="0";
PORT_SSH="4103"
NET_ARR=();

5.4. Chunck 4

if [[ $EUID -ne 0 ]]; then
        if [[ ${LANG:0:5} -eq 'ru_RU' ]]; then
                echo "Ошибка скрипта перезапустите скрипт на root" 1>&2
        else
                echo "This script must be run as root" 1>&2
        fi
        exit 1;
fi

if [[ ! -f "$FILES" ]]; then
        touch steps.txt
fi

5.5. Chunck 5

select opt in Auto PoluAuto Hands Exit; do
case $opt in
Auto)
                echo -n "Сейчас будет произведена автоматическая настройка ";
                sleep 3;
                jumpto start
;;
        Polstart)
                echo -n "В разработке...";
;;
Hands)
                echo -n "В разработке...";
;;
Exit)
exit 1;
;;
*)
echo "Недопустимая опция $REPLY";
;;
esac
done

5.6. Chunck 6

jumpto $start

start:

5.7. Chunck 7

: ${HOSTNAME?} ${USER?} ${HOME?} ${MAIL?}
echo
echo "Имя машины: $HOSTNAME."
echo "Ваше имя: $USER."
echo "Ваш домашний каталог: $HOME."
echo "Ваш почтовый ящик: $MAIL."
echo
echo "Если перед Вами появилось это сообщение,"
echo "то это значит, что все критические переменные окружения установлены."
echo
echo "Сейчас будет установлена postinstall настройка"
echo

cd /etc/apt/
cp sources.list sources.tmp

5.8. Chunck 8

TMPS="0";
interface_sh:

cd /install/
if [[ -z $(sed -n -e "s/^\(1_settings_interface_with_wifi\).*/\1/p" steps.txt) ]]; then

5.9. Chunck 9

cd /etc/network/

5.10. Chunck 10

if [[ ! -f /etc/network/interfaces ]]; then
        touch interfaces
fi

5.11. Chunck 11

cp interfaces interfaces.back

5.12. Chunck 12

COUNT=1;
NET_EN=""

while [[ -n $( ip addr | sed -n -e "s/.*$COUNT\:\s\(.*\)\:\s<.*/\1/p") ]]
do
NET_ARR[COUNT]=$( ip addr | sed -n -e "s/.*$COUNT\:\s\(.*\)\:\s<.*/\1/p");
echo Counter: $COUNT $NET_EN;
((COUNT++));
done

COUNT=0;

5.13. Chunck 13

for COUNT in ${NET_ARR[@]}
do
        if [[ -n $(echo $NET_ARR[$COUNT] | sed -n -e 's/en\(.*\).*/\1/p') ]]; then
                NET_EN=$COUNT;
        fi
        if [[ -n $(echo $NET_ARR[$COUNT] | sed -n -e 's/wl\(.*\).*/\1/p') ]]; then
                NET_WI=$COUNT;
        fi
done

COUNT="0";

if [[ -n $NET_EN && -n $NET_WI ]]; then
        STATE="0";
elif [[ -n $NET_EN ]]; then
        STATE="1";
else
        echo "Error: not search lan interfaces";
        sleep 1;
        exit 2;
fi;

5.14. Chunck 14

if [[ -z $( egrep -n '^[a-z] || ^#' interfaces) && $TMPS -eq "0" ]]; then
reinterfaces
fi

5.15. Chunck 15

5.16. Chunck 16

TMPS="1";

5.17. Chunck 17

if [[ $STATE -eq "0" ]]; then

5.18. Chunck 18

if [[ -z $(sed -n -e "s/\(source \/etc\/network\/interfaces/\\).*/\1/p" interfaces) ]]; then
                TMPS="1";
                reinterfaces;
fi

if [[ -z $(sed -n -e "s/\(auto\slo\).*/\1/p" interfaces) ]]; then
                TMPS="1";
                reinterfaces;
fi
sed -i -e "s/\(auto\s\).*/\1$NET_WI $NET_EN/g" interfaces

5.19. Chunck 19

if [[ -z $( sed -n -e "s/\(iface\slo\).*/\1/p" interfaces) ]]; then
                TMPS="1";
                reinterfaces;
fi

5.20. Chunck 20

sed -i -e "s/iface\slo.*/iface $NET_EN inet dhcp/g" interfaces

5.21. Chunck 21

if [[ -z $( sed -n -e "s/\(allow-hotplug\s\).*/\1/p" interfaces) ]]; then
                TMPS="1";
                reinterfaces;
fi
sed -i -e "s/\(allow-hotplug\s\).*/\1$NET_WI/g" interfaces

5.22. Chunck 22

if [[ -z $( sed -n -e "s/\(iface\s\).*/\1/p" interfaces) ]]; then
                TMPS="1";
                reinterfaces;
fi

5.23. Chunck 23

sed -i -e "$a s/\(iface\s\).*/\1$NET_WI inet dhcp/g" interfaces

5.24. Chunck 24

sed '$a wpa-conf \/home\/rootsu\/wpa_supplicant.conf' interfaces >> interfaces;

5.25. Chunck 25

systemctl restart wpa_supplicant

5.26. Chunck 26

else

if [[ -z $(sed -n -e "s/\(source \/etc\/network\/interfaces/\\).*/\1/p" interfaces) ]]; then
                TMPS="1";
                reinterfaces;
fi

5.27. Chunck 27

if [[ -z $(sed -n -e "s/\(auto\slo\).*/\1/p" interfaces) ]]; then
                TMPS="1";
                reinterfaces;
fi
sed -i -e "s/\(auto\s\).*/\1$NET_EN/g" interfaces

5.28. Chunck 28

if [[ -z $(sed -n -e "s/\(iface\slo\).*/\1/p" interfaces) ]]; then
                TMPS="1";
                reinterfaces;
fi
sed -i -e "s/iface\slo.*/iface $NET_EN inet dhcp/g" interfaces

5.29. Chunck 29

if [[ -z $(sed -n -e "s/\(allow-hotplug\s\).*/\1/p" interfaces) ]]; then
                TMPS="1";
                reinterfaces;
fi
sed -i -e "s/\(allow-hotplug\s\).*/\1$NET_EN/g" interfaces

5.30. Chunck 30

if [[ -z $(sed -n -e "s/\(iface\s\).*/\1/p" interfaces) ]]; then
                TMPS="1";
                reinterfaces;
fi

5.31. Chunck 31

sed -i -e "$a s/\(iface\s\).*/\1$NET_EN inet dhcp/g" interfaces

5.32. Chunck 32

fi

5.33. Chunck 33

systemctl restart networking

cd /install/
echo -e "1_settings_interface_with_wifi" >> steps.txt
fi

5.34. Chunck 34

step_one:

cd /install/
if [[ -z $(sed -n -e "s/^\(1_src_list\).*/\1/p" steps.txt) ]]; then

cd /etc/apt/
if [[ -z $( lsb_release -d | sed -n -e 's/.*(\([^\)]\+\))/\1/p') ]]; then

5.35. Chunck 35

        DEB_VER=$(cat /etc/os-release | sed -n -e "s/.*(\([^\)].*\))\"$/\1/p");
        DEB_VER=$(echo $DEB_VER | sed -n -e "s/\([a-z]*\)$//p")
else
        DEB_VER=$( lsb_release -d | sed -n -e 's/.*(\([^\)]\+\))/\1/p')
fi;

5.36. Chunck 36

if [[ -n $(egrep -n '^[a-z] && ^#' sources.list) && -n $( sed -n -e "s/^deb http:\/\/ftp//p" sources.list) && -n $( sed -n -e "s/^deb-src http:\/\/ftp//p" sources.list) && -n $( sed -n -e "s/^deb http:\/\/deb//p" sources.list) && -n $( sed -n -e "s/^deb-src http:\/\/deb//p" sources.list) ]]; then
STATE="1";
rm sources.list;

5.37. Chunck 37

BUF="#deb cdrom:[Debian GNU/Linux _*_ - Official amd64 NETINST 20210814-10:07]/ * main\ndeb http://ftp.debian.org/debian/ $DEB_VER main non-free contrib\ndeb-src http://ftp.debian.org/debian/ $DEB_VER main non-free contrib\n
\ndeb http://security.debian.org/debian-security/ $DEB_VER-security main contrib non-free \ndeb-src http://security.debian.org/debian-security/ $DEB_VER-security main contrib non-free \n
\n# *-updates, to get updates before a point release is made; \r\n# see https://www.debian.org/doc/manuals/debian-reference/ch02.en.html#_updates_and_backports \ndeb http://deb.debian.org/debian/ $DEB_VER-updates main contrib non-free \ndeb-src http://deb.debian.org/debian/ $DEB_VER-updates main contrib non-free \n
\n
        # This system was installed using small removable media \n
        # (e.g. netinst, live or single CD). The matching \"deb cdrom\" \n
        # entries were disabled at the end of the installation process. \n
        # For information about how to configure apt package sources, \n
        # see the sources.list(5) manual. \n"
echo -e $BUF > sources.list;
echo "Info: sources.list is null";
sleep 1;

5.38. Chunck 38

else

5.39. Chunck 39

 sed -i -e "s/$DEB_VER\s.*$/$DEB_VER main contrib non-free/g" sources.list
 sed -i -e "s/\(\/\s$DEB_VER\-[a-z]*\).*/\1 main contrib non-free/g" sources.list
fi;

echo -e "y\n" | apt-get update;
echo -e "y\n" | apt-get full-upgrade;
if [ $? -ne 0 ]; then
 echo "Error: full upgrade error!!!"
 exit 1
fi
echo -e "y\ny\ny\ny\n" | apt-get install console-setup;
cd /install/
echo -e "1_src_list" >> steps.txt

fi

5.40. Chunck 40

step_two:

cd /install/
if [[ -z $(sed -n -e "s/^\(2_install_driver\).*/\1/p" steps.txt) ]]; then

if [[ $(lspci | grep VGA | sed -n -e "s/.*\[\(.*\)\/.*/\1/p") == "AMD" ]]; then
        echo -e "y\n" | apt-get install libdrm-amdgpu1
        echo -e "y\n" | apt-get install xserver-xorg-video-amdgpu
else
        echo -e "y\n" | apt-get install nvidia-driver firmware-misc-nonfree nvidia-settings
fi

5.41. Chunck 41

echo -e "y\n" | apt-get install firmware-linux

if [[ $(lspci | grep Ethernet | sed -n -e "s/.*ller:\s\([a-zA-Z]\+\s\).*/\1/p") == "Realtek" ]]; then
echo -e "y\n" | apt-get install firmware-realtek
fi
echo -e "y\n" | apt-get install firmware-linux-nonfree
echo -e "y\n" | apt-get install firmware-iwlwifi
echo -e "y\n" | apt-get install man

5.42. Chunck 42

echo -e "y\n" | apt-get install acl
echo -e "y\n" | apt-get install setools policycoreutils selinux-basics selinux-utils selinux-policy-default selinux-policy-mls auditd policycoreutils-python-utils semanage-utils audispd-plugins
echo -e "y\n" | apt-get install mcstrans

systemctl enable auditd
systemctl start auditd

5.43. Chunck 43

touch /.autorelabel
selinux-activate

if [ $? -ne 0 ]; then
 echo "Error: install driver failed!!!"
 exit 1
fi

echo -e "2_install_driver" >> steps.txt

5.44. Chunck 44

reboot
fi

5.45. Chunck 45

if [[ -z $(sed -n -e "s/^\(3_nanorc\).*/\1/p" steps.txt) ]]; then

5.46. Chunck 46

echo -e "y\n" | apt-get install git
if [ ? -ne 0 ]; then
 echo "Error: error install git!!!"
 exit 1;
fi
cd /install
git clone git://git.savannah.gnu.org/nano.git; cd nano;./autogen.sh;./configure; make install

5.47. Chunck 47

find /usr/share/nano -name '*.nanorc' -printf "include %p\n" > ~/.nanorc

5.48. Chunck 48

fi
echo -e "3_nanorc" >> steps.txt

5.49. Chunck 49

if [[ -z $(sed -n -e "s/^\(4_copy_sh\).*/\1/p" steps.txt) ]]; then

5.50. Chunck 50

cd /install/
cp -Rf /install/home/* /home/
cp -Rf /install/home/rootsu/.bashrc ~root
cp -Rf /install/home/rootsu/.profile ~root
cp -Rf /install/home/rootsu/.cmd_shell.sh ~root

cp -Rf /install/home/rootsu/* ~root
chmod ug+rwx -Rf ~root

5.51. Chunck 51

echo -e "4_copy_sh" >> steps.txt
fi

5.52. Chunck 52

if [[ -z $(sed -n -e "s/^\(5_install_util_wd\).*/\1/p" steps.txt) ]]; then

5.53. Chunck 53

echo "y\n" | apt-get install build-essential
if [ $? -ne 0 ]; then
 echo "Error: error install gcc-utils!!!"
 exit 1
fi

add-apt-repository-get ppa:ubuntu-toolchain-r/test && apt update

5.54. Chunck 54

echo -e "y\n" | apt-get install python
echo -e "y\n" | apt-get install python3
echo -e "y\n" | apt-get install tmux;
echo -e "y\n" | apt-get install net-tools
echo -e "y\n" | apt-get install manpages-dev;
echo -e "y\n" | apt-get install wpa_supplicant;
echo -e "y\n" | apt-get install mc;
echo -e "y\n" | apt-get install ncdu;

5.55. Chunck 55

echo -e "y\n" | apt-get install netdata;
echo -e "y\n" | apt-get install systat;
echo -e "y\n" | apt-get install iftop;
echo -e "y\n" | apt-get install htop;
echo -e "y\n" | apt-get install sudo;
echo -e "y\n" | apt-get install iptraf;
echo -e "y\n" | apt-get install ntp
systemctl enable ntp;
systemctl enable start;
sudo systemctl unmask samba;
cp /install/etc/sudoers /etc/sudoers
echo -e "y\n" | apt-get install nmon;
echo -e "y\n" | apt-get install nmap;
echo -e "y\n" | apt-get install safe-rm
echo -e "y\n" | apt-get install aptitude
echo -e "y\n" | apt-get install btrfs-progs

5.56. Chunck 56

iptables –F
echo -e "y\n" | apt-get install cifs-utils
echo -e "y\n" | apt-get install samba
echo -e "y\n" | apt-get install smbfs
echo -e "y\n" | apt-get install whois
echo -e "y\n" | apt-get install lsof
echo -e "y\n" | apt-get install mkpasswd
echo -e "y\n" | apt-get install wget
echo -e "y\n" | apt-get install tree
echo -e "y\n" | apt-get install autofs
echo -e "y\n" | apt-get install gpg
echo -e "y\n" | apt-get install rsync
echo -e "y\n" | apt-get install ca-certificates
echo -e "y\n" | apt-get install shared-mime-info
echo -e "y\n" | apt-get install wget genisoimage xorriso isolinux hwinfo
echo -e "y\n" | apt-get install hddtemp lm-sensors
echo -e "y\n" | apt-get install at
echo -e "y\n" | apt-get install pip
echo -e "y\n" | apt-get install xz-utils
echo -e "y\n" | apt-get install curl
echo -e "y\n" | apt-get install sphinx
echo -e "y\n" | apt-get install smartmontools
echo -e "y\n" | apt-get install python3-sphinx
echo -e "y\n" | apt-get install nfs-common
echo -e "y\n" | apt-get install build-essential libssl-dev libffi-dev python3-dev
echo -e "y\n" | apt-get install python3-venv
echo -e "y\n" | apt-get install mdadm
echo -e "y\n" | apt-get install hdparm
echo -e "y\n" | apt-get install hddtemp lm-sensors psensor
echo -e "y\n" | apt-get install stress
systemctl enable mdadm
update-initramfs -u

python3 -m venv env

5.57. Chunck 57

pip install --upgrade myst-parser
pip install sphinx-autodocgen
pip install Pygments
pip install sphinx-intl
pip install lumache
pip install django
pip install django-docs
pip install sphinxnotes-strike
pip install sphinx_rtd_theme

5.58. Chunck 58

pip install -U sphinx
python -m venv .venv

5.59. Chunck 59

systemctl enable cron

5.60. Chunck 60

systemctl enable autofs

5.61. Chunck 61

apt-get install openssh-server -y
if [ $? -ne 0 ]; then
 echo "Error: error install setup-utils!!!"
 exit 1
fi

5.62. Chunck 62

update-locale LC_TIME=ru_RU.UTF-8;
update-locale LC_ALL=ru_RU.UTF-8;
update-locale LANG=ru_RU.UTF-8;
sed -n -e "s/\(=\).*/\1\"$ru_RU.UTF-8\"/p" /etc/default/locale
update-locale;

cp -Rf /install/etc/* /etc
if [ $? -ne 0 ]; then
 echo "Error: copy install to etc"
 exit 1
fi
cd /install/
echo -e "5_install_util_wd" >> steps.txt

5.63. Chunck 63

fi

5.64. Chunck 64

step_three:

5.65. Chunck 65

step_four:
cd /install/
if [[ -z $(sed -n -e "s/^\(7_driver_opt\).*/\1/p" steps.txt) ]]; then

5.66. Chunck 66

5.67. Chunck 67

5.68. Chunck 68

5.69. Chunck 69

5.70. Chunck 70

5.71. Chunck 71

cd /install/
touch fdisk.txt
fdisk -l | sed -n -e "s/.*\(\/dev\/s[a-z]*[0-9]\).*/\1/p" > fdisk.txt

filename='fdisk.txt'
n=1
while read line; do

5.72. Chunck 72

shd=$(echo $line | sed 's/\//\\\//g')
S1=$(blkid | sed -n -e "s/$shd:\s\(.*\).*/\1/p" | sed -n -e "s/.*UUID=\(.*\)\sB.*/\1/p" | sed 's/\"/\\"/g')
TMPS=$(echo $line | sed -n -e "s/^\/dev\/\([a-z]*[0-9]\).*/\1/p")
chown admin_share:technics -Rf "/mnt/$TMPS"
chmod ugo+rwx -Rf "/mnt/$TMPS"
semanage fcontext -a -t public_content_rw_t "/mnt/$TMPS(/.*)?";

setfacl -m u:admin_share:rwx,u:admin:rwx,u:pub_share:rwx,g:admins:rw,g:technics:rw -R "/mnt/$TMPS";

5.73. Chunck 73

chcon -Rv -t public_content_rw_t "/mnt/$TMPS";

5.74. Chunck 74

chmod go+rwx -R "/mnt/$TMPS";
if [[ -n $S1 ]]; then
        sed -i -e "$ a UUID\=$S1        \/mnt\/$TMPS    ext4    defaults        0       2" /etc/fstab
fi

5.75. Chunck 75

done < $filename
sudo mount -a

5.76. Chunck 76

echo -e "7_driver_opt" >> steps.txt
fi

5.77. Chunck 77

cd /install/

5.78. Chunck 78

5.79. Chunck 79

5.80. Chunck 80

if [[ -z $(sed -n -e "s/^\(9_user_settings\).*/\1/p" steps.txt) ]]; then

STEP_TWO_AFTER:

5.81. Chunck 81

 groupadd -g 1000 admins
 groupadd -g 2000 exp_users
 groupadd -g 3000 pro_users
 groupadd -g 4000 moderators
 groupadd -g 5000 technics
 groupadd -g 6000 ps_users
 groupadd -g 7000 others
 useradd -u 1100 -g admins -c "admin" -s /bin/bash -p $(echo "********" | mkpasswd -s -H MD5) -m admin

 useradd -u 1200 -g admins -c "admin" -s /bin/bash -p $(echo "********" | mkpasswd -s -H MD5) -m admin_tech
usermod -aG sudo,technics,root admin
usermod -aG sudo,technics,root admin_tech

cp /install/home/rootsu/.bashrc /home/admin/
cp /install/home/rootsu/.profile /home/admin/
cp /install/home/rootsu/.cmd_shell.sh /home/admin/

 useradd -u 2100 -g exp_users -s /bin/bash -c "far_exp" -p $(echo "********" | mkpasswd -s -H MD5) -m far_exp
 useradd -u 3100 -g pro_users -s /bin/bash -c "far_pro" -p $(echo "********" | mkpasswd -s -H MD5) -m far_pro
 useradd -u 4100 -g moderators -s /bin/bash -c "far_moderator" -p $(echo "********" | mkpasswd -s -H MD5) -m far_mod
 useradd -u 5100 -g technics -d /opt/SAMBA_SHARE/ -s /bin/false -c "technical admin_share" -p $(echo "********" | mkpasswd -s -H MD5) admin_share
 useradd -u 5200 -g technics -d /opt/SAMBA_SHARE/ -s /bin/false -c "technical pub_share" -p $(echo "********" | mkpasswd -s -H MD5) pub_share
 useradd -u 6100 -g ps_users -s /bin/bash -c "far_user" -p $(echo "********" | mkpasswd -s -H MD5) -m far_user

5.82. Chunck 82

useradd -g ps_users -c "tom" -s /bin/bash -p $(echo "********" | mkpasswd -s -H MD5) -m tom

5.83. Chunck 83

echo -e "********\n********" | smbpasswd -a admin_share
echo -e "********\n********" | smbpasswd -a pub_share
smbpasswd -e admin_share
smbpasswd -e pub_share

5.84. Chunck 84

mkdir /opt/SAMBA_SHARE
mkdir /mnt/SMB
mkdir /mnt/SMB/SOFT_2TBSEAGREEN
mkdir /mnt/SMB/SOFT_3TBSEASYAN
mkdir /media/admin
chown admin:admins /media/admin
chown -R :technics /opt/ /opt/SAMBA_SHARE /mnt/SMB
chown -R admin_share:technics /opt/ /opt/SAMBA_SHARE /mnt/SMB
chmod ug+rw /opt/ /opt/SAMBA_SHARE /mnt/SMB
setfacl -m u:pub_share:rwx,u:admin_share:rwx -R "/mnt/SMB";

5.85. Chunck 85

5.86. Chunck 86

cd /etc/ssh/

cp sshd_config sshd_config.tmp

5.87. Chunck 87

sed -i -e "s/#Port\s.*$\|Port\s.*$/Port $PORT_SSH/g" sshd_config

5.88. Chunck 88

sed -i -e "s/#HostKey/HostKey/g" sshd_config

5.89. Chunck 89

sed -i -e "s/#PubkeyAuthentication\s.*$\|PubkeyAuthentication\s.*$/PubkeyAuthentication yes/g" sshd_config

5.90. Chunck 90

sed -i -e "s/#SysLogFacility\s.*$\|SysLogFacility\s.*$/SysLogFacility AUTHPRIV/g" sshd_config

5.91. Chunck 91

sed -i -e "s/#LogLevel\s.*$\|LogLevel\s.*$/#LogLevel INFO/g" sshd_config

5.92. Chunck 92

sed -i -e "s/#LoginGraceTime\s.*$\|LoginGraceTime\s.*$/LoginGraceTime 2m/g" sshd_config

5.93. Chunck 93

sed -i -e "s/#PermitRootLogin\s.*$\|PermitRootLogin\s.*$/PermitRootLogin yes/g" sshd_config

5.94. Chunck 94

sed -i -e "s/#StrictModes\s.*$\|StrictModes\s.*$/StrictModes no/g" sshd_config

5.95. Chunck 95

sed -i -e "s/#MaxAuthTries\s.*$\|MaxAuthTries\s.*$/MaxAuthTries 3/g" sshd_config

5.96. Chunck 96

sed -i -e "s/#MaxSessions\s.*$\|MaxSessions\s.*$/MaxSessions 3/g" sshd_config

5.97. Chunck 97

sed -i -e "s/#AuthorizedKeysFile\s.*$\|AuthorizedKeysFile\s.*$/AuthorizedKeysFile \/home\/rootsu\/.ssh\/authorized_keys \/home\/%u\/.ssh\/authorized_keys/g" sshd_config

5.98. Chunck 98

sed -i -e "s/#PasswordAuthentication\s.*$\|PasswordAuthentication\s.*$/PasswordAuthentication no/g" sshd_config

5.99. Chunck 99

sed -i -e "s/#PermitEmptyPasswords\s.*$\|PermitEmptyPasswords\s.*$/PermitEmptyPasswords no/g" sshd_config

5.100. Chunck 100

sed -i -e "s/ChallengeResponseAuthentication.*$\|#ChallengeResponseAuthentication.*$/ChallengeResponseAuthentication yes/g" sshd_config

5.101. Chunck 101

sed -i -e "s/#UsePAM\s.*$\|UsePAM\s.*$/UsePAM yes/g" sshd_config

5.102. Chunck 102

sed -i -e "s/#AllowTcpForwarding\s.*$\|AllowTcpForwarding\s.*$/AllowTcpForwarding yes/g" sshd_config

5.103. Chunck 103

sed -i -e "s/#X11Forwarding\s.*$\|X11Forwarding\s.*$/X11Forwarding yes/g" sshd_config

5.104. Chunck 104

sed -i -e "s/#X11DisplayOffset\s.*$\|X11DisplayOffset\s.*$/X11DisplayOffset 10/g" sshd_config

5.105. Chunck 105

sed -i -e "s/#PrintMotd\s.*$\|PrintMotd\s.*$/PrintMotd yes/g" sshd_config

5.106. Chunck 106

sed -i -e "s/Subsystem\s/#Subsystem\s/g" sshd_config

5.107. Chunck 107

systemctl restart ssh

5.108. Chunck 108

sudo bash ~/.cmd_shell.sh --mode "ssh_keygen" --uadd "tom" --gadd "ps_users" --pwd "debian"
bash ~/.cmd_shell.sh --mode "ssh_keygen" --uadd "admin" --gadd "admins" --pwd "debian"

5.109. Chunck 109

mount -v -t cifs //192.168.1.1/SOFT_2TBSEAGREEN//mnt/SMB/SOFT_2TBSEAGREEN -o credentials=/home/rootsu/.smbusers,defcontext="system_u:object_r:samba_share_t:s0";
mount -v -t cifs //192.168.1.1/SOFT_3TBSEASYAN//mnt/SMB/SOFT_3TBSEASYAN -o credentials=/home/rootsu/.smbusers,defcontext="system_u:object_r:samba_share_t:s0";

cp -Rf /install/etc/autofs /etc/
cp -Rf /install/etc/autofs.conf /etc/
cp -Rf /install/etc/samba /etc/
cp -Rf /install/lib/ /lib/
chmod 644 -Rf /etc/autofs/

systemctl restart autofs
systemctl restart smbd

5.110. Chunck 110

echo -e "y" | apt-get install ntfs-3g;

5.111. Chunck 111

echo -e "y" | sudo apt install vsftpd

cd /etc/
sudo cp /etc/vsftpd.conf/etc/vsftpd.conf_default

5.112. Chunck 112

sed -i -e "s/listen=.*$/listen=YES/g" vsftpd.conf

5.113. Chunck 113

sed -i -e "s/listen_ipv6=.*$/listen_ipv6=NO/g" vsftpd.conf

5.114. Chunck 114

sed -i -e "s/#anonymous_enable=.*$\|anonymous_enable=.*$/anonymous_enable=NO/g" vsftpd.conf

5.115. Chunck 115

sed -i -e "s/#anon_upload_enable=.*$\|anon_upload_enable=.*$/anon_upload_enable=NO/g" vsftpd.conf

5.116. Chunck 116

sed -i -e "s/anon_mkdir_write_enable=.*$\|#anon_mkdir_write_enable=.*$/anon_mkdir_write_enable=NO/g" vsftpd.conf

5.117. Chunck 117

sed -i -e "s/#write_enable=.*$\|write_enable=.*$/write_enable=YES/g" vsftpd.conf

5.118. Chunck 118

sed -i -e "s/#local_umask=.*$\|local_umask=.*$/local_umask=022/g" vsftpd.conf

5.119. Chunck 119

sed -i -e "s/connect_from_port_20=.*$/connect_from_port_20=NO/g" vsftpd.conf

5.120. Chunck 120

sed -i -e "s/#ascii_upload_enable=.*$\|ascii_upload_enable=.*$/ascii_upload_enable=YES/g" vsftpd.conf

5.121. Chunck 121

sed -i -e "s/#ascii_upload_enable=.*$\|ascii_upload_enable=.*$/ascii_upload_enable=YES/g" vsftpd.conf

5.122. Chunck 122

sed -i -e "s/#ascii_download_enable=.*$\|ascii_download_enable=.*$/ascii_download_enable=YES/g" vsftpd.conf

5.123. Chunck 123

sed -i -e "s/#ftpd_banner=.*$\|ftpd_banner=.*$/ftpd_banner=Welcome to $HOSTNAME!!!/g" vsftpd.conf

5.124. Chunck 124

sed -i -e "0,/#chroot_local_user=.*$\|chroot_local_user=.*$/ s//chroot_local_user=YES/g" vsftpd.conf

5.125. Chunck 125

sed -i -e "s/#ls_recurse_enable=.*$\|ls_recurse_enable=.*$/ls_recurse_enable=YES/g" vsftpd.conf

5.126. Chunck 126

sed -i -e "s/#chroot_list_file=.*$\|chroot_list_file=.*$/chroot_list_file=\/home\/rootsu\/vsftpd.chroot_list/g" vsftpd.conf

5.127. Chunck 127

sed -i -e "s/#utf8_filesystem=.*$\|utf8_filesystem=.*$/utf8_filesystem=YES/g" vsftpd.conf

5.128. Chunck 128

sed -i -e "s/pam_service_name=.*$/#pam_service_name=vsftpd/g" vsftpd.conf

5.129. Chunck 129

sed -i -e "s/rsa_cert_file=.*$\|#rsa_cert_file=.*$/rsa_cert_file=\/etc\/ssl\/certs\/vsftpd.crt/g" vsftpd.conf

5.130. Chunck 130

sed -i -e "s/rsa_private_key_file=.*$\|#rsa_private_key_file=.*$/rsa_private_key_file=\/etc\/ssl\/private\/vsftpd.key/g" vsftpd.conf

5.131. Chunck 131

sed -i -e "s/ssl_enable=.*$\|#ssl_enable=.*$/ssl_enable=YES/g" vsftpd.conf

5.132. Chunck 132

sed -i -e "$ a force_dot_files=YES" vsftpd.conf

5.133. Chunck 133

sed -i -e "$ a allow_anon_ssl=NO" vsftpd.conf

5.134. Chunck 134

sed -i -e "$ a force_local_data_ssl=NO" vsftpd.conf

5.135. Chunck 135

sed -i -e "$ a force_local_logins_ssl=YES" vsftpd.conf

5.136. Chunck 136

sed -i -e "$ a ssl_sslv3=YES" vsftpd.conf

5.137. Chunck 137

sed -i -e "$ a require_ssl_reuse=YES" vsftpd.conf

5.138. Chunck 138

sed -i -e "$ a ssl_ciphers=HIGH" vsftpd.conf

5.139. Chunck 139

sed -i -e "$ a cmds_allowed=ABOR,CWD,RMW,DELE,LIST,MDTM,MKD,NLST,PASS,PASV,PORT,PWD,QUIT,RETR,RMD,RNFR,RNTO,SITE,SIZE,STOR,TYPE,USER,CDUP,HELP,MODE,NOOP,STAT,STOU,STRU" vsftpd.conf

5.140. Chunck 140

sed -i -e "$ a userlist_enable=YES" vsftpd.conf

5.141. Chunck 141

sed -i -e "$ a userlist_deny=NO" vsftpd.conf

5.142. Chunck 142

sed -i -e "$ a userlist_enable=YES" vsftpd.conf

5.143. Chunck 143

sed -i -e "$ a userlist_file=/home/rootsu/vsftpd-virtual_user/vsftpd_user" vsftpd.conf

5.144. Chunck 144

sed -i -e "$ a user_config_dir=/home/rootsu/vsftpd-virtual_user/" vsftpd.conf

5.145. Chunck 145

sed -i -e "$ a chown_uploads=YES" vsftpd.conf

5.146. Chunck 146

sed -i -e "$ a chown_username=nobody" vsftpd.conf

5.147. Chunck 147

sed -i -e "$ a tcp_wrappers=YES" vsftpd.conf

5.148. Chunck 148

sed -i -e "$ a max_per_ip=10" vsftpd.conf

5.149. Chunck 149

sed -i -e "$ a userlist_enable=YES" vsftpd.conf

5.150. Chunck 150

sed -i -e "$ a local_enable=YES" vsftpd.conf

5.151. Chunck 151

sed -i -e "$ a virtual_use_local_privs=YES" vsftpd.conf

5.152. Chunck 152

sed -i -e "$ a listen_port=21" vsftpd.conf

5.153. Chunck 153

cd /etc/pam.d/
sed -i -e "s/auth       required        pam_shells.so.*$\|#auth required        pam_shells.so.*$/#auth  required        pam_shells.so/g" vsftpd

5.154. Chunck 154

echo -e "RU\nRussia\nSaratov\n$HOSTNAME Ltd.\nWSB-IOT-Embedded\nadmin\nfar1803@ya.ru\n" | openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout /etc/ssl/private/vsftpd.key -out /etc/ssl/certs/vsftpd.crt

chmod 770 /home/rootsu/vsftpd-virtual_user
chmod 770 /home/rootsu/vsftpd.chroot_list
chmod 750 -R /home/rootsu

5.155. Chunck 155

iptables -F
sudo systemctl restart vsftpd
sudo systemctl enable vsftpd
iptables –F

5.156. Chunck 156

cp -Rf /home/admin/.ssh/ /media/admin/ssh

cp -Rf /home/tom/.ssh/ /media/admin/ssh2
chown -Rf admin:admins /media/admin/ /home/admin/

echo -e "9_user_settings" >> steps.txt
fi

5.157. Chunck 157

5.158. Chunck 158

if [[ -z $(sed -n -e "s/^\(10_SELinux_settings\).*/\1/p" steps.txt) ]]; then

semanage fcontext -a -s system_u "/home/rootsu(/.*)?";
semanage fcontext -a -t user_home_dir_t "/home/rootsu(/.*)?";
chcon -Rv -u system_u -t user_home_dir_t "/home/rootsu/";

semanage fcontext -a -t ftpd_etc_t "/home/rootsu/vsftpd-virtual_user";
chcon -Rv -t ftpd_etc_t "/home/rootsu/vsftpd-virtual_user";
semanage fcontext -a -t ftpd_etc_t "/home/rootsu/vsftpd.chroot_list(/.*)?";
chcon -Rv -t ftpd_etc_t "/home/rootsu/vsftpd.chroot_list";
semanage fcontext -a -t samba_etc_t "/home/rootsu/smbuser.conf";
chcon -Rv -t samba_etc_t "/home/rootsu/smbuser.conf";
semanage fcontext -a -t samba_etc_t "/home/rootsu/.smbusers";
chcon -Rv -t samba_etc_t "/home/rootsu/.smbusers";
semanage fcontext -a -u system_u "/home(/.*)?";
chcon -Rv -u system_u "/home/";

5.159. Chunck 159

chcon -Rv -t public_content_rw_t "/media/admin";
semanage fcontext -a -t public_content_rw_t "/media/admin(/.*)?";

setfacl -m u:admin:rwx,u:admin_share:rwx -R "/media/admin";
setfacl -m g:admins:rw -R "/media/admin";
chmod go-rwx -R "/media/admin";

semanage fcontext -a -t public_content_rw_t "/opt(/.*)?"
chcon -Rv -t public_content_rw_t "/opt/";
chmod o-rwx -R "/opt/SAMBA_SHARE/";
setfacl -m g:technics:rwx -R "/opt/SAMBA_SHARE/";
setfacl -m u:pub_share:rwx,u:admin_share:rwx -R "/opt/SAMBA_SHARE/";

setsebool -P ssh_sysadm_login on

5.160. Chunck 160

setsebool -P httpd_use_cifs on
setsebool -P allow_ftpd_use_nfs 1
setsebool -P allow_ftpd_use_cifs 1
setsebool -P ftpd_connect_db 1

setsebool -P ftp_home_dir on
setsebool -P allow_ftpd_full_access on
setsebool -P ftpd_use_passive_mode on

semanage port -a -t ssh_port_t -p tcp 4103
semanage port -a -t smbd_port_t -p tcp 445
semanage port -a -t ftp_port_t -p tcp 21

cd ~
semodule -i mountlocv1v2.pp

COUNT=1;
ip addr | sed -n -e "s/.*1\:\s\(.*\)\:\s<.*/\1/p"
while [[ -n $( ip addr | sed -n -e "s/.*$COUNT\:\s\(.*\)\:\s<.*/\1/p") ]]
do
semanage interface -a -t netif_t -r s0-s0:c0.c1023 $( ip addr | sed -n -e "s/.*$COUNT\:\s\(.*\)\:\s<.*/\1/p")
((COUNT++));
done

5.161. Chunck 161

semanage permissive -a boot_t

5.162. Chunck 162

setsebool -P cron_can_relabel 1
setsebool -P fcron_crond 1
setsebool -P cron_userdomain_transition 1
setsebool -P cron_manage_all_user_content 1
setsebool -P cron_read_all_user_content 1
setsebool -P cron_read_generic_user_content 1

5.163. Chunck 163

setsebool -P allow_mount_anyfile 1
setsebool -P webadm_manage_user_files 1
setsebool -P webadm_read_user_files 1

5.164. Chunck 164

setsebool -P samba_export_all_ro 1
setsebool -P samba_export_all_rw 1
setsebool -P dhcpc_manage_samba 1
setsebool -P samba_create_home_dirs 1
setsebool -P samba_enable_home_dirs 1
setsebool -P samba_share_fusefs 1
setsebool -P samba_share_nfs 1
setsebool -P use_samba_home_dirs 1

5.165. Chunck 165

setsebool -P virt_use_samba 1
setsebool -P virt_use_nfs 1
setsebool -P samba_portmapper 1
setsebool -P systemd_tmpfiles_manage_all 1
setsebool -P cron_manage_generic_user_content 1

5.166. Chunck 166

setsebool -P use_nfs_home_dirs 1

setsebool -P sudo_all_tcp_connect_http_port 1
setsebool -P git_cgi_enable_homedirs 1
setsebool -P git_cgi_use_cifs 1
setsebool -P git_cgi_use_nfs 1
setsebool -P git_session_bind_all_unreserved_ports 1
setsebool -P git_session_send_syslog_msg 1
setsebool -P git_session_users 1
setsebool -P git_system_enable_homedirs 1
setsebool -P git_system_use_cifs 1
setsebool -P git_system_use_nfs 1

systemctl enable mcstrans
systemctl start mcstrans
systemctl reenable fstrim.timer
systemctl reenable fstrim.timer
systemctl start fstrim.service
systemctl start fstrim.timer

5.167. Chunck 167

cd /etc/selinux

5.168. Chunck 168

sed -i -e "s/SELINUX=permissive\|SELINUX=default/SELINUX=enforcing/g" config

5.169. Chunck 169

sed -i -e "s/%sudo.*$/%sudo     ALL=(root) ROLE=sysadm_r NOPASSWD:ALL/g" /etc/sudoers
sed -i -e "s/%admins.*$/%admins ALL=(root) NOPASSWD:ALL/g" /etc/sudoers
sed -i -e "s/admin.*$/admin     ALL=(root) NOPASSWD:ALL/g" /etc/sudoers

sed -i -e '1 a session  required        pam_selinux.so  close' /etc/pam.d/sshd
sed -i -e '$a session   required        pam_selinux.so  multiple open' /etc/pam.d/sshd >> /etc/pam.d/sshd
sed -i -e '$a session   required        pam_access.so' /etc/pam.d/sshd >> /etc/pam.d/sshd

sed -i -e '$a -a exit,always -S open -F auid>=0' /etc/audit/audit.rules

chmod o-x "/etc/systemd/system.conf";

5.170. Chunck 170

chmod o-rwx -R "/boot/";

5.171. Chunck 171

chmod o-rwx -R "/srv/";
chmod o-rwx -R "/mnt/";

5.172. Chunck 172

semanage fcontext -a -t tmp_t "/tmp(/.*)?"
chcon -t tmp_t -R "/tmp"
chmod o-rwx -R "/tmp/";
chmod o-rwx "/media/";

5.173. Chunck 173

semanage fcontext -a -t system_cron_spool_t "/var/spool/cron(/.*)?"
chcon -t system_cron_spool_t -Rv /var/spool/cron/

chmod o-r -R "/home/";
chmod o-x -R "/home/rootsu" "/home/admin/";

5.174. Chunck 174

echo "deb https:\\\download.webmin.com\download\repository sarge contrib" >> /etc/apt/sources.list

5.175. Chunck 175

cd ~

5.176. Chunck 176

semodule -i loaderlocalv1.pp
semodule -i loaderlocalv2.pp
semodule -i loaderlocalv3.pp
semodule -i loaderlocalv4.pp
semodule -i sudotev1.pp
semodule -i sudotev2.pp
semodule -i sudotev3.pp
semodule -i sudotev4.pp
semodule -i sudotev5.pp
semodule -i sudotevb1.pp
semodule -i sudotevb2.pp
semodule -i sudotev70522v21.pp
semodule -i sudotevcrondv1.pp
semodule -i sphinxtev1.pp
semodule -i nodegcc_app1.pp
semanage permissive -a boot_t
semanage permissive -a crond_t
semanage permissive -a crontab_t
semanage permissive -a system_crontab_t
semanage module -d permissive_boot_t

5.177. Chunck 177

semanage user -m -R "system_r sysadm_r staff_r" -r "s0-s0:c0.c1023" sysadm_u

5.178. Chunck 178

semanage login -a -s sysadm_u -r "s0-s0:c0.c1023" admin
semanage login -a -s sysadm_u -r "s0-s0:c0.c1023" admin_tech
semanage login -a -s sysadm_u -r "s0-s0:c0.c1023" %admins

5.179. Chunck 179

semanage login -a -s unconfined_u -r "s0-s0:c0.c1023" %sudo
semanage login -a -s user_u tom

5.180. Chunck 180

5.181. Chunck 181

update-initramfs -k all -u
update-grub

echo -e "y\n" | apt-get install apt-transport-https
echo -e "y\n" | apt-get install perl libnet-ssleay-perl openssl libauthen-pam-perl libpam-runtime libio-pty-perl apt-show-versions python unzip
cd /root
wget https://download.webmin.com/jcameron-key.asc
cat jcameron-key.asc | gpg --dearmor >/usr/share/keyrings/jcameron-key.gpg
cd /install/
wget http://prdownloads.sourceforge.net/webadmin/webmin_1.991_all.deb
dpkg --install webmin_1.991_all.deb
mkdir /var/webmin/.webmin
chmod 755 /var/webmin/.webmin
semanage fcontext -a -t tmp_t "/var/webmin/.webmin";
chcon -Rv -t tmp_t "/var/webmin/.webmin";

5.182. Chunck 182

semanage port -a -t http_port_t -p tcp 10000
semanage port -a -t http_port_t -p tcp 20000

systemctl enable webmin
cp -Rf /install/etc/webmin/etc/
systemctl start webmin

5.183. Chunck 183

echo -e "y\n" | sudo apt-get install transmission
echo -e "y\n" | sudo apt-get install transmission-cli transmission-common transmission-daemon

5.184. Chunck 184

sudo systemctl enable transmission-daemon.service

5.185. Chunck 185

mkdir -m 777 /opt/SAMBA_SHARE/bittorrent_download_store
mkdir -m 777 /opt/SAMBA_SHARE/bittorrent_upload
mkdir -m 777 /opt/SAMBA_SHARE/bittorrent_watch
chown debian-transmission:debian-transmission /opt/SAMBA_SHARE/bittorrent_download_store
chown debian-transmission:debian-transmission /opt/SAMBA_SHARE/bittorrent_upload
chown debian-transmission:debian-transmission /opt/SAMBA_SHARE/bittorrent_watch
chown debian-transmission:debian-transmission /opt/SAMBA_SHARE/torrents
setfacl -m u:admin_share:rwx,u:admin:rwx,u:pub_share:rwx,g:admins:rw,g:technics:rw -R "/opt/";

5.186. Chunck 186

sudo usermod -aG debian-transmission admins
sudo usermod -aG debian-transmission admin_share

5.187. Chunck 187

cp -R /etc/transmission-daemon/ /opt/.transmission_config
chown admin_share:technics -R /opt/.transmission_config

5.188. Chunck 188

chmod -R 775 /opt/.transmission_config

5.189. Chunck 189

sed -i -e "s/CONFIG_DIR=.*$/CONFIG_DIR=\"\/opt\/.transmission_config\/settings.json\"/g" /etc/default/transmission-daemon
semanage port -a -t http_port_t -p tcp 9091

5.190. Chunck 190

sudo service transmission-daemon stop
sed -i -e "s/\"rpc-whitelist\"\:.*$/\"rpc-whitelist\"\: \"127.0.0.1,192.168.*.*\",/g" /var/lib/transmission-daemon/info/settings.json

5.191. Chunck 191

sed -i -e "s/\"rpc-username\"\:.*$/\"rpc-username\"\: \"pub_share\",/g" /var/lib/transmission-daemon/info/settings.json

5.192. Chunck 192

sed -i -e "s/\"rpc-password\"\:.*$/\"rpc-password\"\: \"********\",/g" /var/lib/transmission-daemon/info/settings.json

5.193. Chunck 193

sed -i -e "s/\"download-dir\"\:.*$/\"download-dir\"\: \"\/opt\/SAMBA_SHARE\/torrents\",/g" /var/lib/transmission-daemon/info/settings.json
sed -i -e "s/\"incomplete-dir\"\:.*$/\"incomplete-dir\"\: \"\/opt\/SAMBA_SHARE\/bittorrent_download_store\",/g" /var/lib/transmission-daemon/info/settings.json
sed -i -e "s/\"watch-dir\"\:.*$/\"watch-dir\"\: \"\/opt\/SAMBA_SHARE\/bittorrent_watch\",/g" /var/lib/transmission-daemon/info/settings.json

5.194. Chunck 194

service transmission-daemon start

5.195. Chunck 195

mdadm --detail --scan | sudo tee -a /etc/mdadm/mdadm.conf
update-initramfs -u

5.196. Chunck 196

5.197. Chunck 197

echo -e "\y\n" | apt-get install libpcap-dev
echo -e "\y\n" | apt-get install sendmail
cd ~

5.198. Chunck 198

wget http://fcron.free.fr/archives/fcron-3.2.1.src.tar.gz
tar -xvf fcron-3.2.1.src.tar.gz
cd fcron-3.2.1
./configure
make install
cd ..
rm -Rf fcron-3.2.1
cp -Rf /install/spool/ /usr/local/var/spool/
cp -Rf /install/usr/local/ /usr/local/

systemctl enable fcron
systemctl start fcron

5.199. Chunck 199

echo -e "y\n" | apt-get autoremove

5.200. Chunck 200

setenforce 1
echo -e "10_SELinux_settings" >> steps.txt
fi
echo "Press ESC key to quit"

5.201. Chunck 201

while read -r -n1 key
do

5.202. Chunck 202

if [[ $key == $'\e' ]];
then
break;
fi
done;

5.203. Chunck 203

exit 0;