diff --git a/deployment/bare_metal/build_and_start_login_server.sh b/deployment/bare_metal/old/build_and_start_login_server.sh similarity index 100% rename from deployment/bare_metal/build_and_start_login_server.sh rename to deployment/bare_metal/old/build_and_start_login_server.sh diff --git a/deployment/bare_metal/build_frontend.sh b/deployment/bare_metal/old/build_frontend.sh similarity index 100% rename from deployment/bare_metal/build_frontend.sh rename to deployment/bare_metal/old/build_frontend.sh diff --git a/deployment/bare_metal/nginx/sites-available/gradido b/deployment/bare_metal/old/nginx/sites-available/gradido similarity index 100% rename from deployment/bare_metal/nginx/sites-available/gradido rename to deployment/bare_metal/old/nginx/sites-available/gradido diff --git a/deployment/bare_metal/nginx/sites-available/gradido_updating b/deployment/bare_metal/old/nginx/sites-available/gradido_updating similarity index 100% rename from deployment/bare_metal/nginx/sites-available/gradido_updating rename to deployment/bare_metal/old/nginx/sites-available/gradido_updating diff --git a/deployment/bare_metal/nginx/updating_original.html b/deployment/bare_metal/old/nginx/updating_original.html similarity index 100% rename from deployment/bare_metal/nginx/updating_original.html rename to deployment/bare_metal/old/nginx/updating_original.html diff --git a/deployment/bare_metal/old/setup_server_online_ubuntu18.sh b/deployment/bare_metal/old/setup_server_online_ubuntu18.sh new file mode 100644 index 000000000..cd0ce8ee9 --- /dev/null +++ b/deployment/bare_metal/old/setup_server_online_ubuntu18.sh @@ -0,0 +1,322 @@ +#!/bin/bash +echo "Start with installing necessary packets" +echo "Maria DB MySql-Server" +sudo apt update +sudo apt install -y mariadb-server +sudo mysql_secure_installation +echo "nginx and php 7.2" +sudo apt-get install -y nginx php7.2-fpm php7.2-mbstring php7.2-intl php7.2-xml php7.2-pdo php7.2-mysql +echo "firewall and fail2ban" +sudo apt-get install -y fail2ban ufw net-tools certbot python3-certbot-nginx + +echo "ufw" +sudo ufw allow http +sudo ufw allow https +sudo ufw allow ssh +sudo ufw enable + +# for installing packages for community-server +echo "Composer" +# Composer install script from https://getcomposer.org/doc/faqs/how-to-install-composer-programmatically.md +cd ~ +EXPECTED_CHECKSUM="$(wget -q -O - https://composer.github.io/installer.sig)" +php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" +ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")" + +if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ] +then + echo 'ERROR: Invalid installer checksum' + rm composer-setup.php + exit 1 +fi + +php composer-setup.php --quiet +RESULT=$? +rm composer-setup.php +#exit $RESULT +echo "Composer install result: ${RESULT}" + +sudo mv composer.phar /usr/local/bin/composer + +# for compiling login server +# you can use another folder if you like, this is not the default folder for this +cd ~/ +mkdir code +cd code + + +git clone https://github.com/Kitware/CMake.git --branch v3.19.8 +cd CMake + +./bootstrap && make -j${CPU_COUNT} && sudo make install + +# nginx security +echo "Additional Security for nginx" +sudo mkdir /etc/nginx/common +cd /etc/nginx/common +sudo cat << "EOF" > protect.conf +# Deny access to readme.(txt|html) or license.(txt|html) or example.(txt|html) and other common git related files +location ~* \"/(^$|readme|license|example|README|LEGALNOTICE|INSTALLATION|CHANGELOG)\.(txt|html|md)\" { + deny all; +} +# Deny access to backup extensions & log files +location ~* \"\.(old|orig|original|php#|php~|php_bak|save|swo|aspx?|tpl|sh|bash|bak?|cfg|cgi|dll|exe|git|hg|ini|jsp|log|mdb|out|sql|svn|swp|tar|rdf)$\" { + deny all; +} +# deny access to hidden files and directories +location ~ /\.(?!well-known\/) { + deny all; +} +# deny access to base64 encoded urls +location ~* \"(base64_encode)(.*)(\()\" { + deny all; +} +# deny access to url with the javascript eval() function +location ~* \"(eval\()\" { + deny all; +} +# deny access to url which include \"127.0.0.1\" +location ~* \"(127\.0\.0\.1)\" { + deny all; +} +location ~* \"(GLOBALS|REQUEST)(=|\[|%)\" { + deny all; +} +location ~* \"(<|%3C).*script.*(>|%3)\" { + deny all; +} +location ~ \"(\\|\.\.\.|\.\./|~|`|<|>|\|)\" { + deny all; +} +location ~* \"(\'|\\")(.*)(drop|insert|md5|select|union)\" { + deny all; +} +location ~* \"(https?|ftp|php):/\" { + deny all; +} +location ~* \"(=\\\'|=\\%27|/\\\'/?)\.\" { + deny all; +} +location ~ \"(\{0\}|\(/\(|\.\.\.|\+\+\+|\\\\"\\\\")\" { + deny all; +} +location ~ \"(~|`|<|>|:|;|%|\\|\s|\{|\}|\[|\]|\|)\" { + deny all; +} +location ~* \"(&pws=0|_vti_|\(null\)|\{\$itemURL\}|echo(.*)kae|boot\.ini|etc/passwd|eval\(|self/environ|(wp-)?config\.|cgi-|muieblack)\" { + deny all; +} +location ~* \"/(^$|mobiquo|phpinfo|shell|sqlpatch|thumb|thumb_editor|thumbopen|timthumb|webshell|config|configuration)\.php\" { + deny all; +} +EOF + +sudo cat << "EOF" > protect_add_header.conf +# Prevent browsers from incorrectly detecting non-scripts as scripts +# https://infosec.mozilla.org/guidelines/web_security#x-content-type-options +add_header X-Content-Type-Options "nosniff"; + +# prevent clickjacking: https://www.owasp.org/index.php/Clickjacking +# https://geekflare.com/add-x-frame-options-nginx/ +# https://infosec.mozilla.org/guidelines/web_security#x-frame-options +add_header Content-Security-Policy "frame-ancestors 'none'"; +add_header X-Frame-Options "DENY"; +EOF + +sudo cat << "EOF" > ssl.conf +## + # SSL Settings + ## + + # disable SSLv3(enabled by default since nginx 0.8.19) since it's less secure then TLS http://en.wikipedia.org/wiki/Secure_Sockets_Layer#SSL_3.0 + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE + + # enables server-side protection from BEAST attacks + # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html + ssl_prefer_server_ciphers on; + + # enable session resumption to improve https performance + # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html + ssl_session_cache shared:SSL:50m; + ssl_session_timeout 1d; + ssl_session_tickets off; + + # ciphers chosen for forward secrecy and compatibility + # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html + ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS'; + + # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner) + # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ + resolver 8.8.8.8 8.8.4.4; + ssl_stapling on; + ssl_stapling_verify on; + # ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt; + + # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security + # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping + # also https://hstspreload.org/ + add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload"; +EOF + +cd /etc/nginx/sites-available +sudo cp default default_original +sudo cat< default +## +# You should look at the following URL's in order to grasp a solid understanding +# of Nginx configuration files in order to fully unleash the power of Nginx. +# https://www.nginx.com/resources/wiki/start/ +# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/ +# https://wiki.debian.org/Nginx/DirectoryStructure +# +# In most cases, administrators will remove this file from sites-enabled/ and +# leave it as reference inside of sites-available where it will continue to be +# updated by the nginx packaging team. +# +# This file will automatically load configuration files provided by other +# applications, such as Drupal or Wordpress. These applications will be made +# available underneath a path with that package name, such as /drupal8. +# +# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples. +## + +# Default server configuration +# +server { + listen 80 default_server; + listen [::]:80 default_server; + + include /etc/nginx/common/protect.conf; + + server_name _; + + location / { + deny all; + } + + + # deny access to .htaccess files, if Apache's document root + # concurs with nginx's one + # + #location ~ /\.ht { + # deny all; + #} +} + +# catch requests with empty hosts +server { + listen 80; + server_name ""; + return 444; +} +EOF + +cd /etc/nginx/conf.d +sudo cat < logging.conf +log_format main '$http_x_forwarded_for - $remote_user [$time_local] ' + '"$request_method $scheme://$host$request_uri $server_protocol" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" $request_time'; +EOF + +# fail2ban enable blocking to many http request resulting in forbidden +echo "fail2ban config" +cd /etc/fail2ban/filter.d +sudo cat < nginx-forbidden.conf +[Definition] +failregex = ^.*\[error\] \d+#\d+: .* forbidden .*, client: , .*$ + +ignoreregex = +EOF + +cd /etc/fail2ban/jail.d +sudo cat < nginx-forbidden.conf +[nginx-forbidden] +enabled = true +filter = nginx-forbidden +port = http,https +logpath = /var/log/nginx/*error*.log +findtime = 60 +bantime = 6000 +maxretry = 3 +EOF + +sudo service fail2ban restart + +# phpmyadmin +echo "install and secure phpmyadmin" +sudo apt install phpmyadmin +cd /etc/phpmyadmin/conf.d +sudo cat < pma_secure.php + +EOF +phpmyadminPwd = $(openssl passwd) +echo "Please give a username for phpmyadmin, but not root" +read phpmyadmin_user +# TODO: check if phpmyadmin_user isn't really root +sudo cat < /etc/nginx/pma_pass +$phpmyadmin_user:$phpmyadminPwd +EOF + +serverIP = $(ifconfig | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1') + +sudo cat < /etc/nginx/sites-available/phpmyadmin + +server { + listen 80 ; + + listen [::]:80; + server_name $serverIP; + + + location ~* \.(png|jpg|ico)$ { + expires 30d; + } + + location ~* \.(js|css) { + expires 30d; + } + + location /phpmyadmin { + root /usr/share/phpmyadmin + index index.php; + + location ~ \.php$ { + include snippets/fastcgi-php.conf; + fastcgi_pass unix:/run/php/php7.4-fpm.sock; + } + + location / { + try_files $uri $uri/ /index.php?$args; + } + } + + location ~ /\.ht { + deny all; + } + + access_log /var/log/nginx/access.log main; +} + +EOF +sudo ln -s /etc/nginx/sites-available/phpmyadmin /etc/nginx/sites-enabled + +# certbot +#echo "Install certbot" +#sudo apt update +#sudo apt install software-properties-common +#sudo add repository universe +#sudo apt update +#sudo apt install certbot \ No newline at end of file diff --git a/deployment/bare_metal/update_all.sh b/deployment/bare_metal/old/update_all.sh similarity index 100% rename from deployment/bare_metal/update_all.sh rename to deployment/bare_metal/old/update_all.sh