mirror of
https://github.com/bashclub/zamba-lxc-toolbox.git
synced 2025-11-04 00:02:26 +01:00
Thorsten Spille
GitHub
50
scripts/create-service-account
Normal file
50
scripts/create-service-account
Normal file
@@ -0,0 +1,50 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
USER="$1"
|
||||
|
||||
if [ -z "$USER" ]; then
|
||||
echo "Usage: $0 <username>"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Prüfen, ob ldbmodify verfügbar ist
|
||||
if ! command -v ldbmodify &> /dev/null; then
|
||||
echo "Fehler: 'ldbmodify' ist nicht installiert. Bitte installiere 'ldb-tools' mit:"
|
||||
echo " sudo apt update && sudo apt install ldb-tools"
|
||||
exit 10
|
||||
fi
|
||||
|
||||
# Sicheres Passwort generieren (32 Zeichen, alphanumerisch + Sonderzeichen)
|
||||
PASSWORD=$(openssl rand -base64 24)
|
||||
|
||||
# Benutzer anlegen mit generiertem Passwort
|
||||
samba-tool user create "$USER" "$PASSWORD"
|
||||
echo "✅ Benutzer $USER erfolgreich erstellt."
|
||||
|
||||
# DN des Benutzers ermitteln
|
||||
DN=$(ldbsearch -H /var/lib/samba/private/sam.ldb "(sAMAccountName=$USER)" dn | awk '/^dn: / {print $2}')
|
||||
|
||||
if [ -z "$DN" ]; then
|
||||
echo "❌ Fehler: DN für $USER nicht gefunden." >&2
|
||||
exit 3
|
||||
fi
|
||||
|
||||
# userWorkstations=NONE setzen
|
||||
ldbmodify -H /var/lib/samba/private/sam.ldb <<EOF
|
||||
dn: $DN
|
||||
changetype: modify
|
||||
replace: userWorkstations
|
||||
userWorkstations: NONE
|
||||
EOF
|
||||
|
||||
echo
|
||||
echo "------------------------------------------"
|
||||
echo "BENUTZER ERSTELLT:"
|
||||
echo "Username: $USER"
|
||||
echo "Passwort: $PASSWORD"
|
||||
echo "Distinguished Name:"
|
||||
echo "$DN"
|
||||
echo "------------------------------------------"
|
||||
echo "Bitte notiere Benutzername, Passwort und DN sicher."
|
||||
67
scripts/mailcow-update
Normal file
67
scripts/mailcow-update
Normal file
@@ -0,0 +1,67 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Konfiguration
|
||||
MAILCOW_PATH="/opt/mailcow-dockerized"
|
||||
SPOOL_DIR="/var/lib/check_mk_agent/spool"
|
||||
INTERVAL_SECONDS=87000 # z. B. alle 24 Stunden + Toleranz
|
||||
SPOOL_FILE="${SPOOL_DIR}/${INTERVAL_SECONDS}_mailcow_update"
|
||||
|
||||
# Sicherstellen, dass das Spool-Verzeichnis existiert
|
||||
mkdir -p "$SPOOL_DIR"
|
||||
|
||||
# Temporäre Datei vorbereiten
|
||||
TMP_FILE="$(mktemp)"
|
||||
|
||||
# Header für Local Check
|
||||
echo "<<<local>>>" > "$TMP_FILE"
|
||||
|
||||
# In das Mailcow-Verzeichnis wechseln
|
||||
if ! cd "$MAILCOW_PATH"; then
|
||||
echo "2 Mailcow_Update - ERROR: Verzeichnis $MAILCOW_PATH nicht gefunden" >> "$TMP_FILE"
|
||||
echo "3 Mailcow_Version - UNKNOWN: Verzeichnis nicht gefunden" >> "$TMP_FILE"
|
||||
mv "$TMP_FILE" "$SPOOL_FILE"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
# Aktuelle Uhrzeit für Log
|
||||
NOW="$(date '+%Y-%m-%d %H:%M:%S')"
|
||||
|
||||
# Mailcow-Version auslesen
|
||||
GIT_TAG=$(git describe --tags --abbrev=0 2>/dev/null)
|
||||
GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null)
|
||||
|
||||
if [[ -n "$GIT_TAG" ]]; then
|
||||
echo "0 Mailcow_Version - OK: Version $GIT_TAG ($GIT_COMMIT)" >> "$TMP_FILE"
|
||||
else
|
||||
echo "0 Mailcow_Version - OK: Commit $GIT_COMMIT (kein Tag)" >> "$TMP_FILE"
|
||||
fi
|
||||
|
||||
# Auf Updates prüfen
|
||||
UPDATE_CHECK=$(./update.sh --check 2>&1)
|
||||
if echo "$UPDATE_CHECK" | grep -q "No updates available"; then
|
||||
echo "0 Mailcow_Update - OK: Kein Update verfügbar ($NOW)" >> "$TMP_FILE"
|
||||
mv "$TMP_FILE" "$SPOOL_FILE"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Erstes Update versuchen
|
||||
UPDATE_OUTPUT=$(./update.sh --force --skip-ping-check 2>&1)
|
||||
EXIT_CODE=$?
|
||||
|
||||
# Sonderfall: Skript wurde geändert und muss erneut ausgeführt werden
|
||||
if echo "$UPDATE_OUTPUT" | grep -q "update.sh changed, please run this script again"; then
|
||||
UPDATE_OUTPUT_2=$(./update.sh --force --skip-ping-check 2>&1)
|
||||
EXIT_CODE=$?
|
||||
UPDATE_OUTPUT="${UPDATE_OUTPUT}\n--- retry ---\n${UPDATE_OUTPUT_2}"
|
||||
fi
|
||||
|
||||
if [ "$EXIT_CODE" -eq 0 ]; then
|
||||
echo "0 Mailcow_Update - OK: Update erfolgreich durchgeführt ($NOW)" >> "$TMP_FILE"
|
||||
else
|
||||
echo "2 Mailcow_Update - CRITICAL: Update fehlgeschlagen ($NOW)" >> "$TMP_FILE"
|
||||
echo "$UPDATE_OUTPUT" >> "$TMP_FILE"
|
||||
fi
|
||||
|
||||
# Ergebnis schreiben
|
||||
mv "$TMP_FILE" "$SPOOL_FILE"
|
||||
exit "$EXIT_CODE"
|
||||
103
scripts/zmb-ad_auto-map-root.sh
Normal file
103
scripts/zmb-ad_auto-map-root.sh
Normal file
@@ -0,0 +1,103 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
SMB_CONF="/etc/samba/smb.conf"
|
||||
USERMAP_FILE="/etc/samba/user.map"
|
||||
KEYTAB_PATH="/root/admin.keytab"
|
||||
SYSTEMD_SERVICE="/etc/systemd/system/kinit-admin.service"
|
||||
SYSTEMD_TIMER="/etc/systemd/system/kinit-admin.timer"
|
||||
BASH_PROFILE="/root/.bash_profile"
|
||||
|
||||
# 1. Domain & Realm aus smb.conf auslesen
|
||||
DOMAIN_NAME=$(awk -F '=' '/^[[:space:]]*workgroup[[:space:]]*=/ {gsub(/ /, "", $2); print $2}' "$SMB_CONF")
|
||||
REALM_NAME=$(awk -F '=' '/^[[:space:]]*realm[[:space:]]*=/ {gsub(/ /, "", $2); print toupper($2)}' "$SMB_CONF")
|
||||
|
||||
if [[ -z "$DOMAIN_NAME" || -z "$REALM_NAME" ]]; then
|
||||
echo "[FEHLER] Konnte 'workgroup' oder 'realm' aus smb.conf nicht auslesen."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "[INFO] Domain: $DOMAIN_NAME"
|
||||
echo "[INFO] Realm: $REALM_NAME"
|
||||
|
||||
# 2. user.map schreiben
|
||||
echo "!root = ${DOMAIN_NAME}\\Administrator" > "$USERMAP_FILE"
|
||||
echo "[OK] Benutzerzuordnung geschrieben in $USERMAP_FILE"
|
||||
|
||||
# 3. smb.conf patchen
|
||||
if ! grep -q "^username map *= *$USERMAP_FILE" "$SMB_CONF"; then
|
||||
sed -i "/^\[global\]/a username map = $USERMAP_FILE" "$SMB_CONF"
|
||||
echo "[OK] smb.conf wurde um 'username map' ergänzt."
|
||||
else
|
||||
echo "[INFO] 'username map' bereits gesetzt."
|
||||
fi
|
||||
|
||||
# 4. Keytab erzeugen
|
||||
echo "[INFO] Erzeuge Keytab für Administrator..."
|
||||
samba-tool domain exportkeytab "$KEYTAB_PATH" --principal="administrator@$REALM_NAME"
|
||||
chmod 600 "$KEYTAB_PATH"
|
||||
echo "[OK] Keytab gespeichert unter $KEYTAB_PATH"
|
||||
|
||||
# 5. systemd-Service + Timer für automatisches kinit
|
||||
echo "[INFO] Erstelle systemd-Service & Timer..."
|
||||
|
||||
cat > "$SYSTEMD_SERVICE" <<EOF
|
||||
[Unit]
|
||||
Description=Kerberos Kinit für Administrator
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/bin/kinit -kt $KEYTAB_PATH administrator@$REALM_NAME
|
||||
EOF
|
||||
|
||||
cat > "$SYSTEMD_TIMER" <<EOF
|
||||
[Unit]
|
||||
Description=Kerberos Kinit für Administrator (Boot)
|
||||
|
||||
[Timer]
|
||||
OnBootSec=10sec
|
||||
Unit=kinit-admin.service
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
# Aktivieren
|
||||
systemctl daemon-reexec
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now kinit-admin.timer
|
||||
|
||||
# 6. root-Login: .bash_profile anpassen
|
||||
echo "[INFO] Ergänze .bash_profile von root, um bei Login kinit auszuführen..."
|
||||
mkdir -p "$(dirname "$BASH_PROFILE")"
|
||||
touch "$BASH_PROFILE"
|
||||
|
||||
# Block nur hinzufügen, wenn er nicht bereits vorhanden ist
|
||||
if ! grep -q "kinit -kt $KEYTAB_PATH administrator@$REALM_NAME" "$BASH_PROFILE"; then
|
||||
cat >> "$BASH_PROFILE" <<EOF
|
||||
|
||||
# Automatisches Kerberos-Ticket beim Login holen
|
||||
if ! klist -s; then
|
||||
echo "[INFO] Kein gültiges Kerberos-Ticket – führe kinit aus..."
|
||||
kinit -kt $KEYTAB_PATH administrator@$REALM_NAME && echo "[INFO] Kerberos-Ticket aktualisiert."
|
||||
fi
|
||||
EOF
|
||||
echo "[OK] .bash_profile angepasst."
|
||||
else
|
||||
echo "[INFO] .bash_profile enthält bereits kinit-Befehl."
|
||||
fi
|
||||
|
||||
# 7. samba-ad-dc neu starten
|
||||
echo "[INFO] Starte samba-ad-dc neu..."
|
||||
systemctl restart samba-ad-dc
|
||||
|
||||
# 8. Testausgaben
|
||||
echo "[INFO] getent passwd root:"
|
||||
getent passwd root || echo "[WARNUNG] Kein Eintrag für root"
|
||||
|
||||
echo
|
||||
echo "[INFO] Test: samba-tool user list (falls kein Passwort kommt, war's erfolgreich):"
|
||||
samba-tool user list | head -n 5 || echo "[WARNUNG] Fehler bei samba-tool"
|
||||
|
||||
@@ -17,7 +17,7 @@ chmod a+r /etc/apt/keyrings/docker.gpg
|
||||
# Add the repository to Apt sources:
|
||||
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
|
||||
apt-get update
|
||||
DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install -y -qq rsync docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
||||
DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install -y -qq rsync docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin jq
|
||||
DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get purge -y -qq postfix
|
||||
|
||||
SECRET=$(random_password)
|
||||
@@ -73,6 +73,21 @@ EOF
|
||||
|
||||
}
|
||||
|
||||
# fix docker errors for slow machines
|
||||
cat << EOF > /etc/docker/daemon.json
|
||||
{
|
||||
"default-ulimits": {
|
||||
"nproc": {
|
||||
"name": "nproc",
|
||||
"soft": -1,
|
||||
"hard": -1
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
systemctl restart docker
|
||||
|
||||
|
||||
cd /opt
|
||||
git clone https://github.com/mailcow/mailcow-dockerized
|
||||
cd mailcow-dockerized
|
||||
@@ -104,6 +119,8 @@ DBUSER=mailcow
|
||||
DBPASS=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2> /dev/null | head -c 28)
|
||||
DBROOT=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2> /dev/null | head -c 28)
|
||||
|
||||
REDISPASS=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2> /dev/null | head -c 28)
|
||||
|
||||
# ------------------------------
|
||||
# HTTP/S Bindings
|
||||
# ------------------------------
|
||||
@@ -367,23 +384,6 @@ HTTP_REDIRECT=y
|
||||
|
||||
EOF
|
||||
|
||||
cat << EOF > data/conf/nginx/redirect.conf
|
||||
server {
|
||||
root /web;
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
include /etc/nginx/conf.d/server_name.active;
|
||||
if ( \$request_uri ~* "%0A|%0D" ) { return 403; }
|
||||
location ^~ /.well-known/acme-challenge/ {
|
||||
allow all;
|
||||
default_type "text/plain";
|
||||
}
|
||||
location / {
|
||||
return 301 https://\$host\$uri\$is_args\$args;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
cat << EOF > /etc/cron.daily/mailcowbackup
|
||||
#!/bin/bash
|
||||
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
|
||||
Reference in New Issue
Block a user