diff --git a/doc/EN/app_nextcloud.org b/doc/EN/app_nextcloud.org index 93b3d044..4920101c 100644 --- a/doc/EN/app_nextcloud.org +++ b/doc/EN/app_nextcloud.org @@ -24,6 +24,8 @@ NextCloud is a system for file synchronisation and also has many other plugins f The videoconferencing plugin requires a browser with WebRTC support and so is unlikely to work in a Tor browser, but may still be a better option than using proprietary systems. +* Operational considerations +If your ISP or the government in your area is part of your threat model then NextCloud may not be the best choice for hosting files and [[./app_syncthing.html][Syncthing]] could be preferable. In the past the NextCloud company is known to have remotely scanned servers without permission and reported server admins who don't immediately update to the latest version of the software to their ISPs or to questionable government agencies. Depending upon where you are located such activities by the developer, which are not really in the spirit of independent self-hosting, could have very undesirable results. * Installation Log into your system with: diff --git a/image_build/prosody-0.10-1nightly410.tar.gz b/image_build/prosody-0.10-1nightly410.tar.gz new file mode 100644 index 00000000..267e0534 Binary files /dev/null and b/image_build/prosody-0.10-1nightly410.tar.gz differ diff --git a/src/freedombone-app-gnusocial b/src/freedombone-app-gnusocial index 9d82390b..ea5f2956 100755 --- a/src/freedombone-app-gnusocial +++ b/src/freedombone-app-gnusocial @@ -299,6 +299,7 @@ function gnusocial_set_expire_months { } function configure_interactive_gnusocial { + read_config_param GNUSOCIAL_EXPIRE_MONTHS while true do data=$(tempfile 2>/dev/null) diff --git a/src/freedombone-app-mailpile b/src/freedombone-app-mailpile index e47d1b4d..548b528c 100755 --- a/src/freedombone-app-mailpile +++ b/src/freedombone-app-mailpile @@ -13,7 +13,7 @@ # License # ======= # -# Copyright (C) 2016 Bob Mottram +# Copyright (C) 2016-2017 Bob Mottram # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as published by @@ -37,7 +37,7 @@ MAILPILE_DOMAIN_NAME= MAILPILE_CODE= MAILPILE_ONION_PORT=8103 MAILPILE_REPO="https://github.com/mailpile/Mailpile" -MAILPILE_COMMIT='6f56fe4ad736c8e385bea658454bed110d08c60d' +MAILPILE_COMMIT='88ae8e5831dddc628c827c44224166dbdbed91f1' MAILPILE_PORT=33411 mailpile_variables=(MAILPILE_REPO @@ -45,6 +45,7 @@ mailpile_variables=(MAILPILE_REPO MAILPILE_CODE ONION_ONLY DDNS_PROVIDER + DEFAULT_DOMAIN_NAME MY_USERNAME) function logging_on_mailpile { @@ -109,118 +110,19 @@ function upgrade_mailpile { } function backup_local_mailpile { - if [ ! -f /etc/systemd/system/mailpile.service ]; then - return - fi - MAILPILE_DOMAIN_NAME='mailpile.local' - if grep -q "mailpile domain" $COMPLETION_FILE; then - MAILPILE_DOMAIN_NAME=$(get_completion_param "mailpile domain") - fi - source_directory=/var/www/${MAILPILE_DOMAIN_NAME}/mail/.local - if [ -d $source_directory ]; then - systemctl stop mailpile - - function_check backup_directory_to_usb - backup_directory_to_usb $source_directory mailpile - - systemctl start mailpile - fi + echo -n '' } function restore_local_mailpile { - if [ ! -f /etc/systemd/system/mailpile.service ]; then - return - fi - MAILPILE_DOMAIN_NAME='mailpile.local' - if grep -q "mailpile domain" $COMPLETION_FILE; then - MAILPILE_DOMAIN_NAME=$(get_completion_param "mailpile domain") - fi - if [ $MAILPILE_DOMAIN_NAME ]; then - systemctl stop mailpile - - temp_restore_dir=/root/tempmailpile - restore_directory_from_usb $temp_restore_dir mailpile - if [ -d /var/www/${MAILPILE_DOMAIN_NAME}/mail/.local ]; then - mv /var/www/${MAILPILE_DOMAIN_NAME}/mail/.local /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous - fi - temp_source_dir=$(find ${temp_restore_dir} -name ".local") - cp -r ${temp_source_dir} /var/www/${MAILPILE_DOMAIN_NAME}/mail/ - if [ ! "$?" = "0" ]; then - if [ -d mv /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous ]; then - if [ -d /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous ]; then - rm -rf /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous - fi - mv /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous /var/www/${MAILPILE_DOMAIN_NAME}/mail/.local - fi - backup_unmount_drive - exit 3685 - fi - rm -rf ${temp_restore_dir} - chown -R mailpile: /var/www/$MAILPILE_DOMAIN_NAME/mail/ - - if [ -d /etc/letsencrypt/live/${MAILPILE_DOMAIN_NAME} ]; then - ln -s /etc/letsencrypt/live/${MAILPILE_DOMAIN_NAME}/privkey.pem /etc/ssl/private/${MAILPILE_DOMAIN_NAME}.key - ln -s /etc/letsencrypt/live/${MAILPILE_DOMAIN_NAME}/fullchain.pem /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem - fi - - systemctl start mailpile - fi + echo -n '' } function backup_remote_mailpile { - if [ ! -f /etc/systemd/system/mailpile.service ]; then - return - fi - MAILPILE_DOMAIN_NAME='mailpile.local' - if grep -q "mailpile domain" $COMPLETION_FILE; then - MAILPILE_DOMAIN_NAME=$(get_completion_param "mailpile domain") - fi - source_directory=/var/www/${MAILPILE_DOMAIN_NAME}/mail/.local - if [ -d $source_directory ]; then - systemctl stop mailpile - - function_check backup_directory_to_usb - backup_directory_to_friend $source_directory mailpile - - systemctl start mailpile - fi + echo -n '' } function restore_remote_mailpile { - if [ ! -f /etc/systemd/system/mailpile.service ]; then - return - fi - MAILPILE_DOMAIN_NAME='mailpile.local' - if grep -q "mailpile domain" $COMPLETION_FILE; then - MAILPILE_DOMAIN_NAME=$(get_completion_param "mailpile domain") - fi - if [ $MAILPILE_DOMAIN_NAME ]; then - systemctl stop mailpile - - temp_restore_dir=/root/tempmailpile - restore_directory_from_friend $temp_restore_dir mailpile - if [ -d /var/www/${MAILPILE_DOMAIN_NAME}/mail/.local ]; then - mv /var/www/${MAILPILE_DOMAIN_NAME}/mail/.local /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous - fi - temp_source_dir=$(find ${temp_restore_dir} -name ".local") - cp -r ${temp_source_dir} /var/www/${MAILPILE_DOMAIN_NAME}/mail/ - if [ ! "$?" = "0" ]; then - if [ -d mv /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous ]; then - mv /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous /var/www/${MAILPILE_DOMAIN_NAME}/mail/.local - fi - backup_unmount_drive - exit 36732 - fi - rm -rf ${temp_restore_dir} - chown -R mailpile: /var/www/$MAILPILE_DOMAIN_NAME/mail/ - - if [ -d /etc/letsencrypt/live/${MAILPILE_DOMAIN_NAME} ]; then - ln -s /etc/letsencrypt/live/${MAILPILE_DOMAIN_NAME}/privkey.pem /etc/ssl/private/${MAILPILE_DOMAIN_NAME}.key - ln -s /etc/letsencrypt/live/${MAILPILE_DOMAIN_NAME}/fullchain.pem /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem - fi - - systemctl start mailpile - fi + echo -n '' } function remove_mailpile { @@ -305,6 +207,11 @@ function install_mailpile { adduser mailpile www-data adduser mailpile mail adduser mailpile $MY_USERNAME + if [[ $ONION_ONLY == 'no' ]]; then + chgrp -R ssl-cert /etc/letsencrypt + chmod -R g=rX /etc/letsencrypt + usermod -a -G ssl-cert mailpile + fi chown -R mailpile: /var/www/$MAILPILE_DOMAIN_NAME/mail/ # create folders and tags @@ -440,6 +347,17 @@ function install_mailpile { pip install jinja2==2.9.6 pip install pgpdump==1.5 + # turn off ssl in dovecot + sed -i 's|#ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf + sed -i 's|ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf + + # set ssl certs, just in case we want to use them later + sed -i "s|#ssl_cert =.*|ssl_cert = /dev/null) diff --git a/src/freedombone-app-xmpp b/src/freedombone-app-xmpp index 9cf78788..5e0b06b8 100755 --- a/src/freedombone-app-xmpp +++ b/src/freedombone-app-xmpp @@ -41,8 +41,8 @@ XMPP_CIPHERS='"EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+ XMPP_ECC_CURVE='"secp384r1"' prosody_latest_version='0.10' -prosody_nightly=382 -prosody_nightly_hash='770f1a0466f2361184eebffac9f50c102ad842cd855190db6c7f42f2f09884f5' +prosody_nightly=410 +prosody_nightly_hash='9cf3db6a09895a744d72eb90b4a635758a710afe1a16b78506c7139c4e7211eb' prosody_filename=prosody-${prosody_latest_version}-1nightly${prosody_nightly} prosody_nightly_url="https://prosody.im/nightly/${prosody_latest_version}/latest/${prosody_filename}.tar.gz" @@ -356,7 +356,9 @@ function update_prosody_modules { mkdir -p /var/lib/prosody/prosody-modules fi cp -r $INSTALL_DIR/prosody-modules/* /var/lib/prosody/prosody-modules/ + cp -r $INSTALL_DIR/prosody-modules/* /usr/lib/prosody/modules/ chown -R prosody:prosody /var/lib/prosody/prosody-modules + chown -R prosody:prosody /usr/lib/prosody/modules systemctl start prosody else echo $'Prosody modules not extracted' @@ -1019,6 +1021,7 @@ function install_xmpp { if [ -d /etc/letsencrypt ]; then usermod -a -G ssl-cert prosody fi + apt-mark -q hold prosody systemctl restart prosody if [[ $ONION_ONLY != 'no' ]]; then diff --git a/src/freedombone-base-email b/src/freedombone-base-email index 5cd12d23..6ab7a99a 100755 --- a/src/freedombone-base-email +++ b/src/freedombone-base-email @@ -1345,8 +1345,8 @@ function configure_imap { echo $'Unable to find /etc/dovecot/conf.d/10-ssl.conf' exit 83629 fi - sed -i 's|#ssl =.*|ssl = required|g' /etc/dovecot/conf.d/10-ssl.conf - sed -i 's|ssl =.*|ssl = required|g' /etc/dovecot/conf.d/10-ssl.conf + sed -i 's|#ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf + sed -i 's|ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf sed -i "s|#ssl_cert =.*|ssl_cert = .*|a\ !/usr/local/lib/node_modules ;' /etc/tripwire/twpol.txt fi + # Events here are likely due to USB HRNG activity + if ! grep -q '!/dev/char' /etc/tripwire/twpol.txt; then + sed -i '\|/dev\t\t->.*|a\ !/dev/char ;' /etc/tripwire/twpol.txt + fi + if ! grep -q '!/dev/bus/usb' /etc/tripwire/twpol.txt; then + sed -i '\|/dev\t\t->.*|a\ !/dev/bus/usb ;' /etc/tripwire/twpol.txt + fi # Not much is in /usr/local/bin other than project commands and avoiding it removes # problems with updates. This is a tradeoff, but not by much. diff --git a/src/freedombone-controlpanel b/src/freedombone-controlpanel index 49c1108b..6e87f0b0 100755 --- a/src/freedombone-controlpanel +++ b/src/freedombone-controlpanel @@ -129,8 +129,43 @@ if [[ $USB_DRIVE == *"dev"* ]]; then fi function any_key { - echo ' ' - read -n1 -r -p $"Press any key to continue..." key + echo '' + read -n1 -rsp $"Press any key to continue..." key +} + +function any_key_verify { + echo '' + read -n1 -rsp $"Press any key to continue or C to check a hash..." key + if [[ "$key" != 'c' && "$key" != 'C' ]]; then + return + fi + + data=$(tempfile 2>/dev/null) + trap "rm -f $data" 0 1 2 5 15 + dialog --title $"Check tripwire hash" \ + --backtitle $"Freedombone Control Panel" \ + --inputbox $"Paste your tripwire hash below and it will be checked against the current database" 12 60 2>$data + sel=$? + case $sel in + 0) + GIVEN_HASH=$(<$data) + if [ ${#GIVEN_HASH} -gt 8 ]; then + if [[ "$GIVEN_HASH" == *' '* ]]; then + dialog --title $"Check tripwire" \ + --msgbox $"\nThe hash should not contain any spaces" 10 40 + else + DBHASH=$(sha512sum /var/lib/tripwire/${HOSTNAME}.twd | awk -F ' ' '{print $1}') + if [[ "$DBHASH" == "$GIVEN_HASH" ]]; then + dialog --title $"Check tripwire" \ + --msgbox $"\nSuccess\n\nThe hash you gave matches the current tripwire database" 10 40 + else + dialog --title $"Check tripwire" \ + --msgbox $"\nFailed\n\nThe hash you gave does not match the current tripwire database. This might be because you reset the tripwire, or there could have been an unauthorised modification of the system" 12 50 + fi + fi + fi + ;; + esac } function get_app_icann_address { @@ -2182,7 +2217,7 @@ function menu_top_level { 3) menu_backup_restore;; 4) show_firewall;; 5) show_tripwire_verification_code - any_key;; + any_key_verify;; 6) reset_tripwire;; 7) menu_app_settings;; 8) /usr/local/bin/addremove diff --git a/src/freedombone-utils-gnusocialtools b/src/freedombone-utils-gnusocialtools index ecd667d2..758c3129 100755 --- a/src/freedombone-utils-gnusocialtools +++ b/src/freedombone-utils-gnusocialtools @@ -741,6 +741,9 @@ function expire_gnusocial_posts { expire_days=$((expire_months * 30)) + # files are what take up most of the backup time, so don't keep them for very long + expire_days_files=7 + # To prevent the database size from growing endlessly this script expires posts # after a number of months if [ ! -d /var/www/${domain_name}/htdocs ]; then @@ -788,15 +791,16 @@ function expire_gnusocial_posts { echo '$rowaff1 notices, $rowaff2 conversations, $rowaff3 replies, and $rowaff4 qvitter notifications deleted from database.\n";' >> $gnusocial_expire_posts_script chmod +x $gnusocial_expire_posts_script - gnusocial_expire_script=/usr/bin/${gnusocial_type}-expire + gnusocial_expire_script=/etc/cron.daily/${gnusocial_type}-expire echo '#!/bin/bash' > $gnusocial_expire_script - echo "find /var/www/${domain_name}/htdocs/file/* -mtime +${expire_days} -exec rm {} +" >> $gnusocial_expire_script + echo "find /var/www/${domain_name}/htdocs/file/* -mtime +${expire_days_files} -exec rm {} +" >> $gnusocial_expire_script echo "/usr/bin/php $gnusocial_expire_posts_script" >> $gnusocial_expire_script chmod +x $gnusocial_expire_script - # Add a cron job - if ! grep -q "${gnusocial_expire_script}" /etc/crontab; then - echo "10 3 5 * * root /usr/bin/timeout 500 ${gnusocial_expire_script}" >> /etc/crontab + # remove any old cron job + if grep -q "${gnusocial_type}-expire" /etc/crontab; then + sed -i "/${gnusocial_type}-expire/d" /etc/crontab + rm /usr/bin/${gnusocial_type}-expire fi # remove old expire script diff --git a/src/freedombone-utils-setup b/src/freedombone-utils-setup index b7ad2e96..07ab75cf 100755 --- a/src/freedombone-utils-setup +++ b/src/freedombone-utils-setup @@ -286,10 +286,22 @@ function initial_setup { mark_completed $FUNCNAME } +function turn_off_magic_sysrq { + if grep -q 'kernel.sysrq = 0' /etc/sysctl.conf; then + return + fi + if grep -q 'kernel.sysrq' /etc/sysctl.conf; then + sed -i 's|#kernel.sysrq.*|kernel.sysrq = 0|g' /etc/sysctl.conf + sed -i 's|kernel.sysrq.*|kernel.sysrq = 0|g' /etc/sysctl.conf + else + echo 'kernel.sysrq = 0' >> /etc/sysctl.conf + fi +} + function setup_grub { if [[ $ARCHITECTURE == 'qemu'* || $ARCHITECTURE == 'amd64' || $ARCHITECTURE == 'x86_64' || $ARCHITECTURE == 'i686' || $ARCHITECTURE == 'i386' ]]; then if ! grep -q 'ifnames=0' /etc/default/grub; then - sed -i 's|GRUB_CMDLINE_LINUX_DEFAULT=.*|GRUB_CMDLINE_LINUX_DEFAULT="quiet ifnames=0 slub_debug=FZP slab_nomerge page_poison=1"|g' /etc/default/grub + sed -i 's|GRUB_CMDLINE_LINUX_DEFAULT=.*|GRUB_CMDLINE_LINUX_DEFAULT="quiet ifnames=0 slub_debug=FZP slab_nomerge page_poison=1 panic=0"|g' /etc/default/grub update-grub fi fi @@ -782,6 +794,9 @@ function setup_utils { function_check enable_predictable_device_names enable_predictable_device_names + function_check turn_off_magic_sysrq + turn_off_magic_sysrq + function_check separate_tmp_filesystem separate_tmp_filesystem 150 diff --git a/website/EN/app_nextcloud.html b/website/EN/app_nextcloud.html index 30a804ce..e148fcf0 100644 --- a/website/EN/app_nextcloud.html +++ b/website/EN/app_nextcloud.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + @@ -264,9 +264,17 @@ NextCloud is a system for file synchronisation and also has many other plugins f The videoconferencing plugin requires a browser with WebRTC support and so is unlikely to work in a Tor browser, but may still be a better option than using proprietary systems.

-
-

Installation

-
+
+

Operational considerations

+
+

+If your ISP or the government in your area is part of your threat model then NextCloud may not be the best choice for hosting files and Syncthing could be preferable. In the past the NextCloud company is known to have remotely scanned servers without permission and reported server admins who don't immediately update to the latest version of the software to their ISPs or to questionable government agencies. Depending upon where you are located such activities by the developer, which are not really in the spirit of independent self-hosting, could have very undesirable results. +

+
+
+
+

Installation

+

Log into your system with:

@@ -286,9 +294,9 @@ Select Add/Remove Apps then nextcloud. You will then be asked for
-
-

Initial setup

-
+
+

Initial setup

+

Go to the Administrator control panel and select Passwords then nextcloud. This will give you the password to initially log in to the system and you can change it later from a client app if needed.