diff --git a/doc/EN/armbian.org b/doc/EN/armbian.org index 248e079b..6f491934 100644 --- a/doc/EN/armbian.org +++ b/doc/EN/armbian.org @@ -62,6 +62,7 @@ sudo su Then clone the Freedombone repository and checkout the stretch development branch. #+begin_src bash +apt-get -y install git dialog build-essential git clone https://github.com/bashrc/freedombone cd freedombone git checkout stretch diff --git a/doc/EN/beaglebone.org b/doc/EN/beaglebone.org index ecf358cd..574fe4e0 100644 --- a/doc/EN/beaglebone.org +++ b/doc/EN/beaglebone.org @@ -38,7 +38,7 @@ You may need to obtain a domain name and set up a dynamic DNS account for your n On your laptop or desktop prepare a microSD card image as follows. To create an image on a Debian based system: #+begin_src bash -sudo apt-get install git +sudo apt-get install git dialog build-essential git clone https://github.com/bashrc/freedombone cd freedombone git checkout stretch @@ -49,7 +49,7 @@ freedombone-image --setup debian Or on Arch/Parabola: #+begin_src bash -sudo pacman -S git +sudo pacman -S git dialog git clone https://github.com/bashrc/freedombone cd freedombone git checkout stretch diff --git a/doc/EN/homeserver.org b/doc/EN/homeserver.org index 03ef0dba..1871ca3b 100644 --- a/doc/EN/homeserver.org +++ b/doc/EN/homeserver.org @@ -20,7 +20,7 @@ The quickest way to get started is as follows. You will need to be running a Deb First install freedombone onto your local system (not the target hardware that you want to run Freedombone on). On a debian based distro: #+begin_src bash -sudo apt-get install git +sudo apt-get install git dialog build-essential git clone https://github.com/bashrc/freedombone cd freedombone git checkout stretch @@ -32,7 +32,7 @@ freedombone-image -t i386 --onion-addresses-only yes Or on Arch/Parabola: #+begin_src bash -sudo pacman -S git +sudo pacman -S git dialog git clone https://github.com/bashrc/freedombone cd freedombone git checkout stretch diff --git a/man/freedombone-template.1.gz b/man/freedombone-template.1.gz index b91fe51c..e6fd942c 100644 Binary files a/man/freedombone-template.1.gz and b/man/freedombone-template.1.gz differ diff --git a/src/freedombone-app-bdsmail b/src/freedombone-app-bdsmail new file mode 100755 index 00000000..ebc077e2 --- /dev/null +++ b/src/freedombone-app-bdsmail @@ -0,0 +1,447 @@ +#!/bin/bash +# +# .---. . . +# | | | +# |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-. +# | | (.-' (.-' ( | ( )| | | | )( )| | (.-' +# ' ' --' --' -' - -' ' ' -' -' -' ' - --' +# +# Freedom in the Cloud +# +# Brain Dead Simple Mail Server for i2p +# +# License +# ======= +# +# Copyright (C) 2018 Bob Mottram +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +VARIANTS='full full-vim' + +IN_DEFAULT_INSTALL=0 +SHOW_ON_ABOUT=1 + +BDSMAIL_REPO="https://github.com/majestrate/bdsmail" +BDSMAIL_COMMIT='8fb00a725edea59b31b8d23eb32e0c21972bb723' +BDSMAIL_DIR=/etc/bdsmail +I2P_SAM_PORT=7656 +I2P_SMTP_PORT=2525 + +bdsmail=(MY_USERNAME) + +function bdsmail_configure_users { + for d in /home/*/ ; do + USERNAME=$(echo "$d" | awk -F '/' '{print $3}') + if [[ $(is_valid_user "$USERNAME") == "1" ]]; then + + # Add the user to the i2p group + usermod -a -G i2psvc $USERNAME + + if [ -f /home/$USERNAME/.muttrc ]; then + # Create a mutt i2p folder + if ! grep -q ' =i2p' /home/$USERNAME/.muttrc; then + MUTT_MAILBOXES=$(grep "mailboxes =" /home/$USERNAME/.muttrc) + sed -i "s|$MUTT_MAILBOXES|$MUTT_MAILBOXES =i2p|g" /home/$USERNAME/.muttrc + fi + + # Create a mutt folder hook to the i2p config + if ! grep -q 'folder-hook !i2p' /home/$USERNAME/.muttrc; then + echo 'folder-hook !i2p/* source ~/.muttrc' >> /home/$USERNAME/.muttrc + fi + if ! grep -q 'folder-hook i2p' /home/$USERNAME/.muttrc; then + echo 'folder-hook i2p/* source ~/.mutt/bdsmail' >> /home/$USERNAME/.muttrc + fi + fi + + # Create a directory where i2p mail will be stored + if [ ! -d /home/$USERNAME/Maildir/i2p/new ]; then + mkdir -p /home/$USERNAME/Maildir/i2p/cur + mkdir -p /home/$USERNAME/Maildir/i2p/new + chown -R $USERNAME:$USERNAME /home/$USERNAME/Maildir/i2p + fi + fi + done +} + +function logging_on_bdsmail { + echo -n '' +} + +function logging_off_bdsmail { + echo -n '' +} + +function remove_user_bdsmail { + remove_username="$1" +} + +function add_user_bdsmail { + new_username="$1" + new_user_password="$2" + + if [ ! -d /home/$new_username/.mutt ]; then + mkdir /home/$new_username/.mutt + cp /etc/skel/.mutt/bdsmail /home/$new_username/.mutt + fi + sed -i "s|username|$new_username|g" /home/$new_username/.mutt/bdsmail + bdsmail_configure_users + $BDSMAIL_DIR/bin/mailtool $BDSMAIL_DIR/config.ini $new_username /home/$new_username/Maildir/i2p + chown -R $new_username:$new_username /home/$new_username/.mutt + echo '0' +} + +function install_interactive_bdsmail { + echo -n '' + APP_INSTALLED=1 +} + +function change_password_bdsmail { + curr_username="$1" + new_user_password="$2" +} + +function bdsmail_update_domain { + sed -i "s|set from=.*|set from=username@$(bdsmail_domain)|g" /etc/skel/.mutt/bdsmail + for d in /home/*/ ; do + USERNAME=$(echo "$d" | awk -F '/' '{print $3}') + if [[ $(is_valid_user "$USERNAME") == "1" ]]; then + cp /etc/skel/.mutt/bdsmail /home/${USERNAME}/.mutt/bdsmail + sed -i "s|set from=.*|set from=${USERNAME}@$(bdsmail_domain)|g" /home/${USERNAME}/.mutt/bdsmail + chown ${USERNAME}:${USERNAME} /home/${USERNAME}/.mutt/bdsmail + fi + done +} + +function bdsmail_wait_for_key_generation { + # wait for domain to be generated by the daemon + # This can take a while, probably because i2p is connecting + bds_domain= + sleep_ctr=0 + while [ ! $bds_domain ]; do + echo $"Waiting for i2p domain to be generated ${sleep_ctr}/100" + systemctl restart bdsmail + sleep 30 + bds_domain=$(bdsmail_domain) + sleep_ctr=$((sleep_ctr + 1)) + if [ $sleep_ctr -gt 100 ]; then + break + fi + done +} + +function reconfigure_bdsmail { + systemctl stop bdsmail + rm $BDSMAIL_DIR/*.dat + rm $BDSMAIL_DIR/*.pem + bdsmail_wait_for_key_generation + if [ ! -f $BDSMAIL_DIR/bdsmail-privkey.dat ]; then + return + fi + bdsmail_update_domain +} + +function upgrade_bdsmail { + CURR_BDSMAIL_COMMIT=$(get_completion_param "bdsmail commit") + if [[ "$CURR_BDSMAIL_COMMIT" == "$BDSMAIL_COMMIT" ]]; then + return + fi + + # update to the next commit + set_repo_commit $BDSMAIL_DIR "bdsmail commit" "$BDSMAIL_COMMIT" $BDSMAIL_REPO + cd $BDSMAIL_DIR + make GOROOT=/home/go/go${GO_VERSION} + chown -R i2psvc:i2psvc $BDSMAIL_DIR + systemctl restart bdsmail + + if ! grep -q "$(bdsmail_domain)" /etc/skel/.mutt/bdsmail; then + bdsmail_update_domain + fi +} + +function backup_local_bdsmail { + systemctl stop bdsmail + + source_directory=$BDSMAIL_DIR + + function_check backup_directory_to_usb + dest_directory=bdsmail + backup_directory_to_usb $source_directory $dest_directory + + systemctl start bdsmail +} + +function restore_local_bdsmail { + systemctl stop bdsmail + + temp_restore_dir=/root/tempbdsmail + bdsmail_dir=$BDSMAIL_DIR + + function_check restore_directory_from_usb + restore_directory_from_usb $temp_restore_dir bdsmail + if [ -d $temp_restore_dir ]; then + if [ -d cp $temp_restore_dir$bdsmail_dir ]; then + cp -rp $temp_restore_dir$bdsmail_dir $bdsmail_dir/ + else + if [ ! -d $bdsmail_dir ]; then + mkdir $bdsmail_dir + fi + cp -rp $temp_restore_dir/* $bdsmail_dir + fi + chown -R i2psvc:i2psvc $bdsmail_dir + rm -rf $temp_restore_dir + fi + + systemctl start bdsmail +} + +function backup_remote_bdsmail { + systemctl stop bdsmail + + source_directory=$BDSMAIL_DIR + + function_check backup_directory_to_friend + dest_directory=bdsmail + backup_directory_to_friend $source_directory $dest_directory + + systemctl start bdsmail +} + +function restore_remote_bdsmail { + systemctl stop bdsmail + + temp_restore_dir=/root/tempbdsmail + bdsmail_dir=$BDSMAIL_DIR + + function_check restore_directory_from_friend + restore_directory_from_friend $temp_restore_dir bdsmail + if [ -d $temp_restore_dir ]; then + if [ -d cp $temp_restore_dir$bdsmail_dir ]; then + cp -rp $temp_restore_dir$bdsmail_dir $bdsmail_dir/ + else + if [ ! -d $bdsmail_dir ]; then + mkdir $bdsmail_dir + fi + cp -rp $temp_restore_dir/* $bdsmail_dir + fi + chown -R i2psvc:i2psvc $bdsmail_dir + rm -rf $temp_restore_dir + fi + + systemctl start bdsmail +} + +function remove_bdsmail { + if [ -f /etc/systemd/system/bdsmail.service ]; then + systemctl stop bdsmail + systemctl disable bdsmail + rm /etc/systemd/system/bdsmail.service + fi + + for d in /home/*/ ; do + USERNAME=$(echo "$d" | awk -F '/' '{print $3}') + if [[ $(is_valid_user "$USERNAME") == "1" ]]; then + # remove the user from the i2p group + deluser $USERNAME i2psvc + + # Remove mutt folder hook to the i2p config + if [ -f /home/$USERNAME/.muttrc ]; then + if grep -q 'folder-hook !i2p' /home/$USERNAME/.muttrc; then + sed -i '/folder-hook !i2p/d' /home/$USERNAME/.muttrc + fi + if grep -q 'folder-hook i2p' /home/$USERNAME/.muttrc; then + sed -i '/folder-hook i2p/d' /home/$USERNAME/.muttrc + fi + fi + + # Remove folder + if grep -q ' =i2p' /home/$USERNAME/.muttrc; then + sed -i 's| =i2p||g' /home/$USERNAME/.muttrc + fi + + # NOTE: leave Maildir/i2p/cur. We might want to archive that + # or just be reinstalling the system without losing mail + rm -rf /home/$USERNAME/Maildir/i2p/new + fi + done + + remove_i2p + remove_app bdsmail + remove_completion_param install_bdsmail + sed -i '/bdsmail/d' $COMPLETION_FILE + rm -rf /etc/skel/.mutt + if [ -d $BDSMAIL_DIR ]; then + rm -rf $BDSMAIL_DIR + fi + rm /usr/bin/bdsmail_domain + sed -i '/bdsmail_distribute/d' /etc/crontab + rm /usr/bin/bdsmail_distribute + if [ -f /etc/skel/.mutt/bdsmail ]; then + rm /etc/skel/.mutt/bdsmail + fi +} + +function install_bdsmail { + if [ -d $BDSMAIL_DIR ]; then + remove_bdsmail + fi + + if [ -d /repos/bdsmail ]; then + mkdir $BDSMAIL_DIR + cp -r -p /repos/bdsmail/. $BDSMAIL_DIR + cd $BDSMAIL_DIR + git pull + else + git_clone $BDSMAIL_REPO $BDSMAIL_DIR + fi + + if [ ! -d $BDSMAIL_DIR ]; then + echo $'Unable to clone bdsmail repo' + exit 5735735 + fi + + cd $BDSMAIL_DIR + git checkout $BDSMAIL_COMMIT -b $BDSMAIL_COMMIT + set_completion_param "bdsmail commit" "$BDSMAIL_COMMIT" + + mkdir -p $BDSMAIL_DIR/Maildir/i2p + chmod -R 700 $BDSMAIL_DIR/Maildir + + make GOROOT=/home/go/go${GO_VERSION} + if [ ! -f $BDSMAIL_DIR/bin/bdsconfig ]; then + echo $'Unable to make bdsmail' + exit 87923567842 + fi + + install_i2p + i2p_enable_sam + + # create configuration file + $BDSMAIL_DIR/bin/bdsconfig > $BDSMAIL_DIR/config.ini + echo '[maild]' > $BDSMAIL_DIR/config.ini + echo "i2paddr = 127.0.0.1:$I2P_SAM_PORT" >> $BDSMAIL_DIR/config.ini + echo 'i2pkeyfile = bdsmail-privkey.dat' >> $BDSMAIL_DIR/config.ini + echo "bindmail = 127.0.0.1:$I2P_SMTP_PORT" >> $BDSMAIL_DIR/config.ini + echo 'bindweb = 127.0.0.1:8489' >> $BDSMAIL_DIR/config.ini + echo 'bindpop3 = 127.0.0.1:1110' >> $BDSMAIL_DIR/config.ini + echo 'domain = localhost' >> $BDSMAIL_DIR/config.ini + echo 'maildir = Maildir/i2p' >> $BDSMAIL_DIR/config.ini + echo 'database = localhost.sqlite' >> $BDSMAIL_DIR/config.ini + echo 'assets = contrib/assets/web' >> $BDSMAIL_DIR/config.ini + + echo '[Unit]' > /etc/systemd/system/bdsmail.service + echo 'Description=bdsmail' >> /etc/systemd/system/bdsmail.service + echo 'After=syslog.target' >> /etc/systemd/system/bdsmail.service + echo 'After=network.target' >> /etc/systemd/system/bdsmail.service + echo '' >> /etc/systemd/system/bdsmail.service + echo '[Service]' >> /etc/systemd/system/bdsmail.service + echo 'Type=simple' >> /etc/systemd/system/bdsmail.service + echo 'User=i2psvc' >> /etc/systemd/system/bdsmail.service + echo 'Group=i2psvc' >> /etc/systemd/system/bdsmail.service + echo "WorkingDirectory=$BDSMAIL_DIR" >> /etc/systemd/system/bdsmail.service + echo "ExecStart=$BDSMAIL_DIR/bin/maild $BDSMAIL_DIR/config.ini" >> /etc/systemd/system/bdsmail.service + echo 'Restart=always' >> /etc/systemd/system/bdsmail.service + echo 'Environment="USER=i2psvc"' >> /etc/systemd/system/bdsmail.service + echo '' >> /etc/systemd/system/bdsmail.service + echo '[Install]' >> /etc/systemd/system/bdsmail.service + echo 'WantedBy=multi-user.target' >> /etc/systemd/system/bdsmail.service + + echo '#!/usr/bin/env python2' > $BDSMAIL_DIR/get_address + echo 'import base64, hashlib, sys' >> $BDSMAIL_DIR/get_address + echo 'with open(sys.argv[1]) as f:' >> $BDSMAIL_DIR/get_address + echo " print(base64.b32encode(hashlib.sha256(base64.b64decode(f.read(516), '-~')).digest()).strip('=')+\".b32.i2p\")" >> $BDSMAIL_DIR/get_address + chmod +x $BDSMAIL_DIR/get_address + + chown -R i2psvc:i2psvc $BDSMAIL_DIR + systemctl enable bdsmail + systemctl start bdsmail + + echo '#!/bin/bash' > /usr/bin/bdsmail_distribute + echo "BDSMAIL_DIR=$BDSMAIL_DIR" >> /usr/bin/bdsmail_distribute + echo "MAIL_DIR=\$BDSMAIL_DIR/\$(cat \$BDSMAIL_DIR/config.ini | grep 'maildir =' | awk -F ' ' '{print \$3}')" >> /usr/bin/bdsmail_distribute + echo 'if [ ! -d $MAIL_DIR/postmaster/new ]; then' >> /usr/bin/bdsmail_distribute + echo ' exit 0' >> /usr/bin/bdsmail_distribute + echo 'fi' >> /usr/bin/bdsmail_distribute + echo 'for filename in $MAIL_DIR/postmaster/new/*; do' >> /usr/bin/bdsmail_distribute + echo ' to_line=$(cat $filename | grep "To: " | head -n 1)' >> /usr/bin/bdsmail_distribute + echo " to_username=\$(echo \"\$to_line\" | awk -F ' ' '{print \$2}' | awk -F '@' '{print \$1}')" >> /usr/bin/bdsmail_distribute + echo ' if [ -d /home/$to_username/Maildir/i2p/new ]; then' >> /usr/bin/bdsmail_distribute + echo ' chown $to_username:$to_username $filename' >> /usr/bin/bdsmail_distribute + echo ' chmod 600 $filename' >> /usr/bin/bdsmail_distribute + echo ' mv $filename /home/$to_username/Maildir/i2p/new' >> /usr/bin/bdsmail_distribute + echo ' fi' >> /usr/bin/bdsmail_distribute + echo 'done' >> /usr/bin/bdsmail_distribute + chmod +x /usr/bin/bdsmail_distribute + + if ! grep -q 'bdsmail_distribute' /etc/crontab; then + echo '*/1 * * * * root /usr/bin/bdsmail_distribute 2> /dev/null' >> /etc/crontab + fi + + echo '#!/bin/bash' > /usr/bin/bdsmail_domain + echo "cd $BDSMAIL_DIR" >> /usr/bin/bdsmail_domain + echo 'if [ ! -f bdsmail-privkey.dat ]; then' >> /usr/bin/bdsmail_domain + echo ' exit 1' >> /usr/bin/bdsmail_domain + echo 'fi' >> /usr/bin/bdsmail_domain + echo "python2 get_address bdsmail-privkey.dat | tr '[:upper:]' '[:lower:]'" >> /usr/bin/bdsmail_domain + chmod +x /usr/bin/bdsmail_domain + + echo '' + echo $'Now we will wait for i2p to connect and a private key to be generated' + echo $'This may take a while.' + echo '' + + bdsmail_wait_for_key_generation + + if [ ! $bds_domain ]; then + systemctl stop bdsmail + systemctl disable bdsmail + remove_i2p + echo $'Failed to get the bdsmail domain' + exit 8934638 + fi + + bdsmail_admin_password="$(create_password ${MINIMUM_PASSWORD_LENGTH})" + ${PROJECT_NAME}-pass -u $MY_USERNAME -a bdsmail -p "$bdsmail_admin_password" + $BDSMAIL_DIR/bin/mailtool $BDSMAIL_DIR/config.ini admin $BDSMAIL_DIR/Maildir/i2p/admin "$bdsmail_admin_password" + + # Create mutt configuration + if [ ! -d /etc/skel/.mutt ]; then + mkdir /etc/skel/.mutt + fi + echo 'set mbox_type=Maildir' > /etc/skel/.mutt/bdsmail + echo "set smtp_url=smtp://admin:${bdsmail_admin_password}@127.0.0.1:$I2P_SMTP_PORT/" >> /etc/skel/.mutt/bdsmail + echo 'set use_from=yes' >> /etc/skel/.mutt/bdsmail + echo "set from=username@${bds_domain}" >> /etc/skel/.mutt/bdsmail + echo "set spoolfile=~/Maildir/i2p" >> /etc/skel/.mutt/bdsmail + echo 'set pgp_autoencrypt=no' >> /etc/skel/.mutt/bdsmail + echo 'set pgp_replyencrypt=no' >> /etc/skel/.mutt/bdsmail + echo 'set pgp_autosign=no' >> /etc/skel/.mutt/bdsmail + echo 'set pgp_replysign=no' >> /etc/skel/.mutt/bdsmail + + # mutt configuration for the admin user + if [ ! -d /home/$MY_USERNAME/.mutt ]; then + mkdir /home/$MY_USERNAME/.mutt + fi + cp /etc/skel/.mutt/bdsmail /home/$MY_USERNAME/.mutt + sed -i "s|username|$MY_USERNAME|g" /home/$MY_USERNAME/.mutt/bdsmail + chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.mutt + + bdsmail_configure_users + + $BDSMAIL_DIR/bin/mailtool $BDSMAIL_DIR/config.ini $MY_USERNAME /home/$MY_USERNAME/Maildir/i2p + + APP_INSTALLED=1 +} + +# NOTE: deliberately there is no "exit 0" diff --git a/src/freedombone-app-peertube b/src/freedombone-app-peertube index 604ba56c..8c360ec9 100755 --- a/src/freedombone-app-peertube +++ b/src/freedombone-app-peertube @@ -51,6 +51,7 @@ peertube_variables=(PEERTUBE_DOMAIN_NAME ONION_ONLY DDNS_PROVIDER MY_USERNAME + ARCHITECTURE MY_EMAIL_ADDRESS) function peertube_create_database { @@ -140,8 +141,8 @@ function peertube_disable_signups { --yesno $"\nDo you wish to disable further PeerTube signups?" 8 75 sel=$? case $sel in - 0) sed "0,/RE/s/enabled:.*/enabled: false/" $PEERTUBE_DIR/config/production.yaml;; - 1) sed "0,/RE/s/enabled:.*/enabled: true/" $PEERTUBE_DIR/config/production.yaml;; + 0) sed -i "0,/enabled:.*/s//enabled: false/" $PEERTUBE_DIR/config/production.yaml;; + 1) sed -i "0,/enabled:.*/s//enabled: true/" $PEERTUBE_DIR/config/production.yaml;; 255) return;; esac @@ -341,9 +342,8 @@ function remove_peertube { sed -i '/peertube/d' $COMPLETION_FILE function_check drop_database_postgresql - drop_database_postgresql peertube + drop_database_postgresql peertube peertube - remove_postgresql_user peertube groupdel -f peertube userdel -r peertube @@ -589,11 +589,12 @@ function peertube_create_config { echo ' size: 10 # Max number of previews you want to cache' >> $peertube_config_file echo '' >> $peertube_config_file echo 'admin:' >> $peertube_config_file - echo " email: 'root@local'" >> $peertube_config_file + # This is deliberately a dummy email address + echo " email: 'testuser@testdomain.net'" >> $peertube_config_file echo '' >> $peertube_config_file echo 'signup:' >> $peertube_config_file echo ' enabled: true' >> $peertube_config_file - echo ' limit: 2 # When the limit is reached, registrations are disabled. -1 == unlimited' >> $peertube_config_file + echo ' limit: 5 # When the limit is reached, registrations are disabled. -1 == unlimited' >> $peertube_config_file echo '' >> $peertube_config_file echo 'user:' >> $peertube_config_file echo ' # Default value of maximum video BYTES the user can upload (does not take into account transcoded files).' >> $peertube_config_file @@ -829,6 +830,12 @@ function install_peertube { systemctl start peertube systemctl restart nginx + # wait for the database to get generated after initial peertube daemon start + sleep 10 + + # update the admin email address after creation of the database + sed -i "s|email: .*|email: '$MY_EMAIL_ADDRESS'|g" $PEERTUBE_DIR/config/production.yaml + set_completion_param "peertube domain" "$PEERTUBE_DOMAIN_NAME" APP_INSTALLED=1 } diff --git a/src/freedombone-app-rss b/src/freedombone-app-rss index 4639c71b..4e31eb75 100755 --- a/src/freedombone-app-rss +++ b/src/freedombone-app-rss @@ -428,7 +428,11 @@ function install_rss_main { echo ' deny all;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME echo ' }' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME echo '' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME - echo ' add_header X-Frame-Options DENY;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME + echo ' add_header X-XSS-Protection "1; mode=block";' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME + echo ' add_header X-Robots-Tag none;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME + echo ' add_header X-Download-Options noopen;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME + echo ' add_header X-Permitted-Cross-Domain-Policies none;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME + echo ' add_header X-Frame-Options SAMEORIGIN;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME echo ' add_header X-Content-Type-Options nosniff;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME echo ' client_max_body_size 15m;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME echo '}' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME @@ -482,7 +486,11 @@ function install_rss_main { echo ' deny all;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME echo ' }' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME echo '' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME - echo ' add_header X-Frame-Options DENY;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME + echo ' add_header X-XSS-Protection "1; mode=block";' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME + echo ' add_header X-Robots-Tag none;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME + echo ' add_header X-Download-Options noopen;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME + echo ' add_header X-Permitted-Cross-Domain-Policies none;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME + echo ' add_header X-Frame-Options SAMEORIGIN;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME echo ' add_header X-Content-Type-Options nosniff;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME echo ' client_max_body_size 15m;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME echo '}' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME diff --git a/src/freedombone-backup-local b/src/freedombone-backup-local index b324a444..482f6162 100755 --- a/src/freedombone-backup-local +++ b/src/freedombone-backup-local @@ -13,7 +13,7 @@ # License # ======= # -# Copyright (C) 2015-2016 Bob Mottram +# Copyright (C) 2015-2018 Bob Mottram # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as published by @@ -177,6 +177,10 @@ function backup_users { fi backup_directory_to_usb /home/$USERNAME/tempbackup mutt/$USERNAME fi + if [ -d /home/$USERNAME/.mutt ]; then + echo $"Backing up Mutt configurations for $USERNAME" + backup_directory_to_usb /home/$USERNAME/.mutt mutt/${USERNAME}configs + fi # Backup email if [ -d /home/$USERNAME/Maildir ]; then diff --git a/src/freedombone-backup-remote b/src/freedombone-backup-remote index bb76192c..69e3f529 100755 --- a/src/freedombone-backup-remote +++ b/src/freedombone-backup-remote @@ -231,6 +231,10 @@ function backup_users { fi backup_directory_to_friend /home/$USERNAME/tempbackup mutt/$USERNAME fi + if [ -d /home/$USERNAME/.mutt ]; then + echo $"Backing up Mutt configurations for $USERNAME" + backup_directory_to_friend /home/$USERNAME/.mutt mutt/${USERNAME}configs + fi # procmail settings if [ -f /home/$USERNAME/.procmailrc ]; then diff --git a/src/freedombone-controlpanel-user b/src/freedombone-controlpanel-user index 6940a81d..4dd58a70 100755 --- a/src/freedombone-controlpanel-user +++ b/src/freedombone-controlpanel-user @@ -882,6 +882,20 @@ function menu_run_client_app { fi } +function show_your_email_address { + GPG_FINGERPRINT=$(gpg --fingerprint $GPG_ID | sed -n '2p' | sed 's/^[ \t]*//') + GPG_DATE=$(gpg --fingerprint $GPG_ID | grep -i "pub" | head -n 1 | awk -F ' ' '{print $3}') + if [ ! -d /etc/bdsmail ]; then + dialog --title $"Show your Email Address" \ + --backtitle $"Freedombone User Control Panel" \ + --msgbox $"Email Address: $MY_EMAIL_ADDRESS\n\nKey ID: $GPG_ID\n\nFingerprint: $GPG_FINGERPRINT\n\nCreated: $GPG_DATE" 12 70 + else + dialog --title $"Show your Email Address" \ + --backtitle $"Freedombone User Control Panel" \ + --msgbox $"\nYou can press SHIFT and then drag the mouse and right click to copy.\n\nEmail Address: $MY_EMAIL_ADDRESS\n\nKey ID: $GPG_ID\n\nFingerprint: $GPG_FINGERPRINT\n\nCreated: $GPG_DATE\n\nI2P Address: ${USER}@$(bdsmail_domain)" 17 90 + fi +} + function menu_top_level { while true do @@ -889,16 +903,17 @@ function menu_top_level { trap "rm -f $data" 0 1 2 5 15 dialog --backtitle $"Freedombone User Control Panel" \ --title $"User Control Panel" \ - --radiolist $"Choose an operation:" 19 50 12 \ + --radiolist $"Choose an operation:" 20 60 13 \ 1 $"Use Email" off \ - 2 $"Change Email Filtering Rules" off \ - 3 $"Run an App" off \ - 4 $"Browse the Web" off \ - 5 $"My Encryption Keys" off \ - 6 $"Set an outgoing email proxy" off \ - 7 $"Administrator controls" off \ - 8 $"Exit to the command line" off \ - 9 $"Log out" on 2> $data + 2 $"Show your Email Address" off \ + 3 $"Change Email Filtering/Blocking Rules" off \ + 4 $"Run an App" off \ + 5 $"Browse the Web" off \ + 6 $"My Encryption Keys" off \ + 7 $"Set an outgoing email proxy" off \ + 8 $"Administrator controls" off \ + 9 $"Exit to the command line" off \ + 10 $"Log out" on 2> $data sel=$? case $sel in 1) rm $data @@ -908,15 +923,16 @@ function menu_top_level { esac case $(cat $data) in 1) mutt;; - 2) menu_email;; - 3) menu_run_client_app;; - 4) torify elinks -no-home;; - 5) menu_encryption_keys;; - 6) smtp_proxy;; - 7) menu_admin;; - 8) rm $data + 2) show_your_email_address;; + 3) menu_email;; + 4) menu_run_client_app;; + 5) torify elinks -no-home;; + 6) menu_encryption_keys;; + 7) smtp_proxy;; + 8) menu_admin;; + 9) rm $data break;; - 9) kill -HUP `pgrep -s 0 -o`;; + 10) kill -HUP `pgrep -s 0 -o`;; esac rm $data done diff --git a/src/freedombone-image-customise b/src/freedombone-image-customise index 9611b450..1a1cefe0 100755 --- a/src/freedombone-image-customise +++ b/src/freedombone-image-customise @@ -1946,6 +1946,7 @@ function image_preinstall_repos { git clone $PEERTUBE_REPO $rootdir/repos/peertube git clone $PRIVATEBIN_REPO $rootdir/repos/privatebin git clone $EDITH_REPO $rootdir/repos/edith + git clone $BDSMAIL_REPO $rootdir/repos/bdsmail #git clone $WEKAN_REPO $rootdir/repos/wekan #git clone $FLOW_ROUTER_REPO $rootdir/repos/flowrouter #git clone $METEOR_USERACCOUNTS_REPO $rootdir/repos/meteoruseraccounts diff --git a/src/freedombone-restore-local b/src/freedombone-restore-local index 62e1e3a9..bacbe5cb 100755 --- a/src/freedombone-restore-local +++ b/src/freedombone-restore-local @@ -404,10 +404,18 @@ function restore_mutt_settings { if [ -d $USB_MOUNT/backup/mutt ]; then for d in $USB_MOUNT/backup/mutt/*/ ; do USERNAME=$(echo "$d" | awk -F '/' '{print $6}') + + # skip over configurations + if [[ "$USERNAME" == *'configs' ]]; then + continue + fi + if [[ $(is_valid_user "$USERNAME") == "1" ]]; then if [ ! -d /home/$USERNAME ]; then ${PROJECT_NAME}-adduser $USERNAME fi + echo $"Restoring Mutt configurations for $USERNAME" + restore_directory_from_usb /home/$USERNAME/.mutt mutt/${USERNAME}configs echo $"Restoring Mutt settings for $USERNAME" temp_restore_dir=/root/tempmutt restore_directory_from_usb $temp_restore_dir mutt/$USERNAME diff --git a/src/freedombone-restore-remote b/src/freedombone-restore-remote index b7d55782..61226fdc 100755 --- a/src/freedombone-restore-remote +++ b/src/freedombone-restore-remote @@ -360,11 +360,19 @@ function restore_mutt_settings { fi for d in $SERVER_DIRECTORY/backup/mutt/*/ ; do USERNAME=$(echo "$d" | awk -F '/' '{print $6}') + + # skip over configurations + if [[ "$USERNAME" == *'configs' ]]; then + continue + fi + if [[ $(is_valid_user "$USERNAME") == "1" ]]; then if [ -d $SERVER_DIRECTORY/backup/mutt/$USERNAME ]; then if [ ! -d /home/$USERNAME ]; then ${PROJECT_NAME}-adduser $USERNAME fi + echo $"Restoring Mutt configurations for $USERNAME" + restore_directory_from_friend /home/$USERNAME/.mutt mutt/${USERNAME}configs echo $"Restoring Mutt settings for $USERNAME" temp_restore_dir=/root/tempmutt restore_directory_from_friend ${temp_restore_dir} mutt/$USERNAME diff --git a/src/freedombone-tests b/src/freedombone-tests index 7eb69270..123fff5b 100755 --- a/src/freedombone-tests +++ b/src/freedombone-tests @@ -892,6 +892,12 @@ function test_stig { output "SV-86927r2_rule" $? ${SETLANG} ################ + ##Check that pam_python is not installed + bash $STIG_TESTS_DIR/check-ssh.sh pam_python >/dev/null 2>&1 & + stig_spinner $! + output "SV-86724r2_rule" $? ${SETLANG} + ################ + ##RHEL-06-000247 ##The system clock must be synchronized continuously, or at least daily. diff --git a/src/freedombone-utils-firewall b/src/freedombone-utils-firewall index 8c429973..2359fbe4 100755 --- a/src/freedombone-utils-firewall +++ b/src/freedombone-utils-firewall @@ -265,7 +265,7 @@ function configure_internet_protocol { if ! grep -q "ignore pings" /etc/sysctl.conf; then echo '# ignore pings' >> /etc/sysctl.conf echo 'net.ipv4.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf - echo 'net.ipv6.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf + #echo 'net.ipv6.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf fi if ! grep -q "disable ipv6" /etc/sysctl.conf; then echo '# disable ipv6' >> /etc/sysctl.conf diff --git a/src/freedombone-utils-go b/src/freedombone-utils-go index 9595f4ca..b927b044 100755 --- a/src/freedombone-utils-go +++ b/src/freedombone-utils-go @@ -32,7 +32,7 @@ # before getting to the version we want GO_INTERMEDIATE_VERSION=1.4.2 -GO_VERSION=1.9 +GO_VERSION=1.9.4 GO_REPO="https://go.googlesource.com/go" GO_PACKAGE_MANAGER_REPO="https://github.com/gpmgo/gopm" diff --git a/src/freedombone-utils-i2p b/src/freedombone-utils-i2p new file mode 100755 index 00000000..d3ef3163 --- /dev/null +++ b/src/freedombone-utils-i2p @@ -0,0 +1,101 @@ +#!/bin/bash +# +# .---. . . +# | | | +# |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-. +# | | (.-' (.-' ( | ( )| | | | )( )| | (.-' +# ' ' --' --' -' - -' ' ' -' -' -' ' - --' +# +# Freedom in the Cloud +# +# i2p functions +# +# There's a problem with installing this onto mesh images, which is +# that qemu appears to run out of RAM when using yarn to add webpack. +# +# License +# ======= +# +# Copyright (C) 2017-2018 Bob Mottram +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +I2P_DOMAIN='deb.i2p2.de' + +function install_i2p { + if [ ! -d $INSTALL_DIR ]; then + mkdir -p $INSTALL_DIR + fi + + # install the gpg key + cd $INSTALL_DIR + if [ -f i2p-debian-repo.key.asc ]; then + rm i2p-debian-repo.key.asc + fi + wget https://geti2p.net/_static/i2p-debian-repo.key.asc + if [ ! -f i2p-debian-repo.key.asc ]; then + echo $'failed to ontain i2p repo gpg key' + exit 7834627345 + fi + apt-key add i2p-debian-repo.key.asc + + echo "deb https://${I2P_DOMAIN}/ stretch main" > /etc/apt/sources.list.d/i2p.list + echo "deb-src https://${I2P_DOMAIN}/ stretch main" >> /etc/apt/sources.list.d/i2p.list + + # i2p needs ipv6 to be enabled + sed -i 's|net.ipv6.conf.all.disable_ipv6.*|net.ipv6.conf.all.disable_ipv6 = 0|g' /etc/sysctl.conf + /sbin/sysctl -p -q + + apt-get update + apt-get -yq install i2p i2p-keyring + systemctl restart i2p +} + +function remove_i2p { + apt-get -yq remove i2p-router --purge + apt-get -yq remove i2p --purge + apt-get -yq remove i2p-keyring --purge + apt-get -yq autoremove + + # It's assumed here that ipv6 is only needed for i2p + # This might not be true in future + sed -i 's|net.ipv6.conf.all.disable_ipv6.*|net.ipv6.conf.all.disable_ipv6 = 1|g' /etc/sysctl.conf + /sbin/sysctl -p -q + + if [ -d /var/lib/i2p ]; then + rm -rf /var/lib/i2p + fi + if [ -d /etc/i2p ]; then + rm -rf /etc/i2p + fi + if [ -d /usr/share/i2p ]; then + rm -rf /usr/share/i2p + fi +} + +function i2p_enable_sam { + if [ ! -f /var/lib/i2p/i2p-config/clients.config ]; then + apt-get -yq remove i2p --purge + apt-get -yq remove i2p-router --purge + apt-get -yq install i2p + apt-get -yq install i2p-router + sleep 2 + fi + if [ ! -f /var/lib/i2p/i2p-config/clients.config ]; then + echo $'File not found /var/lib/i2p/i2p-config/clients.config' + exit 483648364834 + fi + sed -i 's|clientApp.1.startOnLoad=.*|clientApp.1.startOnLoad=true|g' /var/lib/i2p/i2p-config/clients.config + systemctl restart i2p +} diff --git a/src/freedombone-utils-nodejs b/src/freedombone-utils-nodejs index c3cc8486..a8ec2935 100755 --- a/src/freedombone-utils-nodejs +++ b/src/freedombone-utils-nodejs @@ -205,7 +205,7 @@ function upgrade_nodejs { npm upgrade -g n@${NODEJS_N_VERSION} --save fi if [[ "$CURR_NODE_VERSION" != "v${NODEJS_VERSION}" ]]; then - n {NODEJS_VERSION} + n ${NODEJS_VERSION} fi cp /usr/local/bin/n /usr/bin/n if [ -f /usr/local/bin/npm ]; then diff --git a/src/freedombone-utils-postgresql b/src/freedombone-utils-postgresql index c41b6e31..e8be209b 100755 --- a/src/freedombone-utils-postgresql +++ b/src/freedombone-utils-postgresql @@ -124,8 +124,12 @@ function remove_postgresql_user { function drop_database_postgresql { database_name="$1" + database_owner_name="$2" cd /etc/postgresql sudo -u postgres psql -c "drop database $database_name" + if [ ${#database_owner_name} -gt 0 ]; then + sudo -u postgres psql -c "drop user $database_owner_name" + fi } function run_system_query_postgresql { diff --git a/tests/check-ssh.sh b/tests/check-ssh.sh index 699d943c..38003d0a 100644 --- a/tests/check-ssh.sh +++ b/tests/check-ssh.sh @@ -194,4 +194,9 @@ case $1 in exit 1 fi ;; + pam_python) + if grep -q 'pam_python' /etc/pam.d/sshd; then + exit 1 + fi + ;; esac diff --git a/tests/output.sh b/tests/output.sh index a94c2e3d..8133a4c4 100644 --- a/tests/output.sh +++ b/tests/output.sh @@ -119,6 +119,11 @@ Check_content: Verify the SSH private host key files have mode "0600" or less pe printf '\n######################\n\nThis system is not intended to support graphical output\n\n######################\n\n' >> $LOG fi ;; + SV-86724r2_rule) log_msg $2 'Dont allow pam_python.' + if [ $2 -ne 0 ];then + printf '\n######################\n\npam_python within /etc/pam.d/sshd could indicate a possible attack on ssh logins.\n\n######################\n\n' >> $LOG + fi + ;; V-38455) if [ "$3" = "en" ]; then log_msg $2 'The system must use a separate file system for /tmp.' else diff --git a/website/EN/armbian.html b/website/EN/armbian.html index 9a461d3a..ce00da54 100644 --- a/website/EN/armbian.html +++ b/website/EN/armbian.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + @@ -326,7 +326,8 @@ Then clone the Freedombone repository and checkout the stretch development branc

-
git clone https://github.com/bashrc/freedombone
+
apt-get -y install git dialog build-essential
+git clone https://github.com/bashrc/freedombone
 cd freedombone
 git checkout stretch
 
diff --git a/website/EN/beaglebone.html b/website/EN/beaglebone.html index 23060e4c..dddba8f8 100644 --- a/website/EN/beaglebone.html +++ b/website/EN/beaglebone.html @@ -3,10 +3,10 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + - +
-
sudo apt-get install git
+
sudo apt-get install git dialog build-essential
 git clone https://github.com/bashrc/freedombone
 cd freedombone
 git checkout stretch
 sudo make install
 freedombone-image --setup debian
-
+

@@ -300,13 +300,13 @@ Or on Arch/Parabola:

-
sudo pacman -S git
+
sudo pacman -S git dialog
 git clone https://github.com/bashrc/freedombone
 cd freedombone
 git checkout stretch
 sudo make install
 freedombone-image --setup parabola
-
+
diff --git a/website/EN/homeserver.html b/website/EN/homeserver.html index 42475f8a..cfbda0ed 100644 --- a/website/EN/homeserver.html +++ b/website/EN/homeserver.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + @@ -256,7 +256,7 @@ First install freedombone onto your local system (not the target hardware that y

-
sudo apt-get install git
+
sudo apt-get install git dialog build-essential
 git clone https://github.com/bashrc/freedombone
 cd freedombone
 git checkout stretch
@@ -271,7 +271,7 @@ Or on Arch/Parabola:
 

-
sudo pacman -S git
+
sudo pacman -S git dialog
 git clone https://github.com/bashrc/freedombone
 cd freedombone
 git checkout stretch