#!/bin/bash # _____ _ _ # | __|___ ___ ___ _| |___ _____| |_ ___ ___ ___ # | __| _| -_| -_| . | . | | . | . | | -_| # |__| |_| |___|___|___|___|_|_|_|___|___|_|_|___| # # Freedom in the Cloud # # SKS Keyserver # # License # ======= # # Copyright (C) 2017-2018 Bob Mottram # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . VARIANTS='full full-vim' IN_DEFAULT_INSTALL=0 SHOW_ON_ABOUT=1 KEYSERVER_WEB_REPO="https://github.com/mattrude/pgpkeyserver-lite" KEYSERVER_WEB_COMMIT='a038cb79b927c99bf7da62f20d2c6a2f20374339' KEYSERVER_PORT=11371 KEYSERVER_ONION_PORT=8122 KEYSERVER_DOMAIN_NAME= KEYSERVER_CODE= keyserver_variables=(ONION_ONLY MY_USERNAME DEFAULT_DOMAIN_NAME KEYSERVER_DOMAIN_NAME KEYSERVER_CODE) function check_keyserver_directory_size { dirsize=$(du /var/lib/sks/DB | awk -F ' ' '{print $1}') # 500M if [ "$dirsize" -gt 500000 ]; then echo "1" return fi echo "0" } function keyserver_watchdog { ADMIN_USERNAME=$(grep "Admin user" "$COMPLETION_FILE" | awk -F ':' '{print $2}') ADMIN_EMAIL_ADDRESS=${ADMIN_USERNAME}@${HOSTNAME} keyserver_size_warning=$"The SKS keyserver database is getting large. Check that you aren't being spammed" keyserver_disabled_warning=$"The SKS keyserver has been disabled because it is getting too large. This is to prevent flooding attacks from crashing the server. You may need to restore the keyserver from backup." keyserver_mail_subject_line=$"${PROJECT_NAME} keyserver warning" keyserver_mail_subject_line_disabled=$"${PROJECT_NAME} keyserver disabled" read_config_param KEYSERVER_DOMAIN_NAME # check database size hourly keyserver_watchdog_script=/tmp/keyserver-watchdog { echo '#!/bin/bash'; echo "dirsize=\$(du /var/lib/sks/DB | awk -F ' ' '{print \$1}')"; echo "if [ \$dirsize -gt 450000 ]; then"; echo " echo \"$keyserver_size_warning\" | mail -s \"$keyserver_mail_subject_line\" $ADMIN_EMAIL_ADDRESS"; echo " if [ \$dirsize -gt 500000 ]; then"; echo " nginx_dissite $KEYSERVER_DOMAIN_NAME"; echo ' systemctl stop sks'; echo ' systemctl disable sks'; echo " echo \"$keyserver_disabled_warning\" | mail -s \"$keyserver_mail_subject_line_disabled\" $ADMIN_EMAIL_ADDRESS"; echo ' fi'; echo 'fi'; } > $keyserver_watchdog_script chmod +x $keyserver_watchdog_script if [ ! -f /etc/cron.hourly/keyserver-watchdog ]; then cp $keyserver_watchdog_script /etc/cron.hourly/keyserver-watchdog else HASH1=$(sha256sum $keyserver_watchdog_script | awk -F ' ' '{print $1}') HASH2=$(sha256sum /etc/cron.hourly/keyserver-watchdog | awk -F ' ' '{print $1}') if [[ "$HASH1" != "$HASH2" ]]; then cp $keyserver_watchdog_script /etc/cron.hourly/keyserver-watchdog fi fi rm $keyserver_watchdog_script } function configure_firewall_for_keyserver { if [[ $ONION_ONLY != "no" ]]; then return fi firewall_add keyserver 11370 tcp firewall_add keyserver 11371 tcp firewall_add keyserver 11372 tcp mark_completed "${FUNCNAME[0]}" } function keyserver_reset_database { if [ -d /var/lib/sks/DB ]; then rm -rf /var/lib/sks/DB fi sks build chown -Rc debian-sks: /var/lib/sks systemctl restart sks } function logging_on_keyserver { echo -n '' } function logging_off_keyserver { echo -n '' } function reconfigure_keyserver { echo -n '' } function upgrade_keyserver { keyserver_watchdog CURR_KEYSERVER_WEB_COMMIT=$(get_completion_param "keyserver web commit") if [[ "$CURR_KEYSERVER_WEB_COMMIT" == "$KEYSERVER_WEB_COMMIT" ]]; then return fi if grep -q "keyserver domain" "$COMPLETION_FILE"; then KEYSERVER_DOMAIN_NAME=$(get_completion_param "keyserver domain") fi # update to the next commit function_check set_repo_commit set_repo_commit "/var/www/$KEYSERVER_DOMAIN_NAME/htdocs" "keyserver web commit" "$KEYSERVER_WEB_COMMIT" $KEYSERVER_WEB_REPO read_config_param MY_USERNAME USER_EMAIL_ADDRESS="$MY_USERNAME@$HOSTNAME" GPG_ID=$(su -m root -c "gpg --list-keys \"$USER_EMAIL_ADDRESS\" | sed -n '2p' | sed 's/^[ \\t]*//'" - "$MY_USERNAME") if [ ! "$GPG_ID" ]; then echo $'No GPG ID for admin user' exit 846336 fi if [ ${#GPG_ID} -lt 5 ]; then echo $'GPG ID not retrieved for admin user' exit 835292 fi if [[ "$GPG_ID" == *"error"* ]]; then echo $'GPG ID not retrieved for admin user due to error' exit 74825 fi sed -i "s|###ENTERPUBLICKEYHERE###|$GPG_ID|g" "/var/www/$KEYSERVER_DOMAIN_NAME/htdocs/404.html" sed -i "s|###ENTERPUBLICKEYHERE###|$GPG_ID|g" "/var/www/$KEYSERVER_DOMAIN_NAME/htdocs/index.html" sed -i "s|###ENTERNAMEHERE###|$USER_EMAIL_ADDRESS|g" "/var/www/$KEYSERVER_DOMAIN_NAME/htdocs/404.html" sed -i "s|###ENTERNAMEHERE###|$USER_EMAIL_ADDRESS|g" "/var/www/$KEYSERVER_DOMAIN_NAME/htdocs/index.html" chown -R www-data:www-data "/var/www/$KEYSERVER_DOMAIN_NAME/htdocs" } function backup_local_keyserver { # remove any unused log files cd /var/lib/sks/DB || exit 2468245 db_archive -d source_directory=/etc/sks if [ -d $source_directory ]; then systemctl stop sks dest_directory=keyserverconfig function_check backup_directory_to_usb backup_directory_to_usb $source_directory $dest_directory systemctl start sks fi if [[ "$(check_keyserver_directory_size)" != "0" ]]; then echo $'WARNING: Keyserver database size is too large to backup' return fi source_directory=/var/lib/sks/DB if [ -d $source_directory ]; then systemctl stop sks dest_directory=keyserver function_check backup_directory_to_usb backup_directory_to_usb $source_directory $dest_directory systemctl start sks fi } function restore_local_keyserver { if [ ! -d /var/lib/sks/DB ]; then return fi echo $"Restoring SKS Keyserver" systemctl stop sks temp_restore_dir=/root/tempkeyserverconfig function_check restore_directory_from_usb restore_directory_from_usb $temp_restore_dir keyserverconfig if [ -d $temp_restore_dir/etc/sks ]; then cp -r $temp_restore_dir/etc/sks/* /etc/sks/ else cp -r $temp_restore_dir/* /etc/sks/ fi rm -rf $temp_restore_dir chown -Rc debian-sks: /etc/sks/sksconf chown -Rc debian-sks: /etc/sks/mailsync temp_restore_dir=/root/tempkeyserver function_check restore_directory_from_usb restore_directory_from_usb $temp_restore_dir keyserver mv /var/lib/sks/DB /var/lib/sks/DB_prev if [ -d $temp_restore_dir/var/lib/sks/DB ]; then cp -r $temp_restore_dir/var/lib/sks/DB /var/lib/sks/DB else if [ ! -d /var/lib/sks/DB ]; then mkdir /var/lib/sks/DB fi cp -r $temp_restore_dir/* /var/lib/sks/DB fi # shellcheck disable=SC2181 if [ ! "$?" = "0" ]; then # restore the old database rm -rf /var/lib/sks/DB mv /var/lib/sks/DB_prev /var/lib/sks/DB rm -rf $temp_restore_dir function_check set_user_permissions set_user_permissions function_check backup_unmount_drive backup_unmount_drive exit 5627294 fi rm -rf $temp_restore_dir chown -Rc debian-sks: /var/lib/sks # remove the old database rm -rf /var/lib/sks/DB_prev systemctl enable sks systemctl start sks nginx_ensite "$KEYSERVER_DOMAIN_NAME" } function backup_remote_keyserver { # remove any unused log files cd /var/lib/sks/DB || exit 734624 db_archive -d source_directory=/etc/sks if [ -d $source_directory ]; then systemctl stop sks dest_directory=keyserverconfig function_check backup_directory_to_friend backup_directory_to_friend $source_directory $dest_directory systemctl start sks fi if [[ "$(check_keyserver_directory_size)" != "0" ]]; then echo $'WARNING: Keyserver database size is too large to backup' return fi source_directory=/var/lib/sks/DB if [ -d $source_directory ]; then systemctl stop sks dest_directory=keyserver function_check backup_directory_to_friend backup_directory_to_friend $source_directory $dest_directory systemctl start sks fi } function restore_remote_keyserver { if [ ! -d /var/lib/sks/DB ]; then return fi echo $"Restoring SKS Keyserver" systemctl stop sks temp_restore_dir=/root/tempkeyserverconfig function_check restore_directory_from_friend restore_directory_from_friend $temp_restore_dir keyserverconfig if [ -d $temp_restore_dir/etc/sks ]; then cp -r $temp_restore_dir/etc/sks/* /etc/sks/ else cp -r $temp_restore_dir/* /etc/sks/ fi rm -rf $temp_restore_dir chown -Rc debian-sks: /etc/sks/sksconf chown -Rc debian-sks: /etc/sks/mailsync temp_restore_dir=/root/tempkeyserver function_check restore_directory_from_friend restore_directory_from_friend $temp_restore_dir keyserver mv /var/lib/sks/DB /var/lib/sks/DB_prev if [ -d $temp_restore_dir/var/lib/sks/DB ]; then cp -r $temp_restore_dir/var/lib/sks/DB /var/lib/sks/DB else if [ ! -d /var/lib/sks/DB ]; then mkdir /var/lib/sks/DB fi cp -r $temp_restore_dir/* /var/lib/sks/DB fi # shellcheck disable=SC2181 if [ ! "$?" = "0" ]; then # restore the old database rm -rf /var/lib/sks/DB mv /var/lib/sks/DB_prev /var/lib/sks/DB rm -rf $temp_restore_dir function_check set_user_permissions set_user_permissions return fi rm -rf $temp_restore_dir chown -Rc debian-sks: /var/lib/sks # remove the old database rm -rf /var/lib/sks/DB_prev systemctl enable sks systemctl start sks nginx_ensite "$KEYSERVER_DOMAIN_NAME" } function remove_keyserver { systemctl stop sks if [ -f /etc/cron.hourly/keyserver-watchdog ]; then rm /etc/cron.hourly/keyserver-watchdog fi apt-get -qy remove sks dirmngr read_config_param "KEYSERVER_DOMAIN_NAME" nginx_dissite "$KEYSERVER_DOMAIN_NAME" remove_certs "${KEYSERVER_DOMAIN_NAME}" if [ -f "/etc/nginx/sites-available/$KEYSERVER_DOMAIN_NAME" ]; then rm -f "/etc/nginx/sites-available/$KEYSERVER_DOMAIN_NAME" fi if [ -d "/var/www/$KEYSERVER_DOMAIN_NAME" ]; then rm -rf "/var/www/$KEYSERVER_DOMAIN_NAME" fi function_check remove_ddns_domain remove_ddns_domain "$KEYSERVER_DOMAIN_NAME" remove_config_param KEYSERVER_DOMAIN_NAME remove_config_param KEYSERVER_CODE function_check remove_onion_service remove_onion_service keyserver "${KEYSERVER_ONION_PORT}" remove_onion_service sks 11370 11371 11372 remove_completion_param "install_keyserver" firewall_remove 11370 tcp firewall_remove 11371 tcp firewall_remove 11372 tcp sed -i '/keyserver/d' "$COMPLETION_FILE" sed -i '/sks onion/d' "$COMPLETION_FILE" if [ -d /var/lib/sks ]; then rm -rf /var/lib/sks fi } function install_interactive_keyserver { if [ ! "$ONION_ONLY" ]; then ONION_ONLY='no' fi if [[ $ONION_ONLY != "no" ]]; then KEYSERVER_DOMAIN_NAME='keyserver.local' write_config_param "KEYSERVER_DOMAIN_NAME" "$KEYSERVER_DOMAIN_NAME" else function_check interactive_site_details interactive_site_details "keyserver" "KEYSERVER_DOMAIN_NAME" "KEYSERVER_CODE" fi APP_INSTALLED=1 } function keyserver_create_mailsync { echo $"# List of email addresses which submitted keys will be forwarded to" > /etc/sks/mailsync echo '' >> /etc/sks/mailsync chown -Rc debian-sks: /etc/sks/mailsync } function keyserver_create_membership { if [ -f /etc/sks/membership ]; then return fi systemctl stop sks { echo $"# List of other $PROJECT_NAME SKS Keyservers to sync with."; echo '#'; echo $"# Don't add major keyservers here, because it will take an"; echo $'# Infeasible amount of time to sync and backups will become'; echo $'# absurdly long and probably break your system. You have been warned.'; echo ''; } > /etc/sks/membership chown -Rc debian-sks: /etc/sks/membership systemctl start sks } function keyserver_import_keys { # NOTE: this function isn't used, but kept for reference dialog --title $"Import public keys database" \ --backtitle $"Freedombone Control Panel" \ --defaultno \ --yesno $"\\nThis will download many gigabytes of data and so depending on your bandwidth it could take several days.\\n\\nContinue?" 10 60 sel=$? case $sel in 1) return;; 255) return;; esac if [ ! -d /var/lib/sks/dump ]; then mkdir -p /var/lib/sks/dump fi cd /var/lib/sks/dump || exit 59242684 echo $'Getting keyserver dump. This may take a few days or longer, so be patient.' rm -rf /var/lib/sks/dump/* KEYSERVER_DUMP_URL="https://keyserver.mattrude.com/dump/$(date +%F)/" wget -crp -e robots=off --level=1 --cut-dirs=3 -nH \ -A pgp,txt "$KEYSERVER_DUMP_URL" cd /var/lib/sks || exit 936572424 echo $'Building the keyserver database from the downloaded dump' keyserver_reset_database } function keyserver_sync { data=$(mktemp 2>/dev/null) dialog --backtitle $"Freedombone Control Panel" \ --title $"Sync with other keyserver" \ --form $"\nEnter details for the other server. Please be aware that it's not a good idea to sync with major keyservers which have exceptionally large databases. This is intended to sync with other $PROJECT_NAME systems each having a small database for a particular community." 16 60 3 \ $"Domain:" 1 1 "" 1 25 32 64 \ $"Port:" 2 1 "11370" 2 25 6 6 \ $"Sync Email (optional):" 3 1 "pgp-public-keys@" 3 25 32 64 \ 2> "$data" sel=$? case $sel in 1) rm -f "$data" return;; 255) rm -f "$data" return;; esac other_keyserver_domain=$(sed -n 1p < "$data") other_keyserver_port=$(sed -n 2p < "$data") other_keyserver_email=$(sed -n 3p < "$data") rm -f "$data" if [[ "$other_keyserver_domain" != *'.'* ]]; then return fi if [[ "$other_keyserver_domain" == *' '* ]]; then return fi if [[ "$other_keyserver_port" == *'.'* ]]; then return fi if [[ "$other_keyserver_port" == *' '* ]]; then return fi if [ ${#other_keyserver_domain} -lt 4 ]; then return fi if [ ${#other_keyserver_port} -lt 4 ]; then return fi # Warn if trying to sync if [[ "$other_keyserver_domain" == *"sks-keyservers.net" || "$other_keyserver_domain" == *"gnupg.net" || "$other_keyserver_domain" == *"pgp.com" || "$other_keyserver_domain" == *"pgp.mit.edu" || "$other_keyserver_domain" == *"the.earth.li" || "$other_keyserver_domain" == *"mayfirst.org" || "$other_keyserver_domain" == *"ubuntu.com" ]]; then dialog --title $"Sync with other keyserver" \ --msgbox $"\\nDon't try to sync with the major keyservers. Your system will be overloaded with an infeasible database size." 8 60 return fi if [[ "$other_keyserver_email" != "pgp-public-keys@" ]]; then if [[ "$other_keyserver_email" == *"@"* ]]; then if [[ "$other_keyserver_email" == *"."* ]]; then keyserver_create_mailsync if ! grep -q "$other_keyserver_email" /etc/sks/mailsync; then echo "$other_keyserver_email" >> /etc/sks/mailsync chown -Rc debian-sks: /etc/sks/mailsync fi else dialog --title $"Sync with other keyserver" \ --msgbox $"Email doesn't look right: $other_keyserver_email" 6 60 return fi fi fi keyserver_create_membership if grep -q "$other_keyserver_domain $other_keyserver_port" /etc/sks/membership; then return fi if grep -q "$other_keyserver_domain " /etc/sks/membership; then sed -i "s|$other_keyserver_domain .*|$other_keyserver_domain $other_keyserver_port|g" /etc/sks/membership else echo "$other_keyserver_domain $other_keyserver_port" >> /etc/sks/membership fi chown -Rc debian-sks: /etc/sks/membership systemctl restart sks dialog --title $"Sync with other keyserver" \ --msgbox $"Keyserver added" 6 40 } function keyserver_edit { if [ ! -f /etc/sks/membership ]; then return fi editor /etc/sks/membership chown -Rc debian-sks: /etc/sks/membership systemctl restart sks } function keyserver_remove_key { data=$(mktemp 2>/dev/null) dialog --title $"Remove a key" \ --backtitle $"Freedombone Control Panel" \ --inputbox $"Enter the ID of the key which you wish to remove:" 12 60 2>"$data" sel=$? case $sel in 0) remove_key_id=$(<"$data") if [ ${#remove_key_id} -gt 8 ]; then sks drop "$remove_key_id" dialog --title $"Remove a key" \ --msgbox $"The key was removed" 6 40 fi ;; esac rm -f "$data" } function configure_interactive_keyserver { W=(1 $"Remove a key" 2 $"Sync with other keyserver" 3 $"Edit sync keyservers") while true do # shellcheck disable=SC2068 selection=$(dialog --backtitle $"Freedombone Administrator Control Panel" --title $"SKS Keyserver" --menu $"Choose an operation, or ESC to exit:" 11 60 3 "${W[@]}" 3>&2 2>&1 1>&3) if [ ! "$selection" ]; then break fi case $selection in 1) keyserver_remove_key;; 2) keyserver_sync;; 3) keyserver_edit;; esac done } function install_keyserver { apt-get -qy install build-essential gcc ocaml libdb-dev wget sks keyserver_reset_database sed -i 's|initstart=.*|initstart=yes|g' /etc/default/sks apt-get -qy install dirmngr systemctl restart sks if [ ! -d /var/www/$KEYSERVER_DOMAIN_NAME ]; then mkdir /var/www/$KEYSERVER_DOMAIN_NAME fi cd "/var/www/$KEYSERVER_DOMAIN_NAME" || exit 25427642847 if [ -d /var/www/$KEYSERVER_DOMAIN_NAME/htdocs ]; then rm -rf /var/www/$KEYSERVER_DOMAIN_NAME/htdocs fi if [ -d /repos/keyserverweb ]; then mkdir htdocs cp -r -p /repos/keyserverweb/. htdocs cd htdocs || exit 379584659 git pull else git_clone $KEYSERVER_WEB_REPO htdocs fi if [ ! -d /var/www/$KEYSERVER_DOMAIN_NAME/htdocs ]; then echo $"/var/www/$KEYSERVER_DOMAIN_NAME/htdocs not found" exit 6539230 fi cd "/var/www/$KEYSERVER_DOMAIN_NAME/htdocs" || exit 264824528 git checkout $KEYSERVER_WEB_COMMIT -b $KEYSERVER_WEB_COMMIT set_completion_param "keyserver web commit" "$KEYSERVER_WEB_COMMIT" USER_EMAIL_ADDRESS=$MY_USERNAME@$HOSTNAME GPG_ID=$(su -m root -c "gpg --list-keys \"$USER_EMAIL_ADDRESS\" | sed -n '2p' | sed 's/^[ \\t]*//'" - "$MY_USERNAME") if [ ! "$GPG_ID" ]; then echo $'No GPG ID for admin user' exit 846336 fi if [ ${#GPG_ID} -lt 5 ]; then echo $'GPG ID not retrieved for admin user' exit 835292 fi if [[ "$GPG_ID" == *"error"* ]]; then echo $'GPG ID not retrieved for admin user due to error' exit 74825 fi sed -i "s|###ENTERPUBLICKEYHERE###|$GPG_ID|g" /var/www/$KEYSERVER_DOMAIN_NAME/htdocs/404.html sed -i "s|###ENTERPUBLICKEYHERE###|$GPG_ID|g" /var/www/$KEYSERVER_DOMAIN_NAME/htdocs/index.html sed -i "s|###ENTERNAMEHERE###|$USER_EMAIL_ADDRESS|g" /var/www/$KEYSERVER_DOMAIN_NAME/htdocs/404.html sed -i "s|###ENTERNAMEHERE###|$USER_EMAIL_ADDRESS|g" /var/www/$KEYSERVER_DOMAIN_NAME/htdocs/index.html sksconf_file=/etc/sks/sksconf sed -i "s|#hostname:.*|hostname: $KEYSERVER_DOMAIN_NAME|g" $sksconf_file sed -i "s|hostname:.*|hostname: $KEYSERVER_DOMAIN_NAME|g" $sksconf_file sed -i "s|#hkp_port:.*|hkp_port: 11373|g" $sksconf_file sed -i "s|hkp_port:.*|hkp_port: 11373|g" $sksconf_file sed -i "s|#recon_port:.*|recon_port: 11370|g" $sksconf_file sed -i "s|recon_port:.*|recon_port: 11370|g" $sksconf_file sed -i "s|#recon_address:.*|recon_address: 0.0.0.0|g" $sksconf_file sed -i "s|recon_address:.*|recon_address: 0.0.0.0|g" $sksconf_file sed -i 's|#hkp_address:.*|hkp_address: 127.0.0.1|g' $sksconf_file sed -i 's|hkp_address:.*|hkp_address: 127.0.0.1|g' $sksconf_file sed -i "s|#from_addr:.*|from_addr: \"pgp-public-keys@$DEFAULT_DOMAIN_NAME\"|g" $sksconf_file sed -i "s|from_addr:.*|from_addr: \"pgp-public-keys@$DEFAULT_DOMAIN_NAME\"|g" $sksconf_file sed -i 's|#sendmail_cmd:|sendmail_cmd:|g' $sksconf_file if ! grep -q "#disable_mailsync" $sksconf_file; then echo '#disable_mailsync:' >> $sksconf_file else sed -i 's|disable_mailsync:|#disable_mailsync:|g' $sksconf_file fi if ! grep -q "membership_reload_interval:" $sksconf_file; then echo 'membership_reload_interval: 1' >> $sksconf_file else sed -i 's|#membership_reload_interval:.*|membership_reload_interval: 1|g' $sksconf_file sed -i 's|membership_reload_interval:.*|membership_reload_interval: 1|g' $sksconf_file fi if ! grep -q "max_matches:" $sksconf_file; then echo 'max_matches: 50' >> $sksconf_file else sed -i 's|#max_matches:.*|max_matches: 50|g' $sksconf_file sed -i 's|max_matches:.*|max_matches: 50|g' $sksconf_file fi if ! grep -q "stat_hour:" $sksconf_file; then echo "stat_hour: $((1 + RANDOM % 8))" >> $sksconf_file else sed -i "s|#stat_hour:.*|stat_hour: $((1 + RANDOM % 8))|g" $sksconf_file sed -i "s|stat_hour:.*|stat_hour: $((1 + RANDOM % 8))|g" $sksconf_file fi if ! grep -q "disable_log_diffs:" $sksconf_file; then echo "disable_log_diffs:" >> $sksconf_file else sed -i "s|#disable_log_diffs:.*|disable_log_diffs:|g" $sksconf_file sed -i "s|disable_log_diffs:.*|disable_log_diffs:|g" $sksconf_file fi if ! grep -q "debuglevel:" $sksconf_file; then echo "debuglevel: 0" >> $sksconf_file else sed -i "s|#debuglevel:.*|debuglevel: 0|g" $sksconf_file sed -i "s|debuglevel:.*|debuglevel: 0|g" $sksconf_file fi chown debian-sks: $sksconf_file if ! grep -q "hidden_service_sks" "$ONION_SERVICES_FILE"; then { echo 'HiddenServiceDir /var/lib/tor/hidden_service_sks/'; echo 'HiddenServiceVersion 3'; echo "HiddenServicePort 11370 127.0.0.1:11370"; echo "HiddenServicePort 11373 127.0.0.1:11371"; echo "HiddenServicePort 11372 127.0.0.1:11372"; } >> "$ONION_SERVICES_FILE" echo $'Added onion site for sks' fi onion_update wait_for_onion_service 'sks' if [ ! -f /var/lib/tor/hidden_service_sks/hostname ]; then echo $'sks onion site hostname not found' exit 8352982 fi SKS_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_sks/hostname) KEYSERVER_ONION_HOSTNAME=$(add_onion_service keyserver 80 ${KEYSERVER_ONION_PORT}) keyserver_nginx_site=/etc/nginx/sites-available/$KEYSERVER_DOMAIN_NAME if [[ $ONION_ONLY == "no" ]]; then # NOTE: without http active on port 80 the keyserver doesn't work # from the commandline { echo 'server {'; echo ' listen 80;'; echo ' listen 0.0.0.0:11371;'; echo ' listen [::]:80;'; echo " server_name $KEYSERVER_DOMAIN_NAME;"; echo ''; echo ' # Logs'; echo ' access_log /dev/null;'; echo ' error_log /dev/null;'; echo ''; echo ' # Root'; echo " root /var/www/$KEYSERVER_DOMAIN_NAME/htdocs;"; echo ''; echo ' rewrite ^/stats /pks/lookup?op=stats;'; echo " rewrite ^/s/(.*) /pks/lookup?search=\$1;"; echo " rewrite ^/search/(.*) /pks/lookup?search=\$1;"; echo " rewrite ^/g/(.*) /pks/lookup?op=get&search=\$1;"; echo " rewrite ^/get/(.*) /pks/lookup?op=get&search=\$1;"; echo " rewrite ^/d/(.*) /pks/lookup?op=get&options=mr&search=\$1;"; echo " rewrite ^/download/(.*) /pks/lookup?op=get&options=mr&search=\$1;"; echo ''; echo ' location / {'; } > $keyserver_nginx_site function_check nginx_limits nginx_limits "$KEYSERVER_DOMAIN_NAME" '128k' { echo ' }'; echo ''; echo ' location /pks {'; echo ' proxy_pass http://127.0.0.1:11373;'; echo ' proxy_pass_header Server;'; echo " add_header Via \"1.1 $KEYSERVER_DOMAIN_NAME:11371 (nginx)\";"; echo ' proxy_ignore_client_abort on;'; echo ' client_max_body_size 8m;'; echo ' client_body_buffer_size 128k;'; echo ' }'; echo '}'; echo ''; echo 'server {'; echo ' listen 443 ssl;'; echo ' listen 0.0.0.0:11372 ssl;'; echo ' #listen [::]:443 ssl;'; echo " server_name $KEYSERVER_DOMAIN_NAME;"; echo ''; echo ' error_page 404 /404.html;'; echo ''; echo ' location ~ (.git|LICENSE|readme.md) {'; echo ' deny all;'; echo ' return 404;'; echo ' }'; echo ''; echo ' # Security'; } >> $keyserver_nginx_site function_check nginx_ssl nginx_ssl $KEYSERVER_DOMAIN_NAME function_check nginx_security_options nginx_security_options $KEYSERVER_DOMAIN_NAME { echo ' add_header Strict-Transport-Security max-age=15768000;'; echo ''; echo ' # Logs'; echo ' access_log /dev/null;'; echo ' error_log /dev/null;'; echo ''; echo ' # Root'; echo " root /var/www/$KEYSERVER_DOMAIN_NAME/htdocs;"; echo ''; echo ' rewrite ^/stats /pks/lookup?op=stats;'; echo " rewrite ^/s/(.*) /pks/lookup?search=\$1;"; echo " rewrite ^/search/(.*) /pks/lookup?search=\$1;"; echo " rewrite ^/g/(.*) /pks/lookup?op=get&search=\$1;"; echo " rewrite ^/get/(.*) /pks/lookup?op=get&search=\$1;"; echo " rewrite ^/d/(.*) /pks/lookup?op=get&options=mr&search=\$1;"; echo " rewrite ^/download/(.*) /pks/lookup?op=get&options=mr&search=\$1;"; echo ''; echo ' location / {'; } >> $keyserver_nginx_site function_check nginx_limits nginx_limits $KEYSERVER_DOMAIN_NAME '128k' { echo ' }'; echo ''; echo ' location /pks {'; echo " proxy_pass http://127.0.0.1:11373;"; echo ' proxy_pass_header Server;'; echo " add_header Via \"1.1 $KEYSERVER_DOMAIN_NAME:11372 (nginx)\";"; echo ' proxy_ignore_client_abort on;'; echo ' client_max_body_size 8m;'; echo ' client_body_buffer_size 128k;'; echo ' }'; echo '}'; echo ''; } >> $keyserver_nginx_site else echo -n '' > $keyserver_nginx_site fi { echo 'server {'; echo " listen 127.0.0.1:$KEYSERVER_ONION_PORT default_server;"; echo " server_name $KEYSERVER_ONION_HOSTNAME;"; echo ''; echo ' error_page 404 /404.html;'; echo ''; echo ' location ~ (.git|LICENSE|readme.md) {'; echo ' deny all;'; echo ' return 404;'; echo ' }'; echo ''; } >> $keyserver_nginx_site function_check nginx_security_options nginx_security_options $KEYSERVER_DOMAIN_NAME { echo ''; echo ' # Logs'; echo ' access_log /dev/null;'; echo ' error_log /dev/null;'; echo ''; echo ' # Root'; echo " root /var/www/$KEYSERVER_DOMAIN_NAME/mail;"; echo ''; echo ' rewrite ^/stats /pks/lookup?op=stats;'; echo " rewrite ^/s/(.*) /pks/lookup?search=\$1;"; echo " rewrite ^/search/(.*) /pks/lookup?search=\$1;"; echo " rewrite ^/g/(.*) /pks/lookup?op=get&search=\$1;"; echo " rewrite ^/get/(.*) /pks/lookup?op=get&search=\$1;"; echo " rewrite ^/d/(.*) /pks/lookup?op=get&options=mr&search=\$1;"; echo " rewrite ^/download/(.*) /pks/lookup?op=get&options=mr&search=\$1;"; echo ''; echo ' location / {'; } >> $keyserver_nginx_site function_check nginx_limits nginx_limits $KEYSERVER_DOMAIN_NAME '128k' { echo ' }'; echo ''; echo ' location /pks {'; echo " proxy_pass http://127.0.0.1:11373;"; echo ' proxy_pass_header Server;'; echo " add_header Via \"1.1 $KEYSERVER_DOMAIN_NAME:$KEYSERVER_ONION_PORT (nginx)\";"; echo ' proxy_ignore_client_abort on;'; echo ' client_max_body_size 8m;'; echo ' client_body_buffer_size 128k;'; echo ' }'; echo '}'; } >> $keyserver_nginx_site function_check create_site_certificate if [ ! -f /etc/ssl/certs/${KEYSERVER_DOMAIN_NAME}.pem ]; then create_site_certificate $KEYSERVER_DOMAIN_NAME 'yes' fi if [ -f /etc/ssl/certs/${KEYSERVER_DOMAIN_NAME}.crt ]; then mv /etc/ssl/certs/${KEYSERVER_DOMAIN_NAME}.crt /etc/ssl/certs/${KEYSERVER_DOMAIN_NAME}.pem fi if [ -f /etc/ssl/certs/${KEYSERVER_DOMAIN_NAME}.pem ]; then chown root:root /etc/ssl/certs/${KEYSERVER_DOMAIN_NAME}.pem sed -i "s|.crt|.pem|g" /etc/nginx/sites-available/${KEYSERVER_DOMAIN_NAME} fi if [ -f /etc/ssl/private/${KEYSERVER_DOMAIN_NAME}.key ]; then chown root:root /etc/ssl/private/${KEYSERVER_DOMAIN_NAME}.key fi chown -R www-data:www-data /var/www/$KEYSERVER_DOMAIN_NAME/htdocs function_check nginx_ensite nginx_ensite $KEYSERVER_DOMAIN_NAME configure_firewall_for_keyserver # remove membership file - don't try to sync with other keyservers if [ -f /etc/sks/membership ]; then rm /etc/sks/membership fi if ! grep -q "pgp-public-keys" /etc/aliases; then echo 'pgp-public-keys: "|/usr/lib/sks/sks_add_mail /etc/sks"' >> /etc/aliases fi chown -Rc debian-sks: /etc/sks/mailsync systemctl enable sks systemctl restart sks systemctl restart nginx set_completion_param "keyserver domain" "$KEYSERVER_DOMAIN_NAME" set_completion_param "keyserver onion domain" "$KEYSERVER_ONION_HOSTNAME" set_completion_param "sks onion domain" "$SKS_ONION_HOSTNAME" keyserver_watchdog APP_INSTALLED=1 } # NOTE: deliberately no exit 0