AltaOS 8 Configuration

dnf -y install dnf-automatic
sed -ie 's/apply_updates = no/apply_updates = yes/' /etc/dnf/automatic.conf
sed -ie 's/emit_via = stdio/emit_via = email,stdio/' /etc/dnf/automatic.conf
sed -ie 's/email_from = [email protected]/email_from = root/' /etc/dnf/automatic.conf
systemctl enable --now dnf-automatic.timer

# Setting the database root password
dnf -y install expect
 
MYSQL_ROOT_PASSWORD=`date +%s | sha256sum | base64 | head -c 16 ; echo`
 
SECURE_MYSQL=$(expect -c "
 
set timeout 3
spawn mysql_secure_installation
 
expect \"Enter current password for root (enter for none):\"
send \"$CURRENT_MYSQL_PASSWORD\r\"
 
expect \"Set root password?\"
send \"y\r\"
 
expect \"New password:\"
send \"$MYSQL_ROOT_PASSWORD\r\"
 
expect \"Re-enter new password:\"
send \"$MYSQL_ROOT_PASSWORD\r\"
 
expect \"Remove anonymous users?\"
send \"y\r\"
 
expect \"Disallow root login remotely?\"
send \"y\r\"
 
expect \"Remove test database and access to it?\"
send \"y\r\"
 
expect \"Reload privilege tables now?\"
send \"y\r\"
expect eof
")
 
echo "$SECURE_MYSQL"
 
dnf -y remove expect
 
if grep -q pass= /etc/webmin/mysql/config; then
  sed -i "/pass=/c\pass=$MYSQL_ROOT_PASSWORD" /etc/webmin/mysql/config
else
  echo pass=$MYSQL_ROOT_PASSWORD >> /etc/webmin/mysql/config
fi
 
# Done setting the database root password
 
if ! grep -Fq "default-character-set = utf8mb4" /etc/my.cnf
then
  rm -f  /etc/my.cnf
cat > /etc/my.cnf << 'EOF'
[client]
default-character-set = utf8mb4
 
[mysql]
default-character-set = utf8mb4
 
[mysqld]
innodb_file_per_table=true
innodb_flush_log_at_trx_commit = 0
innodb_log_buffer_size  = 8M
innodb_buffer_pool_size = 1G
innodb_thread_concurrency = 16
innodb_lock_wait_timeout = 120
innodb_data_file_path   = ibdata1:10M:autoextend
innodb_max_dirty_pages_pct = 90
 
slow_query_log = 1
slow_query_log_file = /var/log/mariadb/slow.log
 
query_cache_size = 128M
query_cache_limit = 16M
 
 
thread_cache_size = 8
myisam_sort_buffer_size = 64M
read_rnd_buffer_size = 8M
read_buffer_size = 2M
sort_buffer_size = 2M
table_cache = 512
max_allowed_packet=1024M
key_buffer_size = 384M
wait_timeout=600
max_connections = 600
tmp_table_size = 256M
max_heap_table_size = 256M
 
 
#
# This group is read both both by the client and the server
# use it for options that affect everything
#
[client-server]
 
#
# include all files from the config directory
#
!includedir /etc/my.cnf.d
EOF
fi
 
# Per https://bugzilla.redhat.com/show_bug.cgi?id=1468028
sed -i s/^plugin-load-add=auth_gssapi.so/#plugin-load-add=auth_gssapi.so/g /etc/my.cnf.d/auth_gssapi.cnf
 
 
# Should go to elsewhere
# Per https://coderwall.com/p/fukoew/speed-up-ssh-logon-by-disabling-gssapiauthentication
sed -i '/GSSAPIAuthentication yes/c\GSSAPIAuthentication no' /etc/ssh/sshd_config

(42, 161, 152);">if ! grep -Fq "Welcome" /etc/motd
then
  echo "Creating /etc/motd .."
cat <<EOT >> /etc/motd
*****************************************************************************
*             Welcome to AltaGrade Optimized Operating System!              *
*                                                                           *
* For any issues please browse through the AltaGrade platform documentation *
* on https://www.altagrade.com/help. If you can't find a suitable solution, *
* then submit a support request on https://my.altagrade.com.                *
*                                                                           *
*****************************************************************************
EOT
fi
 
(42, 161, 152);">if grep -Fq "#Banner none" /etc/ssh/sshd_config
then
  sed -ie '/#Banner none/c\Banner /etc/banner' /etc/ssh/sshd_config
(42, 161, 152);">else
  echo 'Banner /etc/banner' >> /etc/ssh/sshd_config
fi
 
(42, 161, 152);">if ! grep -Fq "" /etc/banner
then
  echo "Creating /etc/banner .."
cat <<EOT >> /etc/banner
 
 
     **      **   **               ********                        **        
    ****    /**  /**              **//////**                      /**        
   **//**   /** ******  ******   **      //  ******  ******       /**  ***** 
  **  //**  /**///**/  //////** /**         //**//* //////**   ****** **///**
 ********** /**  /**    ******* /**    ***** /** /   *******  **///**/*******
/**//////** /**  /**   **////** //**  ////** /**    **////** /**  /**/**//// 
/**     /** ***  //** //******** //******** /***   //********//******//******
//      // ///    //   ////////   ////////  ///     ////////  //////  //////                                                                               
 
 
EOT
fi

if grep -Fq 'installonly_limit=3' /etc/yum.conf
then
  echo "Setting amount of installed kernels to 2 .."
  sed -ie 's/installonly_limit=3/installonly_limit=2/' /etc/yum.conf
fi

echo '*               soft    nofile            65535' >> /etc/security/limits.conf
echo '*               hard    nofile            65535' >> /etc/security/limits.conf
 
if ! grep -q 127.0.0.1 "/etc/resolv.conf"; then
  echo "nameserver 127.0.0.1" >> /etc/resolv.conf
fi

# Removing cockpit
systemctl stop cockpit && systemctl disable cockpit
dnf -y remove cockpit
firewall-cmd --permanent --remove-service=cockpit
 
# Disabling Usermin
/usr/lib/systemd/systemd-sysv-install disable usermin
 
rm -rf /etc/httpd/conf.d/welcome.conf 
chown -R root:bin /etc/webmin
 
systemctl stop chronyd && yum -y remove chrony
systemctl stop wpa_supplicant && yum -y remove wpa_supplicant
# systemctl stop fail2ban && yum -y remove fail2ban* && rm -rf /var/log/fail2ban.log
systemctl stop proftpd && yum -y remove proftpd && rm -rf /var/log/proftpd
if [ $PORT == 19759 ]; then
  systemctl stop sound.target && systemctl disable sound.target
fi

cat > /etc/ag/scripts/update-drupal << 'EOT'
#!/bin/sh
 
export PATH="/usr/local/bin:$PATH"
 
if [ -f /opt/remi/php74/enable ]; then
  source /opt/remi/php74/enable
elif [ -f /opt/remi/php73/enable ]; then
  source /opt/remi/php73/enable
elif [ -f /opt/remi/php72/enable ]; then
  source /opt/remi/php72/enable
fi
 
doms=`virtualmin list-domains --name-only`
for dom in $doms; do
 
# Check if domain is disabled
partial="$(echo $dom | cut -c1-30)"
disabled="$(virtualmin list-domains --domain $dom --disabled | grep $partial)"
# Leave disabled domains out of process
if [ -z "$disabled" ]; then
 
  path=`virtualmin list-domains --domain $dom --home-only`
  echo "***********************************************************************************************"
  echo " Working in $path..."
  # Let's check if domain is set to Yes and skip otherwise
  drupal_auto_update="$(virtualmin list-custom --domain $dom | grep Autoupdate)"
  if [[ $drupal_auto_update == *"Yes"* ]]; then
    drupal=''
    if [ -d $path/public_html ]; then
      cd $path/public_html
      version=$(drush status | grep 'Drupal version')
      if [[ $version = *8.* ]]; then
        drupal='8'
      elif [[ $version = *7.* ]]; then
        drupal='7'
      elif [[ $version = *6.* ]]; then
        drupal='6'
      fi
      if [ -z "$drupal" ]; then
        echo "***********************************************************************************************"
        echo "It is not bootstrapping, so probably this is not a Drupal site. Skipping..."
      else
        user=`virtualmin list-domains --domain $dom --user-only`
        drush cc all >> /dev/null 2>&1
        drush cr >> /dev/null 2>&1
        status=$(drush ups drupal 2> /dev/null | grep 'Update available\|SECURITY UPDATE available')
        if [ -z "$status" ]; then
          echo "The latest version for $dom is already installed."
          echo "***********************************************************************************************"
        else
 #         exec 3>&1 1>>/tmp/log.txt 2>&1
          echo "*** This is an automatically generated email, please do not reply ***" >> /tmp/log.txt
          echo " " >> /tmp/log.txt
          echo "The $dom has been updated to the latest secure Drupal core." >> /tmp/log.txt
          echo " " >> /tmp/log.txt
          echo "Here is the log:" >> /tmp/log.txt
          echo " " >> /tmp/log.txt
          echo "***********************************************************************************************" >> /tmp/log.txt
          echo "Working in $path/public_html ..." >> /tmp/log.txt
          echo "Drupal "$drupal" is detected." >> /tmp/log.txt
          echo "Update is available for $dom. Backing up the website's files and database ..." >> /tmp/log.txt
          drush -q sql-query "DELETE FROM cache_form"
          systemctl restart mariadb
          drush ard default --tar-options="--exclude=.git"
          echo "Securing the .htaccess and robots.txt files ..." >> /tmp/log.txt
          mkdir -p ../keep
          mv .htaccess robots.txt -t ../keep
          echo "Upgrading the website ..." >> /tmp/log.txt
          drush -y en update 2>&1 >> /tmp/log.txt
          drush -y -q up drupal --no-backup
          find . -type f -name .htaccess -exec sed -i "s/FollowSymLinks/SymLinksIfOwnerMatch/g" {} \; && find . -type f -name file.inc -exec sed -i "s/FollowSymLinks/SymLinksIfOwnerMatch/g" {} \;
          mv -f ../keep/.htaccess .
          mv -f ../keep/robots.txt .
          rm -rf ../keep
          chown -R $user:$user ../public_html
          drush -y updb 2>&1 >> /tmp/log.txt
          echo "$dom has been updated to the latest Drupal core." >> /tmp/log.txt
          echo "***********************************************************************************************" >> /tmp/log.txt
          echo " " >> /tmp/log.txt
          echo "*** This is an automatically generated email, please do not reply ***" >> /tmp/log.txt
          # Now let's find parent domain until https://www.virtualmin.com/node/53104 is resolved
          parent=${dom#*.}
          virtualmin notify-domains --domain $parent --body-file /tmp/log.txt --subject "Your website $dom has been updated" --from noreply@altagrade.com
          rm -f /tmp/log.txt
        fi
      fi
    fi
  else
    echo "Autoupdate for $dom is set to No, so skipping..."
    echo "***********************************************************************************************"
  fi
else
  echo "$dom is disabled, so skipping"
  echo "***********************************************************************************************"
fi
done
echo "***********************************************************************************************"
echo "Drupal core updates are complete."
echo "***********************************************************************************************"
exit
EOT