Installation script (Deprecated)

if [ -d /etc/ag ]; then
  echo "It seems this script has already been executed on this server."
  echo "This script should be run only once as otherwise it will duplicate entries in number of configuration files!"
  exit 0
fi
SECONDS=0

yum -y makecache fast && yum -y install yum-plugin-fastestmirror
yum -y update && yum -y install nano
mkdir /etc/ag && cd /etc/ag && mkdir scripts cp
mkdir /sandbox /home/backup /home/backup/ag
ln -s /home/backup /backup

yum -y install perl nano rsync make vim screen wget mlocate gcc pcre-devel nmap openssh-clients ImageMagick gcc-c++ bzip2 net-tools iptables-services ntpdate yum-cron perl-LWP-Protocol-https deltarpm patch  lsof git psacct yum-utils bash-completion at e2fsprogs sudo libxml2-devel htop pam-devel perl-Authen-PAM

cat <<EOT >> /etc/banner
 ▄▄▄       ▓▓▓  ▓▓▓█████▓ ▄▄▄        ▄████  ▓▓▀███   ▄▄▄      ▓█████▄ ▓█████
▒▓▓██▄    ▓██▒  ▓  ▓▓▒ ▓▒▒████▄     ▓▓▒ ▀█▒▓██ ▒ ▓█▒▒▓▓██▄    ▒▓▓▀ ██▌▓▓   ▀
▒▓▓  ▀█▄  ▒▓▓░  ▒ ▓██░ ▒░▒▓▓  ▀█▄  ▒▓▓░▄▄▄░▓▓▓ ░▄█ ▒▒▓▓  ▀█▄  ░██   █▌▒▓▓██
░██▄▄▄▄██ ▒▓▓░  ░ ▓██▓ ░ ░██▄▄▄▄██ ░▓█  ██▓▒▓▓▀▀█▄  ░██▄▄▄▄██ ░▓█▄   ▌▒▓█  ▄
 ▓█   ▓██▒░██████▒▒██▒ ░  ▓█   ▓██▒░▒▓███▀▒░██▓ ▒▓▓▒ ▓█   ▓██▒░▒████▓ ░▒████▒
 ▒▒   ▓▒█░░ ▒░▓  ░▒ ░░    ▒▒   ▓▒█░ ░▒   ▒ ░ ▒▓ ░▒▓░ ▒▒   ▓▒█░ ▒▒▓  ▒ ░░ ▒░ ░
  ▒   ▒▒ ░░ ░ ▒  ░  ░      ▒   ▒▒ ░  ░   ░   ░▒ ░ ▒░  ▒   ▒▒ ░ ░ ▒  ▒  ░ ░  ░
  ░   ▒     ░ ░   ░        ░   ▒   ░ ░   ░   ░░   ░   ░   ▒    ░ ░  ░    ░
      ░  ░    ░  ░             ░  ░      ░    ░           ░  ░   ░       ░  ░
 
EOT
cat <<EOT >> /etc/motd
*****************************************************************************
*             Welcome to AltaGrade Optimized Operating System!              *
*                                                                           *
* If you encounter any issues with the server, then please browse our Help  *
* section on https://www.altagrade.com/help first. And if you couldn't find *
* any solution, then submit a support request at https://my.altagrade.com.  *
*                                                                           *
*****************************************************************************
EOT

24

systemctl enable psacct && systemctl start psacct

sed -ie 's/installonly_limit=5/installonly_limit=2/' /etc/yum.conf
systemctl enable yum-cron.service && systemctl start yum-cron.service

29

useradd -G wheel altagrade
echo "yik78Fv,ag" | passwd altagrade --stdin 
sed -ie 's/root: /altagrade: /' /etc/webmin/webmin.acl
sed -ie 's/root:/altagrade:/' /etc/webmin/miniserv.users
mkdir /home/altagrade/.ssh 
echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC753VZbicoElj5moS0XZ70ERwse483Cuqc6Jf3YXJvn4+ZGzdjUsUI4+0GHK0aufeFh4YNZQ9QoQnM/3HUKZIGm3/2lYvzY1Z2YtyWz57LSX6o+oskq01Pe+3g+sxbt1yOW/KhClVhTSNzFPtMV5h4//JLxdO1Z6pctXSgq2COZ9fnEAm/AzmYFpuNvg0JmNdWuFkvnSKZrkt9hmw72TTjTE+p9DviTmoq4GCr6l2Pg4y6oTlyQ595yi6wDZe0JK7cdkKMsA4U6kAyHqci7zXOu7HjLdYcKZCohCp/iddHZbERmlZuS1eGbiARYtBZb9FNdUmnUB3nggb4DU3FPeDl' >> /home/altagrade/.ssh/authorized_keys
echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4K7QPiD9EbzJDXN9xcfloD6NL6T4hUDmfe3/5lqVgBkiFUr1Npq5R+KE6DyCxu6HC3Yiowf4Ju32e6W66Ke4smcPQSsAPKUjtzm59IB8Ngt8z/iDlsPj66Wonq9TqIVjuKsol2R8J8LvwybmaheuAr6Hccsw2pdUwkh1KZiJOmPwiP5Rm2ekCJ8kUTED45zQrXEuv3q4Mszec6Kt5r0Y8qHfGzNDE4xgCRofNmK55l6WclC36ZZdYRrNt+1btFM10VqwtWUX3OJtumfPYKmzhWGGpBlBk9rbxCjXdSIiGSjJEO+9nzlsWZo0TfThs6T/DqmMSkCMsVu3jb9cms2qT altagrade@vpn.altagrade.net' >> /home/altagrade/.ssh/authorized_keys
restorecon -R -v /home/altagrade/.ssh
sed -i "s/#Port 22/Port ${PORT}/g" /etc/ssh/sshd_config
sed -i "s/#PermitRootLogin yes/PermitRootLogin no/g" /etc/ssh/sshd_config
sed -i "s/PasswordAuthentication yes/PasswordAuthentication no/g" /etc/ssh/sshd_config
echo 'Banner /etc/banner' >> /etc/ssh/sshd_config
 
yum -y install policycoreutils-python
semanage port -a -t ssh_port_t -p tcp ${PORT}
yum -y remove policycoreutils-python setools-libs python-IPy checkpolicy libsemanage-python audit-libs-python 
 
systemctl restart sshd
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

mkdir /etc/ag/custom-menus
cd /etc/ag/custom-menus
cat > ssl.menu << 'EOF'
ssl_self Self-signed SSL Certificate
ssl_le Let's Encrypt SSL Certificate
ssl_commercial Commercial SSL Certificate
EOF
cat > app.menu << 'EOF'
drupal8 Drupal 8
drupal7 Drupal 7
backdrop Backdrop
wordpress Wordpress
other Other
EOF

yum -y install php-soap php-devel php-pear php-gd php-mbstring php-mcrypt
pecl channel-update pecl.php.net
pecl install uploadprogress
echo extension=uploadprogress.so >> /etc/php.d/uploadprogress.ini
yum -y install memcached
yum -y install php-pecl-memcache
rm -f /etc/sysconfig/memcached
cat <<'EOT' >> /etc/sysconfig/memcached 
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="1024"
OPTIONS="-l 127.0.0.1"
EOT
systemctl enable memcached
systemctl start  memcached
 
sed -ie 's/upload_max_filesize = 2M/upload_max_filesize = 20M/' /etc/php.ini
sed -ie 's/post_max_size = 8M/post_max_size = 16M/' /etc/php.ini
sed -ie 's/max_execution_time = 30/max_execution_time = 600/' /etc/php.ini
sed -ie 's/max_input_time = 60/max_input_time = 600/' /etc/php.ini
sed -ie 's/memory_limit = 128M/memory_limit = 1280M/' /etc/php.ini 

25

cat > /etc/cron.hourly/altagrade << 'EOF'
#!/bin/bash
sh /etc/ag/scripts/update-drupal 1 > /dev/null
exit
EOF
chmod 755 /etc/cron.hourly/altagrade
 
cat > /etc/cron.daily/altagrade << 'EOF'
#!/bin/bash
sed -ie 's/CentOS/AltaOS/' /etc/webmin/config >/dev/null 2>&1
sed -ie 's/slider_enabled=true/slider_enabled=false/' /etc/webmin/authentic-theme/settings.js >/dev/null 2>&1
exit
EOF
chmod 755 /etc/cron.daily/altagrade
/etc/cron.daily/altagrade

yum install -y expect
 
MYSQL_ROOT_PASSWORD=`date +%s | sha256sum | base64 | head -c 16 ; echo`
 
SECURE_MYSQL=$(expect -c "
 
set timeout 3
spawn mysql_secure_installation
 
expect \"Enter current password for root (enter for none):\"
send \"$CURRENT_MYSQL_PASSWORD\r\"
 
expect \"Set root password?\"
send \"y\r\"
 
expect \"New password:\"
send \"$MYSQL_ROOT_PASSWORD\r\"
 
expect \"Re-enter new password:\"
send \"$MYSQL_ROOT_PASSWORD\r\"
 
expect \"Remove anonymous users?\"
send \"y\r\"
 
expect \"Disallow root login remotely?\"
send \"y\r\"
 
expect \"Remove test database and access to it?\"
send \"y\r\"
 
expect \"Reload privilege tables now?\"
send \"y\r\"
expect eof
")
 
echo "$SECURE_MYSQL"
 
yum remove -y expect
 
if grep -q pass= /etc/webmin/mysql/config; then
  sed -i "/pass=/c\pass=$MYSQL_ROOT_PASSWORD" /etc/webmin/mysql/config
else
  echo pass=$MYSQL_ROOT_PASSWORD >> /etc/webmin/mysql/config
fi

yum -y install scl-utils
rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
rpm -Uvhl http://rpms.remirepo.net/enterprise/remi-release-7.rpm
 
yum -y install php72 php72-php-mysqlnd php72-php-curl php72-php-simplexml php72-php-devel php72-php-gd php72-php-json php72-php-mcrypt php72-php-mbstring php72-php-opcache php72-php-pear php72-php-pecl-apcu php72-php-pecl-geoip php72-php-pecl-imagick php72-php-pecl-json-post php72-php-pecl-memcache php72-php-pecl-zip php72-php-pspell php72-php-soap php72-php-xml php72-php-xmlrpc php72-php-pecl-uploadprogress php72-php-imap php72-php-pecl-xmldiff php72-php-bcmath
 
source /opt/remi/php72/enable
yum -y install php72-php-tidy
pear channel-update pear.php.net
pear install Cache_Lite
 
sed -ie 's/upload_max_filesize = 2M/upload_max_filesize = 20M/' /etc/opt/remi/php72/php.ini
sed -ie 's/post_max_size = 8M/post_max_size = 16M/' /etc/opt/remi/php72/php.ini
sed -ie 's/max_execution_time = 30/max_execution_time = 600/' /etc/opt/remi/php72/php.ini
sed -ie 's/max_input_time = 60/max_input_time = 600/' /etc/opt/remi/php72/php.ini
sed -ie 's/memory_limit = 128M/memory_limit = 1280M/' /etc/opt/remi/php72/php.ini 
 
yum -y install php73 php73-php-mysqlnd php73-php-curl php73-php-simplexml php73-php-devel php73-php-gd php73-php-json php73-php-mcrypt php73-php-mbstring php73-php-opcache php73-php-pear php73-php-pecl-apcu php73-php-pecl-geoip php73-php-pecl-imagick php73-php-pecl-json-post php73-php-pecl-memcache php73-php-pecl-zip php73-php-pspell php73-php-soap php73-php-xml php73-php-xmlrpc php73-php-pecl-uploadprogress php73-php-imap php73-php-pecl-xmldiff php73-php-bcmath
 
source /opt/remi/php73/enable
 
yum -y install php73-php-tidy
pear channel-update pear.php.net
pear install Cache_Lite
 
sed -ie 's/upload_max_filesize = 2M/upload_max_filesize = 20M/' /etc/opt/remi/php73/php.ini
sed -ie 's/post_max_size = 8M/post_max_size = 16M/' /etc/opt/remi/php73/php.ini
sed -ie 's/max_execution_time = 30/max_execution_time = 600/' /etc/opt/remi/php73/php.ini
sed -ie 's/max_input_time = 60/max_input_time = 600/' /etc/opt/remi/php73/php.ini
sed -ie 's/memory_limit = 128M/memory_limit = 1280M/' /etc/opt/remi/php73/php.ini
sed -ie 's/disable_functions =/disable_functions = pcntl_exec/' /etc/opt/remi/php73/php.ini

rm -f /etc/localtime
ln -s /usr/share/zoneinfo/UTC /etc/localtime
 
echo "timeserver=pool.ntp.org" >> /etc/webmin/time/config
cd /etc/webmin/webmincron/crons/
cat >150338373415549.cron<< 'EOF'
disabled=0
hours=11,14
days=*
mins=0,52
boot=1
id=150338373415549
weekdays=*
func=sync_time_cron
months=*
module=time
EOF

rm -rf /etc/webmin/authentic-theme
mkdir /etc/webmin/authentic-theme
cd /etc/webmin/authentic-theme
cat > settings.js << 'EOF'
settings_side_slider_enabled=false;
settings_right_default_tab_usermin='mail';
settings_right_default_tab_webmin='virtualmin';
settings_sysinfo_theme_updates=true;
settings_sysinfo_theme_patched_updates=false;
EOF

mkdir /etc/ag/skel
cd /etc/ag/skel
if [ -d "public_html" ]; then
  rm -rf public_html
fi
mkdir patches sandbox public_html
ln -s public_html www
cd /etc/ag/skel/public_html
cat > index.php << 'EOF'
<html>
<body>
 
<?php
 
$domain=$_SERVER['SERVER_NAME'];
$protocol="http://$domain";
$ssl="https://$domain";
 
function random_color_part() {
    return str_pad( dechex( mt_rand( 0, 255 ) ), 2, '0', STR_PAD_LEFT);
}
 
function random_color() {
    return random_color_part() . random_color_part() . random_color_part();
}
 
$bgcolor=random_color();
 
$date=date('m/d/Y H:i:s', time());
$port=$_SERVER['SERVER_PORT'];
 
function brightness($hex) {
  $r = hexdec(substr($hex,0,2));
  $g = hexdec(substr($hex,2,2));
  $b = hexdec(substr($hex,4,2));
 
  if($r + $g + $b > 301) {
    $txtcolor="#000000";
  } else {
    $txtcolor="#ffffff";
  }
  return $txtcolor;
}
  $txtcolor=brightness($bgcolor);
 
  $text = "<pre style=\"padding: 10px; border:1px solid $txtcolor\"><strong>Time:</strong> $date <br>";
  $text .= "<strong>Background color:</strong> #$bgcolor </pre>";
  $suffix = "<p>Compare different versions of the same page:<br>
<pre style=\"padding: 10px; border:1px solid $txtcolor\">
<strong>AltaCache</strong> at <a style=\"color:$txtcolor;\" href=\"$protocol\">$protocol</a>
<strong>AltaCache through SSL</strong> termination at <a style=\"color:$txtcolor;\" href=\"$ssl\">$ssl</a>
<strong>Apache</strong> version at <a style=\"color:$txtcolor;\" href=\"$protocol:8080\">$protocol:8080</a></pre></p>";
 
if ($port == "8080") {
  $prefix = "<p><strong>Uncached</strong> page with the background color and current time changing <br>on page refresh.</p>";
} else {
$prefix = "<p><strong>Cached</strong> page, so the background color and time captured won't change <br>on page refresh.<br>Expires in 24 hours unless AltaCache is restarted sooner.</p>";
}
?>
 
<body style="font-family: 'Avenir Next',sans-serif; color:<?php print $txtcolor;?>; background-color:#<?php print $bgcolor;?>;">
<div style="position: relative;float: left;top: 300px;left: 50%;transform: translate(-50%, -50%);">
<h1>AltaGrade Demo</h1>
<?php
print $prefix;
print $text;
print $suffix;
 
?>
</div>
 
</body>
</html>
EOF
 
cd /etc/ag/skel/patches
cat > PATCHES.TXT << 'EOF' 
You can place any information about patches of your website below. 
EOF
 
cd /etc/ag/skel
cat > BEST-PRACTICES.TXT << 'EOF'
Your AltaGrade server is configured to take regular backups of all websites'
home directories. Therefore placing large archive or database dump files within
the home directories make backup process very slow and often times cause errors.
It also negatively effects the overall performance of your server and hosted
the websites. That is why it is in your own best interest to keep the home
directories and document roots of your websites clean and tidy.
 
Ideally a typical home directory on a AltaGrade server should contain only this
text file and the following directories:
 
***
cgi-bin
domains
etc
fcgi-bin
logs
Maildir
patches
public_html
sandbox
ssl
tmp
usermails
www -> public_html
***
 
We recommend to place all non-standard or temporary files in the 'sandbox'
directory, which is excluded from automatic backups.
 
If you have further questions on how to organize your files, please open a
ticket on https://my.altagrade.com. 
EOF

sed -i '/Listen/c\#Listen' /etc/httpd/conf.d/ssl.conf
yum -y install Pound && systemctl enable pound && systemctl start pound
mv /etc/pound.cfg /etc/pound.cfg.orig
cat > /etc/pound.cfg << EOF
ListenHTTP
  Address ${IP}
  Port 80
  Service
    URL "/.well-known/acme-challenge/.*"
    BackEnd
      Address ${IP}
      Port 8888
    End
  End
End
 
Service
    BackEnd
	Address ${IP}
        Port    8888
    End
End
 
EOF

cat > /etc/ag/scripts/pre.sh << 'EOF'
#!/bin/sh

exit 0
EOF
chmod 755 /etc/ag/scripts/pre.sh

# per https://superuser.com/questions/1083882/block-port-111-on-centos-7

systemctl stop rpcbind.socket && systemctl disable rpcbind.socket
systemctl mask fail2ban && systemctl stop fail2ban
systemctl mask firewalld && systemctl stop firewalld
systemctl enable iptables && systemctl start iptables
 
cd /usr/src
wget http://www.rfxn.com/downloads/apf-current.tar.gz
tar xzf apf-current.tar.gz
rm -f apf-current.tar.gz
cd apf*
./install.sh 
chkconfig apf on
sed -ie "s/eth0/$IFACE/" /etc/apf/conf.apf
sed -ie 's/DEVEL_MODE="1"/DEVEL_MODE="0"/' /etc/apf/conf.apf
sed -ie 's/SET_MONOKERN="0"/SET_MONOKERN="1"/' /etc/apf/conf.apf
sed -ie 's/ICMP_LIM="30\/s"/ICMP_LIM="100\/s"/' /etc/apf/conf.apf
sed -ie 's/DLIST_PHP="0"/DLIST_PHP="1"/' /etc/apf/conf.apf
sed -ie 's/DLIST_SPAMHAUS="0"/DLIST_SPAMHAUS="1"/' /etc/apf/conf.apf
sed -ie 's/DLIST_DSHIELD="0"/DLIST_DSHIELD="1"/' /etc/apf/conf.apf
sed -ie 's/IG_TCP_CPORTS=/#IG_TCP_CPORTS=/' /etc/apf/conf.apf
sed -ie 's/IG_UDP_CPORTS=/#IG_UDP_CPORTS=/' /etc/apf/conf.apf
sed -i '2s/^/IG_UDP_CPORTS="53,123,465,587,953,2525,6277,1043,6081,6082,8983"\n/' /etc/apf/conf.apf
sed -i "2s/^/IG_TCP_CPORTS="\"25,53,80,110,143,443,465,587,953,993,995,1043,2525,5900_5910,8079,8080,8888,8983,10000_10010,20000,${PORT}\""\n/" /etc/apf/conf.apf
apf -r
/usr/local/sbin/apf -a 65.49.80.104 "Do not remove this IP address. It belongs to AltaGrade."

wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
tar xzf maldetect-current.tar.gz
rm -rf maldetect-current.tar.gz
cd maldetect*
./install.sh
# Installing inotify-tools per https://www.rfxn.com/appdocs/README.maldetect
yum -y install inotify-tools
# Configuring malware detection settings
sed -ie 's/email_alert="0"/email_alert="1"/' /usr/local/maldetect/conf.maldet
sed -ie 's/email_addr="you@domain.com"/email_addr="security"/' /usr/local/maldetect/conf.maldet
sed -ie 's/email_ignore_clean="1"/email_ignore_clean="0"/' /usr/local/maldetect/conf.maldet
sed -ie 's/quarantine_hits="0"/quarantine_hits="1"/' /usr/local/maldetect/conf.maldet
sed -ie 's/quarantine_clean="0"/quarantine_clean="1"/' /usr/local/maldetect/conf.maldet
sed -ie 's/quarantine_suspend_user="0"/quarantine_suspend_user="1"/' /usr/local/maldetect/conf.maldet
echo "/home/.*/public_html/stats" >> /usr/local/maldetect/ignore_paths
echo "/home/.*/domains/.*/public_html/stats" >> /usr/local/maldetect/ignore_paths

systemctl stop chronyd && yum -y remove chrony
systemctl stop fail2ban && yum -y remove fail2ban*
rm -rf /var/log/fail2ban.log
systemctl stop wpa_supplicant && yum -y remove wpa_supplicant
#yum -y install altagrade
chown -R root:bin /etc/webmin
systemctl restart webmin