AltaOS 8 Configuration

dnf -y install dnf-automatic
sed -ie 's/apply_updates = no/apply_updates = yes/' /etc/dnf/automatic.conf
sed -ie 's/emit_via = stdio/emit_via = email,stdio/' /etc/dnf/automatic.conf
sed -ie 's/email_from = root@example.com/email_from = root/' /etc/dnf/automatic.conf
systemctl enable --now dnf-automatic.timer

# Setting the database root password
dnf -y install expect
 
MYSQL_ROOT_PASSWORD=`date +%s | sha256sum | base64 | head -c 16 ; echo`
 
SECURE_MYSQL=$(expect -c "
 
set timeout 3
spawn mysql_secure_installation
 
expect \"Enter current password for root (enter for none):\"
send \"$CURRENT_MYSQL_PASSWORD\r\"
 
expect \"Set root password?\"
send \"y\r\"
 
expect \"New password:\"
send \"$MYSQL_ROOT_PASSWORD\r\"
 
expect \"Re-enter new password:\"
send \"$MYSQL_ROOT_PASSWORD\r\"
 
expect \"Remove anonymous users?\"
send \"y\r\"
 
expect \"Disallow root login remotely?\"
send \"y\r\"
 
expect \"Remove test database and access to it?\"
send \"y\r\"
 
expect \"Reload privilege tables now?\"
send \"y\r\"
expect eof
")
 
echo "$SECURE_MYSQL"
 
dnf -y remove expect
 
if grep -q pass= /etc/webmin/mysql/config; then
  sed -i "/pass=/c\pass=$MYSQL_ROOT_PASSWORD" /etc/webmin/mysql/config
else
  echo pass=$MYSQL_ROOT_PASSWORD >> /etc/webmin/mysql/config
fi
 
# Done setting the database root password
 
if ! grep -Fq "default-character-set = utf8mb4" /etc/my.cnf
then
  rm -f  /etc/my.cnf
cat > /etc/my.cnf << 'EOF'
[client]
default-character-set = utf8mb4
 
[mysql]
default-character-set = utf8mb4
 
[mysqld]
innodb_file_per_table=true
innodb_flush_log_at_trx_commit = 0
innodb_log_buffer_size  = 8M
innodb_buffer_pool_size = 1G
innodb_thread_concurrency = 16
innodb_lock_wait_timeout = 120
innodb_data_file_path   = ibdata1:10M:autoextend
innodb_max_dirty_pages_pct = 90
 
slow_query_log = 1
slow_query_log_file = /var/log/mariadb/slow.log
 
query_cache_size = 128M
query_cache_limit = 16M
 
 
thread_cache_size = 8
myisam_sort_buffer_size = 64M
read_rnd_buffer_size = 8M
read_buffer_size = 2M
sort_buffer_size = 2M
table_cache = 512
max_allowed_packet=1024M
key_buffer_size = 384M
wait_timeout=600
max_connections = 600
tmp_table_size = 256M
max_heap_table_size = 256M
 
 
#
# This group is read both both by the client and the server
# use it for options that affect everything
#
[client-server]
 
#
# include all files from the config directory
#
!includedir /etc/my.cnf.d
EOF
fi
 
# Per https://bugzilla.redhat.com/show_bug.cgi?id=1468028
sed -i s/^plugin-load-add=auth_gssapi.so/#plugin-load-add=auth_gssapi.so/g /etc/my.cnf.d/auth_gssapi.cnf
 
 
# Should go to elsewhere
# Per https://coderwall.com/p/fukoew/speed-up-ssh-logon-by-disabling-gssapiauthentication
sed -i '/GSSAPIAuthentication yes/c\GSSAPIAuthentication no' /etc/ssh/sshd_config

(42, 161, 152);">if ! grep -Fq "Welcome" /etc/motd
then
  echo "Creating /etc/motd .."
cat <<EOT >> /etc/motd
*****************************************************************************
*             Welcome to AltaGrade Optimized Operating System!              *
*                                                                           *
* For any issues please browse through the AltaGrade platform documentation *
* on https://www.altagrade.com/help. If you can't find a suitable solution, *
* then submit a support request on https://my.altagrade.com.                *
*                                                                           *
*****************************************************************************
EOT
fi
 
(42, 161, 152);">if grep -Fq "#Banner none" /etc/ssh/sshd_config
then
  sed -ie '/#Banner none/c\Banner /etc/banner' /etc/ssh/sshd_config
(42, 161, 152);">else
  echo 'Banner /etc/banner' >> /etc/ssh/sshd_config
fi
 
(42, 161, 152);">if ! grep -Fq "" /etc/banner
then
  echo "Creating /etc/banner .."
cat <<EOT >> /etc/banner
 
 
     **      **   **               ********                        **        
    ****    /**  /**              **//////**                      /**        
   **//**   /** ******  ******   **      //  ******  ******       /**  ***** 
  **  //**  /**///**/  //////** /**         //**//* //////**   ****** **///**
 ********** /**  /**    ******* /**    ***** /** /   *******  **///**/*******
/**//////** /**  /**   **////** //**  ////** /**    **////** /**  /**/**//// 
/**     /** ***  //** //******** //******** /***   //********//******//******
//      // ///    //   ////////   ////////  ///     ////////  //////  //////                                                                               
 
 
EOT
fi

if grep -Fq 'installonly_limit=3' /etc/yum.conf
then
  echo "Setting amount of installed kernels to 2 .."
  sed -ie 's/installonly_limit=3/installonly_limit=2/' /etc/yum.conf
fi

echo '*               soft    nofile            65535' >> /etc/security/limits.conf
echo '*               hard    nofile            65535' >> /etc/security/limits.conf
 
if ! grep -q 127.0.0.1 "/etc/resolv.conf"; then
  echo "nameserver 127.0.0.1" >> /etc/resolv.conf
fi

# Removing cockpit
systemctl stop cockpit && systemctl disable cockpit
dnf -y remove cockpit
firewall-cmd --permanent --remove-service=cockpit
 
# Disabling Usermin
/usr/lib/systemd/systemd-sysv-install disable usermin
 
rm -rf /etc/httpd/conf.d/welcome.conf 
chown -R root:bin /etc/webmin
 
systemctl stop chronyd && yum -y remove chrony
systemctl stop wpa_supplicant && yum -y remove wpa_supplicant
# systemctl stop fail2ban && yum -y remove fail2ban* && rm -rf /var/log/fail2ban.log
systemctl stop proftpd && yum -y remove proftpd && rm -rf /var/log/proftpd
if [ $PORT == 19759 ]; then
  systemctl stop sound.target && systemctl disable sound.target
fi

cat > /etc/ag/scripts/update-drupal << 'EOT'
EOT