#!/bin/bash
echo "=================================================================================="
echo "Check if the system is freshly installed before doing anything else, because we don't want to run the installation script twice..."
if [ -d /etc/webmin ]; then
  echo "It seems this script has already been executed on this server."
  echo "This script should be run only once as otherwise it will duplicate entries in number of configuration files!"
  exit 0
fi
echo "Done..."
echo "=================================================================================="

echo "=================================================================================="
echo "Creating global aliases for user SSH sessions..."
cat > /etc/profile.d/globaliases.sh << 'EOT'
EOT
echo "Done..."
echo "=================================================================================="

echo "=================================================================================="
echo "Defining some variable at early stage, so the installation script uses them later..."
if grep -q "QEMU" /proc/bus/input/devices; then
    PORT=19759
else
    PORT=19753
fi
export PORT
dnf install policycoreutils
semanage port -a -t ssh_port_t -p tcp ${PORT}
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

IP="$( ip  -f inet a show eth0| grep inet| awk '{ print $2}' | cut -d/ -f1 )"
IP6="$( ip -6 addr | grep inet6 | awk -F '[ \t]+|/' '{print $3}' | grep -v ^::1 )"
IFACE=$( ip addr | grep $IP | awk '{print $NF}' )
OWNER="owner"
TIMESTAMP=$(date +%s)
SECONDS=0

if [ "$(readlink /etc/localtime)" != "/usr/share/zoneinfo/UTC" ]; then
  echo "=================================================================================="
  echo "Setting local time to UTC .."
  rm -f /etc/localtime
  ln -s /usr/share/zoneinfo/UTC /etc/localtime
fi

# Setting the receiver of the root mail
sed -ie 's/#root:/root:/' /etc/aliases
sed -ie 's/marc/info@altagrade.com/' /etc/aliases
echo "#owner: ${OWNER}" >> /etc/aliases
newaliases

# Disabling IPv6
echo "net.ipv6.conf.all.disable_ipv6 = 1" >> /etc/sysctl.conf
echo "net.ipv6.conf.default.disable_ipv6 = 1" >> /etc/sysctl.conf
echo "Done..."
echo "=================================================================================="

echo "=================================================================================="
echo "Setting cron job definitions before other scripts start puting their own lines..."
cd /var/spool/cron/
rm -f root
cat > root << 'EOF'
# Example of cron job definition on AltaGrade servers:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
#
# 1. Entry: Minute when the process will be started [0-60]
# 2. Entry: Hour when the process will be started [0-23]
# 3. Entry: Day of the month when the process will be started [1-28/29/30/31]
# 4. Entry: Month of the year when the process will be started [1-12]
# 5. Entry: Weekday when the process will be started [0-6] [0 is Sunday]
#
# every x min = */x
# So according to this your 5 8 * * 6 would run 8:05 every Saturday.
# Ex: 39 * * * * wget -O - -q -t 1 http://YourDrupalSite.com/cron.php?key=YourDrupalSiteCronKeyHere
EOF
echo "Done..."
echo "=================================================================================="

echo "=================================================================================="
echo "Installing Virtualmin that comes with Apache, PHP, MariaDB..."
dnf update -y
# Perl per https://forum.virtualmin.com/t/virtualmin-install-sh-support-for-centos-8/104880/19
dnf install perl -y
# Get and run the Virtualmin installation script
wget https://raw.githubusercontent.com/virtualmin/virtualmin-install/master/virtualmin-install.sh
sh virtualmin-install.sh -y
# Need to run updates once more as fresh Webmin UI shows there is an update for libnghttp2
dnf update -y

# We have to stop Webmin in the following particular way, so it successfully restarts
# only if we want to start working right away before the reboot, which is less likely.
# /etc/webmin/stop
# systemctl start webmin.service
# /usr/libexec/webmin/changepass.pl /etc/webmin root tik88Fv

# If we need $MYSQL_VER variable anywhere in the installation script later
# MYSQL_VER=`mysql --version|awk '{ print $5 }'|awk -F\-MariaDB, '{ print $1 }'`

# Remove PHP 7.2 that comes by default, because Drupal 9 requires PHP 7.3 and more.
# dnf remove php-*
# We might leave the original PHP per https://www.virtualmin.com/comment/782623#comment-782623
# just removing php-fpm mode.
dnf -y remove php-fpm
echo "Done..."
echo "=================================================================================="

echo "=================================================================================="
echo "Installing useful packages..."
dnf -y install htop git php-devel gcc gcc-c++ pcre-devel patch libxml2-devel pam-devel \
perl-Authen-PAM nmap
pecl channel-update pecl.php.net

# Per https://github.com/php/pecl-php-uploadprogress PHP-FPM is not supported.
# pecl install uploadprogress
# echo extension=uploadprogress >> /etc/php.d/30-uploadprogress.ini
# pecl install apcu
# echo extension=apcu >> /etc/php.d/30-apcu.ini
# dnf -y install php-pecl-apcu

systemctl enable psacct && systemctl start psacct
echo "Done..."
echo "=================================================================================="

echo "=================================================================================="
echo "Configuring Webmin and Virtualmin..."
# Changes in /etc/webmin/miniserv.conf
sed -ie 's/port=10000/port=19955/' /etc/webmin/miniserv.conf
sed -ie 's#preload=#preload=virtual-server=virtual-server/virtual-server-lib-funcs.pl virtual-server=virtual-server/feature-unix.pl virtual-server=virtual-server/feature-dir.pl virtual-server=virtual-server/feature-dns.pl virtual-server=virtual-server/feature-mail.pl virtual-server=virtual-server/feature-web.pl virtual-server=virtual-server/feature-webalizer.pl virtual-server=virtual-server/feature-ssl.pl virtual-server=virtual-server/feature-logrotate.pl virtual-server=virtual-server/feature-mysql.pl virtual-server=virtual-server/feature-postgres.pl virtual-server=virtual-server/feature-ftp.pl virtual-server=virtual-server/feature-spam.pl virtual-server=virtual-server/feature-virus.pl virtual-server=virtual-server/feature-webmin.pl virtual-server=virtual-server/feature-virt.pl virtual-server=virtual-server/feature-virt6.pl#' /etc/webmin/miniserv.conf
echo 'premodules=WebminCore' >> /etc/webmin/miniserv.conf
# Per https://my.altagrade.com/ticket/2245
echo "no_testing_cookie=1" >> /etc/webmin/miniserv.conf
# Let Webmin know of MariaDB version
# echo $MYSQL_VER > /etc/webmin/mysql/version

sed -ie 's/php_suexec=3/php_suexec=2/' /etc/webmin/virtual-server/config
sed -ie 's/nopwd=0/nopwd=1' /etc/webmin/mysql/config
echo "PORT ${PORT}" > /etc/webmin/virtual-server/globals
echo "DEFAULT_IP 1" >> /etc/webmin/virtual-server/globals
echo "webmin_from=root" >> /etc/webmin/mailboxes/config
echo "sudo=1" >> /etc/webmin/miniserv.conf
sed -ie 's/root: /altagrade: /' /etc/webmin/webmin.acl
sed -ie 's/root:/altagrade:/' /etc/webmin/miniserv.users
if ! grep -Fq "timeserver=pool.ntp.org" /etc/webmin/time/config; then
  echo "timeserver=pool.ntp.org" >> /etc/webmin/time/config
fi

if [ ! -f /etc/webmin/webmincron/crons/150338373415549.cron ]; then
cat >/etc/webmin/webmincron/crons/150338373415549.cron<< 'EOF'
disabled=0
hours=11,14
days=*
mins=0,52
boot=1
id=150338373415549
weekdays=*
func=sync_time_cron
months=*
module=time
EOF
fi
sed -i 's/bandwidth /traffic /g' /etc/webmin/virtual-server/bw-template
sed -i 's/bandwidth /traffic /g' /etc/webmin/virtual-server/warnbw-template
sed -i 's/Bandwidth /Traffic /g' /etc/webmin/virtual-server/bw-template
sed -i 's/Bandwidth /Traffic /g' /etc/webmin/virtual-server/warnbw-template
yes | /usr/libexec/webmin/authentic-theme/theme-update.sh
rm -rf /etc/webmin/authentic-theme
mv /etc/ag/webmin/authentic-theme /etc/webmin
rm -rf /etc/webmin/status
mv /etc/ag/webmin/status /etc/webmin
rm -rf /etc/webmin/custom
mv /etc/ag/webmin/custom /etc/webmin
cat > /etc/webmin/virtual-server/custom-fields << 'EOT'
EOT
cat > /etc/webmin/virtual-server/config << 'EOT'
EOT
cat > /etc/webmin/virtual-server/last-config << 'EOT'
EOT
cat > /etc/webmin/virtual-server/domain-template << 'EOT'
EOT
cat > /etc/webmin/virtual-server/subdomain-template << 'EOT'
EOT
cat > /etc/webmin/virtual-server/templates/1 << 'EOT'
EOT
cat > /etc/webmin/virtual-server/plans/0 << 'EOT'
EOT
cat > /etc/webmin/webmin.descs << 'EOT'
EOT
cat > /etc/webmin/webmin.catnames << 'EOT'
EOT
echo "Done..."
echo "=================================================================================="

echo "=================================================================================="
echo "Installing additional packages..."
if [ ! -f /usr/local/bin/composer ]; then
  cd /usr/src
  curl -sS https://getcomposer.org/installer | sudo php -- --install-dir=/usr/local/bin --filename=composer
fi
dnf -y install memcached
rm -f /etc/sysconfig/memcached
cat <<'EOT' >> /etc/sysconfig/memcached
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="1024"
OPTIONS="-l 127.0.0.1,::1"
EOT
systemctl enable memcached
systemctl start  memcached
rpm -Uvhl http://rpms.remirepo.net/enterprise/remi-release-8.rpm

dnf -y install php74 php74-php-pecl-mysql php74-php-mysqlnd php74-php-curl php74-php-simplexml php74-php-devel php74-php-gd php74-php-json php74-php-mcrypt php74-php-mbstring php74-php-opcache php74-php-pear php74-php-pecl-apcu php74-php-pecl-geoip php74-php-pecl-imagick php74-php-pecl-json-post php74-php-pecl-memcache php74-php-pecl-zip php74-php-pspell php74-php-soap php74-php-xml php74-php-xmlrpc php74-php-pecl-uploadprogress php74-php-imap php74-php-pecl-xmldiff php74-php-bcmath php74-php-fpm

source /opt/remi/php74/enable
dnf -y install php74-php-tidy
pear channel-update pear.php.net
pear install Cache_Lite
 
sed -ie 's/upload_max_filesize = 2M/upload_max_filesize = 20M/' /etc/opt/remi/php74/php.ini
sed -ie 's/post_max_size = 8M/post_max_size = 16M/' /etc/opt/remi/php74/php.ini
sed -ie 's/max_execution_time = 30/max_execution_time = 600/' /etc/opt/remi/php74/php.ini
sed -ie 's/max_input_time = 60/max_input_time = 600/' /etc/opt/remi/php74/php.ini
sed -ie 's/memory_limit = 128M/memory_limit = 1280M/' /etc/opt/remi/php74/php.ini
systemctl enable php74-php-fpm
systemctl start php74-php-fpm
dnf -y install certbot python3-certbot-apache
 
# Install script to auto-replace the ssl_le.pem files for domains
mkdir /etc/letsencrypt/renewal-hooks
mkdir /etc/letsencrypt/renewal-hooks/deploy
cat > /etc/letsencrypt/renewal-hooks/deploy/replace_pems.sh << 'EOF'
#!/bin/sh

# Re-create the ssl_le.pem files for Pound 
for domain in $RENEWED_DOMAINS; do
  cat $RENEWED_LINEAGE/privkey.pem $RENEWED_LINEAGE/fullchain.pem > $RENEWED_LINEAGE/ssl_le.pem
done
 
exit
EOF
chmod 755 /etc/letsencrypt/renewal-hooks/deploy/replace_pems.sh
 
# Install cron-tab to trigger auto-renew
(crontab -l && echo "0 0,12 * * 7 python -c 'import random; import time; time.sleep(random.random() * 3600)' && /etc/ag/scripts/renew-certs" | sort | uniq) | crontab -
sed -i '/Listen/c\#Listen' /etc/httpd/conf.d/ssl.conf
dnf -y install Pound && systemctl enable pound && systemctl start pound
mv /etc/pound.cfg /etc/pound.cfg.orig
cat > /etc/pound.cfg << EOF
ListenHTTP
  Address ${IP}
  Port 80
  Service
    URL "/.well-known/acme-challenge/.*"
    BackEnd
      Address ${IP}
      Port 8888
    End
  End
End
 
Service
    BackEnd
	Address ${IP}
        Port    8888
    End
End
 
EOF
dnf -y install @varnish
systemctl enable varnish --now
# Configure Apache for Varnish
sed -ie 's/Listen 80/Listen 8080/' /etc/httpd/conf/httpd.conf
echo 'RemoteIPHeader X-Forwarded-For' >> /etc/httpd/conf/httpd.conf
echo "RemoteIPInternalProxy $IP" >> /etc/httpd/conf/httpd.conf
sed -ie 's/%h/%a/' /etc/httpd/conf/httpd.conf
sed -ie 's/6081/8888/' /usr/lib/systemd/system/varnish.service
# Crazy, but there is always an extra systemd entry for Varnish. Probably this should be reported to Varnish or Webmin.
rm -rf /usr/lib/systemd/system/varnish.servicee


systemctl daemon-reload
systemctl restart varnish

cat > /etc/varnish/default.vcl << EOF
vcl 4.0;
 
backend default {
    .host = "${IP}";
    .port = "8080";
}
 
acl purge {
  "localhost";
  "127.0.0.1";
}
 
sub vcl_deliver {
  # If proxying via cloudflare, then send 520 responses in place of 500/503
  if ((resp.status == 500 || resp.status == 503) && req.http.cf-connecting-ip) {
    set resp.status = 520;
  }
}
 
sub vcl_recv {
 
#  if (req.http.host == "demo.altagrade.com") {
#     if (req.url !~ "^/user") {
#         unset req.http.cookie;
#     }
#  }

#  if (req.http.Host == "sub.domain.com" || req.http.Host == "db.domain.net" ) {
#    return (pass);
#  }

  if (req.url == "/check-altagrade-varnish") {
    return(synth(200, "Varnish up"));
  }
 
 # Check the incoming request type is "PURGE", not "GET" or "POST".
  if (req.method == "PURGE") {
    # Check if the IP is allowed.
    if (!client.ip ~ purge) {
      # Return error code 405 (Forbidden) when not.
      return (synth(405, "Not allowed."));
    }
    return (purge);
  }
 
# Do not cache these paths.
  if (req.url ~ "^/status\.php$" ||
      req.url ~ "^/update\.php" ||
      req.url ~ "^/install\.php" ||
      req.url ~ "^/apc\.php$" ||
      req.url ~ "^/admin" ||
      req.url ~ "^/admin/.*$" ||
      req.url ~ "^/user" ||
      req.url ~ "^/user/.*$" ||
      req.url ~ "^/users/.*$" ||
      req.url ~ "^/info/.*$" ||
      req.url ~ "^/flag/.*$" ||
      req.url ~ "^.*/ajax/.*$" ||
      req.url ~ "^.*/ahah/.*$" ||
      req.url ~ "^/system/files/.*$") {
 
    return (pass);
  }
 
 # Always cache the following file types for all users. This list of extensions
  # appears twice, once here and again in vcl_backend_response so make sure you edit both
  # and keep them equal.
  if (req.url ~ "(?i)\.(pdf|asc|dat|txt|doc|xls|ppt|tgz|csv|png|gif|jpeg|jpg|ico|swf|css|js)(\?.*)?$") {
    unset req.http.Cookie;
  }
 
  # Remove all cookies that Drupal doesn't need to know about. We explicitly
  # list the ones that Drupal does need, the SESS and NO_CACHE. If, after
  # running this code we find that either of these two cookies remains, we
  # will pass as the page cannot be cached.
  if (req.http.Cookie) {
    # 1. Append a semi-colon to the front of the cookie string.
    # 2. Remove all spaces that appear after semi-colons.
    # 3. Match the cookies we want to keep, adding the space we removed
    #    previously back. (\1) is first matching group in the regsuball.
    # 4. Remove all other cookies, identifying them by the fact that they have
    #    no space after the preceding semi-colon.
    # 5. Remove all spaces and semi-colons from the beginning and end of the
    #    cookie string.
    set req.http.Cookie = ";" + req.http.Cookie;
    set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
    set req.http.Cookie = regsuball(req.http.Cookie, ";(SESS[a-z0-9]+|SSESS[a-z0-9]+|NO_CACHE)=", "; \1=");
    set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
    set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");
 
    if (req.http.Cookie == "") {
      # If there are no remaining cookies, remove the cookie header. If there
      # aren't any cookie headers, Varnish's default behavior will be to cache
      # the page.
      unset req.http.Cookie;
    }
    else {
      # If there is any cookies left (a session or NO_CACHE cookie), do not
      # cache the page. Pass it on to Apache directly.
      return (pass);
    }
  }
 
 
}
EOF
# Remove unnecessary services
firewall-cmd --permanent --remove-service=ftp
firewall-cmd --permanent --remove-service=dhcpv6-client
firewall-cmd --permanent --remove-service=imap
firewall-cmd --permanent --remove-service=imaps
firewall-cmd --permanent --remove-service=pop3
firewall-cmd --permanent --remove-service=pop3s
firewall-cmd --permanent --remove-service=smtp
firewall-cmd --permanent --remove-service=smtps

# Remove ports which come open by default
firewall-cmd --permanent --zone=public --remove-port=1025-65535/tcp
firewall-cmd --permanent --zone=public --remove-port=10000-10100/tcp
firewall-cmd --permanent --zone=public --remove-port=20000/tcp
firewall-cmd --permanent --zone=public --remove-port=2222/tcp
firewall-cmd --permanent --zone=public --remove-port=20/tcp
firewall-cmd --permanent --zone=public --remove-port=587/tcp
firewall-cmd --permanent --zone=public --remove-port=53/tcp
firewall-cmd --permanent --zone=public --remove-port=53/udp

# Open needed ports
firewall-cmd --permanent --zone=public --add-port=8080/tcp
firewall-cmd --permanent --zone=public --add-port=8888/tcp
firewall-cmd --permanent --zone=public --add-port=${PORT}/tcp
firewall-cmd --permanent --zone=public --add-port=19955/tcp

firewall-cmd --reload
# Installing drush
wget https://github.com/drush-ops/drush/releases/download/8.3.3/drush.phar
php drush.phar core-status
chmod +x drush.phar
mv drush.phar /usr/local/bin/drush
drush -y init
 
# Fixing https://github.com/drush-ops/drush/issues/2065
# sed -i '/disable_functions/c\disable_functions = pcntl_exec' /etc/php.ini
# sed -i '/disable_functions/c\disable_functions = pcntl_exec' /etc/opt/remi/php74/php.ini
cd /usr/local/src
git clone https://github.com/backdrop-contrib/brush.git
ln -s /usr/local/src/brush/brush /usr/local/bin
dnf install fail2ban -y

# Start and enable
systemctl start fail2ban
systemctl enable fail2ban

# Replace local fail2ban configuration
rm -rf /etc/fail2ban/jail.local
echo "[DEFAULT]
# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
# will not ban a host that matches an address in this list. Several addresses
# can be defined using space (and/or comma) separator.
# VPN's ip address and subnet
ignoreip = 127.0.0.1/8 10.0.0.1/24 66.160.206.199

# "bantime" is the number of seconds that a host is banned.
bantime = 60m
# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 5m
# "maxretry" is the number of failures before a host gets banned.
maxretry = 5
# "backend" specifies the backend used to get files modification.
# systemd: uses systemd python library to access the systemd journal.
# Specifying "logpath" is not valid for this backend.
# See "journalmatch" in the jails associated filter config
backend=systemd

[sshd]
enabled = true
port = ssh
action = firewallcmd-ipset
logpath = %(sshd_log)s

[webmin-auth]
enabled = true
port    = 19955

[proftpd]
enabled  = true
port     = ftp,ftp-data,ftps,ftps-data

[postfix]
enabled  = true
port     = smtp,465,submission

[dovecot]
enabled = true
port    = pop3,pop3s,imap,imaps,submission,465,sieve

[postfix-sasl]
enabled  = true
port     = smtp,465,submission,imap,imaps,pop3,pop3s" >> /etc/fail2ban/jail.local

# Restart fail2ban
systemctl restart fail2ban



echo "Done..."
echo "=================================================================================="

echo "=================================================================================="
echo "Configure AltaOS 8..."
dnf -y install dnf-automatic
sed -ie 's/apply_updates = no/apply_updates = yes/' /etc/dnf/automatic.conf
sed -ie 's/emit_via = stdio/emit_via = email,stdio/' /etc/dnf/automatic.conf
sed -ie 's/email_from = root@example.com/email_from = root/' /etc/dnf/automatic.conf
systemctl enable --now dnf-automatic.timer
if ! id "altagrade" >/dev/null 2>&1; then
  echo "=================================================================================="
  echo "Creating altagrade user .."
  # Disabling root password
  dnf -y install "perl(IO::Pty)"
  passwd -d root
  useradd -G wheel altagrade
  openssl rand -base64 12 | passwd altagrade --stdin
  echo "Setting %wheel group members passwordless sudoers .."
  sed -ie 's/%wheel/#%wheel/' /etc/sudoers && sed -ie 's/# #%wheel/%wheel/' /etc/sudoers
  mkdir /home/altagrade/.ssh
  echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC753VZbicoElj5moS0XZ70ERwse483Cuqc6Jf3YXJvn4+ZGzdjUsUI4+0GHK0aufeFh4YNZQ9QoQnM/3HUKZIGm3/2lYvzY1Z2YtyWz57LSX6o+oskq01Pe+3g+sxbt1yOW/KhClVhTSNzFPtMV5h4//JLxdO1Z6pctXSgq2COZ9fnEAm/AzmYFpuNvg0JmNdWuFkvnSKZrkt9hmw72TTjTE+p9DviTmoq4GCr6l2Pg4y6oTlyQ595yi6wDZe0JK7cdkKMsA4U6kAyHqci7zXOu7HjLdYcKZCohCp/iddHZbERmlZuS1eGbiARYtBZb9FNdUmnUB3nggb4DU3FPeDl
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGfQcSb8ATF0+1LZTEFEXvTz9tl67VDr+Zklu5YJhWajezq6hom4RZ3wWZd01P6qIsqy+wbcY+9NGo/sjU5dRg70lRMYzOU0fX5qz8mz/I3EiXBjSu2Pv2gAKj6ajX0ifMXwNcZkxNX2BLIbHgjSsw9ci5L610gFGjR65q66jjwAIDZP+Ohih7oerfK1LWRcNIsrkUTVSbVWJQytiiyH9Up9Q5wzIceq7H2Kc4GUS0FYKM52oNhpGSD9hPR449w528/hEBeHr1rAT294qZYR59jrZYTtlwOcXU/JlOef0n+G4++dd75zQZ+/NZCh8S+kuYY+Lzip2W6EzMpUvmPVih nurlan' >> /home/altagrade/.ssh/authorized_keys
  restorecon -R -v /home/altagrade/.ssh
  sed -i "s/#Port 22/Port ${PORT}/g" /etc/ssh/sshd_config
  sed -i "s/#PermitRootLogin yes/PermitRootLogin no/g" /etc/ssh/sshd_config
  sed -i "s/PasswordAuthentication yes/PasswordAuthentication no/g" /etc/ssh/sshd_config
fi
# Setting the database root password
dnf -y install expect
 
MYSQL_ROOT_PASSWORD=`date +%s | sha256sum | base64 | head -c 16 ; echo`
 
SECURE_MYSQL=$(expect -c "
 
set timeout 3
spawn mysql_secure_installation
 
expect \"Enter current password for root (enter for none):\"
send \"$CURRENT_MYSQL_PASSWORD\r\"
 
expect \"Set root password?\"
send \"y\r\"
 
expect \"New password:\"
send \"$MYSQL_ROOT_PASSWORD\r\"
 
expect \"Re-enter new password:\"
send \"$MYSQL_ROOT_PASSWORD\r\"
 
expect \"Remove anonymous users?\"
send \"y\r\"
 
expect \"Disallow root login remotely?\"
send \"y\r\"
 
expect \"Remove test database and access to it?\"
send \"y\r\"
 
expect \"Reload privilege tables now?\"
send \"y\r\"
expect eof
")
 
echo "$SECURE_MYSQL"
 
dnf -y remove expect
 
if grep -q pass= /etc/webmin/mysql/config; then
  sed -i "/pass=/c\pass=$MYSQL_ROOT_PASSWORD" /etc/webmin/mysql/config
else
  echo pass=$MYSQL_ROOT_PASSWORD >> /etc/webmin/mysql/config
fi

# Done setting the database root password

if ! grep -Fq "default-character-set = utf8mb4" /etc/my.cnf
then
  rm -f  /etc/my.cnf
cat > /etc/my.cnf << 'EOF'
[client]
default-character-set = utf8mb4
 
[mysql]
default-character-set = utf8mb4

[mysqld]
innodb_file_per_table=true
innodb_flush_log_at_trx_commit = 0
innodb_log_buffer_size  = 8M
innodb_buffer_pool_size = 1G
innodb_thread_concurrency = 16
innodb_lock_wait_timeout = 120
innodb_data_file_path   = ibdata1:10M:autoextend
innodb_max_dirty_pages_pct = 90

slow_query_log = 1
slow_query_log_file = /var/log/mariadb/slow.log

query_cache_size = 128M
query_cache_limit = 16M


thread_cache_size = 8
myisam_sort_buffer_size = 64M
read_rnd_buffer_size = 8M
read_buffer_size = 2M
sort_buffer_size = 2M
table_cache = 512
max_allowed_packet=1024M
key_buffer_size = 384M
wait_timeout=600
max_connections = 600
tmp_table_size = 256M
max_heap_table_size = 256M


#
# This group is read both both by the client and the server
# use it for options that affect everything
#
[client-server]

#
# include all files from the config directory
#
!includedir /etc/my.cnf.d
EOF
fi

# Per https://bugzilla.redhat.com/show_bug.cgi?id=1468028
sed -i s/^plugin-load-add=auth_gssapi.so/#plugin-load-add=auth_gssapi.so/g /etc/my.cnf.d/auth_gssapi.cnf


# Should go to elsewhere
# Per https://coderwall.com/p/fukoew/speed-up-ssh-logon-by-disabling-gssapiauthentication
sed -i '/GSSAPIAuthentication yes/c\GSSAPIAuthentication no' /etc/ssh/sshd_config
if [ ! -d /home/backup ]; then
  echo "Creating /home/backup directory .."
  mkdir /home/backup
  echo "Creating a symlink /backup to /home/backup .."
  ln -s /home/backup /backup
fi

if [ ! -d /sandbox ]; then
  echo "Creating /sandbox directory .."
  mkdir /sandbox
fi
if ! grep -Fq "Welcome" /etc/motd
then
  echo "Creating /etc/motd .."
cat <<EOT >> /etc/motd
*****************************************************************************
*             Welcome to AltaGrade Optimized Operating System!              *
*                                                                           *
* For any issues please browse through the AltaGrade platform documentation *
* on https://www.altagrade.com/help. If you can't find a suitable solution, *
* then submit a support request on https://my.altagrade.com.                *
*                                                                           *
*****************************************************************************
EOT
fi

if grep -Fq "#Banner none" /etc/ssh/sshd_config
then
  sed -ie '/#Banner none/c\Banner /etc/banner' /etc/ssh/sshd_config
else
  echo 'Banner /etc/banner' >> /etc/ssh/sshd_config
fi

if ! grep -Fq "" /etc/banner
then
  echo "Creating /etc/banner .."
cat <<EOT >> /etc/banner
 
 
     **      **   **               ********                        **        
    ****    /**  /**              **//////**                      /**        
   **//**   /** ******  ******   **      //  ******  ******       /**  ***** 
  **  //**  /**///**/  //////** /**         //**//* //////**   ****** **///**
 ********** /**  /**    ******* /**    ***** /** /   *******  **///**/*******
/**//////** /**  /**   **////** //**  ////** /**    **////** /**  /**/**//// 
/**     /** ***  //** //******** //******** /***   //********//******//******
//      // ///    //   ////////   ////////  ///     ////////  //////  //////                                                                               
 
 
EOT
fi
if ! grep -Fq "update-webmin" /root/.bashrc; then
  echo "Creating root aliases .."
  cat >> /root/.bashrc << 'EOF'
alias update-webmin='yes | /usr/libexec/webmin/update-from-repo.sh'
alias update-theme='yes | /usr/libexec/webmin/authentic-theme/theme-update.sh'
alias webminpass='/usr/libexec/webmin/changepass.pl /etc/webmin root'
alias ps10='ps -auxf | sort -nr -k 4 | head -10'
alias cpu10='ps -eo pcpu,pid,user,args | sort -k 1 -r | head -10'
alias qchwr='drush pml --no-core --type=module --status=enabled --pipe | xargs drush -y dis'
alias repo='sed -n -e "/^\[/h; /priority *=/{ G; s/\n/ /; s/ity=/ity = /; p }" /etc/yum.repos.d/*.repo | sort -k3n'
alias psx="ps -eo pcpu,pid -o comm= | sort -k1 -n -r | head -12"
alias psg="ps fuxa |grep $1"
alias psm="ps -eo pmem,pcpu,rss,vsize,args | sort -k 1 -r | less"
alias eba='nano /etc/profile.d/globaliases.sh'
alias lba='source /etc/profile.d/globaliases.sh'
 
alias net1='rm -rf /etc/udev/rules.d/70-persistent-net.rules'
alias net2='nano /etc/resolv.conf'
alias net3='nano /etc/sysconfig/network-scripts/ifcfg*'
 
snd () {
rsync --rsh -av -e 'ssh -p 19759' --progress --partial ${1} root@IP:/
}
 
# sync two directories
# rsync -azP -e 'ssh -p 19759' local_dir root@IP:/remote_dir

EOF
fi
if grep -Fq 'installonly_limit=3' /etc/yum.conf
then
  echo "Setting amount of installed kernels to 2 .."
  sed -ie 's/installonly_limit=3/installonly_limit=2/' /etc/yum.conf
fi
if [ -f /etc/ag/scripts/login-notify.sh ]; then
  chmod 755 /etc/ag/scripts/login-notify.sh
  echo 'session optional pam_exec.so seteuid /etc/ag/scripts/login-notify.sh' >> /etc/pam.d/sshd
fi
cat > /etc/cron.daily/altagrade << 'EOF'
#!/bin/bash
sed -ie 's/CentOS/AltaOS/' /etc/webmin/config >/dev/null 2>&1
sh /etc/ag/cp/new-lang.sh >/dev/null 2>&1
sed -ie 's/slider_enabled=true/slider_enabled=false/' /etc/webmin/authentic-theme/settings.js >/dev/null 2>&1
/usr/libexec/webmin/update-from-repo.sh -y >/dev/null 2>&1
/usr/libexec/webmin/authentic-theme/theme-update.sh -y >/dev/null 2>&1
exit
EOF
chmod 755 /etc/cron.daily/altagrade
/etc/cron.daily/altagrade
echo '*               soft    nofile            65535' >> /etc/security/limits.conf
echo '*               hard    nofile            65535' >> /etc/security/limits.conf
 
if ! grep -q 127.0.0.1 "/etc/resolv.conf"; then
  echo "nameserver 127.0.0.1" >> /etc/resolv.conf
fi
grep -rl 65.49.80.99 /etc | xargs sed -i "s/65.49.80.99/$IP/g"
grep -rl fe80::216:3eff:feca:7117 /etc | xargs sed -i "s/fe80::216:3eff:feca:7117/$IP6/g"
grep -rl host.altagrade.org /etc | xargs sed -i "s/host.altagrade.org/$HOSTNAME/g"
grep -rl eth0 /etc | xargs sed -i "s/eth0/$IFACE/g"
# Per https://www.virtualmin.com/node/43097
rm -rf /var/webmin/module.infos.cache
/sbin/virtualmin check-config
# Removing cockpit
systemctl stop cockpit && systemctl disable cockpit
dnf -y remove cockpit
firewall-cmd --permanent --remove-service=cockpit

# Disabling Usermin
/usr/lib/systemd/systemd-sysv-install disable usermin

rm -rf /etc/httpd/conf.d/welcome.conf 
chown -R root:bin /etc/webmin

systemctl stop chronyd && yum -y remove chrony
systemctl stop wpa_supplicant && yum -y remove wpa_supplicant
# systemctl stop fail2ban && yum -y remove fail2ban* && rm -rf /var/log/fail2ban.log
systemctl stop proftpd && yum -y remove proftpd && rm -rf /var/log/proftpd
if [ $PORT == 19759 ]; then
  systemctl stop sound.target && systemctl disable sound.target
fi
sed -ie '/SSLProtocol/c\SSLProtocol All -SSLv2 -SSLv3' /etc/httpd/conf/httpd.conf
sed -ie '/SSLCipherSuite/c\SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"' /etc/httpd/conf/httpd.conf
sed -ie '/SSLCipherSuite/i\SSLHonorCipherOrder on' /etc/httpd/conf/httpd.conf
 
# per https://support.plesk.com/hc/en-us/articles/213399589-Websites-are-slow-and-a-warning-appears-in-logs-mod-fcgid-ap-pass-brigade-failed
echo 'FcgidMaxRequestsPerProcess 500' >> /etc/httpd/conf.d/fcgid.conf
echo 'FcgidOutputBufferSize 0' >> /etc/httpd/conf.d/fcgid.conf
sed -ie 's|LoadModule|#LoadModule|' /etc/httpd/conf.modules.d/00-dav.conf
 
# Maybe we can turn the below ones off.
sed -ie 's/LoadModule proxy/#LoadModule proxy/' /etc/httpd/conf.modules.d/00-proxy.conf
sed -ie 's@#LoadModule proxy_module@LoadModule proxy_module@g' /etc/httpd/conf.modules.d/00-proxy.conf
sed -ie 's@#LoadModule proxy_fcgi_module@LoadModule proxy_fcgi_module@g' /etc/httpd/conf.modules.d/00-proxy.conf
sed -ie 's@LoadModule lbmethod_heartbeat@#LoadModule lbmethod_heartbeat@g' /etc/httpd/conf.modules.d/00-proxy.conf
cat > /etc/ag/scripts/update-drupal << 'EOT'
EOT
echo "Done..."
echo "=================================================================================="

echo "=================================================================================="
echo "Finalizing the installation script..."
# Calculating execution time
executed="$(($SECONDS / 60)) minutes and $(($SECONDS % 60)) seconds"
echo "The installation took $executed"
echo "AltaOS8 installed on $(date)" > /root/.altaos/.install_date
 
# Sending the final e-mail notification
dnf -y install mailx
echo "Installation of AltaOS8 on ${HOSTNAME} completed in $executed. The system is rebooting..." | mail -s "AltaOS8 has been installed on ${HOSTNAME}" 6504506428@vtext.com
 
rm -f /root/recipe*
rm -f /usr/src/altaos8.sh
 
updatedb
echo "Rebooting the system..."
reboot
echo "Done..."
echo "=================================================================================="

exit