API tools faq
paste
tomba2k

hestia-install.sh

tomba2k
Apr 28th, 2020
397
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 30.53 KB | None | 0 0
raw download clone embed print report
  1. export PATH=$PATH:/sbin
  2. RHOST='apt.hestiacp.com'
  3. GPG='gpg.hestiacp.com'
  4. HESTIA='/usr/local/hestia'
  5. LOG="/root/hst_install_backups/hst_install-$(date +%d%m%Y%H%M).log"
  6. memory=$(grep 'MemTotal' /proc/meminfo |tr ' ' '\n' |grep [0-9])
  7. hst_backups="/root/hst_install_backups/$(date +%d%m%Y%H%M)"
  8. arch=$(uname -i)
  9. spinner="/-\|"
  10. codename="$(cat /etc/os-release |grep VERSION= |cut -f 2 -d \(|cut -f 1 -d \))"
  11. pma_v='5.0.1'
  12. fpm_v="7.4"
  13. HESTIA_INSTALL_DIR="$HESTIA/install/deb"
  14.  
  15. nginx='yes'
  16. phpfpm='yes'
  17. multiphp='no'
  18. vsftpd='yes'
  19. proftpd='no'
  20. named='yes'
  21. mysql='yes'
  22. postgresql='no'
  23. exim='yes'
  24. dovecot='yes'
  25. clamd='yes'
  26. spamd='yes'
  27. iptables='yes'
  28. fail2ban='yes'
  29. quota='no'
  30. interactive='yes'
  31. api='yes'
  32. email='[email protected]'
  33. lang='en'
  34. port=8083
  35.  
  36. # Defining password-gen function
  37. gen_pass() {
  38.     MATRIX='0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
  39.     LENGTH=10
  40.     while [ ${n:=1} -le $LENGTH ]; do
  41.         PASS="$PASS${MATRIX:$(($RANDOM%${#MATRIX})):1}"
  42.         let n+=1
  43.     done
  44.     echo "$PASS"
  45. }
  46.  
  47. software="awstats bc bind bind-libs bind-utils clamav clamav-update
  48.    curl dovecot e2fsprogs exim expect fail2ban flex freetype ftp GeoIP httpd
  49.    ImageMagick iptables-services lsof mailx mc
  50.    net-tools nginx openssh-clients pcre libidn git php
  51.    php-bcmath php-cli php-common php-fpm php-gd php-imap php-mbstring
  52.    php-mcrypt phpMyAdmin php-mysql php-pdo php-pgsql php-soap
  53.    php-tidy php-xml php-xmlrpc php-opcache php-pspell php-readline
  54.    php-imagick php-intl php-json php-bz2 php-zip php-ldap php-apcu php-curl
  55.    roundcubemail rrdtool rsyslog screen
  56.    spamassassin sqlite sudo tar telnet unzip quota
  57.    sudo vim-common vsftpd which zip sysstat"
  58.  
  59. # Asking for confirmation to proceed
  60. if [ "$interactive" = 'yes' ]; then
  61.     read -p 'Would you like to continue with the installation? [Y/N]: ' answer
  62.     if [ "$answer" != 'y' ] && [ "$answer" != 'Y'  ]; then
  63.         echo 'Goodbye'
  64.         exit 1
  65.     fi
  66.  
  67.     # Asking for contact email
  68.     if [ -z "$email" ]; then
  69.         read -p 'Please enter admin email address: ' email
  70.     fi
  71.  
  72.     # Asking to set FQDN hostname
  73.     if [ -z "$servername" ]; then
  74.         read -p "Please enter FQDN hostname [$(hostname -f)]: " servername
  75.     fi
  76. fi
  77.  
  78. # Set hostname if it wasn't set
  79. if [ -z "$servername" ]; then
  80.     servername=$(hostname -f)
  81. fi
  82.  
  83. # Set FQDN if it wasn't set
  84. mask1='(([[:alnum:]](-?[[:alnum:]])*)\.)'
  85. mask2='*[[:alnum:]](-?[[:alnum:]])+\.[[:alnum:]]{2,}'
  86. if ! [[ "$servername" =~ ^${mask1}${mask2}$ ]]; then
  87.     if [ ! -z "$servername" ]; then
  88.         servername="$servername.example.com"
  89.     else
  90.         servername="example.com"
  91.     fi
  92.     echo "127.0.0.1 $servername" >> /etc/hosts
  93. fi
  94.  
  95. # Set email if it wasn't set
  96. if [ -z "$email" ]; then
  97.     email="admin@$servername"
  98. fi
  99.  
  100. # Creating backup directory tree
  101. mkdir -p $hst_backups
  102. cd $hst_backups
  103. mkdir nginx apache2 php vsftpd proftpd bind exim4 dovecot clamd
  104. mkdir spamassassin mysql postgresql hestia
  105.  
  106. # Backup nginx configuration
  107. systemctl stop nginx > /dev/null 2>&1
  108. cp -r /etc/nginx/* $hst_backups/nginx > /dev/null 2>&1
  109.  
  110. # Backup Apache configuration
  111. systemctl stop apache2 > /dev/null 2>&1
  112. cp -r /etc/apache2/* $hst_backups/apache2 > /dev/null 2>&1
  113. rm -f /etc/apache2/conf.d/* > /dev/null 2>&1
  114.  
  115. # Backup PHP-FPM configuration
  116. systemctl stop php*-fpm > /dev/null 2>&1
  117. cp -r /etc/php/* $hst_backups/php/ > /dev/null 2>&1
  118.  
  119. # Backup Bind configuration
  120. systemctl stop named > /dev/null 2>&1
  121. cp -r /etc/named* $hst_backups/named > /dev/null 2>&1
  122.  
  123. # Backup Vsftpd configuration
  124. systemctl stop vsftpd > /dev/null 2>&1
  125. cp /etc/vsftpd.conf $hst_backups/vsftpd > /dev/null 2>&1
  126.  
  127. # Backup ProFTPD configuration
  128. systemctl stop proftpd > /dev/null 2>&1
  129. cp /etc/proftpd.conf $hst_backups/proftpd > /dev/null 2>&1
  130.  
  131. # Backup Exim configuration
  132. systemctl stop exim > /dev/null 2>&1
  133. cp -r /etc/exim/* $hst_backups/exim > /dev/null 2>&1
  134.  
  135. # Backup ClamAV configuration
  136. systemctl stop clamav-daemon > /dev/null 2>&1
  137. cp -r /etc/clam* $hst_backups/clamav > /dev/null 2>&1
  138.  
  139. # Backup SpamAssassin configuration
  140. systemctl stop spamassassin > /dev/null 2>&1
  141. cp -r /etc/spamassassin/* $hst_backups/spamassassin > /dev/null 2>&1
  142.  
  143. # Backup Dovecot configuration
  144. systemctl stop dovecot > /dev/null 2>&1
  145. cp /etc/dovecot.conf $hst_backups/dovecot > /dev/null 2>&1
  146. cp -r /etc/dovecot/* $hst_backups/dovecot > /dev/null 2>&1
  147.  
  148. # Backup MySQL/MariaDB configuration and data
  149. systemctl stop mysql > /dev/null 2>&1
  150. killall -9 mysqld > /dev/null 2>&1
  151. mv /var/lib/mysql $hst_backups/mysql/mysql_datadir > /dev/null 2>&1
  152. cp -r /etc/percona-server.conf.d* $hst_backups/mysql > /dev/null 2>&1
  153. mv -f /root/.my.cnf $hst_backups/mysql > /dev/null 2>&1
  154.  
  155. # Backup Hestia
  156. systemctl stop hestia > /dev/null 2>&1
  157. cp -r $HESTIA/* $hst_backups/hestia > /dev/null 2>&1
  158. rm -rf $HESTIA > /dev/null 2>&1
  159.  
  160. # Restarting rsyslog
  161. service rsyslog restart > /dev/null 2>&1
  162.  
  163. # Checking ipv6 on loopback interface
  164. check_lo_ipv6=$(/sbin/ip addr | grep 'inet6')
  165. check_rc_ipv6=$(grep 'scope global dev lo' /etc/rc.local)
  166. if [ ! -z "$check_lo_ipv6)" ] && [ -z "$check_rc_ipv6" ]; then
  167.     ip addr add ::2/128 scope global dev lo
  168.     echo "# Vesta: Workraround for openssl validation func" >> /etc/rc.local
  169.     echo "ip addr add ::2/128 scope global dev lo" >> /etc/rc.local
  170.     chmod a+x /etc/rc.local
  171. fi
  172.  
  173. # Disabling SELinux
  174. if [ -e '/etc/sysconfig/selinux' ]; then
  175.     sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/sysconfig/selinux
  176.     sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
  177.     setenforce 0 2>/dev/null
  178. fi
  179.  
  180. # Disabling iptables
  181. service iptables stop
  182. service firewalld stop >/dev/null 2>&1
  183.  
  184. # Adding backup user
  185. adduser backup 2>/dev/null
  186. ln -sf /home/backup /backup
  187. chmod a+x /backup
  188.  
  189. # Set directory color
  190. echo 'LS_COLORS="$LS_COLORS:di=00;33"' >> /etc/profile
  191.  
  192. # Register /sbin/nologin and /usr/sbin/nologin
  193. echo "/sbin/nologin" >> /etc/shells
  194. echo "/usr/sbin/nologin" >> /etc/shells
  195.  
  196. # Changing default systemd interval
  197. echo "DefaultStartLimitInterval=1s" >> /etc/systemd/system.conf
  198. echo "DefaultStartLimitBurst=60" >> /etc/systemd/system.conf
  199. systemctl daemon-reexec
  200.  
  201. echo "(*) Configuring system settings..."
  202. # Enable SSH password authentication
  203. sed -i "s/rdAuthentication no/rdAuthentication yes/g" /etc/ssh/sshd_config
  204.  
  205.  
  206. # Reduce SSH login grace time
  207. sed -i "s/LoginGraceTime 2m/LoginGraceTime 1m/g" /etc/ssh/sshd_config
  208. sed -i "s/#LoginGraceTime 2m/LoginGraceTime 1m/g" /etc/ssh/sshd_config
  209.  
  210. # Set directory color
  211. if [ -z "$(grep 'LS_COLORS="$LS_COLORS:di=00;33"' /etc/profile)" ]; then
  212.     echo 'LS_COLORS="$LS_COLORS:di=00;33"' >> /etc/profile
  213. fi
  214.  
  215. # Registering /usr/sbin/nologin
  216. if [ -z "$(grep nologin /etc/shells)" ]; then
  217.     echo "/usr/sbin/nologin" >> /etc/shells
  218. fi
  219.  
  220. echo "(*) Configuring Hestia Control Panel..."
  221. # Installing sudo configuration
  222. mkdir -p /etc/sudoers.d
  223. cp -fn $HESTIA_INSTALL_DIR/sudo/admin /etc/sudoers.d/
  224. chmod 440 /etc/sudoers.d/admin
  225.  
  226. # Configuring system env
  227. echo "export HESTIA='$HESTIA'" > /etc/profile.d/hestia.sh
  228. echo 'PATH=$PATH:'$HESTIA'/bin' >> /etc/profile.d/hestia.sh
  229. echo 'export PATH' >> /etc/profile.d/hestia.sh
  230. chmod 755 /etc/profile.d/hestia.sh
  231. source /etc/profile.d/hestia.sh
  232.  
  233. # Configuring logrotate for Hestia logs
  234. cp -fn $HESTIA_INSTALL_DIR/logrotate/hestia /etc/logrotate.d/hestia
  235.  
  236. # Building directory tree and creating some blank files for Hestia
  237. mkdir -p $HESTIA/conf $HESTIA/log $HESTIA/ssl $HESTIA/data/ips \
  238.     $HESTIA/data/queue $HESTIA/data/users $HESTIA/data/firewall \
  239.     $HESTIA/data/sessions
  240. touch $HESTIA/data/queue/backup.pipe $HESTIA/data/queue/disk.pipe \
  241.     $HESTIA/data/queue/webstats.pipe $HESTIA/data/queue/restart.pipe \
  242.     $HESTIA/data/queue/traffic.pipe $HESTIA/log/system.log \
  243.     $HESTIA/log/nginx-error.log $HESTIA/log/auth.log
  244. chmod 750 $HESTIA/conf $HESTIA/data/users $HESTIA/data/ips $HESTIA/log
  245. chmod -R 750 $HESTIA/data/queue
  246. chmod 660 $HESTIA/log/*
  247. rm -f /var/log/hestia
  248. ln -s $HESTIA/log /var/log/hestia
  249. chmod 770 $HESTIA/data/sessions
  250.  
  251. # Generating Hestia configuration
  252. rm -f $HESTIA/conf/hestia.conf > /dev/null 2>&1
  253. touch $HESTIA/conf/hestia.conf
  254. chmod 660 $HESTIA/conf/hestia.conf
  255.  
  256. echo "WEB_SYSTEM='nginx'" >> $HESTIA/conf/hestia.conf
  257. echo "WEB_PORT='80'" >> $HESTIA/conf/hestia.conf
  258. echo "WEB_SSL_PORT='443'" >> $HESTIA/conf/hestia.conf
  259. echo "WEB_SSL='openssl'"  >> $HESTIA/conf/hestia.conf
  260. #echo "STATS_SYSTEM='awstats'" >> $HESTIA/conf/hestia.conf
  261. echo "WEB_BACKEND='php-fpm'" >> $HESTIA/conf/hestia.conf
  262.  
  263. installed_db_types='mysql'
  264.  
  265. db=$(echo "$installed_db_types" |\
  266.     sed "s/,/\n/g"|\
  267.     sort -r -u |\
  268.     sed "/^$/d"|\
  269.     sed ':a;N;$!ba;s/\n/,/g')
  270. echo "DB_SYSTEM='$db'" >> $HESTIA/conf/hestia.conf
  271.  
  272. echo "FTP_SYSTEM='vsftpd'" >> $HESTIA/conf/hestia.conf
  273. echo "DNS_SYSTEM='named'" >> $HESTIA/conf/hestia.conf
  274.  
  275. # Mail stack
  276. if [ "$exim" = 'yes' ]; then
  277.     echo "MAIL_SYSTEM='exim'" >> $HESTIA/conf/hestia.conf
  278.     if [ "$clamd" = 'yes'  ]; then
  279.         echo "ANTIVIRUS_SYSTEM='clamav-daemon'" >> $HESTIA/conf/hestia.conf
  280.     fi
  281.     if [ "$spamd" = 'yes' ]; then
  282.         echo "ANTISPAM_SYSTEM='spamassassin'" >> $HESTIA/conf/hestia.conf
  283.     fi
  284.     if [ "$dovecot" = 'yes' ]; then
  285.         echo "IMAP_SYSTEM='dovecot'" >> $HESTIA/conf/hestia.conf
  286.     fi
  287. fi
  288.  
  289. # Cron daemon
  290. echo "CRON_SYSTEM='crond'" >> $HESTIA/conf/hestia.conf
  291.  
  292. # Firewall stack
  293. if [ "$iptables" = 'yes' ]; then
  294.     echo "FIREWALL_SYSTEM='iptables'" >> $HESTIA/conf/hestia.conf
  295. fi
  296. if [ "$iptables" = 'yes' ] && [ "$fail2ban" = 'yes' ]; then
  297.     echo "FIREWALL_EXTENSION='fail2ban'" >> $HESTIA/conf/hestia.conf
  298. fi
  299.  
  300. # Disk quota
  301. if [ "$quota" = 'yes' ]; then
  302.     echo "DISK_QUOTA='yes'" >> $HESTIA/conf/hestia.conf
  303. fi
  304.  
  305. # Backups
  306. echo "BACKUP_SYSTEM='local'" >> $HESTIA/conf/hestia.conf
  307.  
  308. # Language
  309. echo "LANGUAGE='$lang'" >> $HESTIA/conf/hestia.conf
  310.  
  311. # Version & Release Branch
  312. echo "VERSION='1.1.1'" >> $HESTIA/conf/hestia.conf
  313. echo "RELEASE_BRANCH='release'" >> $HESTIA/conf/hestia.conf
  314.  
  315. # Installing hosting packages
  316. cp -rf $HESTIA_INSTALL_DIR/packages $HESTIA/data/
  317.  
  318. # Update nameservers in hosting package
  319. IFS='.' read -r -a domain_elements <<< "$servername"
  320. if [ ! -z "${domain_elements[-2]}" ] && [ ! -z "${domain_elements[-1]}" ]; then
  321.     serverdomain="${domain_elements[-2]}.${domain_elements[-1]}"
  322.     sed -i s/"domain.tld"/"$serverdomain"/g $HESTIA/data/packages/*.pkg
  323. fi
  324.  
  325. # Installing templates
  326. cp -rf $HESTIA_INSTALL_DIR/templates $HESTIA/data/
  327.  
  328. mkdir -p /var/www/html
  329. mkdir -p /var/www/document_errors
  330.  
  331. # Install default success page
  332. cp -rf $HESTIA_INSTALL_DIR/templates/web/unassigned/index.html /var/www/html/
  333. cp -rf $HESTIA_INSTALL_DIR/templates/web/skel/document_errors/* /var/www/document_errors/
  334.  
  335. # Installing firewall rules
  336. cp -rf $HESTIA_INSTALL_DIR/firewall $HESTIA/data/
  337.  
  338. # Configuring server hostname
  339. $HESTIA/bin/v-change-sys-hostname $servername > /dev/null 2>&1
  340.  
  341. # Generating SSL certificate
  342. echo "(*) Generating default self-signed SSL certificate..."
  343. $HESTIA/bin/v-generate-ssl-cert $(hostname) $email 'US' 'California' \
  344.      'San Francisco' 'Hestia Control Panel' 'IT' > /tmp/hst.pem
  345.  
  346. # Parsing certificate file
  347. crt_end=$(grep -n "END CERTIFICATE-" /tmp/hst.pem |cut -f 1 -d:)
  348. key_start=$(grep -n "BEGIN RSA" /tmp/hst.pem |cut -f 1 -d:)
  349. key_end=$(grep -n  "END RSA" /tmp/hst.pem |cut -f 1 -d:)
  350.  
  351. # Adding SSL certificate
  352. echo "(*) Adding SSL certificate to Hestia Control Panel..."
  353. cd $HESTIA/ssl
  354. sed -n "1,${crt_end}p" /tmp/hst.pem > certificate.crt
  355. sed -n "$key_start,${key_end}p" /tmp/hst.pem > certificate.key
  356. chown root:mail $HESTIA/ssl/*
  357. chmod 660 $HESTIA/ssl/*
  358. rm /tmp/hst.pem
  359.  
  360. # Adding nologin as a valid system shell
  361. if [ -z "$(grep nologin /etc/shells)" ]; then
  362.     echo "/usr/sbin/nologin" >> /etc/shells
  363. fi
  364.  
  365. # Install dhparam.pem
  366. #cp -fn $HESTIA_INSTALL_DIR/ssl/dhparam.pem /etc/ssl
  367. openssl dhparam -dsaparam -out /etc/ssl/dhparam.pem 4096
  368.  
  369. if [ "$nginx" = 'yes' ]; then
  370.     echo "(*) Configuring NGINX..."
  371.     rm -f /etc/nginx/conf.d/*.conf
  372.     cp -fn $HESTIA_INSTALL_DIR/nginx/nginx.conf /etc/nginx/
  373.     cp -fn $HESTIA_INSTALL_DIR/nginx/status.conf /etc/nginx/conf.d/
  374.     cp -fn $HESTIA_INSTALL_DIR/nginx/phpmyadmin.inc /etc/nginx/conf.d/
  375.     cp -fn $HESTIA_INSTALL_DIR/nginx/phppgadmin.inc /etc/nginx/conf.d/
  376.     cp -fn $HESTIA_INSTALL_DIR/logrotate/nginx /etc/logrotate.d/
  377.     mkdir -p /etc/nginx/conf.d/domains
  378.     mkdir -p /var/log/nginx/domains
  379.  
  380.     # Update dns servers in nginx.conf
  381.     dns_resolver=$(cat /etc/resolv.conf | grep -i '^nameserver' | cut -d ' ' -f2 | tr '\r\n' ' ' | xargs)
  382.     for ip in $dns_resolver; do
  383.         if [[ $ip =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
  384.             resolver="$ip $resolver"
  385.         fi
  386.     done
  387.     if [ ! -z "$resolver" ]; then
  388.         sed -i "s/1.0.0.1 1.1.1.1/$resolver/g" /etc/nginx/nginx.conf
  389.         sed -i "s/1.0.0.1 1.1.1.1/$resolver/g" /usr/local/hestia/nginx/conf/nginx.conf
  390.     fi
  391.  
  392.     systemctl enable nginx > /dev/null 2>&1
  393.     systemctl start nginx >> $LOG
  394. fi
  395.  
  396. #----------------------------------------------------------#
  397. #                     Configure PHP-FPM                    #
  398. #----------------------------------------------------------#
  399.  
  400. if [ "$phpfpm" = 'yes' ]; then
  401.     echo "(*) Configuring PHP-FPM..."
  402.     $HESTIA/bin/v-add-web-php "$fpm_v" > /dev/null 2>&1
  403.     cp -fn $HESTIA_INSTALL_DIR/php-fpm/www.conf /etc/php-fpm.d/www.conf
  404.     systemctl enable php-fpm > /dev/null 2>&1
  405.     systemctl start php-fpm >> $LOG
  406.     update-alternatives --set php /usr/bin/php$fpm_v > /dev/null 2>&1
  407. fi
  408.  
  409. #----------------------------------------------------------#
  410. #                     Configure PHP                        #
  411. #----------------------------------------------------------#
  412.  
  413. ZONE=$(timedatectl 2>/dev/null|grep 'Time zone'|awk '{print $3}')
  414. if [ -e '/etc/sysconfig/clock' ]; then
  415.     source /etc/sysconfig/clock
  416. fi
  417. if [ -z "$ZONE" ]; then
  418.     ZONE='UTC'
  419. fi
  420. for pconf in $(find /etc/php* -name php.ini); do
  421.     sed -i "s|;date.timezone =|date.timezone = $ZONE|g" $pconf
  422.     sed -i 's%_open_tag = Off%_open_tag = On%g' $pconf
  423. done
  424.  
  425. # Cleanup php session files not changed in the last 7 days (60*24*7 minutes)
  426. echo '#!/bin/sh' > /etc/cron.daily/php-session-cleanup
  427. echo "find -O3 /home/*/tmp/ -ignore_readdir_race -depth -mindepth 1 -name 'sess_*' -type f -cmin '+10080' -delete > /dev/null 2>&1" >> /etc/cron.daily/php-session-cleanup
  428. echo "find -O3 $HESTIA/data/sessions/ -ignore_readdir_race -depth -mindepth 1 -name 'sess_*' -type f -cmin '+10080' -delete > /dev/null 2>&1" >> /etc/cron.daily/php-session-cleanup
  429. chmod 755 /etc/cron.daily/php-session-cleanup
  430.  
  431.  
  432.  
  433. #----------------------------------------------------------#
  434. #                    Configure Vsftpd                      #
  435. #----------------------------------------------------------#
  436.  
  437. if [ "$vsftpd" = 'yes' ]; then
  438.     echo "(*) Configuring Vsftpd server..."
  439.     cp -fn $HESTIA_INSTALL_DIR/vsftpd/vsftpd.conf /etc/
  440.     touch /var/log/vsftpd.log
  441.     chown root:adm /var/log/vsftpd.log
  442.     chmod 640 /var/log/vsftpd.log
  443.     touch /var/log/xferlog
  444.     chown root:adm /var/log/xferlog
  445.     chmod 640 /var/log/xferlog
  446.     systemctl enable vsftpd
  447.     systemctl start vsftpd >> $LOG
  448. fi
  449.  
  450. #----------------------------------------------------------#
  451. #                  Configure MySQL                       #
  452. #----------------------------------------------------------#
  453.  
  454. if [ "$mysql" = 'yes' ]; then
  455.     echo "(*) Configuring MySQL database server..."
  456.     mycnf="my-small.cnf"
  457.     if [ $memory -gt 1200000 ]; then
  458.         mycnf="my-medium.cnf"
  459.     fi
  460.     if [ $memory -gt 3900000 ]; then
  461.         mycnf="my-large.cnf"
  462.     fi
  463.  
  464.     # Configuring MySQL
  465.     #cp -fn $HESTIA_INSTALL_DIR/mysql/$mycnf /etc/percona-server.conf.d/mysqld.cnf
  466.     #mysql_install_db >> $LOG
  467.  
  468.     systemctl enable mysql
  469.     systemctl start mysql >> $LOG
  470.  
  471.     # Securing MySQL installation
  472.     #mpass=$(date +%s | sha256sum | base64 | head -c 16 ; echo)
  473.     mpass=`grep 'temporary password' /var/log/mysqld.log | tail -n 1 | cut -d"@" -f 2 | cut -d" " -f 2`
  474.     echo -e "[client]\npassword='$mpass'\n" > /root/.my.cnf
  475.     mysqladmin -u root password $mpass >> $LOG
  476.     chmod 600 /root/.my.cnf
  477.  
  478.     # Clear MySQL Test Users and Databases
  479.     mysql -e "DELETE FROM mysql.user WHERE User=''"
  480.     mysql -e "DROP DATABASE test" > /dev/null 2>&1
  481.     mysql -e "DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%'"
  482.     mysql -e "DELETE FROM mysql.user WHERE user='';"
  483.     mysql -e "DELETE FROM mysql.user WHERE authentication_string='';"
  484.  
  485.  
  486.     # Configuring phpMyAdmin
  487.     mysql < /usr/share/phpMyAdmin/sql/create_tables.sql
  488.     p=$(date +%s | sha256sum | base64 | head -c 16 ; echo)
  489.     fish=$(date +%s | sha256sum | base64 | head -c 16 ; echo)
  490.     mysql -e "GRANT ALL ON phpmyadmin.*
  491.        TO phpmyadmin@localhost IDENTIFIED BY '$p'"
  492.     cp -fn $HESTIA/pma/config.inc.conf /etc/phpMyAdmin/config.inc.php
  493.     sed -i "s/%blowfish_secret%/$fish/g" /etc/phpMyAdmin/config.inc.php
  494.     sed -i "s/%phpmyadmin_pass%/$p/g" /etc/phpMyAdmin/config.inc.php
  495.     chmod 777 /var/lib/phpMyAdmin/temp
  496.     chmod 777 /var/lib/phpMyAdmin/save
  497.    
  498.    
  499.     # Configuring phpMyAdmin
  500.     #cp -fn $HESTIA_INSTALL_DIR/pma/config.inc.php /etc/phpMyAdmin/
  501.     #chmod 777 /var/lib/phpMyAdmin/temp/
  502. fi
  503.  
  504.  
  505. #----------------------------------------------------------#
  506. #                      Configure Bind                      #
  507. #----------------------------------------------------------#
  508.  
  509. if [ "$named" = 'yes' ]; then
  510.     echo "(*) Configuring Bind DNS server..."
  511.     cp -fn $HESTIA_INSTALL_DIR/bind/named.conf /etc/
  512.     cp -fn $HESTIA_INSTALL_DIR/bind/named.conf.options /etc/named/
  513.     chown root:named /etc/named.conf
  514.     chown root:named /etc/bind/named.conf.options
  515.     chown named:named /var/cache/bind
  516.     chmod 640 /etc/named.conf
  517.     chmod 640 /etc/named/named.conf.options
  518.     #aa-complain /usr/sbin/named > /dev/null 2>&1
  519.     #echo "/home/** rwm," >> /etc/apparmor.d/local/usr.sbin.named 2> /dev/null
  520.     #if ! grep --quiet lxc /proc/1/environ; then
  521.     #    systemctl status apparmor > /dev/null 2>&1
  522.     #    if [ $? -ne 0 ]; then
  523.     #        systemctl restart apparmor >> $LOG
  524.     #    fi
  525.     #fi
  526.     systemctl enable bind9
  527.     systemctl start bind9
  528.  
  529.     # Workaround for OpenVZ/Virtuozzo
  530.     #if [ -e "/proc/vz/veinfo" ] && [ -e "/etc/rc.local" ]; then
  531.     #    sed -i "s/^exit 0/service bind9 restart\nexit 0/" /etc/rc.local
  532.     #fi
  533. fi
  534.  
  535.  
  536. #----------------------------------------------------------#
  537. #                      Configure Exim                      #
  538. #----------------------------------------------------------#
  539.  
  540. if [ "$exim" = 'yes' ]; then
  541.     echo "(*) Configuring Exim mail server..."
  542.     gpasswd -a exim mail > /dev/null 2>&1
  543.     cp -fn $HESTIA_INSTALL_DIR/exim/exim4.conf.template /etc/exim/exim.conf.template
  544.     cp -fn $HESTIA_INSTALL_DIR/exim/dnsbl.conf /etc/exim/
  545.     cp -fn $HESTIA_INSTALL_DIR/exim/spam-blocks.conf /etc/exim/
  546.     touch /etc/exim/white-blocks.conf
  547.  
  548.     if [ "$spamd" = 'yes' ]; then
  549.         sed -i "s/#SPAM/SPAM/g" /etc/exim/exim.conf.template
  550.     fi
  551.     if [ "$clamd" = 'yes' ]; then
  552.         sed -i "s/#CLAMD/CLAMD/g" /etc/exim/exim.conf.template
  553.     fi
  554.  
  555.     chmod 640 /etc/exim/exim.conf.template
  556.     rm -rf /etc/exim/domains
  557.     mkdir -p /etc/exim/domains
  558.  
  559.     rm -fn /etc/alternatives/mta
  560.     ln -s /usr/sbin/exim /etc/alternatives/mta
  561.     systemctl disable sendmail > /dev/null 2>&1
  562.     systemctl stop sendmail > /dev/null 2>&1
  563.     systemctl disable postfix > /dev/null 2>&1
  564.     systemctl stop postfix > /dev/null 2>&1
  565.  
  566.     systemctl enable exim
  567.     systemctl start exim4 >> $LOG
  568. fi
  569.  
  570.  
  571. #----------------------------------------------------------#
  572. #                     Configure Dovecot                    #
  573. #----------------------------------------------------------#
  574.  
  575. if [ "$dovecot" = 'yes' ]; then
  576.     echo "(*) Configuring Dovecot POP/IMAP mail server..."
  577.     gpasswd -a dovecot mail > /dev/null 2>&1
  578.     cp -rf $HESTIA_INSTALL_DIR/dovecot /etc/
  579.     cp -fn $HESTIA_INSTALL_DIR/logrotate/dovecot /etc/logrotate.d/
  580.     if [ "$release" = '18.04' ]; then
  581.         rm -fn /etc/dovecot/conf.d/15-mailboxes.conf
  582.     fi
  583.     chown -R root:root /etc/dovecot*
  584.     systemctl enable dovecot
  585.     systemctl start dovecot >> $LOG
  586. fi
  587.  
  588. #----------------------------------------------------------#
  589. #                     Configure ClamAV                     #
  590. #----------------------------------------------------------#
  591.  
  592. if [ "$clamd" = 'yes' ]; then
  593.     gpasswd -a clamav mail > /dev/null 2>&1
  594.     gpasswd -a clamav exim > /dev/null 2>&1
  595.     cp -fn $HESTIA_INSTALL_DIR/clamav/clamd.conf /etc/
  596.     systemctl enable clamd
  597.     echo -ne "(*) Installing ClamAV anti-virus definitions... "
  598.     /usr/bin/freshclam >> $LOG &
  599.     BACK_PID=$!
  600.     spin_i=1
  601.     while kill -0 $BACK_PID > /dev/null 2>&1 ; do
  602.         printf "\b${spinner:spin_i++%${#spinner}:1}"
  603.         sleep 0.5
  604.     done
  605.     echo
  606.     systemctl start clamav-daemon >> $LOG
  607. fi
  608.  
  609.  
  610. #----------------------------------------------------------#
  611. #                  Configure SpamAssassin                  #
  612. #----------------------------------------------------------#
  613.  
  614. if [ "$spamd" = 'yes' ]; then
  615.     echo "(*) Configuring SpamAssassin..."
  616.     systemctl enable spamassassin > /dev/null 2>&1
  617.     #sed -i "s/ENABLED=0/ENABLED=1/" /etc/default/spamassassin
  618.     systemctl start spamassassin >> $LOG
  619.     unit_files="$(systemctl list-unit-files |grep spamassassin)"
  620.     if [[ "$unit_files" =~ "disabled" ]]; then
  621.         systemctl enable spamassassin > /dev/null 2>&1
  622.     fi
  623. fi
  624.  
  625. #----------------------------------------------------------#
  626. #                   Configure Roundcube                    #
  627. #----------------------------------------------------------#
  628.  
  629. if [ "$dovecot" = 'yes' ] && [ "$exim" = 'yes' ] && [ "$mysql" = 'yes' ]; then
  630.     echo "(*) Configuring Roundcube webmail client..."
  631.     cp -fn $HESTIA_INSTALL_DIR/roundcube/main.inc.php /etc/roundcubemail/config.inc.php
  632.     cp -fn $HESTIA_INSTALL_DIR/roundcube/config.inc.php /etc/roundcubemail/plugins/password/
  633.     cp -fn $HESTIA_INSTALL_DIR/roundcube/hestia.php /usr/share/roundcubemail/plugins/password/drivers/
  634.     touch /var/log/roundcubemail/errors
  635.     chmod 640 /etc/roundcubemail/config.inc.php
  636.     chown root:nginx /etc/roundcubemail/config.inc.php
  637.     chmod 640 /var/log/roundcubemail/errors
  638.     chown nginx:adm /var/log/roundcubemail/errors
  639.  
  640.     r="$(date +%s | sha256sum | base64 | head -c 32 ; echo)"
  641.     rcDesKey="$(openssl rand -base64 30 | tr -d "/" | cut -c1-24)"
  642.     mysql -e "CREATE DATABASE roundcube"
  643.     mysql -e "GRANT ALL ON roundcube.*
  644.        TO roundcube@localhost IDENTIFIED BY '$r'"
  645.     sed -i "s/%password%/$r/g" /etc/roundcubemail/debian-db-roundcube.php
  646.     sed -i "s/%des_key%/$rcDesKey/g" /etc/roundcubemail/config.inc.php
  647.     sed -i "s/localhost/$servername/g" /etc/roundcubemail/plugins/password/config.inc.php
  648.     mysql roundcube < /usr/share/roundcubemail/SQL/mysql.initial.sql
  649.  
  650.     # Configure webmail alias
  651.     echo "WEBMAIL_ALIAS='webmail'" >> $HESTIA/conf/hestia.conf
  652.  
  653.     # Add robots.txt
  654.     echo "User-agent: *" > /var/lib/roundcubemail/robots.txt
  655.     echo "Disallow: /" >> /var/lib/roundcubemail/robots.txt
  656.  
  657.     if [ "$nginx" = 'yes' ]; then
  658.         systemctl restart nginx >> $LOG
  659.     fi
  660. fi
  661.  
  662. #----------------------------------------------------------#
  663. #                    Configure Fail2Ban                    #
  664. #----------------------------------------------------------#
  665.  
  666. if [ "$fail2ban" = 'yes' ]; then
  667.     echo "(*) Configuring fail2ban access monitor..."
  668.     cp -rf $HESTIA_INSTALL_DIR/fail2ban /etc/
  669.     if [ "$dovecot" = 'no' ]; then
  670.         fline=$(cat /etc/fail2ban/jail.local |grep -n dovecot-iptables -A 2)
  671.         fline=$(echo "$fline" |grep enabled |tail -n1 |cut -f 1 -d -)
  672.         sed -i "${fline}s/true/false/" /etc/fail2ban/jail.local
  673.     fi
  674.     if [ "$exim" = 'no' ]; then
  675.         fline=$(cat /etc/fail2ban/jail.local |grep -n exim-iptables -A 2)
  676.         fline=$(echo "$fline" |grep enabled |tail -n1 |cut -f 1 -d -)
  677.         sed -i "${fline}s/true/false/" /etc/fail2ban/jail.local
  678.     fi
  679.     if [ "$vsftpd" = 'yes' ]; then
  680.         #Create vsftpd Log File
  681.         if [ ! -f "/var/log/vsftpd.log" ]; then
  682.             touch /var/log/vsftpd.log
  683.         fi
  684.         fline=$(cat /etc/fail2ban/jail.local |grep -n vsftpd-iptables -A 2)
  685.         fline=$(echo "$fline" |grep enabled |tail -n1 |cut -f 1 -d -)
  686.         sed -i "${fline}s/false/true/" /etc/fail2ban/jail.local
  687.     fi
  688.  
  689.     systemctl enable fail2ban
  690.     systemctl start fail2ban >> $LOG
  691. fi
  692.  
  693.  
  694. #----------------------------------------------------------#
  695. #                       Configure API                      #
  696. #----------------------------------------------------------#
  697.  
  698. if [ "$api" = 'yes' ]; then
  699.     echo "API='yes'" >> $HESTIA/conf/hestia.conf
  700. else
  701.     rm -r $HESTIA/web/api
  702.     echo "API='no'" >> $HESTIA/conf/hestia.conf
  703. fi
  704.  
  705.  
  706. #----------------------------------------------------------#
  707. #                   Configure Admin User                   #
  708. #----------------------------------------------------------#
  709.  
  710. # Deleting old admin user
  711. if [ ! -z "$(grep ^admin: /etc/passwd)" ] && [ "$force" = 'yes' ]; then
  712.     chattr -i /home/admin/conf > /dev/null 2>&1
  713.     userdel -f admin > /dev/null 2>&1
  714.     chattr -i /home/admin/conf > /dev/null 2>&1
  715.     mv -f /home/admin  $hst_backups/home/ > /dev/null 2>&1
  716.     rm -f /tmp/sess_* > /dev/null 2>&1
  717. fi
  718. if [ ! -z "$(grep ^admin: /etc/group)" ] && [ "$force" = 'yes' ]; then
  719.     groupdel admin > /dev/null 2>&1
  720. fi
  721.  
  722. # Enable sftp jail
  723. $HESTIA/bin/v-add-sys-sftp-jail > /dev/null 2>&1
  724.  
  725. # Adding Hestia admin account
  726. $HESTIA/bin/v-add-user admin $vpass $email default System Administrator
  727. $HESTIA/bin/v-change-user-shell admin nologin
  728. $HESTIA/bin/v-change-user-language admin $lang
  729.  
  730. # Configuring system IPs
  731. $HESTIA/bin/v-update-sys-ip > /dev/null 2>&1
  732.  
  733. # Get main IP
  734. ip=$(ip addr|grep 'inet '|grep global|head -n1|awk '{print $2}'|cut -f1 -d/)
  735.  
  736. # Configuring firewall
  737. if [ "$iptables" = 'yes' ]; then
  738.     $HESTIA/bin/v-update-firewall
  739. fi
  740.  
  741. # Get public IP
  742. pub_ip=$(curl --ipv4 -s https://ip.hestiacp.com/)
  743. if [ ! -z "$pub_ip" ] && [ "$pub_ip" != "$ip" ]; then
  744.     if [ -e /etc/rc.local ]; then
  745.         sed -i '/exit 0/d' /etc/rc.local
  746.     fi
  747.  
  748.     #check_rclocal=$(cat /etc/rc.local | grep "#!")
  749.     #if [ -z "$check_rclocal" ]; then
  750.     #    echo "#!/bin/sh" >> /etc/rc.local
  751.     #fi
  752.  
  753.     echo "$HESTIA/bin/v-update-sys-ip" >> /etc/rc.local
  754.     echo "exit 0" >> /etc/rc.local
  755.     chmod +x /etc/rc.local
  756.     systemctl enable rc-local
  757.     $HESTIA/bin/v-change-sys-ip-nat $ip $pub_ip > /dev/null 2>&1
  758.     ip=$pub_ip
  759. fi
  760.  
  761. # Configuring MySQL host
  762. if [ "$mysql" = 'yes' ]; then
  763.     $HESTIA/bin/v-add-database-host mysql localhost root $mpass mysql
  764. fi
  765.  
  766. # Adding default domain
  767. $HESTIA/bin/v-add-web-domain admin $servername
  768.  
  769. # Adding cron jobs
  770. export SCHEDULED_RESTART="yes"
  771. command="sudo $HESTIA/bin/v-update-sys-queue restart"
  772. $HESTIA/bin/v-add-cron-job 'admin' '*/2' '*' '*' '*' '*' "$command"
  773. systemctl restart cron
  774.  
  775. command="sudo $HESTIA/bin/v-update-sys-queue disk"
  776. $HESTIA/bin/v-add-cron-job 'admin' '15' '02' '*' '*' '*' "$command"
  777. command="sudo $HESTIA/bin/v-update-sys-queue traffic"
  778. $HESTIA/bin/v-add-cron-job 'admin' '10' '00' '*' '*' '*' "$command"
  779. command="sudo $HESTIA/bin/v-update-sys-queue webstats"
  780. $HESTIA/bin/v-add-cron-job 'admin' '30' '03' '*' '*' '*' "$command"
  781. command="sudo $HESTIA/bin/v-update-sys-queue backup"
  782. $HESTIA/bin/v-add-cron-job 'admin' '*/5' '*' '*' '*' '*' "$command"
  783. command="sudo $HESTIA/bin/v-backup-users"
  784. $HESTIA/bin/v-add-cron-job 'admin' '10' '05' '*' '*' '*' "$command"
  785. command="sudo $HESTIA/bin/v-update-user-stats"
  786. $HESTIA/bin/v-add-cron-job 'admin' '20' '00' '*' '*' '*' "$command"
  787. command="sudo $HESTIA/bin/v-update-sys-rrd"
  788. $HESTIA/bin/v-add-cron-job 'admin' '*/5' '*' '*' '*' '*' "$command"
  789.  
  790. # Enable automatic updates
  791. $HESTIA/bin/v-add-cron-hestia-autoupdate
  792.  
  793. # Building initital rrd images
  794. $HESTIA/bin/v-update-sys-rrd
  795.  
  796. # Enabling file system quota
  797. if [ "$quota" = 'yes' ]; then
  798.     $HESTIA/bin/v-add-sys-quota
  799. fi
  800.  
  801. # Set backend port
  802. $HESTIA/bin/v-change-sys-port $port
  803.  
  804. # Set default theme
  805. $HESTIA/bin/v-change-sys-theme 'default'
  806.  
  807. # Starting Hestia service
  808. systemctl enable hestia
  809. systemctl start hestia
  810. chown admin:admin $HESTIA/data/sessions
  811.  
  812. #----------------------------------------------------------#
  813. #                   Hestia Access Info                     #
  814. #----------------------------------------------------------#
  815.  
  816. # Comparing hostname and IP
  817. host_ip=$(host $servername| head -n 1 |awk '{print $NF}')
  818. if [ "$host_ip" = "$ip" ]; then
  819.     ip="$servername"
  820. fi
  821.  
  822. echo -e "\n"
  823. echo "===================================================================="
  824. echo -e "\n"
  825.  
  826. # Sending notification to admin email
  827. echo -e "Congratulations!
  828.  
  829. You have successfully installed Hestia Control Panel on your server.
  830.  
  831. Ready to get started? Log in using the following credentials:
  832.  
  833.    Admin URL:  https://$ip:$port
  834.    Username:   admin
  835.    Password:   $vpass
  836.  
  837. Thank you for choosing Hestia Control Panel to power your full stack web server,
  838. we hope that you enjoy using it as much as we do!
  839.  
  840. Please feel free to contact us at any time if you have any questions,
  841. or if you encounter any bugs or problems:
  842.  
  843. E-mail:  [email protected]
  844. Web:     https://www.hestiacp.com/
  845. Forum:   https://forum.hestiacp.com/
  846. GitHub:  https://www.github.com/hestiacp/hestiacp
  847.  
  848. Note: Automatic updates are enabled by default. If you would like to disable them,
  849. please log in and navigate to Server > Updates to turn them off.
  850.  
  851. Help support the Hestia Contol Panel project by donating via PayPal:
  852. https://www.hestiacp.com/donate
  853. --
  854. Sincerely yours,
  855. The Hestia Control Panel development team
  856.  
  857. Made with love & pride by the open-source community around the world.
  858. " > $tmpfile
  859.  
  860. send_mail="$HESTIA/web/inc/mail-wrapper.php"
  861. cat $tmpfile | $send_mail -s "Hestia Control Panel" $email
  862.  
  863. # Congrats
  864. echo
  865. cat $tmpfile
  866. rm -f $tmpfile
  867.  
  868. # Add welcome message to notification panel
  869. $HESTIA/bin/v-add-user-notification admin 'Welcome!' 'For more information on how to use Hestia Control Panel, click on the Help icon in the top right corner of the toolbar.<br><br>Please report any bugs or issues on GitHub at<br>https://github.com/hestiacp/hestiacp/issues<br><br>Have a great day!'
  870.  
  871. echo "(!) IMPORTANT: You must logout or restart the server before continuing."
  872. echo ""
  873. if [ "$interactive" = 'yes' ]; then
  874.     echo -n " Do you want to reboot now? [Y/N] "
  875.     read reboot
  876.  
  877.     if [ "$reboot" = "Y" ] || [ "$reboot" = "y" ]; then
  878.         reboot
  879.     fi
  880. fi
  881.  
  882. # EOF
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!