🎉 Feature: Enhanced log management & firewall integration in backend
This commit is contained in:
270
backend/setup.sh
270
backend/setup.sh
@@ -19,6 +19,7 @@ readonly HTTPS_SERVICE_NAME="myp-https"
|
||||
readonly KIOSK_SERVICE_NAME="myp-kiosk"
|
||||
readonly WATCHDOG_SERVICE_NAME="kiosk-watchdog"
|
||||
readonly WATCHDOG_PYTHON_SERVICE_NAME="kiosk-watchdog-python"
|
||||
readonly FIREWALL_SERVICE_NAME="myp-firewall"
|
||||
readonly KIOSK_USER="kiosk"
|
||||
readonly CURRENT_DIR="$(pwd)"
|
||||
readonly INSTALL_LOG="/var/log/myp-install.log"
|
||||
@@ -560,6 +561,7 @@ install_systemd_services() {
|
||||
"$KIOSK_SERVICE_NAME.service"
|
||||
"$WATCHDOG_SERVICE_NAME.service"
|
||||
"$WATCHDOG_PYTHON_SERVICE_NAME.service"
|
||||
"$FIREWALL_SERVICE_NAME.service"
|
||||
)
|
||||
|
||||
for service_file in "${service_files[@]}"; do
|
||||
@@ -603,6 +605,12 @@ enable_and_start_services() {
|
||||
systemctl enable "$WATCHDOG_SERVICE_NAME" || warning "Fehler beim Aktivieren des Watchdog-Service"
|
||||
systemctl start "$WATCHDOG_SERVICE_NAME" || warning "Fehler beim Starten des Watchdog-Service"
|
||||
|
||||
# Firewall-Service aktivieren (falls vorhanden)
|
||||
if [ -f "$SYSTEM_SYSTEMD_DIR/$FIREWALL_SERVICE_NAME.service" ]; then
|
||||
progress "Aktiviere Firewall-Service..."
|
||||
systemctl enable "$FIREWALL_SERVICE_NAME" || warning "Fehler beim Aktivieren des Firewall-Service"
|
||||
fi
|
||||
|
||||
log "✅ Services erfolgreich konfiguriert"
|
||||
}
|
||||
|
||||
@@ -679,13 +687,16 @@ show_menu() {
|
||||
echo -e "${GREEN}3)${NC} Nur Services installieren/aktualisieren"
|
||||
echo -e " ${BLUE}→ Systemd-Services aus systemd/ Verzeichnis kopieren${NC}"
|
||||
echo ""
|
||||
echo -e "${GREEN}4)${NC} System-Test durchführen"
|
||||
echo -e " ${BLUE}→ HTTPS-Verbindung und SSL-Zertifikat testen${NC}"
|
||||
echo -e "${GREEN}4)${NC} Remote-Zugang konfigurieren (RDP + SSH + Firewall)"
|
||||
echo -e " ${BLUE}→ SSH (user:raspberry), RDP (root:744563017196A), firewalld${NC}"
|
||||
echo ""
|
||||
echo -e "${GREEN}5)${NC} Beenden"
|
||||
echo -e "${GREEN}5)${NC} System-Test durchführen"
|
||||
echo -e " ${BLUE}→ HTTPS-Verbindung, SSL-Zertifikat, Remote-Zugang testen${NC}"
|
||||
echo ""
|
||||
echo -e "${GREEN}6)${NC} Beenden"
|
||||
echo ""
|
||||
echo -e "${CYAN}=================================================================${NC}"
|
||||
echo -n "Ihre Wahl [1-5]: "
|
||||
echo -n "Ihre Wahl [1-6]: "
|
||||
}
|
||||
|
||||
# =========================== INSTALLATIONS-MODI ===========================
|
||||
@@ -740,6 +751,17 @@ install_full_kiosk() {
|
||||
configure_autologin
|
||||
install_systemd_services
|
||||
enable_and_start_services
|
||||
|
||||
# Frage nach Remote-Zugang
|
||||
echo ""
|
||||
echo -n "Remote-Zugang (RDP + SSH + Firewall) konfigurieren? [j/N]: "
|
||||
read -r configure_remote
|
||||
|
||||
if [[ "$configure_remote" =~ ^[Jj]$ ]]; then
|
||||
install_remote_access
|
||||
configure_firewall
|
||||
fi
|
||||
|
||||
test_application
|
||||
cleanup_old_files
|
||||
|
||||
@@ -769,6 +791,23 @@ install_services_only() {
|
||||
success "✅ Service-Installation abgeschlossen!"
|
||||
}
|
||||
|
||||
install_remote_access_only() {
|
||||
log "=== MODUS: NUR REMOTE-ZUGANG KONFIGURIEREN ==="
|
||||
|
||||
check_root
|
||||
check_debian_system
|
||||
check_internet_connection
|
||||
|
||||
install_remote_access
|
||||
configure_firewall
|
||||
test_remote_access
|
||||
|
||||
success "✅ Remote-Zugang-Konfiguration abgeschlossen!"
|
||||
info "Zugang verfügbar über:"
|
||||
info " 📡 SSH: ssh user@<ip-adresse> (Passwort: raspberry)"
|
||||
info " 🖥️ RDP: <ip-adresse>:3389 (Benutzer: root, Passwort: 744563017196A)"
|
||||
}
|
||||
|
||||
run_system_test() {
|
||||
log "=== MODUS: SYSTEM-TEST ==="
|
||||
|
||||
@@ -777,7 +816,7 @@ run_system_test() {
|
||||
# Zusätzliche Tests
|
||||
progress "Prüfe Service-Status..."
|
||||
|
||||
local services=("$HTTPS_SERVICE_NAME" "$KIOSK_SERVICE_NAME" "$WATCHDOG_SERVICE_NAME")
|
||||
local services=("$HTTPS_SERVICE_NAME" "$KIOSK_SERVICE_NAME" "$WATCHDOG_SERVICE_NAME" "$FIREWALL_SERVICE_NAME")
|
||||
|
||||
for service in "${services[@]}"; do
|
||||
if systemctl is-enabled --quiet "$service" 2>/dev/null; then
|
||||
@@ -791,9 +830,220 @@ run_system_test() {
|
||||
fi
|
||||
done
|
||||
|
||||
# Remote-Zugang testen (falls konfiguriert)
|
||||
if systemctl is-enabled --quiet ssh 2>/dev/null || systemctl is-enabled --quiet xrdp 2>/dev/null; then
|
||||
test_remote_access
|
||||
else
|
||||
info "ℹ️ Remote-Zugang nicht konfiguriert"
|
||||
fi
|
||||
|
||||
success "✅ System-Test abgeschlossen!"
|
||||
}
|
||||
|
||||
# =========================== RDP & SSH ZUGANG ===========================
|
||||
install_remote_access() {
|
||||
log "=== INSTALLIERE REMOTE-ZUGANG (RDP & SSH) ==="
|
||||
|
||||
# SSH-Server installieren und konfigurieren
|
||||
progress "Installiere und konfiguriere SSH-Server..."
|
||||
apt-get install -y openssh-server || error "SSH-Server Installation fehlgeschlagen"
|
||||
|
||||
# SSH-Service aktivieren
|
||||
systemctl enable ssh
|
||||
systemctl start ssh
|
||||
|
||||
# SSH-Benutzer 'user' erstellen (falls nicht vorhanden)
|
||||
if ! id "user" &>/dev/null; then
|
||||
progress "Erstelle SSH-Benutzer: user"
|
||||
useradd -m -s /bin/bash user || error "Kann SSH-Benutzer nicht erstellen"
|
||||
echo "user:raspberry" | chpasswd || error "Kann Passwort für SSH-Benutzer nicht setzen"
|
||||
usermod -aG sudo user 2>/dev/null || true
|
||||
log "✅ SSH-Benutzer 'user' erstellt mit Passwort 'raspberry'"
|
||||
else
|
||||
info "SSH-Benutzer 'user' existiert bereits"
|
||||
echo "user:raspberry" | chpasswd || warning "Konnte Passwort für SSH-Benutzer nicht aktualisieren"
|
||||
fi
|
||||
|
||||
# RDP-Server (xrdp) installieren
|
||||
progress "Installiere RDP-Server (xrdp)..."
|
||||
|
||||
# Minimale Desktop-Umgebung für RDP installieren
|
||||
progress "Installiere minimale Desktop-Umgebung für RDP..."
|
||||
apt-get install -y tasksel || error "tasksel Installation fehlgeschlagen"
|
||||
|
||||
# XFCE als leichtgewichtige Desktop-Umgebung installieren
|
||||
progress "Installiere XFCE Desktop-Umgebung..."
|
||||
apt-get install -y xfce4 xfce4-goodies || error "XFCE Installation fehlgeschlagen"
|
||||
|
||||
# xrdp installieren
|
||||
apt-get install -y xrdp || error "xrdp Installation fehlgeschlagen"
|
||||
|
||||
# xrdp-Service aktivieren
|
||||
systemctl enable xrdp
|
||||
systemctl start xrdp
|
||||
|
||||
# SSL-Zertifikate für xrdp erstellen
|
||||
progress "Erstelle SSL-Zertifikate für xrdp..."
|
||||
mkdir -p /etc/xrdp/certs
|
||||
cd /etc/xrdp/certs
|
||||
|
||||
openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 3650 \
|
||||
-subj "/C=DE/ST=Baden-Wuerttemberg/L=Stuttgart/O=Mercedes-Benz/OU=IT/CN=myp-rdp" \
|
||||
|| error "SSL-Zertifikat-Generierung für xrdp fehlgeschlagen"
|
||||
|
||||
# Berechtigungen für xrdp-Zertifikate setzen
|
||||
chown -R xrdp:xrdp /etc/xrdp/certs
|
||||
chmod 0644 /etc/xrdp/certs/cert.pem
|
||||
chmod 0600 /etc/xrdp/certs/key.pem
|
||||
|
||||
# xrdp-Konfiguration für TLS
|
||||
progress "Konfiguriere xrdp für TLS..."
|
||||
cp /etc/xrdp/xrdp.ini /etc/xrdp/xrdp.ini.backup
|
||||
|
||||
cat > /etc/xrdp/xrdp.ini << 'EOF'
|
||||
[Globals]
|
||||
ini_version=1
|
||||
fork=true
|
||||
port=3389
|
||||
tcp_nodelay=true
|
||||
tcp_keepalive=true
|
||||
security_layer=tls
|
||||
certificate=/etc/xrdp/certs/cert.pem
|
||||
key_file=/etc/xrdp/certs/key.pem
|
||||
ssl_protocols=TLSv1.2, TLSv1.3
|
||||
autorun=
|
||||
allow_channels=true
|
||||
allow_multimon=true
|
||||
bitmap_cache=true
|
||||
bitmap_compression=true
|
||||
bulk_compression=true
|
||||
max_bpp=32
|
||||
new_cursors=true
|
||||
use_fastpath=both
|
||||
require_credentials=true
|
||||
ask_for_reconnect_reason=true
|
||||
enable_token_login=true
|
||||
|
||||
[Xorg]
|
||||
name=Xorg
|
||||
lib=libxup.so
|
||||
username=ask
|
||||
password=ask
|
||||
ip=127.0.0.1
|
||||
port=-1
|
||||
code=20
|
||||
EOF
|
||||
|
||||
# Root-Passwort für RDP setzen
|
||||
progress "Setze Root-Passwort für RDP-Zugang..."
|
||||
echo "root:744563017196A" | chpasswd || error "Kann Root-Passwort nicht setzen"
|
||||
|
||||
# xrdp-Service neu starten
|
||||
systemctl restart xrdp
|
||||
|
||||
cd "$CURRENT_DIR"
|
||||
|
||||
log "✅ Remote-Zugang konfiguriert:"
|
||||
log " 📡 SSH: user:raspberry (Port 22)"
|
||||
log " 🖥️ RDP: root:744563017196A (Port 3389)"
|
||||
}
|
||||
|
||||
# =========================== FIREWALL KONFIGURATION ===========================
|
||||
configure_firewall() {
|
||||
log "=== KONFIGURIERE FIREWALL (firewalld) ==="
|
||||
|
||||
# firewalld installieren
|
||||
progress "Installiere firewalld..."
|
||||
apt-get install -y firewalld || error "firewalld Installation fehlgeschlagen"
|
||||
|
||||
# firewalld aktivieren und starten
|
||||
systemctl enable firewalld
|
||||
systemctl start firewalld
|
||||
|
||||
# Warte kurz bis firewalld vollständig gestartet ist
|
||||
sleep 3
|
||||
|
||||
progress "Konfiguriere firewalld-Zonen und -Regeln..."
|
||||
|
||||
# Zone definieren
|
||||
firewall-cmd --permanent --new-zone=myp-backend 2>/dev/null || true
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source=192.168.0.0/24
|
||||
|
||||
# Nur HTTPS für API & Kiosk zulassen
|
||||
firewall-cmd --permanent --zone=myp-backend --add-port=443/tcp
|
||||
|
||||
# SSH für Wartung
|
||||
firewall-cmd --permanent --zone=myp-backend --add-service=ssh
|
||||
|
||||
# RDP für Remote-Desktop
|
||||
firewall-cmd --permanent --zone=myp-backend --add-port=3389/tcp
|
||||
|
||||
# Default-Zone setzen
|
||||
firewall-cmd --set-default-zone=myp-backend
|
||||
|
||||
# Änderungen übernehmen
|
||||
firewall-cmd --reload
|
||||
|
||||
# Firewall-Status anzeigen
|
||||
progress "Firewall-Konfiguration:"
|
||||
firewall-cmd --list-all-zones | grep -A 10 "myp-backend" || true
|
||||
|
||||
log "✅ Firewall konfiguriert:"
|
||||
log " 🔒 Zone: myp-backend (192.168.0.0/24)"
|
||||
log " 🌐 HTTPS: Port 443/tcp"
|
||||
log " 📡 SSH: Port 22/tcp"
|
||||
log " 🖥️ RDP: Port 3389/tcp"
|
||||
}
|
||||
|
||||
# =========================== REMOTE-ZUGANG TESTEN ===========================
|
||||
test_remote_access() {
|
||||
log "=== TESTE REMOTE-ZUGANG ==="
|
||||
|
||||
# SSH-Service testen
|
||||
progress "Teste SSH-Service..."
|
||||
if systemctl is-active --quiet ssh; then
|
||||
success "✅ SSH-Service läuft"
|
||||
|
||||
# SSH-Port testen
|
||||
if ss -tlnp | grep -q ":22 "; then
|
||||
success "✅ SSH-Port 22 ist offen"
|
||||
else
|
||||
warning "⚠️ SSH-Port 22 nicht erreichbar"
|
||||
fi
|
||||
else
|
||||
error "❌ SSH-Service läuft nicht"
|
||||
fi
|
||||
|
||||
# RDP-Service testen
|
||||
progress "Teste RDP-Service..."
|
||||
if systemctl is-active --quiet xrdp; then
|
||||
success "✅ RDP-Service läuft"
|
||||
|
||||
# RDP-Port testen
|
||||
if ss -tlnp | grep -q ":3389 "; then
|
||||
success "✅ RDP-Port 3389 ist offen"
|
||||
else
|
||||
warning "⚠️ RDP-Port 3389 nicht erreichbar"
|
||||
fi
|
||||
else
|
||||
error "❌ RDP-Service läuft nicht"
|
||||
fi
|
||||
|
||||
# Firewall-Status testen
|
||||
progress "Teste Firewall-Status..."
|
||||
if systemctl is-active --quiet firewalld; then
|
||||
success "✅ Firewall läuft"
|
||||
|
||||
# Aktive Zone anzeigen
|
||||
local active_zone=$(firewall-cmd --get-active-zones | head -1)
|
||||
info "Aktive Zone: $active_zone"
|
||||
else
|
||||
warning "⚠️ Firewall läuft nicht"
|
||||
fi
|
||||
|
||||
log "✅ Remote-Zugang-Test abgeschlossen"
|
||||
}
|
||||
|
||||
# =========================== HAUPTPROGRAMM ===========================
|
||||
main() {
|
||||
# Erstelle Log-Datei
|
||||
@@ -823,17 +1073,23 @@ main() {
|
||||
read -r
|
||||
;;
|
||||
4)
|
||||
run_system_test
|
||||
install_remote_access_only
|
||||
echo ""
|
||||
echo -n "Drücken Sie Enter um fortzufahren..."
|
||||
read -r
|
||||
;;
|
||||
5)
|
||||
run_system_test
|
||||
echo ""
|
||||
echo -n "Drücken Sie Enter um fortzufahren..."
|
||||
read -r
|
||||
;;
|
||||
6)
|
||||
log "Setup-Skript beendet"
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
error "Ungültige Auswahl. Bitte wählen Sie 1-5."
|
||||
error "Ungültige Auswahl. Bitte wählen Sie 1-6."
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
Reference in New Issue
Block a user