📚 Improved logging structure & added backup file 🔜
This commit is contained in:
251
backend/setup.sh
251
backend/setup.sh
@@ -139,6 +139,149 @@ update_system() {
|
||||
log "✅ System-Update abgeschlossen"
|
||||
}
|
||||
|
||||
configure_network_security() {
|
||||
log "=== KONFIGURIERE ERWEITERTE NETZWERK-SICHERHEIT ==="
|
||||
|
||||
# IPv6 vollständig deaktivieren
|
||||
progress "Deaktiviere IPv6..."
|
||||
|
||||
# IPv6 in GRUB deaktivieren
|
||||
if [ -f /etc/default/grub ]; then
|
||||
cp /etc/default/grub /etc/default/grub.backup
|
||||
sed -i 's/GRUB_CMDLINE_LINUX_DEFAULT="[^"]*/& ipv6.disable=1/' /etc/default/grub
|
||||
sed -i 's/GRUB_CMDLINE_LINUX="[^"]*/& ipv6.disable=1/' /etc/default/grub
|
||||
update-grub 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# IPv6 in sysctl deaktivieren
|
||||
cat >> /etc/sysctl.conf << 'EOF'
|
||||
|
||||
# ===================================================================
|
||||
# MYP Netzwerk-Sicherheitskonfiguration
|
||||
# ===================================================================
|
||||
|
||||
# IPv6 vollständig deaktivieren
|
||||
net.ipv6.conf.all.disable_ipv6 = 1
|
||||
net.ipv6.conf.default.disable_ipv6 = 1
|
||||
net.ipv6.conf.lo.disable_ipv6 = 1
|
||||
|
||||
# IP-Spoofing-Schutz aktivieren
|
||||
net.ipv4.conf.all.rp_filter = 1
|
||||
net.ipv4.conf.default.rp_filter = 1
|
||||
|
||||
# Source-Routing deaktivieren (verhindert IP-Spoofing)
|
||||
net.ipv4.conf.all.accept_source_route = 0
|
||||
net.ipv4.conf.default.accept_source_route = 0
|
||||
|
||||
# ICMP-Redirects ignorieren (verhindert Man-in-the-Middle)
|
||||
net.ipv4.conf.all.accept_redirects = 0
|
||||
net.ipv4.conf.default.accept_redirects = 0
|
||||
net.ipv4.conf.all.send_redirects = 0
|
||||
|
||||
# Secure ICMP-Redirects ignorieren
|
||||
net.ipv4.conf.all.secure_redirects = 0
|
||||
net.ipv4.conf.default.secure_redirects = 0
|
||||
|
||||
# SYN-Flood-Schutz aktivieren
|
||||
net.ipv4.tcp_syncookies = 1
|
||||
net.ipv4.tcp_max_syn_backlog = 2048
|
||||
net.ipv4.tcp_synack_retries = 2
|
||||
net.ipv4.tcp_syn_retries = 5
|
||||
|
||||
# TCP-RFC-Compliance (verhindert aggressive Paketwiederholungen)
|
||||
net.ipv4.tcp_retries1 = 3
|
||||
net.ipv4.tcp_retries2 = 15
|
||||
net.ipv4.tcp_orphan_retries = 3
|
||||
|
||||
# TCP-Window-Skalierung optimieren (geringere Netzwerkauslastung)
|
||||
net.ipv4.tcp_window_scaling = 1
|
||||
net.ipv4.tcp_rmem = 4096 65536 16777216
|
||||
net.ipv4.tcp_wmem = 4096 65536 16777216
|
||||
net.core.rmem_max = 16777216
|
||||
net.core.wmem_max = 16777216
|
||||
net.core.netdev_max_backlog = 5000
|
||||
|
||||
# Broadcast-Pings ignorieren (verhindert Smurf-Angriffe)
|
||||
net.ipv4.icmp_echo_ignore_broadcasts = 1
|
||||
|
||||
# Bogus ICMP-Antworten ignorieren
|
||||
net.ipv4.icmp_ignore_bogus_error_responses = 1
|
||||
|
||||
# Paketweiterleitung verhindern (Router-Funktionalität deaktivieren)
|
||||
net.ipv4.ip_forward = 0
|
||||
|
||||
# Martian-Pakete loggen (verdächtige Pakete)
|
||||
net.ipv4.conf.all.log_martians = 1
|
||||
net.ipv4.conf.default.log_martians = 1
|
||||
|
||||
# TCP-Timestamps deaktivieren (verhindert Fingerprinting)
|
||||
net.ipv4.tcp_timestamps = 0
|
||||
|
||||
# TCP-SACK deaktivieren (verhindert bestimmte Angriffe)
|
||||
net.ipv4.tcp_sack = 0
|
||||
|
||||
# TCP-Keepalive optimieren
|
||||
net.ipv4.tcp_keepalive_time = 7200
|
||||
net.ipv4.tcp_keepalive_probes = 9
|
||||
net.ipv4.tcp_keepalive_intvl = 75
|
||||
|
||||
# Memory-Limits für Netzwerk-Buffers
|
||||
net.core.rmem_default = 262144
|
||||
net.core.wmem_default = 262144
|
||||
|
||||
# Schutz vor Time-Wait-Assassination
|
||||
net.ipv4.tcp_rfc1337 = 1
|
||||
|
||||
EOF
|
||||
|
||||
# Sysctl-Einstellungen sofort anwenden
|
||||
sysctl -p || warning "Einige sysctl-Einstellungen konnten nicht angewendet werden"
|
||||
|
||||
# IPv6 in Netzwerk-Interfaces deaktivieren
|
||||
progress "Deaktiviere IPv6 in Netzwerk-Interfaces..."
|
||||
|
||||
# Für systemd-networkd
|
||||
if systemctl is-enabled systemd-networkd 2>/dev/null; then
|
||||
mkdir -p /etc/systemd/network
|
||||
cat > /etc/systemd/network/99-disable-ipv6.network << 'EOF'
|
||||
[Match]
|
||||
Name=*
|
||||
|
||||
[Network]
|
||||
IPv6AcceptRA=no
|
||||
LinkLocalAddressing=no
|
||||
EOF
|
||||
systemctl restart systemd-networkd 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# Für NetworkManager
|
||||
if systemctl is-enabled NetworkManager 2>/dev/null; then
|
||||
cat > /etc/NetworkManager/conf.d/99-disable-ipv6.conf << 'EOF'
|
||||
[main]
|
||||
plugins=keyfile
|
||||
|
||||
[keyfile]
|
||||
unmanaged-devices=none
|
||||
|
||||
[connection]
|
||||
ipv6.method=ignore
|
||||
EOF
|
||||
systemctl restart NetworkManager 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# IPv6 in /etc/hosts auskommentieren
|
||||
sed -i 's/^::1/#::1/' /etc/hosts 2>/dev/null || true
|
||||
|
||||
log "✅ Erweiterte Netzwerk-Sicherheit konfiguriert:"
|
||||
log " 🚫 IPv6 vollständig deaktiviert"
|
||||
log " 🛡️ IP-Spoofing-Schutz aktiviert"
|
||||
log " 🔒 SYN-Flood-Schutz aktiviert"
|
||||
log " 📝 Verdächtige Pakete werden geloggt"
|
||||
log " 🚫 Paketweiterleitung deaktiviert"
|
||||
log " ⚡ TCP-Performance optimiert"
|
||||
log " 🔐 RFC-Compliance für TCP aktiviert"
|
||||
}
|
||||
|
||||
# =========================== DESKTOP-ENVIRONMENT ENTFERNUNG ===========================
|
||||
remove_desktop_environments() {
|
||||
log "=== ENTFERNE DESKTOP ENVIRONMENTS FÜR KIOSK-MODUS ==="
|
||||
@@ -823,7 +966,9 @@ install_dependencies_only() {
|
||||
check_debian_system
|
||||
check_internet_connection
|
||||
|
||||
configure_hostname
|
||||
update_system
|
||||
configure_network_security
|
||||
install_python_dependencies
|
||||
install_nodejs_npm
|
||||
install_ssl_certificates
|
||||
@@ -847,6 +992,7 @@ install_dependencies_only() {
|
||||
|
||||
success "✅ Abhängigkeiten-Installation abgeschlossen!"
|
||||
info "Das System ist bereit für manuelle Tests und Entwicklung"
|
||||
info "Hostname wurde auf 'raspberrypi' gesetzt"
|
||||
info "HTTPS-Backend kann manuell gestartet werden mit:"
|
||||
info " cd /opt/myp && python3 app.py"
|
||||
}
|
||||
@@ -858,10 +1004,14 @@ install_full_production_system() {
|
||||
check_debian_system
|
||||
check_internet_connection
|
||||
|
||||
# Hostname zuerst setzen
|
||||
configure_hostname
|
||||
|
||||
# Führe zuerst Abhängigkeiten-Installation durch (falls noch nicht geschehen)
|
||||
if [ ! -d "$APP_DIR" ] || [ ! -f "$APP_DIR/app.py" ]; then
|
||||
warning "Anwendung noch nicht deployed - führe Abhängigkeiten-Installation durch..."
|
||||
update_system
|
||||
configure_network_security
|
||||
install_python_dependencies
|
||||
install_nodejs_npm
|
||||
install_ssl_certificates
|
||||
@@ -869,6 +1019,9 @@ install_full_production_system() {
|
||||
deploy_application
|
||||
install_npm_dependencies
|
||||
generate_ssl_certificate
|
||||
else
|
||||
# Netzwerk-Sicherheit auch bei bestehender Installation konfigurieren
|
||||
configure_network_security
|
||||
fi
|
||||
|
||||
# Desktop-Environments entfernen und minimale X11 installieren
|
||||
@@ -897,10 +1050,11 @@ install_full_production_system() {
|
||||
|
||||
success "✅ Vollständige Kiosk-Installation abgeschlossen!"
|
||||
info "Das System ist vollständig konfiguriert:"
|
||||
info " 🖥️ Hostname: raspberrypi"
|
||||
info " 🖥️ Automatischer Kiosk-Modus beim Boot"
|
||||
info " 📡 SSH: ssh user@<ip> (Passwort: raspberry)"
|
||||
info " 🖥️ RDP: <ip>:3389 (Benutzer: root, Passwort: 744563017196A)"
|
||||
info " 🔒 Firewall: 192.168.0.0/16 + localhost + m040tbaraspi001"
|
||||
info " 🔒 Firewall: 192.168.0.0/16 + localhost + raspberrypi + m040tbaraspi001"
|
||||
warning "⚠️ Neustart erforderlich für automatischen Kiosk-Start: sudo reboot"
|
||||
}
|
||||
|
||||
@@ -1032,30 +1186,36 @@ configure_firewall() {
|
||||
# Zone definieren
|
||||
firewall-cmd --permanent --new-zone=myp-backend 2>/dev/null || true
|
||||
|
||||
# Erweiterte Netzwerk-Quellen definieren
|
||||
# Erweiterte Netzwerk-Quellen definieren (nur IPv4)
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source=192.168.0.0/16
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source=127.0.0.1/32
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source=::1/128
|
||||
|
||||
# Lokaler Hostname hinzufügen (falls auflösbar)
|
||||
local local_hostname=$(hostname)
|
||||
if [ -n "$local_hostname" ]; then
|
||||
progress "Füge lokalen Hostname hinzu: $local_hostname"
|
||||
# Versuche IP-Adresse des lokalen Hostnames zu ermitteln
|
||||
local local_ip=$(getent hosts "$local_hostname" | awk '{print $1}' | head -1 2>/dev/null || true)
|
||||
if [ -n "$local_ip" ]; then
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source="$local_ip/32" 2>/dev/null || true
|
||||
fi
|
||||
# Lokaler Hostname "raspberrypi" hinzufügen
|
||||
local local_hostname="raspberrypi"
|
||||
progress "Füge lokalen Hostname hinzu: $local_hostname"
|
||||
local local_ip=$(getent hosts "$local_hostname" | awk '{print $1}' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' | head -1 2>/dev/null || true)
|
||||
if [ -n "$local_ip" ]; then
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source="$local_ip/32" 2>/dev/null || true
|
||||
log "✅ Lokaler Hostname $local_hostname hinzugefügt: $local_ip"
|
||||
else
|
||||
info "Lokaler Hostname $local_hostname nicht auflösbar - wird beim nächsten Boot verfügbar sein"
|
||||
fi
|
||||
|
||||
# Remote-Hostname m040tbaraspi001 hinzufügen (falls auflösbar)
|
||||
progress "Füge Remote-Hostname hinzu: m040tbaraspi001"
|
||||
local remote_ip=$(getent hosts "m040tbaraspi001" | awk '{print $1}' | head -1 2>/dev/null || true)
|
||||
if [ -n "$remote_ip" ]; then
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source="$remote_ip/32" 2>/dev/null || true
|
||||
log "✅ Remote-Hostname m040tbaraspi001 hinzugefügt: $remote_ip"
|
||||
# Frontend-Server m040tbaraspi001 hinzufügen (falls auflösbar)
|
||||
progress "Füge Frontend-Server hinzu: m040tbaraspi001"
|
||||
local frontend_ip=$(getent hosts "m040tbaraspi001" | awk '{print $1}' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' | head -1 2>/dev/null || true)
|
||||
if [ -n "$frontend_ip" ]; then
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source="$frontend_ip/32" 2>/dev/null || true
|
||||
log "✅ Frontend-Server m040tbaraspi001 hinzugefügt: $frontend_ip"
|
||||
else
|
||||
info "Remote-Hostname m040tbaraspi001 nicht auflösbar - überspringe"
|
||||
# Versuche auch mit FQDN
|
||||
local frontend_fqdn_ip=$(getent hosts "m040tbaraspi001.de040.corpintra.net" | awk '{print $1}' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' | head -1 2>/dev/null || true)
|
||||
if [ -n "$frontend_fqdn_ip" ]; then
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source="$frontend_fqdn_ip/32" 2>/dev/null || true
|
||||
log "✅ Frontend-Server m040tbaraspi001.de040.corpintra.net hinzugefügt: $frontend_fqdn_ip"
|
||||
else
|
||||
info "Frontend-Server m040tbaraspi001 nicht auflösbar - überspringe"
|
||||
fi
|
||||
fi
|
||||
|
||||
# HTTPS für API & Kiosk zulassen
|
||||
@@ -1067,6 +1227,11 @@ configure_firewall() {
|
||||
# RDP für Remote-Desktop
|
||||
firewall-cmd --permanent --zone=myp-backend --add-port=3389/tcp
|
||||
|
||||
# IPv6 in firewalld deaktivieren
|
||||
progress "Deaktiviere IPv6 in firewalld..."
|
||||
firewall-cmd --permanent --set-target=DROP --zone=public --family=ipv6 2>/dev/null || true
|
||||
firewall-cmd --permanent --set-target=DROP --zone=myp-backend --family=ipv6 2>/dev/null || true
|
||||
|
||||
# Default-Zone setzen
|
||||
firewall-cmd --set-default-zone=myp-backend
|
||||
|
||||
@@ -1079,11 +1244,12 @@ configure_firewall() {
|
||||
|
||||
log "✅ Firewall konfiguriert:"
|
||||
log " 🔒 Zone: myp-backend"
|
||||
log " 🌐 Netzwerk: 192.168.0.0/16"
|
||||
log " 🏠 Localhost: 127.0.0.1, ::1"
|
||||
log " 🖥️ Lokaler Host: $local_hostname"
|
||||
log " 📡 Remote Host: m040tbaraspi001"
|
||||
log " 🌐 Netzwerk: 192.168.0.0/16 (nur IPv4)"
|
||||
log " 🏠 Localhost: 127.0.0.1"
|
||||
log " 🖥️ Lokaler Host: raspberrypi"
|
||||
log " 📡 Frontend-Server: m040tbaraspi001"
|
||||
log " 🔌 Ports: 443/tcp (HTTPS), 22/tcp (SSH), 3389/tcp (RDP)"
|
||||
log " 🚫 IPv6 vollständig blockiert"
|
||||
}
|
||||
|
||||
# =========================== REMOTE-ZUGANG TESTEN ===========================
|
||||
@@ -1135,6 +1301,45 @@ test_remote_access() {
|
||||
log "✅ Remote-Zugang-Test abgeschlossen"
|
||||
}
|
||||
|
||||
# =========================== HOSTNAME KONFIGURATION ===========================
|
||||
configure_hostname() {
|
||||
log "=== KONFIGURIERE HOSTNAME ==="
|
||||
|
||||
local target_hostname="raspberrypi"
|
||||
local current_hostname=$(hostname)
|
||||
|
||||
if [ "$current_hostname" != "$target_hostname" ]; then
|
||||
progress "Setze Hostname von '$current_hostname' auf '$target_hostname'..."
|
||||
|
||||
# Hostname sofort setzen
|
||||
hostnamectl set-hostname "$target_hostname" || error "Fehler beim Setzen des Hostnames"
|
||||
|
||||
# /etc/hostname aktualisieren
|
||||
echo "$target_hostname" > /etc/hostname
|
||||
|
||||
# /etc/hosts aktualisieren
|
||||
cp /etc/hosts /etc/hosts.backup
|
||||
sed -i "s/127.0.1.1.*/127.0.1.1\t$target_hostname/" /etc/hosts
|
||||
|
||||
# Falls kein 127.0.1.1 Eintrag existiert, hinzufügen
|
||||
if ! grep -q "127.0.1.1" /etc/hosts; then
|
||||
echo "127.0.1.1 $target_hostname" >> /etc/hosts
|
||||
fi
|
||||
|
||||
log "✅ Hostname erfolgreich auf '$target_hostname' gesetzt"
|
||||
else
|
||||
log "✅ Hostname bereits korrekt: '$target_hostname'"
|
||||
fi
|
||||
|
||||
# Hostname-Auflösung testen
|
||||
if getent hosts "$target_hostname" >/dev/null 2>&1; then
|
||||
local resolved_ip=$(getent hosts "$target_hostname" | awk '{print $1}' | head -1)
|
||||
log "✅ Hostname-Auflösung funktioniert: $target_hostname -> $resolved_ip"
|
||||
else
|
||||
warning "⚠️ Hostname-Auflösung für '$target_hostname' fehlgeschlagen"
|
||||
fi
|
||||
}
|
||||
|
||||
# =========================== NETZWERK-SICHERHEIT ===========================
|
||||
configure_network_security() {
|
||||
log "=== KONFIGURIERE ERWEITERTE NETZWERK-SICHERHEIT ==="
|
||||
|
||||
Reference in New Issue
Block a user