chore: Änderungen commited
This commit is contained in:
@ -56,10 +56,14 @@ create_directory_structure() {
|
||||
mkdir -p "/etc/myp"
|
||||
mkdir -p "/usr/local/bin/myp"
|
||||
|
||||
# Desktop-Konfiguration Verzeichnisse
|
||||
mkdir -p "/home/$PROJECT_USER/.config"
|
||||
mkdir -p "/home/$PROJECT_USER/.local/share/applications"
|
||||
mkdir -p "/home/$PROJECT_USER/Desktop"
|
||||
# Desktop-Konfiguration Verzeichnisse (nur wenn Benutzer existiert)
|
||||
if id "$PROJECT_USER" &>/dev/null; then
|
||||
mkdir -p "/home/$PROJECT_USER/.config"
|
||||
mkdir -p "/home/$PROJECT_USER/.local/share/applications"
|
||||
mkdir -p "/home/$PROJECT_USER/Desktop"
|
||||
else
|
||||
log "WARN" "Benutzer $PROJECT_USER existiert noch nicht - überspringe Benutzer-Verzeichnisse"
|
||||
fi
|
||||
|
||||
log "INFO" "Verzeichnisstruktur erstellt"
|
||||
}
|
||||
@ -100,8 +104,14 @@ copy_project_files() {
|
||||
set_file_permissions() {
|
||||
log "INFO" "Setze Dateiberechtigungen..."
|
||||
|
||||
# Besitzer für Installationsverzeichnis
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "$INSTALL_PATH"
|
||||
# Besitzer für Installationsverzeichnis (nur wenn Benutzer existiert)
|
||||
if id "$PROJECT_USER" &>/dev/null; then
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "$INSTALL_PATH"
|
||||
else
|
||||
log "WARN" "Benutzer $PROJECT_USER existiert noch nicht - überspringe Besitzer-Änderung"
|
||||
# Temporär root als Besitzer setzen
|
||||
chown -R root:root "$INSTALL_PATH"
|
||||
fi
|
||||
|
||||
# Grundlegende Verzeichnisberechtigungen
|
||||
find "$INSTALL_PATH" -type d -exec chmod 755 {} \;
|
||||
@ -118,12 +128,16 @@ set_file_permissions() {
|
||||
chmod 755 "$INSTALL_PATH/uploads"
|
||||
chmod 755 "$INSTALL_PATH/static"
|
||||
|
||||
# Log-Verzeichnis Berechtigungen
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "/var/log/myp"
|
||||
# Log-Verzeichnis Berechtigungen (nur wenn Benutzer existiert)
|
||||
if id "$PROJECT_USER" &>/dev/null; then
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "/var/log/myp"
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "/etc/myp"
|
||||
else
|
||||
log "WARN" "Benutzer $PROJECT_USER existiert noch nicht - überspringe Log/Config-Verzeichnis-Besitzer"
|
||||
chown -R root:root "/var/log/myp"
|
||||
chown -R root:root "/etc/myp"
|
||||
fi
|
||||
chmod 755 "/var/log/myp"
|
||||
|
||||
# Konfigurationsverzeichnis
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "/etc/myp"
|
||||
chmod 755 "/etc/myp"
|
||||
|
||||
log "INFO" "Dateiberechtigungen gesetzt"
|
||||
@ -443,10 +457,12 @@ export PYTHONHTTPSVERIFY=1
|
||||
export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
|
||||
EOF
|
||||
|
||||
# Python-Konfiguration in Benutzer-Profile einbinden
|
||||
if [[ -f "/home/$PROJECT_USER/.bashrc" ]]; then
|
||||
# Python-Konfiguration in Benutzer-Profile einbinden (nur wenn Benutzer existiert)
|
||||
if id "$PROJECT_USER" &>/dev/null && [[ -f "/home/$PROJECT_USER/.bashrc" ]]; then
|
||||
echo "# Mercedes-Benz Python Certificate Configuration" >> "/home/$PROJECT_USER/.bashrc"
|
||||
echo "source /etc/myp/python-certs.conf" >> "/home/$PROJECT_USER/.bashrc"
|
||||
else
|
||||
log "WARN" "Benutzer $PROJECT_USER/.bashrc nicht verfügbar - überspringe Benutzer-spezifische Python-Konfiguration"
|
||||
fi
|
||||
|
||||
# Für systemweite Anwendung
|
||||
@ -470,10 +486,12 @@ export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
|
||||
# export NODE_TLS_REJECT_UNAUTHORIZED=0
|
||||
EOF
|
||||
|
||||
# Node.js-Konfiguration in Profile einbinden
|
||||
if [[ -f "/home/$PROJECT_USER/.bashrc" ]]; then
|
||||
# Node.js-Konfiguration in Profile einbinden (nur wenn Benutzer existiert)
|
||||
if id "$PROJECT_USER" &>/dev/null && [[ -f "/home/$PROJECT_USER/.bashrc" ]]; then
|
||||
echo "# Mercedes-Benz Node.js Certificate Configuration" >> "/home/$PROJECT_USER/.bashrc"
|
||||
echo "source /etc/myp/nodejs-certs.conf" >> "/home/$PROJECT_USER/.bashrc"
|
||||
else
|
||||
log "WARN" "Benutzer $PROJECT_USER/.bashrc nicht verfügbar - überspringe Benutzer-spezifische Node.js-Konfiguration"
|
||||
fi
|
||||
|
||||
log "INFO" "Node.js-Zertifikat-Konfiguration abgeschlossen"
|
||||
@ -503,8 +521,8 @@ configure_chromium_certificates() {
|
||||
}
|
||||
EOF
|
||||
|
||||
# Chromium NSS-Datenbank für Benutzer konfigurieren
|
||||
if command -v certutil >/dev/null 2>&1; then
|
||||
# Chromium NSS-Datenbank für Benutzer konfigurieren (nur wenn Benutzer existiert)
|
||||
if command -v certutil >/dev/null 2>&1 && id "$PROJECT_USER" &>/dev/null; then
|
||||
local nss_dir="/home/$PROJECT_USER/.pki/nssdb"
|
||||
mkdir -p "$nss_dir"
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "/home/$PROJECT_USER/.pki"
|
||||
@ -523,6 +541,8 @@ EOF
|
||||
done
|
||||
|
||||
log "INFO" "Mercedes-Zertifikate zu Chromium NSS-Datenbank hinzugefügt"
|
||||
elif ! id "$PROJECT_USER" &>/dev/null; then
|
||||
log "WARN" "Benutzer $PROJECT_USER existiert noch nicht - überspringe Chromium-NSS-Konfiguration"
|
||||
else
|
||||
log "WARN" "certutil nicht verfügbar, installiere NSS-Tools..."
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y libnss3-tools
|
||||
|
||||
@ -28,9 +28,87 @@ create_system_user() {
|
||||
# Benutzer-Umgebung konfigurieren
|
||||
configure_user_environment
|
||||
|
||||
# Nach Benutzer-Erstellung: Berechtigungen und Verzeichnisse korrigieren
|
||||
fix_post_user_creation_permissions
|
||||
|
||||
log "INFO" "System-Benutzer Erstellung abgeschlossen"
|
||||
}
|
||||
|
||||
fix_post_user_creation_permissions() {
|
||||
log "INFO" "Korrigiere Berechtigungen nach Benutzer-Erstellung..."
|
||||
|
||||
# Installationsverzeichnis Besitzer korrigieren
|
||||
if [[ -d "$INSTALL_PATH" ]]; then
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "$INSTALL_PATH"
|
||||
log "INFO" "Installationsverzeichnis-Besitzer zu $PROJECT_USER geändert"
|
||||
fi
|
||||
|
||||
# Log-Verzeichnis Besitzer korrigieren
|
||||
if [[ -d "/var/log/myp" ]]; then
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "/var/log/myp"
|
||||
log "INFO" "Log-Verzeichnis-Besitzer zu $PROJECT_USER geändert"
|
||||
fi
|
||||
|
||||
# Konfigurationsverzeichnis Besitzer korrigieren
|
||||
if [[ -d "/etc/myp" ]]; then
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "/etc/myp"
|
||||
log "INFO" "Konfigurationsverzeichnis-Besitzer zu $PROJECT_USER geändert"
|
||||
fi
|
||||
|
||||
# Desktop-Konfiguration Verzeichnisse nachholen (falls übersprungen)
|
||||
local user_home="/home/$PROJECT_USER"
|
||||
if [[ ! -d "$user_home/.config" ]]; then
|
||||
mkdir -p "$user_home/.config"
|
||||
mkdir -p "$user_home/.local/share/applications"
|
||||
mkdir -p "$user_home/Desktop"
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "$user_home/.config"
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "$user_home/.local"
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "$user_home/Desktop"
|
||||
log "INFO" "Desktop-Konfiguration-Verzeichnisse nachträglich erstellt"
|
||||
fi
|
||||
|
||||
# Mercedes-Zertifikat-Konfiguration nachholen für Benutzer-Profile
|
||||
if [[ -f "/etc/myp/python-certs.conf" ]] && [[ -f "$user_home/.bashrc" ]]; then
|
||||
if ! grep -q "python-certs.conf" "$user_home/.bashrc"; then
|
||||
echo "# Mercedes-Benz Python Certificate Configuration" >> "$user_home/.bashrc"
|
||||
echo "source /etc/myp/python-certs.conf" >> "$user_home/.bashrc"
|
||||
log "INFO" "Python-Zertifikat-Konfiguration zu .bashrc hinzugefügt"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -f "/etc/myp/nodejs-certs.conf" ]] && [[ -f "$user_home/.bashrc" ]]; then
|
||||
if ! grep -q "nodejs-certs.conf" "$user_home/.bashrc"; then
|
||||
echo "# Mercedes-Benz Node.js Certificate Configuration" >> "$user_home/.bashrc"
|
||||
echo "source /etc/myp/nodejs-certs.conf" >> "$user_home/.bashrc"
|
||||
log "INFO" "Node.js-Zertifikat-Konfiguration zu .bashrc hinzugefügt"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Chromium-NSS-Konfiguration nachholen
|
||||
if command -v certutil >/dev/null 2>&1; then
|
||||
local nss_dir="$user_home/.pki/nssdb"
|
||||
if [[ ! -d "$nss_dir" ]]; then
|
||||
mkdir -p "$nss_dir"
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "$user_home/.pki"
|
||||
|
||||
# NSS-Datenbank initialisieren
|
||||
sudo -u "$PROJECT_USER" certutil -N -d sql:"$nss_dir" --empty-password 2>/dev/null || true
|
||||
|
||||
# Mercedes-Zertifikate hinzufügen
|
||||
for cert_file in /usr/local/share/ca-certificates/mercedes/*.crt; do
|
||||
if [[ -f "$cert_file" ]]; then
|
||||
local cert_name=$(basename "$cert_file" .crt)
|
||||
sudo -u "$PROJECT_USER" certutil -A -n "Mercedes-$cert_name" -t "C,," -d sql:"$nss_dir" -i "$cert_file" 2>/dev/null || true
|
||||
fi
|
||||
done
|
||||
|
||||
log "INFO" "Chromium-NSS-Konfiguration nachträglich eingerichtet"
|
||||
fi
|
||||
fi
|
||||
|
||||
log "INFO" "Post-User-Creation-Berechtigungen korrigiert"
|
||||
}
|
||||
|
||||
setup_systemd_services() {
|
||||
log "INFO" "=== SYSTEMD SERVICES EINRICHTEN ==="
|
||||
|
||||
|
||||
Reference in New Issue
Block a user