🎉 Hinzugefügt: Vollständiges Setup-Skript für die Produktionsumgebung mit HTTPS-Only-Konfiguration, automatischer Kiosk-Start, verbesserter Firewall-Sicherheit und browser-kompatiblen SSL-Zertifikaten. 🚀🔒
This commit is contained in:
@@ -308,6 +308,19 @@ This site can't provide a secure connection
|
|||||||
SSL certificate key usage incompatible
|
SSL certificate key usage incompatible
|
||||||
```
|
```
|
||||||
|
|
||||||
|
**🚀 NEUE PRODUKTIONS-LÖSUNG (HTTPS-Only):**
|
||||||
|
```bash
|
||||||
|
# Ein Skript für alles - HTTPS-Only Setup:
|
||||||
|
cd /opt/myp
|
||||||
|
sudo ./setup_https_only.sh
|
||||||
|
|
||||||
|
# Das Skript macht automatisch:
|
||||||
|
# ✅ Browser-kompatible SSL-Zertifikate
|
||||||
|
# ✅ Port 5000 blockieren, nur Port 443 öffnen
|
||||||
|
# ✅ Kiosk-Modus automatisch konfigurieren
|
||||||
|
# ✅ Firewall für maximale Sicherheit
|
||||||
|
```
|
||||||
|
|
||||||
**Lösung:**
|
**Lösung:**
|
||||||
|
|
||||||
**🍓 RASPBERRY PI (Zielsystem) - PRIMÄRE LÖSUNG:**
|
**🍓 RASPBERRY PI (Zielsystem) - PRIMÄRE LÖSUNG:**
|
||||||
|
|||||||
49
backend/EINFACHE_ANLEITUNG.md
Normal file
49
backend/EINFACHE_ANLEITUNG.md
Normal file
@@ -0,0 +1,49 @@
|
|||||||
|
# 🚀 MYP EINFACHE ANLEITUNG
|
||||||
|
|
||||||
|
## Ein Skript für alles!
|
||||||
|
|
||||||
|
Du musst nur **ein einziges Skript** ausführen und alles wird automatisch konfiguriert:
|
||||||
|
|
||||||
|
### Auf dem Raspberry Pi:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 1. Ins MYP-Verzeichnis wechseln
|
||||||
|
cd /opt/myp
|
||||||
|
|
||||||
|
# 2. HTTPS-Only Setup ausführen (macht ALLES automatisch)
|
||||||
|
sudo ./setup_https_only.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
**Das war's!** 🎉
|
||||||
|
|
||||||
|
## Was das Skript automatisch macht:
|
||||||
|
|
||||||
|
✅ **ERR_SSL_KEY_USAGE_INCOMPATIBLE** behebt
|
||||||
|
✅ **Port 5000 komplett blockiert** (nur noch HTTPS Port 443)
|
||||||
|
✅ **Browser-kompatible SSL-Zertifikate** erstellt
|
||||||
|
✅ **Kiosk-Modus automatisch** konfiguriert
|
||||||
|
✅ **Firewall nur Port 443** öffnet
|
||||||
|
✅ **Alle Services** installiert und startet
|
||||||
|
|
||||||
|
## Nach dem Setup:
|
||||||
|
|
||||||
|
- **Zugriff nur über**: https://localhost oder https://m040tbaraspi001.de040.corpintra.net
|
||||||
|
- **Kiosk startet automatisch** mit HTTPS
|
||||||
|
- **Browser-Zertifikat-Warnung** ist normal (einfach akzeptieren)
|
||||||
|
|
||||||
|
## Bei Problemen:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Status prüfen:
|
||||||
|
sudo systemctl status myp-production myp-kiosk
|
||||||
|
|
||||||
|
# Logs anzeigen:
|
||||||
|
sudo journalctl -u myp-production -f
|
||||||
|
|
||||||
|
# Verbindung testen:
|
||||||
|
curl -k -v https://localhost
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**🎯 Ein Befehl - alles erledigt!**
|
||||||
@@ -1 +1,254 @@
|
|||||||
|
# MYP Production HTTPS-Only Setup
|
||||||
|
|
||||||
|
## 🎯 Ziel
|
||||||
|
- **ERR_SSL_KEY_USAGE_INCOMPATIBLE** beheben
|
||||||
|
- Nur Port 443 (HTTPS) verwenden
|
||||||
|
- Port 5000 (HTTP) komplett deaktivieren
|
||||||
|
- Kiosk-Modus automatisch starten
|
||||||
|
- Firewall: Nur Port 443 offen
|
||||||
|
|
||||||
|
## 🚀 Schnelle Lösung (Raspberry Pi)
|
||||||
|
|
||||||
|
### Automatisches Setup (Empfohlen)
|
||||||
|
```bash
|
||||||
|
# Ein Skript für alles:
|
||||||
|
cd /opt/myp
|
||||||
|
sudo ./setup_https_only.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
### 3. Services prüfen
|
||||||
|
```bash
|
||||||
|
# Status prüfen:
|
||||||
|
sudo systemctl status myp-production
|
||||||
|
sudo systemctl status myp-kiosk
|
||||||
|
|
||||||
|
# Logs anzeigen:
|
||||||
|
sudo journalctl -u myp-production -f
|
||||||
|
```
|
||||||
|
|
||||||
|
## 📋 Manuelle Schritte (falls Skripte nicht verfügbar)
|
||||||
|
|
||||||
|
### 1. Alte Services stoppen
|
||||||
|
```bash
|
||||||
|
sudo systemctl stop myp-https myp-app myp-kiosk
|
||||||
|
sudo systemctl disable myp-https myp-app
|
||||||
|
```
|
||||||
|
|
||||||
|
### 2. Browser-kompatible SSL-Zertifikate erstellen
|
||||||
|
```bash
|
||||||
|
# SSL-Verzeichnis erstellen
|
||||||
|
sudo mkdir -p /opt/myp/ssl
|
||||||
|
cd /opt/myp/ssl
|
||||||
|
|
||||||
|
# Browser-kompatible OpenSSL-Konfiguration
|
||||||
|
sudo tee ssl.conf << 'EOF'
|
||||||
|
[req]
|
||||||
|
distinguished_name = req_distinguished_name
|
||||||
|
req_extensions = v3_req
|
||||||
|
prompt = no
|
||||||
|
|
||||||
|
[req_distinguished_name]
|
||||||
|
C = DE
|
||||||
|
ST = Baden-Wuerttemberg
|
||||||
|
L = Stuttgart
|
||||||
|
O = Mercedes-Benz AG
|
||||||
|
OU = MYP Druckerverwaltung
|
||||||
|
CN = m040tbaraspi001
|
||||||
|
|
||||||
|
[v3_req]
|
||||||
|
# KRITISCH für Browser-Kompatibilität
|
||||||
|
basicConstraints = critical, CA:FALSE
|
||||||
|
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||||
|
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||||
|
subjectAltName = critical, @alt_names
|
||||||
|
nsCertType = server
|
||||||
|
|
||||||
|
[alt_names]
|
||||||
|
DNS.1 = localhost
|
||||||
|
DNS.2 = m040tbaraspi001
|
||||||
|
DNS.3 = m040tbaraspi001.local
|
||||||
|
DNS.4 = m040tbaraspi001.de040.corpintra.net
|
||||||
|
IP.1 = 127.0.0.1
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Zertifikate generieren
|
||||||
|
sudo openssl genrsa -out key.pem 2048
|
||||||
|
sudo openssl req -new -x509 -key key.pem -out cert.pem \
|
||||||
|
-days 365 -config ssl.conf -extensions v3_req -sha256
|
||||||
|
|
||||||
|
# Berechtigungen setzen
|
||||||
|
sudo chmod 644 cert.pem
|
||||||
|
sudo chmod 600 key.pem
|
||||||
|
sudo rm ssl.conf
|
||||||
|
```
|
||||||
|
|
||||||
|
### 3. Production Service installieren
|
||||||
|
```bash
|
||||||
|
# Service-Datei kopieren
|
||||||
|
sudo cp /opt/myp/systemd/myp-production.service /etc/systemd/system/
|
||||||
|
|
||||||
|
# Service aktivieren
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
sudo systemctl enable myp-production
|
||||||
|
sudo systemctl start myp-production
|
||||||
|
```
|
||||||
|
|
||||||
|
### 4. Kiosk-Service für HTTPS aktualisieren
|
||||||
|
```bash
|
||||||
|
# Aktualisierte Kiosk-Service-Datei kopieren
|
||||||
|
sudo cp /opt/myp/systemd/myp-kiosk.service /etc/systemd/system/
|
||||||
|
|
||||||
|
# Service neu laden und starten
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
sudo systemctl enable myp-kiosk
|
||||||
|
sudo systemctl start myp-kiosk
|
||||||
|
```
|
||||||
|
|
||||||
|
### 5. Firewall für HTTPS-Only konfigurieren
|
||||||
|
```bash
|
||||||
|
# UFW installieren falls nicht vorhanden
|
||||||
|
sudo apt update && sudo apt install -y ufw
|
||||||
|
|
||||||
|
# Firewall zurücksetzen
|
||||||
|
sudo ufw --force reset
|
||||||
|
|
||||||
|
# Restriktive Policies
|
||||||
|
sudo ufw default deny incoming
|
||||||
|
sudo ufw default deny outgoing
|
||||||
|
sudo ufw default deny forward
|
||||||
|
|
||||||
|
# Loopback erlauben
|
||||||
|
sudo ufw allow in on lo
|
||||||
|
sudo ufw allow out on lo
|
||||||
|
|
||||||
|
# SSH beibehalten (falls aktiv)
|
||||||
|
sudo ufw allow 22/tcp
|
||||||
|
|
||||||
|
# Nur HTTPS Port 443 öffnen
|
||||||
|
sudo ufw allow 443/tcp
|
||||||
|
|
||||||
|
# HTTP-Ports explizit blockieren
|
||||||
|
sudo ufw deny 80/tcp
|
||||||
|
sudo ufw deny 5000/tcp
|
||||||
|
|
||||||
|
# System-Updates erlauben
|
||||||
|
sudo ufw allow out 53/udp # DNS
|
||||||
|
sudo ufw allow out 80/tcp # HTTP für Updates
|
||||||
|
sudo ufw allow out 443/tcp # HTTPS für Updates
|
||||||
|
sudo ufw allow out 123/udp # NTP
|
||||||
|
|
||||||
|
# Lokales Netzwerk für Drucker
|
||||||
|
sudo ufw allow out on eth0 to 192.168.0.0/16
|
||||||
|
sudo ufw allow out on wlan0 to 192.168.0.0/16
|
||||||
|
|
||||||
|
# UFW aktivieren
|
||||||
|
sudo ufw --force enable
|
||||||
|
```
|
||||||
|
|
||||||
|
## 🔧 Problembehandlung
|
||||||
|
|
||||||
|
### SSL-Zertifikat-Fehler beheben
|
||||||
|
```bash
|
||||||
|
# SSL-Fix-Skript ausführen (falls vorhanden)
|
||||||
|
sudo /opt/myp/fix_ssl_raspberry.sh
|
||||||
|
|
||||||
|
# Oder manuell neue Zertifikate erstellen (siehe oben)
|
||||||
|
```
|
||||||
|
|
||||||
|
### Connection Refused beheben
|
||||||
|
```bash
|
||||||
|
# Quick Fix ausführen
|
||||||
|
sudo /opt/myp/quick_fix_connection.sh
|
||||||
|
|
||||||
|
# Oder detaillierte Diagnose
|
||||||
|
sudo /opt/myp/debug_connection_refused.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
### Service-Status prüfen
|
||||||
|
```bash
|
||||||
|
# Alle Services prüfen
|
||||||
|
sudo systemctl status myp-production myp-kiosk
|
||||||
|
|
||||||
|
# Logs anzeigen
|
||||||
|
sudo journalctl -u myp-production -f
|
||||||
|
sudo journalctl -u myp-kiosk -f
|
||||||
|
|
||||||
|
# Port-Status prüfen
|
||||||
|
sudo netstat -tlnp | grep :443
|
||||||
|
sudo ss -tlnp | grep :443
|
||||||
|
```
|
||||||
|
|
||||||
|
### Verbindungstest
|
||||||
|
```bash
|
||||||
|
# HTTPS-Verbindung testen
|
||||||
|
curl -k -v https://localhost
|
||||||
|
curl -k -v https://m040tbaraspi001.de040.corpintra.net
|
||||||
|
|
||||||
|
# Port-Erreichbarkeit testen
|
||||||
|
timeout 5 bash -c '</dev/tcp/localhost/443' && echo "Port 443 offen"
|
||||||
|
timeout 5 bash -c '</dev/tcp/localhost/5000' && echo "Port 5000 offen (PROBLEM!)"
|
||||||
|
```
|
||||||
|
|
||||||
|
## 🌐 Zugriffs-URLs
|
||||||
|
|
||||||
|
Nach dem Setup ist MYP nur noch über HTTPS erreichbar:
|
||||||
|
|
||||||
|
- **Lokal**: https://localhost
|
||||||
|
- **Intranet**: https://m040tbaraspi001.de040.corpintra.net
|
||||||
|
- **Direkt**: https://[IP-Adresse]
|
||||||
|
|
||||||
|
## 🔐 Sicherheits-Features
|
||||||
|
|
||||||
|
✅ **Nur Port 443 (HTTPS) öffentlich zugänglich**
|
||||||
|
✅ **Port 5000 (HTTP) komplett blockiert**
|
||||||
|
✅ **Browser-kompatible SSL-Zertifikate**
|
||||||
|
✅ **Automatischer HTTPS-Redirect**
|
||||||
|
✅ **Sicherheits-Headers (HSTS, CSP, etc.)**
|
||||||
|
✅ **Kiosk-Modus verwendet automatisch HTTPS**
|
||||||
|
|
||||||
|
## ⚠️ Wichtige Hinweise
|
||||||
|
|
||||||
|
1. **Browser-Zertifikat-Warnung ist normal** (Self-Signed Certificate)
|
||||||
|
2. **HTTP-Zugriff funktioniert nicht mehr** (nur HTTPS)
|
||||||
|
3. **Root-Berechtigung erforderlich** für Port 443
|
||||||
|
4. **Firewall blockiert alle anderen Ports**
|
||||||
|
5. **Kiosk startet automatisch mit HTTPS-URL**
|
||||||
|
|
||||||
|
## 🏁 Erfolgskontrolle
|
||||||
|
|
||||||
|
Nach dem Setup sollte folgendes funktionieren:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 1. Production Service läuft
|
||||||
|
sudo systemctl is-active myp-production
|
||||||
|
# Ausgabe: active
|
||||||
|
|
||||||
|
# 2. HTTPS-Port ist offen
|
||||||
|
sudo netstat -tlnp | grep :443
|
||||||
|
# Ausgabe: tcp 0.0.0.0:443 LISTEN
|
||||||
|
|
||||||
|
# 3. HTTP-Port ist geschlossen
|
||||||
|
sudo netstat -tlnp | grep :5000
|
||||||
|
# Ausgabe: (leer)
|
||||||
|
|
||||||
|
# 4. HTTPS-Webserver antwortet
|
||||||
|
curl -k -s https://localhost | grep -i "MYP"
|
||||||
|
# Ausgabe: HTML mit MYP-Inhalt
|
||||||
|
|
||||||
|
# 5. Kiosk-Service läuft (falls Display vorhanden)
|
||||||
|
sudo systemctl is-active myp-kiosk
|
||||||
|
# Ausgabe: active
|
||||||
|
```
|
||||||
|
|
||||||
|
## 📞 Support
|
||||||
|
|
||||||
|
Bei Problemen:
|
||||||
|
|
||||||
|
1. **Logs prüfen**: `sudo journalctl -u myp-production -f`
|
||||||
|
2. **Quick Fix**: `sudo /opt/myp/quick_fix_connection.sh`
|
||||||
|
3. **Diagnose**: `sudo /opt/myp/debug_connection_refused.sh`
|
||||||
|
4. **SSL-Fix**: `sudo /opt/myp/fix_ssl_raspberry.sh`
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**🎉 Nach diesem Setup läuft MYP sicher im HTTPS-Only Modus mit browser-kompatiblen SSL-Zertifikaten!**
|
||||||
@@ -1,193 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# MYP Production Deployment - HTTPS-Only
|
|
||||||
# Deployed die optimierte Produktions-Version mit SSL-Fix
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
# Farben
|
|
||||||
GREEN='\033[0;32m'
|
|
||||||
YELLOW='\033[1;33m'
|
|
||||||
BLUE='\033[0;34m'
|
|
||||||
RED='\033[0;31m'
|
|
||||||
NC='\033[0m'
|
|
||||||
|
|
||||||
echo -e "${BLUE}🚀 MYP PRODUCTION DEPLOYMENT${NC}"
|
|
||||||
echo -e "${BLUE}HTTPS-Only Produktions-Setup${NC}"
|
|
||||||
echo "=============================================="
|
|
||||||
|
|
||||||
# Prüfe Root-Berechtigung
|
|
||||||
if [[ $EUID -ne 0 ]]; then
|
|
||||||
echo -e "${RED}❌ Root-Berechtigung erforderlich${NC}"
|
|
||||||
echo -e "${YELLOW}💡 Führe aus mit: sudo $0${NC}"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# 1. Stoppe alte Services
|
|
||||||
echo -e "${YELLOW}🛑 Schritt 1: Stoppe alte HTTP-Services${NC}"
|
|
||||||
OLD_SERVICES=("myp-https" "myp-app" "myp-kiosk")
|
|
||||||
|
|
||||||
for service in "${OLD_SERVICES[@]}"; do
|
|
||||||
if systemctl is-active "$service" >/dev/null 2>&1; then
|
|
||||||
echo " Stoppe $service..."
|
|
||||||
systemctl stop "$service" 2>/dev/null || true
|
|
||||||
systemctl disable "$service" 2>/dev/null || true
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
# 2. SSL-Zertifikate erstellen/reparieren
|
|
||||||
echo -e "${YELLOW}🔐 Schritt 2: Browser-kompatible SSL-Zertifikate${NC}"
|
|
||||||
if [ -f "/opt/myp/fix_ssl_raspberry.sh" ]; then
|
|
||||||
echo " Führe SSL-Fix-Skript aus..."
|
|
||||||
bash /opt/myp/fix_ssl_raspberry.sh
|
|
||||||
else
|
|
||||||
echo " Erstelle SSL-Zertifikate manuell..."
|
|
||||||
SSL_DIR="/opt/myp/ssl"
|
|
||||||
mkdir -p "$SSL_DIR"
|
|
||||||
|
|
||||||
# Browser-kompatible SSL-Konfiguration
|
|
||||||
cat > /tmp/ssl.conf << 'EOF'
|
|
||||||
[req]
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
req_extensions = v3_req
|
|
||||||
prompt = no
|
|
||||||
|
|
||||||
[req_distinguished_name]
|
|
||||||
C = DE
|
|
||||||
ST = Baden-Wuerttemberg
|
|
||||||
L = Stuttgart
|
|
||||||
O = Mercedes-Benz AG
|
|
||||||
OU = MYP Druckerverwaltung
|
|
||||||
CN = m040tbaraspi001
|
|
||||||
|
|
||||||
[v3_req]
|
|
||||||
basicConstraints = critical, CA:FALSE
|
|
||||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
|
||||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
|
||||||
subjectAltName = critical, @alt_names
|
|
||||||
nsCertType = server
|
|
||||||
|
|
||||||
[alt_names]
|
|
||||||
DNS.1 = localhost
|
|
||||||
DNS.2 = m040tbaraspi001
|
|
||||||
DNS.3 = m040tbaraspi001.local
|
|
||||||
DNS.4 = m040tbaraspi001.de040.corpintra.net
|
|
||||||
IP.1 = 127.0.0.1
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Generiere Zertifikate
|
|
||||||
openssl genrsa -out "$SSL_DIR/key.pem" 2048
|
|
||||||
openssl req -new -x509 -key "$SSL_DIR/key.pem" -out "$SSL_DIR/cert.pem" \
|
|
||||||
-days 365 -config /tmp/ssl.conf -extensions v3_req -sha256
|
|
||||||
|
|
||||||
chmod 644 "$SSL_DIR/cert.pem"
|
|
||||||
chmod 600 "$SSL_DIR/key.pem"
|
|
||||||
rm /tmp/ssl.conf
|
|
||||||
|
|
||||||
echo " ✅ Browser-kompatible SSL-Zertifikate erstellt"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# 3. Produktions-Service installieren
|
|
||||||
echo -e "${YELLOW}📦 Schritt 3: Produktions-Service installieren${NC}"
|
|
||||||
if [ -f "/opt/myp/systemd/myp-production.service" ]; then
|
|
||||||
cp /opt/myp/systemd/myp-production.service /etc/systemd/system/
|
|
||||||
systemctl daemon-reload
|
|
||||||
systemctl enable myp-production
|
|
||||||
echo " ✅ myp-production.service installiert"
|
|
||||||
else
|
|
||||||
echo -e "${RED} ❌ myp-production.service nicht gefunden${NC}"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# 4. Kiosk-Service für HTTPS aktualisieren
|
|
||||||
echo -e "${YELLOW}🖥️ Schritt 4: Kiosk-Service für HTTPS aktualisieren${NC}"
|
|
||||||
if [ -f "/opt/myp/systemd/myp-kiosk.service" ]; then
|
|
||||||
cp /opt/myp/systemd/myp-kiosk.service /etc/systemd/system/
|
|
||||||
systemctl daemon-reload
|
|
||||||
systemctl enable myp-kiosk
|
|
||||||
echo " ✅ myp-kiosk.service für HTTPS aktualisiert"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# 5. Firewall für HTTPS-Only konfigurieren
|
|
||||||
echo -e "${YELLOW}🔥 Schritt 5: Firewall für HTTPS-Only${NC}"
|
|
||||||
if [ -f "/opt/myp/setup_production_firewall.sh" ]; then
|
|
||||||
bash /opt/myp/setup_production_firewall.sh
|
|
||||||
else
|
|
||||||
# Fallback: Manuelle Firewall-Konfiguration
|
|
||||||
if command -v ufw >/dev/null 2>&1; then
|
|
||||||
ufw allow 443/tcp
|
|
||||||
ufw deny 5000/tcp
|
|
||||||
ufw deny 80/tcp
|
|
||||||
ufw --force enable
|
|
||||||
echo " ✅ Firewall manuell konfiguriert"
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
# 6. Produktions-Service starten
|
|
||||||
echo -e "${YELLOW}🚀 Schritt 6: Produktions-Service starten${NC}"
|
|
||||||
systemctl start myp-production
|
|
||||||
sleep 5
|
|
||||||
|
|
||||||
if systemctl is-active myp-production >/dev/null 2>&1; then
|
|
||||||
echo " ✅ myp-production läuft"
|
|
||||||
else
|
|
||||||
echo -e "${RED} ❌ myp-production Start-Fehler${NC}"
|
|
||||||
echo " Logs: journalctl -u myp-production -f"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# 7. Kiosk-Service starten
|
|
||||||
echo -e "${YELLOW}🖥️ Schritt 7: Kiosk-Service starten${NC}"
|
|
||||||
systemctl start myp-kiosk
|
|
||||||
sleep 3
|
|
||||||
|
|
||||||
if systemctl is-active myp-kiosk >/dev/null 2>&1; then
|
|
||||||
echo " ✅ myp-kiosk läuft"
|
|
||||||
else
|
|
||||||
echo -e "${YELLOW} ⚠️ myp-kiosk Start-Problem (normal bei fehlendem Display)${NC}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# 8. Verbindungstest
|
|
||||||
echo -e "${YELLOW}🌐 Schritt 8: HTTPS-Verbindungstest${NC}"
|
|
||||||
sleep 5
|
|
||||||
|
|
||||||
if timeout 10 bash -c "</dev/tcp/localhost/443" 2>/dev/null; then
|
|
||||||
echo " ✅ Port 443 (HTTPS) erreichbar"
|
|
||||||
else
|
|
||||||
echo -e "${RED} ❌ Port 443 nicht erreichbar${NC}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Test mit curl
|
|
||||||
if curl -k -s --connect-timeout 5 https://localhost >/dev/null 2>&1; then
|
|
||||||
echo " ✅ HTTPS-Webserver antwortet"
|
|
||||||
else
|
|
||||||
echo -e "${RED} ❌ HTTPS-Webserver antwortet nicht${NC}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# 9. Status-Übersicht
|
|
||||||
echo ""
|
|
||||||
echo -e "${GREEN}🏁 PRODUCTION DEPLOYMENT ABGESCHLOSSEN!${NC}"
|
|
||||||
echo ""
|
|
||||||
echo -e "${BLUE}📊 Service-Status:${NC}"
|
|
||||||
systemctl is-active myp-production && echo -e " ✅ myp-production: $(systemctl is-active myp-production)"
|
|
||||||
systemctl is-active myp-kiosk && echo -e " ✅ myp-kiosk: $(systemctl is-active myp-kiosk)"
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo -e "${BLUE}🌐 Zugriff über:${NC}"
|
|
||||||
echo " • https://localhost (lokal)"
|
|
||||||
echo " • https://m040tbaraspi001.de040.corpintra.net (Intranet)"
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo -e "${GREEN}🔐 SICHERHEITS-STATUS:${NC}"
|
|
||||||
echo " ✅ Nur Port 443 (HTTPS) ist öffentlich"
|
|
||||||
echo " ✅ Port 5000 (HTTP) ist blockiert"
|
|
||||||
echo " ✅ Browser-kompatible SSL-Zertifikate"
|
|
||||||
echo " ✅ Kiosk-Modus verwendet HTTPS"
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo -e "${YELLOW}📋 NÄCHSTE SCHRITTE:${NC}"
|
|
||||||
echo " 1. Browser-Zertifikat-Warnung akzeptieren"
|
|
||||||
echo " 2. Kiosk sollte automatisch HTTPS verwenden"
|
|
||||||
echo " 3. Bei Problemen: journalctl -u myp-production -f"
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo -e "${GREEN}✨ MYP läuft jetzt im sicheren HTTPS-Only Modus!${NC}"
|
|
||||||
403
backend/setup_https_only.sh
Normal file
403
backend/setup_https_only.sh
Normal file
@@ -0,0 +1,403 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# MYP HTTPS-Only Setup - Das einzige Skript das du brauchst!
|
||||||
|
# Löst ALLE Probleme automatisch:
|
||||||
|
# - ERR_SSL_KEY_USAGE_INCOMPATIBLE
|
||||||
|
# - Port 5000 blockieren
|
||||||
|
# - Nur Port 443 (HTTPS)
|
||||||
|
# - Kiosk automatisch starten
|
||||||
|
# - Firewall sichern
|
||||||
|
#
|
||||||
|
# Verwendung: sudo ./setup_https_only.sh
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Farben für Output
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
BLUE='\033[0;34m'
|
||||||
|
RED='\033[0;31m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
BOLD='\033[1m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
# Banner
|
||||||
|
echo -e "${CYAN}${BOLD}"
|
||||||
|
echo "╔══════════════════════════════════════════════════════════════╗"
|
||||||
|
echo "║ MYP HTTPS-ONLY SETUP ║"
|
||||||
|
echo "║ Das einzige Skript das du brauchst! ║"
|
||||||
|
echo "║ ║"
|
||||||
|
echo "║ ✅ SSL Browser-Kompatibilität (ERR_SSL_KEY_USAGE_INCOMPATIBLE) ║"
|
||||||
|
echo "║ ✅ Nur Port 443 (HTTPS) - Port 5000 blockiert ║"
|
||||||
|
echo "║ ✅ Automatischer Kiosk-Start ║"
|
||||||
|
echo "║ ✅ Maximale Firewall-Sicherheit ║"
|
||||||
|
echo "║ ✅ Standalone Flask (kein Proxy) ║"
|
||||||
|
echo "╚══════════════════════════════════════════════════════════════╝"
|
||||||
|
echo -e "${NC}"
|
||||||
|
|
||||||
|
# Prüfe Root-Berechtigung
|
||||||
|
if [[ $EUID -ne 0 ]]; then
|
||||||
|
echo -e "${RED}❌ Root-Berechtigung erforderlich${NC}"
|
||||||
|
echo -e "${YELLOW}💡 Führe aus mit: sudo $0${NC}"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Arbeitsverzeichnis setzen
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
MYP_DIR="/opt/myp"
|
||||||
|
|
||||||
|
# Prüfe ob wir im Git-Clone oder Production-Verzeichnis sind
|
||||||
|
if [[ "$SCRIPT_DIR" == *"/tmp/"* ]] || [[ "$SCRIPT_DIR" != "$MYP_DIR"* ]]; then
|
||||||
|
echo -e "${BLUE}📁 Git-Clone-Modus erkannt - kopiere nach $MYP_DIR${NC}"
|
||||||
|
|
||||||
|
# Erstelle Production-Verzeichnis
|
||||||
|
mkdir -p "$MYP_DIR"
|
||||||
|
|
||||||
|
# Kopiere alle relevanten Dateien
|
||||||
|
if [[ -d "$(dirname "$SCRIPT_DIR")" ]]; then
|
||||||
|
PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
|
||||||
|
echo " Kopiere Backend-Dateien..."
|
||||||
|
cp -r "$SCRIPT_DIR"/* "$MYP_DIR/" 2>/dev/null || true
|
||||||
|
|
||||||
|
# Kopiere wichtige Root-Dateien
|
||||||
|
for file in "README.md" "requirements.txt" ".env" "config.py"; do
|
||||||
|
if [[ -f "$PROJECT_ROOT/$file" ]]; then
|
||||||
|
cp "$PROJECT_ROOT/$file" "$MYP_DIR/" 2>/dev/null || true
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo -e "${GREEN} ✅ Dateien nach $MYP_DIR kopiert${NC}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Wechsle ins Production-Verzeichnis
|
||||||
|
cd "$MYP_DIR"
|
||||||
|
else
|
||||||
|
echo -e "${BLUE}📁 Production-Modus - arbeite in $MYP_DIR${NC}"
|
||||||
|
cd "$MYP_DIR"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e "${BLUE}🚀 STARTE SETUP...${NC}"
|
||||||
|
echo "=============================================="
|
||||||
|
|
||||||
|
# ===== SCHRITT 1: SYSTEM VORBEREITEN =====
|
||||||
|
echo -e "${YELLOW}📦 Schritt 1/8: System vorbereiten${NC}"
|
||||||
|
|
||||||
|
# System-Updates
|
||||||
|
echo " Aktualisiere Paketlisten..."
|
||||||
|
apt update -qq
|
||||||
|
|
||||||
|
# Installiere benötigte Pakete
|
||||||
|
echo " Installiere benötigte Pakete..."
|
||||||
|
REQUIRED_PACKAGES=(
|
||||||
|
"python3" "python3-pip" "python3-venv"
|
||||||
|
"openssl" "curl" "ufw" "systemd"
|
||||||
|
"chromium-browser" "unclutter"
|
||||||
|
"xorg" "xinit" "x11-xserver-utils"
|
||||||
|
)
|
||||||
|
|
||||||
|
for package in "${REQUIRED_PACKAGES[@]}"; do
|
||||||
|
if ! dpkg -l | grep -q "^ii $package "; then
|
||||||
|
echo " Installiere $package..."
|
||||||
|
apt install -y "$package" -qq 2>/dev/null || true
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo -e "${GREEN} ✅ System vorbereitet${NC}"
|
||||||
|
|
||||||
|
# ===== SCHRITT 2: PYTHON DEPENDENCIES =====
|
||||||
|
echo -e "${YELLOW}🐍 Schritt 2/8: Python-Dependencies installieren${NC}"
|
||||||
|
|
||||||
|
# Python-Pakete installieren
|
||||||
|
if [[ -f "requirements.txt" ]]; then
|
||||||
|
echo " Installiere Python-Pakete..."
|
||||||
|
python3 -m pip install -r requirements.txt --break-system-packages --quiet 2>/dev/null || {
|
||||||
|
echo " Fallback: Installiere kritische Pakete einzeln..."
|
||||||
|
python3 -m pip install flask flask-login flask-sqlalchemy werkzeug --break-system-packages --quiet 2>/dev/null || true
|
||||||
|
}
|
||||||
|
else
|
||||||
|
echo " Installiere Standard-Pakete..."
|
||||||
|
python3 -m pip install flask flask-login flask-sqlalchemy werkzeug --break-system-packages --quiet 2>/dev/null || true
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "${GREEN} ✅ Python-Dependencies installiert${NC}"
|
||||||
|
|
||||||
|
# ===== SCHRITT 3: ALTE SERVICES STOPPEN =====
|
||||||
|
echo -e "${YELLOW}🛑 Schritt 3/8: Alte Services stoppen${NC}"
|
||||||
|
|
||||||
|
OLD_SERVICES=("myp-https" "myp-app" "myp-kiosk" "apache2" "nginx")
|
||||||
|
|
||||||
|
for service in "${OLD_SERVICES[@]}"; do
|
||||||
|
if systemctl is-active "$service" >/dev/null 2>&1; then
|
||||||
|
echo " Stoppe $service..."
|
||||||
|
systemctl stop "$service" 2>/dev/null || true
|
||||||
|
if [[ "$service" != "myp-kiosk" ]]; then
|
||||||
|
systemctl disable "$service" 2>/dev/null || true
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo -e "${GREEN} ✅ Alte Services gestoppt${NC}"
|
||||||
|
|
||||||
|
# ===== SCHRITT 4: BROWSER-KOMPATIBLE SSL-ZERTIFIKATE =====
|
||||||
|
echo -e "${YELLOW}🔐 Schritt 4/8: Browser-kompatible SSL-Zertifikate${NC}"
|
||||||
|
|
||||||
|
SSL_DIR="$MYP_DIR/ssl"
|
||||||
|
mkdir -p "$SSL_DIR"
|
||||||
|
|
||||||
|
# Prüfe ob gültige Zertifikate vorhanden sind
|
||||||
|
CERT_VALID=false
|
||||||
|
if [[ -f "$SSL_DIR/cert.pem" ]] && [[ -f "$SSL_DIR/key.pem" ]]; then
|
||||||
|
if openssl x509 -in "$SSL_DIR/cert.pem" -noout -checkend 86400 >/dev/null 2>&1; then
|
||||||
|
# Prüfe Browser-Kompatibilität
|
||||||
|
if openssl x509 -in "$SSL_DIR/cert.pem" -noout -text | grep -q "Digital Signature" && \
|
||||||
|
openssl x509 -in "$SSL_DIR/cert.pem" -noout -text | grep -q "Key Encipherment" && \
|
||||||
|
openssl x509 -in "$SSL_DIR/cert.pem" -noout -text | grep -q "TLS Web Server Authentication" && \
|
||||||
|
openssl x509 -in "$SSL_DIR/cert.pem" -noout -text | grep -q "Subject Alternative Name"; then
|
||||||
|
CERT_VALID=true
|
||||||
|
echo " ✅ Gültige browser-kompatible Zertifikate gefunden"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Erstelle neue Zertifikate falls nötig
|
||||||
|
if [[ "$CERT_VALID" == "false" ]]; then
|
||||||
|
echo " Erstelle neue browser-kompatible SSL-Zertifikate..."
|
||||||
|
|
||||||
|
# Browser-kompatible OpenSSL-Konfiguration
|
||||||
|
cat > "$SSL_DIR/ssl.conf" << 'EOF'
|
||||||
|
[req]
|
||||||
|
distinguished_name = req_distinguished_name
|
||||||
|
req_extensions = v3_req
|
||||||
|
prompt = no
|
||||||
|
|
||||||
|
[req_distinguished_name]
|
||||||
|
C = DE
|
||||||
|
ST = Baden-Wuerttemberg
|
||||||
|
L = Stuttgart
|
||||||
|
O = Mercedes-Benz AG
|
||||||
|
OU = MYP Druckerverwaltung
|
||||||
|
CN = m040tbaraspi001
|
||||||
|
|
||||||
|
[v3_req]
|
||||||
|
# KRITISCH für Browser-Kompatibilität
|
||||||
|
basicConstraints = critical, CA:FALSE
|
||||||
|
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||||
|
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||||
|
subjectAltName = critical, @alt_names
|
||||||
|
nsCertType = server
|
||||||
|
nsComment = "MYP Production SSL - Browser Compatible"
|
||||||
|
|
||||||
|
[alt_names]
|
||||||
|
# Lokale Entwicklung
|
||||||
|
DNS.1 = localhost
|
||||||
|
DNS.2 = *.localhost
|
||||||
|
IP.1 = 127.0.0.1
|
||||||
|
IP.2 = ::1
|
||||||
|
|
||||||
|
# Raspberry Pi Hostname
|
||||||
|
DNS.3 = m040tbaraspi001
|
||||||
|
DNS.4 = m040tbaraspi001.local
|
||||||
|
DNS.5 = raspberrypi
|
||||||
|
DNS.6 = raspberrypi.local
|
||||||
|
|
||||||
|
# Intranet-Domain
|
||||||
|
DNS.7 = m040tbaraspi001.de040.corpintra.net
|
||||||
|
DNS.8 = *.de040.corpintra.net
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Generiere Private Key
|
||||||
|
openssl genrsa -out "$SSL_DIR/key.pem" 2048 2>/dev/null
|
||||||
|
|
||||||
|
# Generiere browser-kompatibles Zertifikat
|
||||||
|
openssl req -new -x509 \
|
||||||
|
-key "$SSL_DIR/key.pem" \
|
||||||
|
-out "$SSL_DIR/cert.pem" \
|
||||||
|
-days 365 \
|
||||||
|
-config "$SSL_DIR/ssl.conf" \
|
||||||
|
-extensions v3_req \
|
||||||
|
-sha256 2>/dev/null
|
||||||
|
|
||||||
|
# Setze korrekte Berechtigungen
|
||||||
|
chmod 644 "$SSL_DIR/cert.pem"
|
||||||
|
chmod 600 "$SSL_DIR/key.pem"
|
||||||
|
rm "$SSL_DIR/ssl.conf"
|
||||||
|
|
||||||
|
echo -e "${GREEN} ✅ Browser-kompatible SSL-Zertifikate erstellt${NC}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ===== SCHRITT 5: PRODUCTION SERVICE INSTALLIEREN =====
|
||||||
|
echo -e "${YELLOW}📦 Schritt 5/8: Production Service installieren${NC}"
|
||||||
|
|
||||||
|
# Kopiere Service-Dateien
|
||||||
|
if [[ -f "$MYP_DIR/systemd/myp-production.service" ]]; then
|
||||||
|
cp "$MYP_DIR/systemd/myp-production.service" /etc/systemd/system/
|
||||||
|
echo " ✅ myp-production.service installiert"
|
||||||
|
else
|
||||||
|
echo -e "${RED} ❌ myp-production.service nicht gefunden${NC}"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Kiosk-Service aktualisieren
|
||||||
|
if [[ -f "$MYP_DIR/systemd/myp-kiosk.service" ]]; then
|
||||||
|
cp "$MYP_DIR/systemd/myp-kiosk.service" /etc/systemd/system/
|
||||||
|
echo " ✅ myp-kiosk.service aktualisiert"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Services aktivieren
|
||||||
|
systemctl daemon-reload
|
||||||
|
systemctl enable myp-production
|
||||||
|
systemctl enable myp-kiosk
|
||||||
|
|
||||||
|
echo -e "${GREEN} ✅ Services installiert und aktiviert${NC}"
|
||||||
|
|
||||||
|
# ===== SCHRITT 6: FIREWALL KONFIGURIEREN =====
|
||||||
|
echo -e "${YELLOW}🔥 Schritt 6/8: Firewall für HTTPS-Only${NC}"
|
||||||
|
|
||||||
|
# UFW installieren falls nicht vorhanden
|
||||||
|
if ! command -v ufw >/dev/null 2>&1; then
|
||||||
|
echo " Installiere UFW..."
|
||||||
|
apt install -y ufw -qq
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo " Konfiguriere restriktive Firewall..."
|
||||||
|
|
||||||
|
# UFW zurücksetzen
|
||||||
|
ufw --force reset >/dev/null 2>&1
|
||||||
|
|
||||||
|
# Restriktive Standard-Policies
|
||||||
|
ufw default deny incoming >/dev/null 2>&1
|
||||||
|
ufw default deny outgoing >/dev/null 2>&1
|
||||||
|
ufw default deny forward >/dev/null 2>&1
|
||||||
|
|
||||||
|
# Loopback-Interface erlauben
|
||||||
|
ufw allow in on lo >/dev/null 2>&1
|
||||||
|
ufw allow out on lo >/dev/null 2>&1
|
||||||
|
|
||||||
|
# SSH beibehalten (falls aktiv)
|
||||||
|
if systemctl is-active ssh >/dev/null 2>&1 || systemctl is-active sshd >/dev/null 2>&1; then
|
||||||
|
ufw allow 22/tcp >/dev/null 2>&1
|
||||||
|
echo " ✅ SSH-Zugriff beibehalten"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Nur HTTPS Port 443 öffnen
|
||||||
|
ufw allow 443/tcp >/dev/null 2>&1
|
||||||
|
echo " ✅ Port 443 (HTTPS) geöffnet"
|
||||||
|
|
||||||
|
# HTTP-Ports explizit blockieren
|
||||||
|
ufw deny 80/tcp >/dev/null 2>&1
|
||||||
|
ufw deny 5000/tcp >/dev/null 2>&1
|
||||||
|
echo " ✅ Port 80/5000 (HTTP) blockiert"
|
||||||
|
|
||||||
|
# System-Updates erlauben
|
||||||
|
ufw allow out 53/udp >/dev/null 2>&1 # DNS
|
||||||
|
ufw allow out 80/tcp >/dev/null 2>&1 # HTTP für Updates
|
||||||
|
ufw allow out 443/tcp >/dev/null 2>&1 # HTTPS für Updates
|
||||||
|
ufw allow out 123/udp >/dev/null 2>&1 # NTP
|
||||||
|
|
||||||
|
# Lokales Netzwerk für Drucker
|
||||||
|
ufw allow out on eth0 to 192.168.0.0/16 >/dev/null 2>&1
|
||||||
|
ufw allow out on wlan0 to 192.168.0.0/16 >/dev/null 2>&1
|
||||||
|
ufw allow out on eth0 to 10.0.0.0/8 >/dev/null 2>&1
|
||||||
|
ufw allow out on wlan0 to 10.0.0.0/8 >/dev/null 2>&1
|
||||||
|
|
||||||
|
# UFW aktivieren
|
||||||
|
ufw --force enable >/dev/null 2>&1
|
||||||
|
|
||||||
|
echo -e "${GREEN} ✅ Firewall konfiguriert (nur Port 443 offen)${NC}"
|
||||||
|
|
||||||
|
# ===== SCHRITT 7: SERVICES STARTEN =====
|
||||||
|
echo -e "${YELLOW}🚀 Schritt 7/8: Production Services starten${NC}"
|
||||||
|
|
||||||
|
# Production Service starten
|
||||||
|
echo " Starte myp-production..."
|
||||||
|
systemctl start myp-production
|
||||||
|
sleep 5
|
||||||
|
|
||||||
|
if systemctl is-active myp-production >/dev/null 2>&1; then
|
||||||
|
echo -e "${GREEN} ✅ myp-production läuft${NC}"
|
||||||
|
else
|
||||||
|
echo -e "${RED} ❌ myp-production Start-Fehler${NC}"
|
||||||
|
echo " Logs: journalctl -u myp-production -n 20"
|
||||||
|
journalctl -u myp-production -n 10 --no-pager
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Kiosk Service starten
|
||||||
|
echo " Starte myp-kiosk..."
|
||||||
|
systemctl start myp-kiosk
|
||||||
|
sleep 3
|
||||||
|
|
||||||
|
if systemctl is-active myp-kiosk >/dev/null 2>&1; then
|
||||||
|
echo -e "${GREEN} ✅ myp-kiosk läuft${NC}"
|
||||||
|
else
|
||||||
|
echo -e "${YELLOW} ⚠️ myp-kiosk Start-Problem (normal ohne Display)${NC}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ===== SCHRITT 8: VERBINDUNGSTEST =====
|
||||||
|
echo -e "${YELLOW}🌐 Schritt 8/8: HTTPS-Verbindungstest${NC}"
|
||||||
|
|
||||||
|
sleep 5
|
||||||
|
|
||||||
|
# Port-Test
|
||||||
|
if timeout 10 bash -c '</dev/tcp/localhost/443' 2>/dev/null; then
|
||||||
|
echo -e "${GREEN} ✅ Port 443 (HTTPS) erreichbar${NC}"
|
||||||
|
else
|
||||||
|
echo -e "${RED} ❌ Port 443 nicht erreichbar${NC}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# HTTP-Port sollte blockiert sein
|
||||||
|
if timeout 3 bash -c '</dev/tcp/localhost/5000' 2>/dev/null; then
|
||||||
|
echo -e "${YELLOW} ⚠️ Port 5000 noch offen (sollte blockiert sein)${NC}"
|
||||||
|
else
|
||||||
|
echo -e "${GREEN} ✅ Port 5000 korrekt blockiert${NC}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# HTTPS-Webserver-Test
|
||||||
|
if curl -k -s --connect-timeout 5 https://localhost >/dev/null 2>&1; then
|
||||||
|
echo -e "${GREEN} ✅ HTTPS-Webserver antwortet${NC}"
|
||||||
|
else
|
||||||
|
echo -e "${RED} ❌ HTTPS-Webserver antwortet nicht${NC}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ===== SETUP ABGESCHLOSSEN =====
|
||||||
|
echo ""
|
||||||
|
echo -e "${GREEN}${BOLD}🎉 HTTPS-ONLY SETUP ERFOLGREICH ABGESCHLOSSEN! 🎉${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e "${CYAN}╔══════════════════════════════════════════════════════════════╗${NC}"
|
||||||
|
echo -e "${CYAN}║ SETUP ZUSAMMENFASSUNG ║${NC}"
|
||||||
|
echo -e "${CYAN}╠══════════════════════════════════════════════════════════════╣${NC}"
|
||||||
|
echo -e "${CYAN}║${NC} ${GREEN}✅ SSL Browser-Kompatibilität behoben${NC} ${CYAN}║${NC}"
|
||||||
|
echo -e "${CYAN}║${NC} ${GREEN}✅ Nur Port 443 (HTTPS) öffentlich zugänglich${NC} ${CYAN}║${NC}"
|
||||||
|
echo -e "${CYAN}║${NC} ${GREEN}✅ Port 5000 (HTTP) komplett blockiert${NC} ${CYAN}║${NC}"
|
||||||
|
echo -e "${CYAN}║${NC} ${GREEN}✅ Kiosk-Modus automatisch konfiguriert${NC} ${CYAN}║${NC}"
|
||||||
|
echo -e "${CYAN}║${NC} ${GREEN}✅ Maximale Firewall-Sicherheit aktiviert${NC} ${CYAN}║${NC}"
|
||||||
|
echo -e "${CYAN}║${NC} ${GREEN}✅ Standalone Flask App (kein Proxy)${NC} ${CYAN}║${NC}"
|
||||||
|
echo -e "${CYAN}╚══════════════════════════════════════════════════════════════╝${NC}"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e "${BLUE}📊 SERVICE-STATUS:${NC}"
|
||||||
|
systemctl is-active myp-production >/dev/null && echo -e " ${GREEN}✅ myp-production: $(systemctl is-active myp-production)${NC}"
|
||||||
|
systemctl is-active myp-kiosk >/dev/null && echo -e " ${GREEN}✅ myp-kiosk: $(systemctl is-active myp-kiosk)${NC}"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e "${BLUE}🌐 ZUGRIFF ÜBER:${NC}"
|
||||||
|
echo -e " ${GREEN}• https://localhost${NC} (lokal)"
|
||||||
|
echo -e " ${GREEN}• https://m040tbaraspi001.de040.corpintra.net${NC} (Intranet)"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e "${BLUE}🔐 SICHERHEITS-STATUS:${NC}"
|
||||||
|
echo -e " ${GREEN}✅ Nur Port 443 (HTTPS) ist öffentlich${NC}"
|
||||||
|
echo -e " ${GREEN}✅ Port 5000/80 (HTTP) sind blockiert${NC}"
|
||||||
|
echo -e " ${GREEN}✅ Browser-kompatible SSL-Zertifikate${NC}"
|
||||||
|
echo -e " ${GREEN}✅ Automatischer HTTPS-Redirect${NC}"
|
||||||
|
echo -e " ${GREEN}✅ Kiosk verwendet automatisch HTTPS${NC}"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e "${YELLOW}📋 NÄCHSTE SCHRITTE:${NC}"
|
||||||
|
echo -e " ${CYAN}1.${NC} Browser-Zertifikat-Warnung akzeptieren (normal bei Self-Signed)"
|
||||||
|
echo -e " ${CYAN}2.${NC} Kiosk sollte automatisch mit HTTPS starten"
|
||||||
|
echo -e " ${CYAN}3.${NC} Bei Problemen: ${YELLOW}journalctl -u myp-production -f${NC}"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e "${GREEN}${BOLD}🚀 MYP läuft jetzt im sicheren HTTPS-Only Produktions-Modus! 🚀${NC}"
|
||||||
|
echo -e "${CYAN} Ein Skript - alles erledigt!${NC}"
|
||||||
@@ -1 +0,0 @@
|
|||||||
|
|
||||||
@@ -1,137 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# MYP Production Firewall Setup - Nur Port 443
|
|
||||||
# Konfiguriert UFW für maximale Sicherheit mit nur HTTPS-Zugriff
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
# Farben für Output
|
|
||||||
GREEN='\033[0;32m'
|
|
||||||
YELLOW='\033[1;33m'
|
|
||||||
BLUE='\033[0;34m'
|
|
||||||
RED='\033[0;31m'
|
|
||||||
NC='\033[0m'
|
|
||||||
|
|
||||||
echo -e "${BLUE}🔥 MYP PRODUCTION FIREWALL SETUP${NC}"
|
|
||||||
echo -e "${BLUE}Konfiguriert UFW für HTTPS-Only Betrieb${NC}"
|
|
||||||
echo "=============================================="
|
|
||||||
|
|
||||||
# Prüfe Root-Berechtigung
|
|
||||||
if [[ $EUID -ne 0 ]]; then
|
|
||||||
echo -e "${RED}❌ Root-Berechtigung erforderlich${NC}"
|
|
||||||
echo -e "${YELLOW}💡 Führe aus mit: sudo $0${NC}"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Prüfe ob UFW installiert ist
|
|
||||||
if ! command -v ufw >/dev/null 2>&1; then
|
|
||||||
echo -e "${YELLOW}📦 Installiere UFW...${NC}"
|
|
||||||
apt update && apt install -y ufw
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo -e "${YELLOW}🔧 Konfiguriere Firewall für HTTPS-Only Betrieb...${NC}"
|
|
||||||
|
|
||||||
# UFW zurücksetzen für saubere Konfiguration
|
|
||||||
echo " Setze UFW-Regeln zurück..."
|
|
||||||
ufw --force reset >/dev/null 2>&1
|
|
||||||
|
|
||||||
# Standard-Policies setzen (alles blockieren)
|
|
||||||
echo " Setze restriktive Standard-Policies..."
|
|
||||||
ufw default deny incoming >/dev/null 2>&1
|
|
||||||
ufw default deny outgoing >/dev/null 2>&1
|
|
||||||
ufw default deny forward >/dev/null 2>&1
|
|
||||||
|
|
||||||
# Loopback-Interface erlauben (wichtig für lokale Verbindungen)
|
|
||||||
echo " Erlaube Loopback-Interface..."
|
|
||||||
ufw allow in on lo >/dev/null 2>&1
|
|
||||||
ufw allow out on lo >/dev/null 2>&1
|
|
||||||
|
|
||||||
# SSH-Zugriff beibehalten (falls aktiv)
|
|
||||||
if systemctl is-active ssh >/dev/null 2>&1 || systemctl is-active sshd >/dev/null 2>&1; then
|
|
||||||
echo " Erlaube SSH (Port 22) für Administration..."
|
|
||||||
ufw allow 22/tcp >/dev/null 2>&1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# HTTPS-Port 443 öffnen (einziger öffentlicher Port)
|
|
||||||
echo " Öffne HTTPS Port 443..."
|
|
||||||
ufw allow 443/tcp >/dev/null 2>&1
|
|
||||||
|
|
||||||
# Ausgehende Verbindungen für System-Updates erlauben
|
|
||||||
echo " Erlaube ausgehende System-Updates..."
|
|
||||||
ufw allow out 53/udp >/dev/null 2>&1 # DNS
|
|
||||||
ufw allow out 80/tcp >/dev/null 2>&1 # HTTP für Updates
|
|
||||||
ufw allow out 443/tcp >/dev/null 2>&1 # HTTPS für Updates
|
|
||||||
|
|
||||||
# NTP für Zeitsynchonisation
|
|
||||||
echo " Erlaube NTP für Zeitsynchonisation..."
|
|
||||||
ufw allow out 123/udp >/dev/null 2>&1
|
|
||||||
|
|
||||||
# Lokales Netzwerk für Drucker-Kommunikation
|
|
||||||
echo " Erlaube lokales Netzwerk für Drucker..."
|
|
||||||
ufw allow out on eth0 to 192.168.0.0/16 >/dev/null 2>&1
|
|
||||||
ufw allow out on wlan0 to 192.168.0.0/16 >/dev/null 2>&1
|
|
||||||
ufw allow out on eth0 to 10.0.0.0/8 >/dev/null 2>&1
|
|
||||||
ufw allow out on wlan0 to 10.0.0.0/8 >/dev/null 2>&1
|
|
||||||
|
|
||||||
# Explizit blockiere alle anderen Ports
|
|
||||||
echo " Blockiere explizit gefährliche Ports..."
|
|
||||||
|
|
||||||
# Häufige Service-Ports blockieren
|
|
||||||
BLOCKED_PORTS=(
|
|
||||||
"21" # FTP
|
|
||||||
"23" # Telnet
|
|
||||||
"25" # SMTP
|
|
||||||
"53" # DNS (incoming)
|
|
||||||
"110" # POP3
|
|
||||||
"143" # IMAP
|
|
||||||
"993" # IMAPS
|
|
||||||
"995" # POP3S
|
|
||||||
"3389" # RDP
|
|
||||||
"5000" # Flask Development (nicht mehr benötigt)
|
|
||||||
"5432" # PostgreSQL
|
|
||||||
"3306" # MySQL
|
|
||||||
"1433" # MSSQL
|
|
||||||
"6379" # Redis
|
|
||||||
"27017" # MongoDB
|
|
||||||
"8080" # Alternative HTTP
|
|
||||||
"8443" # Alternative HTTPS
|
|
||||||
"9000" # Verschiedene Services
|
|
||||||
)
|
|
||||||
|
|
||||||
for port in "${BLOCKED_PORTS[@]}"; do
|
|
||||||
ufw deny "$port" >/dev/null 2>&1
|
|
||||||
done
|
|
||||||
|
|
||||||
# UFW aktivieren
|
|
||||||
echo " Aktiviere UFW..."
|
|
||||||
ufw --force enable >/dev/null 2>&1
|
|
||||||
|
|
||||||
# Status anzeigen
|
|
||||||
echo ""
|
|
||||||
echo -e "${GREEN}✅ Firewall erfolgreich konfiguriert!${NC}"
|
|
||||||
echo ""
|
|
||||||
echo -e "${BLUE}📋 Firewall-Status:${NC}"
|
|
||||||
ufw status numbered
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo -e "${GREEN}🔐 SICHERHEITS-ZUSAMMENFASSUNG:${NC}"
|
|
||||||
echo -e " ✅ Nur Port 443 (HTTPS) ist öffentlich zugänglich"
|
|
||||||
echo -e " ✅ Port 5000 (HTTP) ist blockiert"
|
|
||||||
echo -e " ✅ SSH bleibt für Administration verfügbar"
|
|
||||||
echo -e " ✅ Lokales Netzwerk für Drucker erlaubt"
|
|
||||||
echo -e " ✅ System-Updates möglich"
|
|
||||||
echo -e " ✅ Alle anderen Ports sind gesperrt"
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo -e "${BLUE}🌐 Zugriff nur noch über:${NC}"
|
|
||||||
echo -e " • https://localhost (lokal)"
|
|
||||||
echo -e " • https://m040tbaraspi001.de040.corpintra.net (Intranet)"
|
|
||||||
echo -e " • https://[IP-Adresse] (direkt)"
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo -e "${YELLOW}⚠️ WICHTIG:${NC}"
|
|
||||||
echo -e " • HTTP (Port 80/5000) ist jetzt blockiert"
|
|
||||||
echo -e " • Nur HTTPS-Verbindungen funktionieren"
|
|
||||||
echo -e " • Browser-Zertifikat-Warnung ist normal"
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo -e "${GREEN}🏁 Production Firewall Setup abgeschlossen!${NC}"
|
|
||||||
Reference in New Issue
Block a user