Till Tomczak
0d5b87f163
- Added SSL configuration to the backend, including self-signed certificate generation and management. - Updated `setup_myp.sh` to create SSL certificates during installation. - Enhanced `app.py` to support SSL context for secure communication. - Introduced a new SSL management menu in the setup script for easier certificate handling. - Updated frontend API calls to use HTTPS for secure data transmission. - Implemented kiosk mode features, including automatic browser launch with SSL support. - Improved documentation in `SUMMARY.md` to reflect new features and network topology changes.
1582 lines
47 KiB
Bash
Executable File
1582 lines
47 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# MYP V2 - Command Center
|
|
# Ein umfassendes Verwaltungsskript für MYP V2 (Manage Your Printer)
|
|
|
|
# Fehlerabbruch aktivieren
|
|
set -e
|
|
|
|
# Farben für bessere Lesbarkeit
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[0;33m'
|
|
BLUE='\033[0;34m'
|
|
NC='\033[0m' # No Color
|
|
|
|
# Funktion für Titel
|
|
print_header() {
|
|
clear
|
|
echo -e "${BLUE}================================================================${NC}"
|
|
echo -e "${BLUE} MYP V2 - Manage Your Printer ${NC}"
|
|
echo -e "${BLUE} Command Center ${NC}"
|
|
echo -e "${BLUE}================================================================${NC}"
|
|
echo ""
|
|
}
|
|
|
|
# Funktion zum Überprüfen, ob der Benutzer Root-Rechte hat
|
|
check_root() {
|
|
if [ "$EUID" -ne 0 ]; then
|
|
echo -e "${RED}Dieses Skript muss mit Root-Rechten ausgeführt werden.${NC}"
|
|
echo -e "${YELLOW}Bitte mit 'sudo ./setup_myp.sh' neu starten.${NC}"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# Funktion zum Überprüfen, ob MYP installiert ist
|
|
is_myp_installed() {
|
|
if [ -d "/opt/myp" ]; then
|
|
return 0 # true
|
|
else
|
|
return 1 # false
|
|
fi
|
|
}
|
|
|
|
# Hauptmenü
|
|
show_main_menu() {
|
|
print_header
|
|
echo -e "${GREEN}Willkommen zum MYP V2 Command Center${NC}"
|
|
echo ""
|
|
echo -e "Bitte wählen Sie eine Option:"
|
|
echo ""
|
|
echo -e "${YELLOW}INSTALLATION & KONFIGURATION${NC}"
|
|
echo "1) MYP V2 Standardinstallation"
|
|
echo "2) MYP V2 Kiosk-Modus Installation"
|
|
echo "3) MYP V2 deinstallieren"
|
|
echo ""
|
|
echo -e "${YELLOW}NETZWERK & SYSTEM${NC}"
|
|
echo "4) Netzwerkeinstellungen konfigurieren"
|
|
echo "5) DNS-Server konfigurieren"
|
|
echo "6) System-Status anzeigen"
|
|
echo ""
|
|
echo -e "${YELLOW}WARTUNG & HILFE${NC}"
|
|
echo "7) MYP-Dienst starten/stoppen/neustarten"
|
|
echo "8) Logs anzeigen"
|
|
echo "9) Dokumentation anzeigen"
|
|
echo "10) SSL-Zertifikat-Management"
|
|
echo ""
|
|
echo "q) Beenden"
|
|
echo ""
|
|
read -p "Ihre Auswahl: " main_option
|
|
process_main_menu "$main_option"
|
|
}
|
|
|
|
# Verarbeiten der Hauptmenü-Auswahl
|
|
process_main_menu() {
|
|
case $1 in
|
|
1)
|
|
standard_installation
|
|
;;
|
|
2)
|
|
kiosk_installation
|
|
;;
|
|
3)
|
|
uninstall_myp
|
|
;;
|
|
4)
|
|
network_configuration
|
|
;;
|
|
5)
|
|
dns_configuration
|
|
;;
|
|
6)
|
|
system_status
|
|
;;
|
|
7)
|
|
service_management
|
|
;;
|
|
8)
|
|
show_logs
|
|
;;
|
|
9)
|
|
show_documentation
|
|
;;
|
|
10)
|
|
show_ssl_management
|
|
;;
|
|
q|Q)
|
|
echo -e "${GREEN}Auf Wiedersehen!${NC}"
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo -e "${RED}Ungültige Option.${NC}"
|
|
sleep 2
|
|
show_main_menu
|
|
;;
|
|
esac
|
|
}
|
|
|
|
# 1) MYP V2 Standardinstallation
|
|
standard_installation() {
|
|
print_header
|
|
echo -e "${GREEN}MYP V2 Standardinstallation${NC}"
|
|
echo ""
|
|
|
|
if is_myp_installed; then
|
|
echo -e "${YELLOW}MYP ist bereits installiert!${NC}"
|
|
read -p "Möchten Sie die Installation aktualisieren? (j/n): " update_option
|
|
if [[ "$update_option" != "j" && "$update_option" != "J" ]]; then
|
|
show_main_menu
|
|
return
|
|
fi
|
|
fi
|
|
|
|
echo "Installiere MYP V2..."
|
|
|
|
# Benötigte System-Pakete installieren
|
|
echo "Installiere System-Abhängigkeiten..."
|
|
apt update
|
|
apt install -y python3.11 python3.11-pip python3.11-venv python3.11-dev \
|
|
build-essential git curl openssl
|
|
|
|
# Verzeichnis für MYP erstellen/aktualisieren
|
|
mkdir -p /opt/myp
|
|
|
|
# Basispfad ermitteln
|
|
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
|
|
|
|
# Komplette Projektstruktur kopieren
|
|
echo "Kopiere Projektdateien..."
|
|
cp -r "$SCRIPT_DIR/app" /opt/myp/
|
|
cp -r "$SCRIPT_DIR/docs" /opt/myp/
|
|
cp -r "$SCRIPT_DIR/install" /opt/myp/
|
|
cp "$SCRIPT_DIR/requirements.txt" /opt/myp/
|
|
cp "$SCRIPT_DIR/README.md" /opt/myp/
|
|
cp "$SCRIPT_DIR/ROADMAP.md" /opt/myp/
|
|
cp "$SCRIPT_DIR/COMMON_ERRORS.md" /opt/myp/
|
|
|
|
# Log-Verzeichnisse erstellen
|
|
echo "Erstelle Log-Verzeichnisse..."
|
|
mkdir -p /opt/myp/logs/{app,auth,jobs,printers,scheduler}
|
|
|
|
# Datenbank-Verzeichnis erstellen
|
|
mkdir -p /opt/myp/data
|
|
|
|
# SSL-Verzeichnis erstellen
|
|
mkdir -p /opt/myp/ssl
|
|
|
|
# Python-Umgebung und Abhängigkeiten einrichten
|
|
echo "Richte Python-Umgebung ein..."
|
|
cd /opt/myp
|
|
if [ ! -d ".venv" ]; then
|
|
python3.11 -m venv .venv
|
|
fi
|
|
source .venv/bin/activate
|
|
pip install --upgrade pip
|
|
pip install -r requirements.txt
|
|
|
|
# SSL-Zertifikate erstellen
|
|
echo "Erstelle SSL-Zertifikate..."
|
|
chmod +x /opt/myp/install/create_ssl_cert.sh
|
|
/opt/myp/install/create_ssl_cert.sh -d /opt/myp/ssl
|
|
|
|
# Berechtigungen setzen
|
|
echo "Setze Berechtigungen..."
|
|
chown -R www-data:www-data /opt/myp
|
|
chmod -R 755 /opt/myp
|
|
chmod -R 775 /opt/myp/logs
|
|
chmod -R 775 /opt/myp/data
|
|
chmod 600 /opt/myp/ssl/myp.key
|
|
|
|
echo -e "${GREEN}Installation abgeschlossen.${NC}"
|
|
echo ""
|
|
echo -e "${YELLOW}Nächste Schritte:${NC}"
|
|
echo "1. Konfiguration anpassen: /opt/myp/app/config/settings.py"
|
|
echo "2. MYP starten:"
|
|
echo " cd /opt/myp && source .venv/bin/activate && python3.11 app/app.py"
|
|
echo ""
|
|
echo -e "${BLUE}Oder verwenden Sie Option 7 für Dienst-Management${NC}"
|
|
echo -e "${GREEN}MYP V2 ist unter https://$(hostname -I | awk '{print $1}'):5000 erreichbar${NC}"
|
|
|
|
read -p "Drücken Sie eine Taste, um zum Hauptmenü zurückzukehren..."
|
|
show_main_menu
|
|
}
|
|
|
|
# 2) MYP V2 Kiosk-Modus Installation
|
|
kiosk_installation() {
|
|
print_header
|
|
echo -e "${GREEN}MYP V2 Kiosk-Modus Installation (Ultra-Sicher)${NC}"
|
|
echo ""
|
|
echo -e "${RED}WARNUNG: Diese Installation erstellt einen gehärteten Kiosk-Modus!${NC}"
|
|
echo -e "${YELLOW}Deaktivierung nur mit Passwort möglich: 744563017196A${NC}"
|
|
echo ""
|
|
|
|
read -p "Möchten Sie fortfahren? (j/n): " confirm
|
|
if [[ "$confirm" != "j" && "$confirm" != "J" ]]; then
|
|
show_main_menu
|
|
return
|
|
fi
|
|
|
|
# Cleanup vorheriger Installationen
|
|
echo -e "${YELLOW}Bereinige vorherige Installationen...${NC}"
|
|
cleanup_previous_installation
|
|
|
|
# System-Updates und Sicherheits-Patches
|
|
echo -e "${YELLOW}Installiere System-Updates und Sicherheits-Patches...${NC}"
|
|
apt update && apt upgrade -y
|
|
|
|
# Benötigte Pakete installieren (Debian-kompatibel)
|
|
echo -e "${YELLOW}Installiere benötigte Pakete...${NC}"
|
|
apt install -y python3.11 python3.11-pip python3.11-venv python3.11-dev \
|
|
build-essential chromium unclutter xdotool \
|
|
xscreensaver git curl nginx fail2ban ufw \
|
|
sudo openssh-server iptables-persistent \
|
|
apparmor apparmor-utils auditd \
|
|
clamav clamav-daemon rkhunter chkrootkit \
|
|
psmisc procps net-tools
|
|
|
|
# Sicherheits-Konfiguration
|
|
echo -e "${YELLOW}Konfiguriere Sicherheitsmaßnahmen...${NC}"
|
|
configure_security_hardening
|
|
|
|
# MYP Installation
|
|
echo -e "${YELLOW}Installiere MYP V2...${NC}"
|
|
install_myp_secure
|
|
|
|
# Kiosk-Benutzer erstellen (isoliert)
|
|
echo -e "${YELLOW}Erstelle sicheren Kiosk-Benutzer...${NC}"
|
|
create_secure_kiosk_user
|
|
|
|
# Kiosk-Umgebung härten
|
|
echo -e "${YELLOW}Härte Kiosk-Umgebung...${NC}"
|
|
harden_kiosk_environment
|
|
|
|
# Überwachung und Logging einrichten
|
|
echo -e "${YELLOW}Richte Sicherheitsüberwachung ein...${NC}"
|
|
setup_security_monitoring
|
|
|
|
# Passwort-basierte Deaktivierung einrichten
|
|
echo -e "${YELLOW}Richte Passwort-Deaktivierung ein...${NC}"
|
|
setup_password_deactivation
|
|
|
|
# Firewall konfigurieren
|
|
echo -e "${YELLOW}Konfiguriere Firewall...${NC}"
|
|
configure_firewall
|
|
|
|
# Autostart und Services
|
|
echo -e "${YELLOW}Konfiguriere Autostart...${NC}"
|
|
configure_secure_autostart
|
|
|
|
echo -e "${GREEN}Ultra-sichere Kiosk-Installation abgeschlossen!${NC}"
|
|
echo ""
|
|
echo -e "${RED}WICHTIGE SICHERHEITSHINWEISE:${NC}"
|
|
echo -e "${YELLOW}1. Kiosk-Deaktivierung: Strg+Alt+F1, dann 'sudo /opt/myp/deactivate_kiosk.sh'${NC}"
|
|
echo -e "${YELLOW}2. Passwort für Deaktivierung: 744563017196A${NC}"
|
|
echo -e "${YELLOW}3. SSH-Zugang nur mit Key-Authentifizierung${NC}"
|
|
echo -e "${YELLOW}4. Alle Aktivitäten werden geloggt und überwacht${NC}"
|
|
echo -e "${YELLOW}5. System startet automatisch im Kiosk-Modus${NC}"
|
|
echo ""
|
|
echo -e "${BLUE}MYP V2 ist unter http://localhost erreichbar${NC}"
|
|
|
|
read -p "System jetzt neu starten? (j/n): " reboot_confirm
|
|
if [[ "$reboot_confirm" == "j" || "$reboot_confirm" == "J" ]]; then
|
|
echo -e "${GREEN}System wird neu gestartet...${NC}"
|
|
sleep 3
|
|
reboot
|
|
fi
|
|
|
|
show_main_menu
|
|
}
|
|
|
|
# Cleanup vorheriger Installationen
|
|
cleanup_previous_installation() {
|
|
echo "Stoppe alle MYP-Services..."
|
|
systemctl stop myp.service 2>/dev/null || true
|
|
systemctl stop myp-kiosk.service 2>/dev/null || true
|
|
systemctl disable myp.service 2>/dev/null || true
|
|
systemctl disable myp-kiosk.service 2>/dev/null || true
|
|
|
|
echo "Entferne alte Service-Dateien..."
|
|
rm -f /etc/systemd/system/myp*.service
|
|
systemctl daemon-reload
|
|
|
|
echo "Entferne alte Kiosk-Konfigurationen..."
|
|
rm -rf /home/*/kiosk.sh
|
|
rm -rf /home/*/.config/autostart/myp*.desktop
|
|
rm -rf /opt/myp/kiosk*
|
|
|
|
echo "Entferne alte Benutzer..."
|
|
userdel -r kiosk 2>/dev/null || true
|
|
userdel -r myp-kiosk 2>/dev/null || true
|
|
|
|
echo "Bereinige Netzwerk-Konfiguration..."
|
|
rm -f /etc/nginx/sites-enabled/myp*
|
|
rm -f /etc/nginx/sites-available/myp*
|
|
|
|
echo "Cleanup abgeschlossen."
|
|
}
|
|
|
|
# Sicherheits-Härtung konfigurieren
|
|
configure_security_hardening() {
|
|
echo "Konfiguriere Kernel-Sicherheitsparameter..."
|
|
cat > /etc/sysctl.d/99-myp-security.conf << 'EOF'
|
|
# Netzwerk-Sicherheit
|
|
net.ipv4.ip_forward = 0
|
|
net.ipv4.conf.all.send_redirects = 0
|
|
net.ipv4.conf.default.send_redirects = 0
|
|
net.ipv4.conf.all.accept_redirects = 0
|
|
net.ipv4.conf.default.accept_redirects = 0
|
|
net.ipv4.conf.all.accept_source_route = 0
|
|
net.ipv4.conf.default.accept_source_route = 0
|
|
net.ipv4.conf.all.log_martians = 1
|
|
net.ipv4.conf.default.log_martians = 1
|
|
net.ipv4.icmp_echo_ignore_broadcasts = 1
|
|
net.ipv4.icmp_ignore_bogus_error_responses = 1
|
|
net.ipv4.tcp_syncookies = 1
|
|
|
|
# Speicher-Schutz
|
|
kernel.dmesg_restrict = 1
|
|
kernel.kptr_restrict = 2
|
|
kernel.yama.ptrace_scope = 1
|
|
kernel.core_uses_pid = 1
|
|
fs.suid_dumpable = 0
|
|
EOF
|
|
|
|
sysctl -p /etc/sysctl.d/99-myp-security.conf
|
|
|
|
echo "Konfiguriere SSH-Härtung..."
|
|
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup
|
|
cat > /etc/ssh/sshd_config << 'EOF'
|
|
# MYP Secure SSH Configuration
|
|
Port 22
|
|
Protocol 2
|
|
HostKey /etc/ssh/ssh_host_rsa_key
|
|
HostKey /etc/ssh/ssh_host_ecdsa_key
|
|
HostKey /etc/ssh/ssh_host_ed25519_key
|
|
|
|
# Authentifizierung
|
|
PermitRootLogin no
|
|
PubkeyAuthentication yes
|
|
PasswordAuthentication no
|
|
PermitEmptyPasswords no
|
|
ChallengeResponseAuthentication no
|
|
UsePAM yes
|
|
|
|
# Sicherheitseinstellungen
|
|
X11Forwarding no
|
|
PrintMotd no
|
|
PrintLastLog yes
|
|
TCPKeepAlive yes
|
|
UsePrivilegeSeparation yes
|
|
StrictModes yes
|
|
MaxAuthTries 3
|
|
MaxSessions 2
|
|
ClientAliveInterval 300
|
|
ClientAliveCountMax 2
|
|
|
|
# Logging
|
|
SyslogFacility AUTH
|
|
LogLevel VERBOSE
|
|
|
|
# Nur bestimmte Benutzer erlauben
|
|
AllowUsers root admin
|
|
EOF
|
|
|
|
systemctl restart ssh
|
|
|
|
echo "Konfiguriere Fail2Ban..."
|
|
cat > /etc/fail2ban/jail.local << 'EOF'
|
|
[DEFAULT]
|
|
bantime = 3600
|
|
findtime = 600
|
|
maxretry = 3
|
|
backend = systemd
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = 3
|
|
|
|
[nginx-http-auth]
|
|
enabled = true
|
|
filter = nginx-http-auth
|
|
port = http,https
|
|
logpath = /var/log/nginx/error.log
|
|
maxretry = 3
|
|
|
|
[myp-auth]
|
|
enabled = true
|
|
filter = myp-auth
|
|
port = http,https
|
|
logpath = /opt/myp/logs/auth/auth.log
|
|
maxretry = 5
|
|
EOF
|
|
|
|
# Custom Fail2Ban Filter für MYP
|
|
cat > /etc/fail2ban/filter.d/myp-auth.conf << 'EOF'
|
|
[Definition]
|
|
failregex = ^.*Authentication failed.*<HOST>.*$
|
|
^.*Invalid login attempt.*<HOST>.*$
|
|
^.*Unauthorized access attempt.*<HOST>.*$
|
|
ignoreregex =
|
|
EOF
|
|
|
|
systemctl enable fail2ban
|
|
systemctl restart fail2ban
|
|
}
|
|
|
|
# Sichere MYP Installation
|
|
install_myp_secure() {
|
|
# Verzeichnis für MYP erstellen
|
|
mkdir -p /opt/myp
|
|
|
|
# Basispfad ermitteln
|
|
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
|
|
|
|
# Komplette Projektstruktur kopieren
|
|
echo "Kopiere Projektdateien..."
|
|
cp -r "$SCRIPT_DIR/app" /opt/myp/
|
|
cp -r "$SCRIPT_DIR/docs" /opt/myp/
|
|
cp -r "$SCRIPT_DIR/install" /opt/myp/
|
|
cp "$SCRIPT_DIR/requirements.txt" /opt/myp/
|
|
cp "$SCRIPT_DIR/README.md" /opt/myp/
|
|
cp "$SCRIPT_DIR/ROADMAP.md" /opt/myp/
|
|
cp "$SCRIPT_DIR/COMMON_ERRORS.md" /opt/myp/
|
|
|
|
# Sichere Log-Verzeichnisse erstellen
|
|
mkdir -p /opt/myp/logs/{app,auth,jobs,printers,scheduler,security}
|
|
mkdir -p /opt/myp/data
|
|
mkdir -p /opt/myp/security
|
|
|
|
# Python-Umgebung einrichten
|
|
cd /opt/myp
|
|
python3.11 -m venv .venv
|
|
source .venv/bin/activate
|
|
pip install --upgrade pip
|
|
pip install -r requirements.txt
|
|
pip install gunicorn psutil
|
|
|
|
# Sicherheits-Konfiguration für Flask
|
|
cat > /opt/myp/app/config/security.py << 'EOF'
|
|
# MYP Security Configuration
|
|
import os
|
|
import secrets
|
|
|
|
# Sichere Session-Konfiguration
|
|
SECRET_KEY = os.environ.get('MYP_SECRET_KEY', secrets.token_hex(32))
|
|
SESSION_COOKIE_SECURE = True
|
|
SESSION_COOKIE_HTTPONLY = True
|
|
SESSION_COOKIE_SAMESITE = 'Lax'
|
|
PERMANENT_SESSION_LIFETIME = 1800 # 30 Minuten
|
|
|
|
# Sicherheits-Headers
|
|
SECURITY_HEADERS = {
|
|
'X-Content-Type-Options': 'nosniff',
|
|
'X-Frame-Options': 'DENY',
|
|
'X-XSS-Protection': '1; mode=block',
|
|
'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
|
|
'Content-Security-Policy': "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'",
|
|
'Referrer-Policy': 'strict-origin-when-cross-origin'
|
|
}
|
|
|
|
# Rate Limiting
|
|
RATELIMIT_STORAGE_URL = 'memory://'
|
|
RATELIMIT_DEFAULT = "100 per hour"
|
|
RATELIMIT_LOGIN = "5 per minute"
|
|
|
|
# Kiosk-Modus Konfiguration
|
|
KIOSK_MODE = True
|
|
KIOSK_PASSWORD_HASH = 'pbkdf2:sha256:260000$salt$hash' # Wird später gesetzt
|
|
EOF
|
|
|
|
# Systemd-Dienst für Flask-Backend einrichten
|
|
cat > /etc/systemd/system/myp.service << 'EOF'
|
|
[Unit]
|
|
Description=MYP V2 Flask Application (Secure)
|
|
After=network.target
|
|
Wants=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=www-data
|
|
Group=www-data
|
|
WorkingDirectory=/opt/myp
|
|
Environment=PATH=/opt/myp/.venv/bin
|
|
Environment=FLASK_ENV=production
|
|
Environment=MYP_SECRET_KEY=SECURE_RANDOM_KEY_WILL_BE_GENERATED
|
|
ExecStart=/opt/myp/.venv/bin/gunicorn --bind 127.0.0.1:5000 --workers 2 --timeout 30 app.app:app
|
|
Restart=always
|
|
RestartSec=10
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
# Sicherheits-Einschränkungen
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ReadWritePaths=/opt/myp/logs /opt/myp/data
|
|
CapabilityBoundingSet=
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
# Nginx-Konfiguration mit Sicherheits-Headers
|
|
cat > /etc/nginx/sites-available/myp << 'EOF'
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
# Sicherheits-Headers
|
|
add_header X-Frame-Options "DENY" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self';" always;
|
|
|
|
# Rate Limiting
|
|
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
|
|
limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:5000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# Timeout-Einstellungen
|
|
proxy_connect_timeout 30s;
|
|
proxy_send_timeout 30s;
|
|
proxy_read_timeout 30s;
|
|
}
|
|
|
|
location /auth/login {
|
|
limit_req zone=login burst=3 nodelay;
|
|
proxy_pass http://127.0.0.1:5000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location /api/ {
|
|
limit_req zone=api burst=10 nodelay;
|
|
proxy_pass http://127.0.0.1:5000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location /static {
|
|
alias /opt/myp/app/static;
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable";
|
|
|
|
# Verhindere Ausführung von Skripten
|
|
location ~* \.(php|pl|py|jsp|asp|sh|cgi)$ {
|
|
deny all;
|
|
}
|
|
}
|
|
|
|
# Verstecke Nginx-Version
|
|
server_tokens off;
|
|
|
|
# Blockiere verdächtige Anfragen
|
|
location ~* \.(git|svn|env|htaccess|htpasswd)$ {
|
|
deny all;
|
|
return 404;
|
|
}
|
|
}
|
|
EOF
|
|
|
|
ln -sf /etc/nginx/sites-available/myp /etc/nginx/sites-enabled/
|
|
rm -f /etc/nginx/sites-enabled/default
|
|
|
|
# Berechtigungen setzen (restriktiv)
|
|
chown -R www-data:www-data /opt/myp
|
|
chmod -R 750 /opt/myp
|
|
chmod -R 770 /opt/myp/logs
|
|
chmod -R 770 /opt/myp/data
|
|
chmod 600 /opt/myp/app/config/security.py
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable myp.service
|
|
systemctl restart nginx
|
|
systemctl start myp.service
|
|
}
|
|
|
|
# Sicheren Kiosk-Benutzer erstellen
|
|
create_secure_kiosk_user() {
|
|
# Kiosk-Benutzer erstellen (ohne Shell-Zugang)
|
|
useradd -m -s /bin/false -G audio,video myp-kiosk 2>/dev/null || true
|
|
|
|
# Home-Verzeichnis sichern
|
|
chmod 750 /home/myp-kiosk
|
|
|
|
# Minimale Desktop-Umgebung für Kiosk
|
|
mkdir -p /home/myp-kiosk/.config/autostart
|
|
mkdir -p /home/myp-kiosk/.local/share/applications
|
|
|
|
# Kiosk-Desktop-Session erstellen
|
|
cat > /usr/share/xsessions/myp-kiosk.desktop << 'EOF'
|
|
[Desktop Entry]
|
|
Name=MYP Kiosk
|
|
Comment=MYP Secure Kiosk Mode
|
|
Exec=/opt/myp/security/start_kiosk.sh
|
|
Type=Application
|
|
DesktopNames=MYP-Kiosk
|
|
EOF
|
|
|
|
chown -R myp-kiosk:myp-kiosk /home/myp-kiosk
|
|
}
|
|
|
|
# Kiosk-Umgebung härten
|
|
harden_kiosk_environment() {
|
|
# Sicheres Kiosk-Start-Script
|
|
mkdir -p /opt/myp/security
|
|
cat > /opt/myp/security/start_kiosk.sh << 'EOF'
|
|
#!/bin/bash
|
|
# MYP Ultra-Secure Kiosk Startup Script
|
|
|
|
# Logging aktivieren
|
|
exec > >(tee -a /opt/myp/logs/security/kiosk.log) 2>&1
|
|
echo "$(date): Kiosk-Modus wird gestartet..."
|
|
|
|
# Umgebungsvariablen setzen
|
|
export DISPLAY=:0
|
|
export HOME=/home/myp-kiosk
|
|
|
|
# Sicherheits-Checks
|
|
if [ "$USER" != "myp-kiosk" ]; then
|
|
echo "$(date): SECURITY ALERT - Unauthorized user attempted kiosk start: $USER"
|
|
exit 1
|
|
fi
|
|
|
|
# Bildschirmschoner und Energieverwaltung deaktivieren
|
|
xset s off
|
|
xset -dpms
|
|
xset s noblank
|
|
|
|
# Mauszeiger verstecken
|
|
unclutter -idle 1 -root &
|
|
|
|
# Tastatur-Shortcuts blockieren (außer Escape-Sequenz)
|
|
xmodmap -e "clear mod1"
|
|
xmodmap -e "clear mod4"
|
|
|
|
# Chromium im Ultra-Secure Kiosk-Modus starten
|
|
chromium \
|
|
--kiosk \
|
|
--noerrdialogs \
|
|
--disable-infobars \
|
|
--disable-session-crashed-bubble \
|
|
--disable-restore-session-state \
|
|
--disable-background-timer-throttling \
|
|
--disable-backgrounding-occluded-windows \
|
|
--disable-renderer-backgrounding \
|
|
--disable-features=TranslateUI,VizDisplayCompositor \
|
|
--disable-ipc-flooding-protection \
|
|
--disable-background-networking \
|
|
--disable-sync \
|
|
--disable-default-apps \
|
|
--disable-extensions \
|
|
--disable-plugins \
|
|
--disable-java \
|
|
--disable-javascript-harmony-shipping \
|
|
--disable-webgl \
|
|
--disable-3d-apis \
|
|
--disable-accelerated-2d-canvas \
|
|
--disable-accelerated-jpeg-decoding \
|
|
--disable-accelerated-mjpeg-decode \
|
|
--disable-accelerated-video-decode \
|
|
--disable-dev-tools \
|
|
--disable-file-system \
|
|
--disable-notifications \
|
|
--disable-speech-api \
|
|
--disable-usb-keyboard-detect \
|
|
--no-first-run \
|
|
--no-default-browser-check \
|
|
--no-sandbox \
|
|
--disable-gpu \
|
|
--disable-software-rasterizer \
|
|
--disable-background-mode \
|
|
--disable-component-extensions-with-background-pages \
|
|
--disable-client-side-phishing-detection \
|
|
--disable-datasaver-prompt \
|
|
--disable-desktop-notifications \
|
|
--disable-domain-reliability \
|
|
--disable-features=AudioServiceOutOfProcess \
|
|
--user-data-dir=/tmp/chromium-kiosk \
|
|
--app=http://localhost/ &
|
|
|
|
CHROMIUM_PID=$!
|
|
|
|
# Überwachung des Chromium-Prozesses
|
|
while kill -0 $CHROMIUM_PID 2>/dev/null; do
|
|
sleep 5
|
|
|
|
# Prüfe auf verdächtige Prozesse
|
|
if pgrep -f "bash|sh|zsh|fish|tcsh|csh" | grep -v $$ | grep -v $(pgrep -f start_kiosk.sh); then
|
|
echo "$(date): SECURITY ALERT - Unauthorized shell detected!"
|
|
pkill -f "bash|sh|zsh|fish|tcsh|csh"
|
|
fi
|
|
|
|
# Prüfe auf Entwicklertools
|
|
if pgrep -f "devtools|inspector|debugger"; then
|
|
echo "$(date): SECURITY ALERT - Developer tools detected!"
|
|
pkill -f "devtools|inspector|debugger"
|
|
fi
|
|
done
|
|
|
|
echo "$(date): Chromium beendet, Kiosk-Modus wird neu gestartet..."
|
|
sleep 2
|
|
exec $0
|
|
EOF
|
|
|
|
chmod +x /opt/myp/security/start_kiosk.sh
|
|
|
|
# Kiosk-Deaktivierungs-Script
|
|
cat > /opt/myp/security/deactivate_kiosk.sh << 'EOF'
|
|
#!/bin/bash
|
|
# MYP Kiosk Deactivation Script
|
|
|
|
echo "MYP Kiosk-Modus Deaktivierung"
|
|
echo "=============================="
|
|
echo ""
|
|
|
|
# Passwort-Eingabe
|
|
read -s -p "Deaktivierungs-Passwort eingeben: " password
|
|
echo ""
|
|
|
|
# Passwort-Hash prüfen (744563017196A)
|
|
expected_hash="e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
|
input_hash=$(echo -n "$password" | sha256sum | cut -d' ' -f1)
|
|
|
|
if [ "$password" != "744563017196A" ]; then
|
|
echo "FEHLER: Falsches Passwort!"
|
|
logger "MYP SECURITY: Failed kiosk deactivation attempt from $(who am i)"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Passwort korrekt. Deaktiere Kiosk-Modus..."
|
|
logger "MYP SECURITY: Kiosk mode deactivated by $(who am i)"
|
|
|
|
# Kiosk-Prozesse beenden
|
|
pkill -f chromium
|
|
pkill -f start_kiosk.sh
|
|
pkill -f unclutter
|
|
|
|
# Autostart deaktivieren
|
|
systemctl disable myp-kiosk.service 2>/dev/null || true
|
|
|
|
# Desktop-Session wiederherstellen
|
|
export DISPLAY=:0
|
|
startx &
|
|
|
|
echo "Kiosk-Modus deaktiviert. Desktop-Umgebung wird gestartet..."
|
|
EOF
|
|
|
|
chmod +x /opt/myp/security/deactivate_kiosk.sh
|
|
|
|
# Passwort-Hash für Flask-App generieren
|
|
python3.11 -c "
|
|
from werkzeug.security import generate_password_hash
|
|
hash_value = generate_password_hash('744563017196A')
|
|
print(f'KIOSK_PASSWORD_HASH = \"{hash_value}\"')
|
|
" >> /opt/myp/app/config/security.py
|
|
}
|
|
|
|
# Sicherheitsüberwachung einrichten
|
|
setup_security_monitoring() {
|
|
# Audit-Regeln für MYP
|
|
cat > /etc/audit/rules.d/myp-security.rules << 'EOF'
|
|
# MYP Security Audit Rules
|
|
-w /opt/myp/ -p wa -k myp_access
|
|
-w /etc/nginx/sites-enabled/myp -p wa -k myp_config
|
|
-w /etc/systemd/system/myp.service -p wa -k myp_service
|
|
-w /home/myp-kiosk/ -p wa -k kiosk_access
|
|
-w /opt/myp/security/ -p wa -k security_scripts
|
|
EOF
|
|
|
|
systemctl restart auditd
|
|
|
|
# Sicherheits-Monitoring Script
|
|
cat > /opt/myp/security/monitor.sh << 'EOF'
|
|
#!/bin/bash
|
|
# MYP Security Monitoring
|
|
|
|
LOG_FILE="/opt/myp/logs/security/monitor.log"
|
|
ALERT_FILE="/opt/myp/logs/security/alerts.log"
|
|
|
|
log_event() {
|
|
echo "$(date): $1" >> "$LOG_FILE"
|
|
}
|
|
|
|
alert() {
|
|
echo "$(date): ALERT - $1" >> "$ALERT_FILE"
|
|
logger "MYP SECURITY ALERT: $1"
|
|
}
|
|
|
|
# Prüfe auf verdächtige Prozesse
|
|
check_processes() {
|
|
# Entwicklertools
|
|
if pgrep -f "devtools|inspector|debugger|firebug"; then
|
|
alert "Developer tools detected and terminated"
|
|
pkill -f "devtools|inspector|debugger|firebug"
|
|
fi
|
|
|
|
# Unerlaubte Shells außerhalb SSH
|
|
suspicious_shells=$(pgrep -f "bash|sh|zsh|fish" | while read pid; do
|
|
if ! ps -p $pid -o ppid= | xargs ps -p 2>/dev/null | grep -q "sshd"; then
|
|
echo $pid
|
|
fi
|
|
done)
|
|
|
|
if [ -n "$suspicious_shells" ]; then
|
|
alert "Unauthorized shell processes detected: $suspicious_shells"
|
|
echo $suspicious_shells | xargs kill -9 2>/dev/null
|
|
fi
|
|
}
|
|
|
|
# Prüfe Dateisystem-Integrität
|
|
check_filesystem() {
|
|
# Prüfe kritische Dateien
|
|
if [ ! -f "/opt/myp/security/start_kiosk.sh" ]; then
|
|
alert "Critical kiosk script missing!"
|
|
fi
|
|
|
|
# Prüfe Berechtigungen
|
|
if [ "$(stat -c %a /opt/myp/security/deactivate_kiosk.sh)" != "755" ]; then
|
|
alert "Deactivation script permissions changed!"
|
|
chmod 755 /opt/myp/security/deactivate_kiosk.sh
|
|
fi
|
|
}
|
|
|
|
# Prüfe Netzwerk-Verbindungen
|
|
check_network() {
|
|
# Prüfe auf unerlaubte ausgehende Verbindungen
|
|
suspicious_connections=$(netstat -tnp 2>/dev/null | grep -E ":22|:80|:443" | grep -v "127.0.0.1\|localhost")
|
|
if [ -n "$suspicious_connections" ]; then
|
|
log_event "Network connections detected: $suspicious_connections"
|
|
fi
|
|
}
|
|
|
|
# Hauptschleife
|
|
while true; do
|
|
check_processes
|
|
check_filesystem
|
|
check_network
|
|
sleep 30
|
|
done
|
|
EOF
|
|
|
|
chmod +x /opt/myp/security/monitor.sh
|
|
|
|
# Monitoring-Service
|
|
cat > /etc/systemd/system/myp-monitor.service << 'EOF'
|
|
[Unit]
|
|
Description=MYP Security Monitor
|
|
After=myp.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=root
|
|
ExecStart=/opt/myp/security/monitor.sh
|
|
Restart=always
|
|
RestartSec=10
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable myp-monitor.service
|
|
systemctl start myp-monitor.service
|
|
}
|
|
|
|
# Passwort-basierte Deaktivierung einrichten
|
|
setup_password_deactivation() {
|
|
# Kiosk-Deaktivierungs-Endpoint für Flask
|
|
cat > /opt/myp/app/kiosk_control.py << 'EOF'
|
|
from flask import Blueprint, request, jsonify, session
|
|
from werkzeug.security import check_password_hash
|
|
import subprocess
|
|
import logging
|
|
import os
|
|
|
|
kiosk_bp = Blueprint('kiosk', __name__)
|
|
|
|
# Sicherheits-Logger
|
|
security_logger = logging.getLogger('myp.security')
|
|
handler = logging.FileHandler('/opt/myp/logs/security/kiosk_control.log')
|
|
formatter = logging.Formatter('%(asctime)s - %(levelname)s - %(message)s')
|
|
handler.setFormatter(formatter)
|
|
security_logger.addHandler(handler)
|
|
security_logger.setLevel(logging.INFO)
|
|
|
|
@kiosk_bp.route('/api/kiosk/deactivate', methods=['POST'])
|
|
def deactivate_kiosk():
|
|
"""Deaktiviert den Kiosk-Modus mit Passwort"""
|
|
try:
|
|
data = request.get_json()
|
|
password = data.get('password', '')
|
|
|
|
# IP-Adresse für Logging
|
|
client_ip = request.environ.get('HTTP_X_REAL_IP', request.remote_addr)
|
|
|
|
# Passwort prüfen
|
|
if password != '744563017196A':
|
|
security_logger.warning(f"Failed kiosk deactivation attempt from {client_ip}")
|
|
return jsonify({'error': 'Falsches Passwort'}), 401
|
|
|
|
security_logger.info(f"Kiosk deactivation authorized from {client_ip}")
|
|
|
|
# Kiosk-Modus deaktivieren
|
|
try:
|
|
subprocess.run(['/opt/myp/security/deactivate_kiosk.sh'],
|
|
check=True, timeout=30)
|
|
return jsonify({'success': True, 'message': 'Kiosk-Modus deaktiviert'})
|
|
except subprocess.CalledProcessError as e:
|
|
security_logger.error(f"Failed to deactivate kiosk: {e}")
|
|
return jsonify({'error': 'Deaktivierung fehlgeschlagen'}), 500
|
|
|
|
except Exception as e:
|
|
security_logger.error(f"Kiosk deactivation error: {e}")
|
|
return jsonify({'error': 'Interner Fehler'}), 500
|
|
|
|
@kiosk_bp.route('/api/kiosk/status', methods=['GET'])
|
|
def kiosk_status():
|
|
"""Gibt den aktuellen Kiosk-Status zurück"""
|
|
try:
|
|
# Prüfe ob Kiosk-Prozesse laufen
|
|
result = subprocess.run(['pgrep', '-f', 'start_kiosk.sh'],
|
|
capture_output=True, text=True)
|
|
kiosk_active = result.returncode == 0
|
|
|
|
return jsonify({
|
|
'kiosk_active': kiosk_active,
|
|
'timestamp': datetime.now().isoformat()
|
|
})
|
|
except Exception as e:
|
|
return jsonify({'error': str(e)}), 500
|
|
EOF
|
|
|
|
# Notfall-Deaktivierung über Tastenkombination
|
|
cat > /opt/myp/security/emergency_exit.sh << 'EOF'
|
|
#!/bin/bash
|
|
# Notfall-Deaktivierung für Kiosk-Modus
|
|
|
|
# Prüfe auf Escape-Sequenz (Strg+Alt+Shift+E)
|
|
while true; do
|
|
if xinput test-xi2 --root | grep -q "KeyPress.*Escape"; then
|
|
echo "Emergency exit sequence detected"
|
|
/opt/myp/security/deactivate_kiosk.sh
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
EOF
|
|
|
|
chmod +x /opt/myp/security/emergency_exit.sh
|
|
}
|
|
|
|
# Firewall konfigurieren
|
|
configure_firewall() {
|
|
# UFW zurücksetzen
|
|
ufw --force reset
|
|
|
|
# Standard-Policies
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
|
|
# Erlaubte Ports
|
|
ufw allow 22/tcp # SSH
|
|
ufw allow 80/tcp # HTTP
|
|
ufw allow 443/tcp # HTTPS (falls später benötigt)
|
|
|
|
# Rate Limiting für SSH
|
|
ufw limit ssh
|
|
|
|
# UFW aktivieren
|
|
ufw --force enable
|
|
|
|
echo "Firewall konfiguriert und aktiviert."
|
|
}
|
|
|
|
# Sicheren Autostart konfigurieren
|
|
configure_secure_autostart() {
|
|
# Kiosk-Service erstellen
|
|
cat > /etc/systemd/system/myp-kiosk.service << 'EOF'
|
|
[Unit]
|
|
Description=MYP Secure Kiosk Mode
|
|
After=graphical-session.target
|
|
Wants=graphical-session.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=myp-kiosk
|
|
Group=myp-kiosk
|
|
Environment=DISPLAY=:0
|
|
ExecStart=/opt/myp/security/start_kiosk.sh
|
|
Restart=always
|
|
RestartSec=5
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
[Install]
|
|
WantedBy=graphical-session.target
|
|
EOF
|
|
|
|
# Display Manager für automatischen Login konfigurieren
|
|
if [ -f "/etc/lightdm/lightdm.conf" ]; then
|
|
cp /etc/lightdm/lightdm.conf /etc/lightdm/lightdm.conf.backup
|
|
sed -i 's/#autologin-user=/autologin-user=myp-kiosk/' /etc/lightdm/lightdm.conf
|
|
sed -i 's/#autologin-user-timeout=0/autologin-user-timeout=0/' /etc/lightdm/lightdm.conf
|
|
sed -i 's/#autologin-session=/autologin-session=myp-kiosk/' /etc/lightdm/lightdm.conf
|
|
fi
|
|
|
|
# GDM3 Konfiguration (falls vorhanden)
|
|
if [ -f "/etc/gdm3/daemon.conf" ]; then
|
|
cp /etc/gdm3/daemon.conf /etc/gdm3/daemon.conf.backup
|
|
cat >> /etc/gdm3/daemon.conf << 'EOF'
|
|
|
|
[daemon]
|
|
AutomaticLoginEnable=true
|
|
AutomaticLogin=myp-kiosk
|
|
EOF
|
|
fi
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable myp-kiosk.service
|
|
|
|
echo "Sicherer Autostart konfiguriert."
|
|
}
|
|
|
|
# 3) MYP V2 deinstallieren
|
|
uninstall_myp() {
|
|
print_header
|
|
echo -e "${RED}MYP V2 deinstallieren${NC}"
|
|
echo ""
|
|
|
|
if ! is_myp_installed; then
|
|
echo -e "${YELLOW}MYP ist nicht installiert.${NC}"
|
|
read -p "Drücken Sie eine Taste, um zum Hauptmenü zurückzukehren..."
|
|
show_main_menu
|
|
return
|
|
fi
|
|
|
|
read -p "Sind Sie sicher, dass Sie MYP komplett deinstallieren möchten? (j/n): " confirm
|
|
if [[ "$confirm" != "j" && "$confirm" != "J" ]]; then
|
|
show_main_menu
|
|
return
|
|
fi
|
|
|
|
echo "Stoppe MYP-Dienste..."
|
|
systemctl stop myp.service 2>/dev/null || true
|
|
systemctl disable myp.service 2>/dev/null || true
|
|
rm -f /etc/systemd/system/myp.service
|
|
systemctl daemon-reload
|
|
|
|
echo "Entferne Kiosk-Modus Komponenten..."
|
|
rm -f /home/pi/kiosk.sh
|
|
rm -f /home/pi/.config/autostart/myp-kiosk.desktop
|
|
|
|
echo "Entferne MYP-Dateien..."
|
|
rm -rf /opt/myp
|
|
|
|
echo -e "${GREEN}MYP wurde vollständig deinstalliert.${NC}"
|
|
read -p "Drücken Sie eine Taste, um zum Hauptmenü zurückzukehren..."
|
|
show_main_menu
|
|
}
|
|
|
|
# 4) Netzwerkeinstellungen konfigurieren
|
|
network_configuration() {
|
|
print_header
|
|
echo -e "${GREEN}Netzwerkeinstellungen konfigurieren${NC}"
|
|
echo ""
|
|
|
|
# Netzwerkschnittstellen anzeigen
|
|
echo -e "${YELLOW}Verfügbare Netzwerkschnittstellen:${NC}"
|
|
ip -o link show | awk -F': ' '{print $2}'
|
|
echo ""
|
|
|
|
read -p "Welche Schnittstelle möchten Sie konfigurieren? (z.B. eth0, wlan0): " interface
|
|
|
|
# Prüfen, ob die Schnittstelle existiert
|
|
if ! ip link show "$interface" &>/dev/null; then
|
|
echo -e "${RED}Die angegebene Schnittstelle existiert nicht.${NC}"
|
|
read -p "Drücken Sie eine Taste, um zum Hauptmenü zurückzukehren..."
|
|
show_main_menu
|
|
return
|
|
fi
|
|
|
|
echo ""
|
|
echo -e "${YELLOW}Konfiguration für $interface:${NC}"
|
|
echo "1) DHCP (automatische IP-Adresse)"
|
|
echo "2) Statische IP-Adresse"
|
|
echo "3) WLAN konfigurieren (für wlan0)"
|
|
echo "4) Zurück zum Hauptmenü"
|
|
echo ""
|
|
read -p "Ihre Auswahl: " network_option
|
|
|
|
case $network_option in
|
|
1)
|
|
# DHCP konfigurieren
|
|
echo "Konfiguriere DHCP für $interface..."
|
|
cat > "/etc/network/interfaces.d/$interface" << EOF
|
|
auto $interface
|
|
iface $interface inet dhcp
|
|
EOF
|
|
if [ "$interface" == "wlan0" ]; then
|
|
echo "Für WLAN bitte auch SSID und Passwort konfigurieren."
|
|
network_configuration
|
|
return
|
|
fi
|
|
systemctl restart networking
|
|
echo -e "${GREEN}DHCP wurde für $interface konfiguriert.${NC}"
|
|
;;
|
|
2)
|
|
# Statische IP-Adresse konfigurieren
|
|
read -p "IP-Adresse (z.B. 192.168.1.100): " ip_address
|
|
read -p "Netzmaske (z.B. 255.255.255.0): " netmask
|
|
read -p "Gateway (z.B. 192.168.1.1): " gateway
|
|
|
|
cat > "/etc/network/interfaces.d/$interface" << EOF
|
|
auto $interface
|
|
iface $interface inet static
|
|
address $ip_address
|
|
netmask $netmask
|
|
gateway $gateway
|
|
EOF
|
|
systemctl restart networking
|
|
echo -e "${GREEN}Statische IP-Adresse wurde für $interface konfiguriert.${NC}"
|
|
;;
|
|
3)
|
|
# WLAN konfigurieren
|
|
if [ "$interface" != "wlan0" ]; then
|
|
echo -e "${RED}Diese Option ist nur für wlan0 verfügbar.${NC}"
|
|
network_configuration
|
|
return
|
|
fi
|
|
|
|
read -p "SSID (Netzwerkname): " ssid
|
|
read -s -p "Passwort: " password
|
|
echo ""
|
|
|
|
# wpa_supplicant.conf erstellen/aktualisieren
|
|
wpa_passphrase "$ssid" "$password" > /etc/wpa_supplicant/wpa_supplicant.conf
|
|
|
|
# Netzwerk-Interface konfigurieren
|
|
cat > "/etc/network/interfaces.d/wlan0" << EOF
|
|
auto wlan0
|
|
allow-hotplug wlan0
|
|
iface wlan0 inet dhcp
|
|
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
|
|
EOF
|
|
|
|
# WLAN neustarten
|
|
systemctl restart networking
|
|
wpa_cli -i wlan0 reconfigure
|
|
|
|
echo -e "${GREEN}WLAN wurde konfiguriert und verbunden.${NC}"
|
|
;;
|
|
4)
|
|
show_main_menu
|
|
return
|
|
;;
|
|
*)
|
|
echo -e "${RED}Ungültige Option.${NC}"
|
|
network_configuration
|
|
return
|
|
;;
|
|
esac
|
|
|
|
read -p "Drücken Sie eine Taste, um zum Hauptmenü zurückzukehren..."
|
|
show_main_menu
|
|
}
|
|
|
|
# 5) DNS-Server konfigurieren
|
|
dns_configuration() {
|
|
print_header
|
|
echo -e "${GREEN}DNS-Server konfigurieren${NC}"
|
|
echo ""
|
|
|
|
# Aktuelle DNS-Server anzeigen
|
|
echo -e "${YELLOW}Aktuelle DNS-Server:${NC}"
|
|
if [ -f "/etc/resolv.conf" ]; then
|
|
grep "nameserver" /etc/resolv.conf || echo "Keine DNS-Server konfiguriert."
|
|
else
|
|
echo "Die Datei /etc/resolv.conf existiert nicht."
|
|
fi
|
|
echo ""
|
|
|
|
echo "1) DNS-Server automatisch beziehen (über DHCP)"
|
|
echo "2) Manuelle DNS-Server konfigurieren"
|
|
echo "3) Zurück zum Hauptmenü"
|
|
echo ""
|
|
read -p "Ihre Auswahl: " dns_option
|
|
|
|
case $dns_option in
|
|
1)
|
|
# Automatische DNS-Konfiguration
|
|
if [ -f "/etc/dhcp/dhclient.conf" ]; then
|
|
sed -i 's/^prepend domain-name-servers.*//' /etc/dhcp/dhclient.conf
|
|
echo -e "${GREEN}DNS-Server werden jetzt automatisch über DHCP bezogen.${NC}"
|
|
systemctl restart networking
|
|
else
|
|
echo -e "${RED}Die Datei /etc/dhcp/dhclient.conf existiert nicht.${NC}"
|
|
fi
|
|
;;
|
|
2)
|
|
# Manuelle DNS-Konfiguration
|
|
read -p "Primärer DNS-Server (z.B. 8.8.8.8): " primary_dns
|
|
read -p "Sekundärer DNS-Server (z.B. 8.8.4.4, leer lassen wenn nicht benötigt): " secondary_dns
|
|
|
|
# resolv.conf direkt bearbeiten
|
|
echo "nameserver $primary_dns" > /etc/resolv.conf
|
|
if [ -n "$secondary_dns" ]; then
|
|
echo "nameserver $secondary_dns" >> /etc/resolv.conf
|
|
fi
|
|
|
|
# Für persistente Konfiguration
|
|
if [ -f "/etc/dhcp/dhclient.conf" ]; then
|
|
if [ -n "$secondary_dns" ]; then
|
|
sed -i "s/^prepend domain-name-servers.*/prepend domain-name-servers $primary_dns, $secondary_dns;/" /etc/dhcp/dhclient.conf
|
|
if ! grep -q "prepend domain-name-servers" /etc/dhcp/dhclient.conf; then
|
|
echo "prepend domain-name-servers $primary_dns, $secondary_dns;" >> /etc/dhcp/dhclient.conf
|
|
fi
|
|
else
|
|
sed -i "s/^prepend domain-name-servers.*/prepend domain-name-servers $primary_dns;/" /etc/dhcp/dhclient.conf
|
|
if ! grep -q "prepend domain-name-servers" /etc/dhcp/dhclient.conf; then
|
|
echo "prepend domain-name-servers $primary_dns;" >> /etc/dhcp/dhclient.conf
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
echo -e "${GREEN}DNS-Server wurden konfiguriert.${NC}"
|
|
;;
|
|
3)
|
|
show_main_menu
|
|
return
|
|
;;
|
|
*)
|
|
echo -e "${RED}Ungültige Option.${NC}"
|
|
dns_configuration
|
|
return
|
|
;;
|
|
esac
|
|
|
|
read -p "Drücken Sie eine Taste, um zum Hauptmenü zurückzukehren..."
|
|
show_main_menu
|
|
}
|
|
|
|
# 6) System-Status anzeigen
|
|
system_status() {
|
|
print_header
|
|
echo -e "${GREEN}System-Status${NC}"
|
|
echo ""
|
|
|
|
# Systeminfos anzeigen
|
|
echo -e "${YELLOW}Systeminformationen:${NC}"
|
|
echo -e "Hostname: $(hostname)"
|
|
echo -e "IP-Adresse: $(hostname -I | awk '{print $1}')"
|
|
echo -e "Betriebssystem: $(lsb_release -ds 2>/dev/null || cat /etc/*release 2>/dev/null | head -n1 || uname -om)"
|
|
echo -e "Kernel: $(uname -r)"
|
|
echo -e "CPU: $(grep -c ^processor /proc/cpuinfo) Kerne"
|
|
echo -e "RAM: $(free -h | awk '/^Mem/ {print $2}')"
|
|
echo -e "Festplatte: $(df -h / | awk 'NR==2 {print $2}')"
|
|
echo ""
|
|
|
|
# MYP-Status anzeigen
|
|
echo -e "${YELLOW}MYP-Status:${NC}"
|
|
if is_myp_installed; then
|
|
echo -e "MYP ist installiert: ${GREEN}Ja${NC}"
|
|
|
|
# Prüfen, ob der MYP-Service läuft
|
|
if systemctl is-active --quiet myp.service 2>/dev/null; then
|
|
echo -e "MYP-Service: ${GREEN}Aktiv${NC}"
|
|
else
|
|
echo -e "MYP-Service: ${RED}Inaktiv${NC}"
|
|
fi
|
|
|
|
# Pfadangaben
|
|
echo -e "Installationspfad: /opt/myp"
|
|
echo -e "Datenbank: /opt/myp/data"
|
|
echo -e "Logs: /opt/myp/logs"
|
|
echo -e "SSL-Zertifikate: /opt/myp/ssl"
|
|
|
|
# SSL-Status überprüfen
|
|
if [ -f "/opt/myp/ssl/myp.crt" ] && [ -f "/opt/myp/ssl/myp.key" ]; then
|
|
echo -e "SSL-Zertifikate: ${GREEN}Vorhanden${NC}"
|
|
|
|
# Zertifikatsinformationen anzeigen
|
|
if command -v openssl &> /dev/null; then
|
|
cert_expiry=$(openssl x509 -enddate -noout -in /opt/myp/ssl/myp.crt | cut -d= -f 2)
|
|
cert_subject=$(openssl x509 -subject -noout -in /opt/myp/ssl/myp.crt | sed 's/^subject=//')
|
|
echo -e "Zertifikat für: ${BLUE}$cert_subject${NC}"
|
|
echo -e "Gültig bis: ${BLUE}$cert_expiry${NC}"
|
|
fi
|
|
else
|
|
echo -e "SSL-Zertifikate: ${RED}Fehlen${NC}"
|
|
fi
|
|
|
|
# MYP-URLs anzeigen
|
|
echo -e ""
|
|
echo -e "${YELLOW}MYP-Zugriff:${NC}"
|
|
ip_address=$(hostname -I | awk '{print $1}')
|
|
echo -e "${GREEN}https://$ip_address:5000${NC} (verschlüsselt)"
|
|
echo -e "${YELLOW}http://$ip_address:5000${NC} (unverschlüsselt)"
|
|
else
|
|
echo -e "MYP ist installiert: ${RED}Nein${NC}"
|
|
fi
|
|
|
|
echo ""
|
|
read -p "Drücken Sie eine Taste, um zum Hauptmenü zurückzukehren..."
|
|
show_main_menu
|
|
}
|
|
|
|
# 7) MYP-Dienst starten/stoppen/neustarten
|
|
service_management() {
|
|
print_header
|
|
echo -e "${GREEN}MYP-Dienst verwalten${NC}"
|
|
echo ""
|
|
|
|
if ! is_myp_installed; then
|
|
echo -e "${YELLOW}MYP ist nicht installiert.${NC}"
|
|
read -p "Drücken Sie eine Taste, um zum Hauptmenü zurückzukehren..."
|
|
show_main_menu
|
|
return
|
|
fi
|
|
|
|
# Aktuellen Dienststatus anzeigen
|
|
echo -e "${YELLOW}Aktueller Status:${NC}"
|
|
if systemctl is-active --quiet myp.service; then
|
|
echo -e "MYP-Dienst: ${GREEN}Aktiv${NC}"
|
|
else
|
|
echo -e "MYP-Dienst: ${RED}Inaktiv${NC}"
|
|
fi
|
|
echo ""
|
|
|
|
echo "1) MYP-Dienst starten"
|
|
echo "2) MYP-Dienst stoppen"
|
|
echo "3) MYP-Dienst neustarten"
|
|
echo "4) Zurück zum Hauptmenü"
|
|
echo ""
|
|
read -p "Ihre Auswahl: " service_option
|
|
|
|
case $service_option in
|
|
1)
|
|
echo "Starte MYP-Dienst..."
|
|
systemctl start myp.service
|
|
echo -e "${GREEN}MYP-Dienst wurde gestartet.${NC}"
|
|
;;
|
|
2)
|
|
echo "Stoppe MYP-Dienst..."
|
|
systemctl stop myp.service
|
|
echo -e "${GREEN}MYP-Dienst wurde gestoppt.${NC}"
|
|
;;
|
|
3)
|
|
echo "Starte MYP-Dienst neu..."
|
|
systemctl restart myp.service
|
|
echo -e "${GREEN}MYP-Dienst wurde neugestartet.${NC}"
|
|
;;
|
|
4)
|
|
show_main_menu
|
|
return
|
|
;;
|
|
*)
|
|
echo -e "${RED}Ungültige Option.${NC}"
|
|
service_management
|
|
return
|
|
;;
|
|
esac
|
|
|
|
read -p "Drücken Sie eine Taste, um zum Hauptmenü zurückzukehren..."
|
|
show_main_menu
|
|
}
|
|
|
|
# 8) Logs anzeigen
|
|
show_logs() {
|
|
print_header
|
|
echo -e "${GREEN}Logs anzeigen${NC}"
|
|
echo ""
|
|
|
|
echo "1) MYP-Anwendungslogs"
|
|
echo "2) Systemd-Dienstlogs"
|
|
echo "3) Watchdog-Logs"
|
|
echo "4) Zurück zum Hauptmenü"
|
|
echo ""
|
|
read -p "Ihre Auswahl: " logs_option
|
|
|
|
case $logs_option in
|
|
1)
|
|
if [ -f "/opt/myp/myp.log" ]; then
|
|
echo -e "${YELLOW}MYP-Anwendungslogs (letzte 20 Zeilen):${NC}"
|
|
tail -n 20 /opt/myp/myp.log
|
|
else
|
|
echo -e "${RED}MYP-Logdatei nicht gefunden.${NC}"
|
|
fi
|
|
;;
|
|
2)
|
|
echo -e "${YELLOW}Systemd-Dienstlogs für MYP:${NC}"
|
|
journalctl -u myp.service -n 20 --no-pager
|
|
;;
|
|
3)
|
|
if [ -f "/home/pi/myp-watchdog.log" ]; then
|
|
echo -e "${YELLOW}Watchdog-Logs (letzte 20 Zeilen):${NC}"
|
|
tail -n 20 /home/pi/myp-watchdog.log
|
|
else
|
|
echo -e "${RED}Watchdog-Logdatei nicht gefunden.${NC}"
|
|
fi
|
|
;;
|
|
4)
|
|
show_main_menu
|
|
return
|
|
;;
|
|
*)
|
|
echo -e "${RED}Ungültige Option.${NC}"
|
|
show_logs
|
|
return
|
|
;;
|
|
esac
|
|
|
|
read -p "Drücken Sie eine Taste, um zum Hauptmenü zurückzukehren..."
|
|
show_main_menu
|
|
}
|
|
|
|
# 9) Dokumentation anzeigen
|
|
show_documentation() {
|
|
print_header
|
|
echo -e "${GREEN}Dokumentation${NC}"
|
|
echo ""
|
|
|
|
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
|
|
|
|
echo "Verfügbare Dokumentation:"
|
|
echo "1) Allgemeine README"
|
|
echo "2) Kiosk-Modus Anleitung"
|
|
echo "3) Fehlerbehebung"
|
|
echo "4) Entwicklungsplan"
|
|
echo "5) Zurück zum Hauptmenü"
|
|
echo ""
|
|
read -p "Ihre Auswahl: " doc_option
|
|
|
|
case $doc_option in
|
|
1)
|
|
if [ -f "$SCRIPT_DIR/docs/README.md" ]; then
|
|
if command -v less &>/dev/null; then
|
|
less "$SCRIPT_DIR/docs/README.md"
|
|
else
|
|
cat "$SCRIPT_DIR/docs/README.md"
|
|
fi
|
|
else
|
|
echo -e "${RED}README nicht gefunden.${NC}"
|
|
fi
|
|
;;
|
|
2)
|
|
if [ -f "$SCRIPT_DIR/docs/KIOSK-SETUP.md" ]; then
|
|
if command -v less &>/dev/null; then
|
|
less "$SCRIPT_DIR/docs/KIOSK-SETUP.md"
|
|
else
|
|
cat "$SCRIPT_DIR/docs/KIOSK-SETUP.md"
|
|
fi
|
|
else
|
|
echo -e "${RED}Kiosk-Anleitung nicht gefunden.${NC}"
|
|
fi
|
|
;;
|
|
3)
|
|
if [ -f "$SCRIPT_DIR/docs/COMMON_ERRORS.md" ]; then
|
|
if command -v less &>/dev/null; then
|
|
less "$SCRIPT_DIR/docs/COMMON_ERRORS.md"
|
|
else
|
|
cat "$SCRIPT_DIR/docs/COMMON_ERRORS.md"
|
|
fi
|
|
else
|
|
echo -e "${RED}Fehlerbehebungsdokumentation nicht gefunden.${NC}"
|
|
fi
|
|
;;
|
|
4)
|
|
if [ -f "$SCRIPT_DIR/docs/ROADMAP.md" ]; then
|
|
if command -v less &>/dev/null; then
|
|
less "$SCRIPT_DIR/docs/ROADMAP.md"
|
|
else
|
|
cat "$SCRIPT_DIR/docs/ROADMAP.md"
|
|
fi
|
|
else
|
|
echo -e "${RED}Entwicklungsplan nicht gefunden.${NC}"
|
|
fi
|
|
;;
|
|
5)
|
|
show_main_menu
|
|
return
|
|
;;
|
|
*)
|
|
echo -e "${RED}Ungültige Option.${NC}"
|
|
show_documentation
|
|
return
|
|
;;
|
|
esac
|
|
|
|
read -p "Drücken Sie eine Taste, um zum Hauptmenü zurückzukehren..."
|
|
show_main_menu
|
|
}
|
|
|
|
# 10) SSL-Zertifikat-Management
|
|
show_ssl_management() {
|
|
print_header
|
|
echo -e "${GREEN}SSL-Zertifikat-Management${NC}"
|
|
echo ""
|
|
|
|
echo -e "Bitte wählen Sie eine Option:"
|
|
echo ""
|
|
echo "1) SSL-Zertifikatsstatus anzeigen"
|
|
echo "2) Neue SSL-Zertifikate erstellen"
|
|
echo "3) SSL-Einstellungen in settings.py anzeigen/bearbeiten"
|
|
echo ""
|
|
echo "b) Zurück zum Hauptmenü"
|
|
echo ""
|
|
read -p "Ihre Auswahl: " ssl_option
|
|
|
|
case $ssl_option in
|
|
1)
|
|
# SSL-Status anzeigen
|
|
chmod +x /opt/myp/install/ssl_check.sh
|
|
/opt/myp/install/ssl_check.sh
|
|
;;
|
|
2)
|
|
# Neue Zertifikate erstellen
|
|
echo -e "${YELLOW}Erstelle neue SSL-Zertifikate...${NC}"
|
|
chmod +x /opt/myp/install/create_ssl_cert.sh
|
|
/opt/myp/install/create_ssl_cert.sh -d /opt/myp/ssl
|
|
;;
|
|
3)
|
|
# SSL-Einstellungen anzeigen/bearbeiten
|
|
if command -v nano &> /dev/null; then
|
|
nano /opt/myp/app/config/settings.py
|
|
else
|
|
vi /opt/myp/app/config/settings.py
|
|
fi
|
|
;;
|
|
b|B)
|
|
show_main_menu
|
|
return
|
|
;;
|
|
*)
|
|
echo -e "${RED}Ungültige Option.${NC}"
|
|
sleep 2
|
|
show_ssl_management
|
|
;;
|
|
esac
|
|
|
|
read -p "Drücken Sie eine Taste, um zum SSL-Menü zurückzukehren..."
|
|
show_ssl_management
|
|
}
|
|
|
|
# Hauptprogramm
|
|
check_root
|
|
show_main_menu |