83 lines
2.6 KiB
Bash
83 lines
2.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
readonly SSH_PORT_CONFIG="/etc/ochenstarik-server/ssh-port.conf"
|
|
readonly DEFAULT_SSH_PORT="20202"
|
|
|
|
log() { printf '[+] %s\n' "$*"; }
|
|
warn() { printf '[!] %s\n' "$*" >&2; }
|
|
die() { printf '[x] %s\n' "$*" >&2; exit 1; }
|
|
|
|
is_valid_port() {
|
|
local port="$1"
|
|
[[ "$port" =~ ^[0-9]{1,5}$ ]] || return 1
|
|
(( 10#$port >= 1 && 10#$port <= 65535 ))
|
|
}
|
|
|
|
choose_ssh_port() {
|
|
local default_port="$DEFAULT_SSH_PORT" saved_port selected_port
|
|
|
|
if [[ -e "$SSH_PORT_CONFIG" ]]; then
|
|
[[ -f "$SSH_PORT_CONFIG" && ! -L "$SSH_PORT_CONFIG" ]] \
|
|
|| die "$SSH_PORT_CONFIG must be a regular non-symlink file"
|
|
saved_port="$(sed -n 's/^SSH_PORT=//p' "$SSH_PORT_CONFIG" | head -n1 | tr -d '\r')"
|
|
if is_valid_port "$saved_port"; then
|
|
default_port="$((10#$saved_port))"
|
|
else
|
|
warn "Ignoring invalid saved SSH port: ${saved_port:-empty}"
|
|
fi
|
|
fi
|
|
|
|
while :; do
|
|
read -rp "SSH port for step 3 [${default_port}]: " selected_port
|
|
selected_port="${selected_port:-$default_port}"
|
|
if is_valid_port "$selected_port"; then
|
|
SSH_PORT="$((10#$selected_port))"
|
|
return 0
|
|
fi
|
|
warn "SSH port must be a number between 1 and 65535"
|
|
done
|
|
}
|
|
|
|
[[ "$EUID" -eq 0 ]] || die "Run this script as root"
|
|
SSH_PORT=""
|
|
choose_ssh_port
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
|
|
log "Updating the operating system"
|
|
apt-get update
|
|
apt-get upgrade -y
|
|
|
|
log "Installing server and document-processing packages"
|
|
apt-get install -y \
|
|
sudo ufw fail2ban curl ca-certificates openssl openssh-server logrotate \
|
|
poppler-utils qpdf ghostscript ocrmypdf \
|
|
tesseract-ocr tesseract-ocr-eng tesseract-ocr-rus \
|
|
libreoffice pandoc antiword catdoc imagemagick libimage-exiftool-perl webp \
|
|
ffmpeg mediainfo p7zip-full unzip zip unrar jq yq csvkit sqlite3 \
|
|
python3-pip python3-venv mc
|
|
|
|
install -d -m 700 -o root -g root "$(dirname "$SSH_PORT_CONFIG")"
|
|
printf 'SSH_PORT=%s\n' "$SSH_PORT" > "$SSH_PORT_CONFIG"
|
|
chown root:root "$SSH_PORT_CONFIG"
|
|
chmod 600 "$SSH_PORT_CONFIG"
|
|
log "Saved SSH port ${SSH_PORT} for step 3"
|
|
|
|
log "Configuring UFW"
|
|
# Keep port 22 open until step 3 moves SSH to the selected port and the new login is tested.
|
|
ufw allow "22/tcp"
|
|
ufw allow "${SSH_PORT}/tcp"
|
|
ufw allow "80/tcp"
|
|
ufw allow "2096/tcp"
|
|
ufw allow "443/tcp"
|
|
ufw allow "40000/tcp"
|
|
ufw allow "63636/tcp"
|
|
ufw --force enable
|
|
|
|
log "Installed versions"
|
|
printf 'Timezone: %s\n' "$(timedatectl show --property=Timezone --value)"
|
|
ufw status verbose
|
|
|
|
printf '\nDone. Now run ochenstarik-server-user-3.sh as root.\n'
|
|
printf 'Step 3 will move SSH to port %s.\n' "$SSH_PORT"
|
|
printf 'Do not remove the UFW rule for port 22 until SSH login on port %s succeeds.\n' "$SSH_PORT"
|