#!/bin/bash # ----------------------------------------------------------------------------- # Install script for webserver with Apache/MySQL/PHP* on CentOS 7 # ----------------------------------------------------------------------------- SRC=cdn1.groweb.it OWNER=groweb # curl -s -O https://$SRC/gpanel/wwwinstall8 # ----------------------------------------------------------------------------- # Network IPv6 setting - manadatory for ACME/LetsEncrypt verify # ----------------------------------------------------------------------------- sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/sysconfig/selinux sed -i "s/SELINUX=permissive/SELINUX=disabled/g" /etc/sysconfig/selinux sed -i "s/SELINUX = enforcing/SELINUX=disabled/g" /etc/sysconfig/selinux sed -i "s/SELINUX = permissive/SELINUX=disabled/g" /etc/sysconfig/selinux sed -i "s/net.ipv6.conf.all.disable_ipv6 = 1/net.ipv6.conf.all.disable_ipv6 = 0/g" /etc/sysctl.conf sed -i "s/net.ipv6.conf.all.disable_ipv6=1/net.ipv6.conf.all.disable_ipv6=0/g" /etc/sysctl.conf sysctl --system read -p "Reboot now? (y/n)" SYSREBOOT if [ "$SYSREBOOT" == "y" ] || [ "$SYSREBOOT" == "Y" ] || [ "$SYSREBOOT" == "1" ] then echo "Rebooting now..." reboot exit 0 fi # ----------------------------------------------------------------------------- # User input parameters # ----------------------------------------------------------------------------- read -p "Server number: " SRVNUM SYSNAME=$OWNER-srv$SRVNUM SYSURL=srv$SRVNUM.$OWNER.it read -p "Internal name: " SRVINT SRVINT=$SRVINT.$OWNER.it read -p "Server size: " SRVSIZE read -p "ACME staging: " ACMESTAGING read -s -p "System apache password: " SYSAPACHEPWD echo read -s -p "MySQL root password: " MYSQLROOTPWD echo echo "Inserire la password dell'utente root" passwd yum install epel-release -y yum install -y tar sqlite net-tools rsync libaio ncurses-libs ncurses-compat-libs tree unzip goaccess fontconfig cockpit yum upgrade -y # ----------------------------------------------------------------------------- # download main resource # ----------------------------------------------------------------------------- alias cp="cp" alias rm="rm" alias mv="mv" mkdir -p /tmp/$OWNER cd /tmp/$OWNER curl -O https://$SRC/gpanel/www.tar.gz tar -xf www.tar.gz && rm www.tar.gz chown -R root:root * cp -prv * / # personalizzazione dei file "speciali" # /etc/init.d è un link simbolico, e la copia ricorsiva dà errore -> il file va copiato singolarmente cp etc/init.d/tomcat /etc/init.d/tomcat cp etc/init.d/mysql /etc/init.d/mysql # apache authorized_keys (apache è l'utente di scambio dati tra i server) mkdir -p /work/www/.ssh cp /root/.ssh/id_rsa.pub /work/www/.ssh/authorized_keys chown -R apache:apache /work/www/.ssh chmod 700 /work/www/.ssh chmod 600 /work/www/.ssh/authorized_keys cd / rm -r /tmp/$OWNER # ----------------------------------------------------------------------------- mkdir /backup rm -r /etc/sudoers.d/* curl https://get.acme.sh | sh ln -s /root/.acme.sh /.acme.sh /root/.acme.sh/acme.sh --register-account --server letsencrypt $ACMESTAGING > /tmp/AT tail -n 1 /tmp/AT > /tmp/AT2 cat /tmp/AT2 | awk -F"'" '{print $2}' > /work/util/ACCOUNT_THUMBPRINT rm /tmp/AT* cat /root/.shellrc >> /root/.bashrc rm /root/.shellrc echo $SYSNAME > /srv/name dd if=/dev/zero of=/swapfile bs=1048576 count=1024 chmod 0600 /swapfile mkswap /swapfile swapon /swapfile echo "/swapfile swap swap defaults 0 0" >> /etc/fstab useradd pxtmc chown -R pxtmc:pxtmc /home/pxtmc chmod 700 /home/pxtmc/.ssh chmod 600 /home/pxtmc/.ssh/authorized_keys useradd loris chown -R loris:loris /home/loris chmod 700 /home/loris/.ssh chmod 600 /home/loris/.ssh/authorized_keys sed -i "s/PermitRootLogin/#PermitRootLogin no/g" /etc/ssh/sshd_config sed -i "s/PasswordAuthentication/#PasswordAuthentication no/g" /etc/ssh/sshd_config echo "PermitRootLogin no" >> /etc/ssh/sshd_config echo "PasswordAuthentication no" >> /etc/ssh/sshd_config echo "AllowUsers pxtmc loris apache" >> /etc/ssh/sshd_config service sshd restart rm /etc/localtime ln -s /usr/share/zoneinfo/Europe/Rome /etc/localtime echo "LANG=en_US.UTF-8" >> /etc/environment echo "LC_ALL=en_US.UTF-8" >> /etc/environment systemctl stop firewalld systemctl disable firewalld systemctl mask firewalld yum remove -y firewalld yum install -y iptables-services cd /etc/sysconfig rm iptables ip6tables ln -s iptables.rules iptables ln -s iptables.rules ip6tables sed -i "s/SRVIPPOOL/pool-$SYSURL/g" iptables.rules systemctl start iptables.service systemctl start ip6tables.service systemctl enable iptables.service systemctl enable ip6tables.service chkconfig iptables on chkconfig ip6tables on echo "systemctl start iptables.service" >> /etc/rc.d/rc.local echo "systemctl start ip6tables.service" >> /etc/rc.d/rc.local echo "rm /tmp/*.chk" >> /etc/rc.local yum install -y vsftpd sed -i "s/local_umask=022/local_umask=002/g" /etc/vsftpd/vsftpd.conf sed -i "s/#chroot_local_user/chroot_local_user/g" /etc/vsftpd/vsftpd.conf sed -i "s/#chroot_list_enable/chroot_list_enable/g" /etc/vsftpd/vsftpd.conf sed -i "s/#chroot_list_file/chroot_list_file/g" /etc/vsftpd/vsftpd.conf echo "allow_writeable_chroot=YES" >> /etc/vsftpd/vsftpd.conf echo "pasv_enable=yes" >> /etc/vsftpd/vsftpd.conf echo "pasv_min_port=50000" >> /etc/vsftpd/vsftpd.conf echo "pasv_max_port=50100" >> /etc/vsftpd/vsftpd.conf touch /etc/vsftpd/chroot_list systemctl enable vsftpd.service chkconfig vsftpd on service vsftpd restart cd /usr/local mkdir /usr/local/mysql-data mkdir /var/run/mysql groupadd mysql useradd -r -g mysql mysql chown -R mysql:mysql mariadb* chown -R mysql:mysql mysql* chown -R mysql:mysql /var/run/mysql /usr/local/mysql/scripts/mysql_install_db --user=mysql chkconfig mysql on service mysql start /usr/local/mysql/bin/mysqladmin -S /var/run/mysql/mysql.sock --user=root password "$MYSQLROOTPWD" /usr/local/mysql/bin/mysql -u root -e "CREATE USER 'root'@'%' IDENTIFIED BY '$MYSQLROOTPWD';" /usr/local/mysql/bin/mysql -u root -e "GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION;" /usr/local/mysql/bin/mysql -u root -e "CREATE USER 'backup'@'127.0.0.1' IDENTIFIED BY 'f0EMDe2dw2sdLCBlq9A9pC3fAB9CQ3iiZSQ58Z5XZ59ZBHp9l2x0SejA801ZLe8V';" /usr/local/mysql/bin/mysql -u root -e "GRANT SUPER, ALTER, INSERT, CREATE, DROP, REFERENCES, CREATE ROUTINE, PROCESS, SELECT, SHOW VIEW, CREATE VIEW, RELOAD, REPLICATION CLIENT, EVENT, TRIGGER, LOCK TABLES ON *.* TO 'backup'@'127.0.0.1';" /usr/local/mysql/bin/mysql -u root -e "CREATE USER 'gpanel'@'127.0.0.1' IDENTIFIED BY '2FvLm722CSSuuVY7FUFO11tQlRs7q25QL323iR2Vr9Q5H9i2vi49WZcli8L8xBZ0';" /usr/local/mysql/bin/mysql -u root -e "GRANT ALL ON gpanel.* TO 'gpanel'@'127.0.0.1';" /usr/local/mysql/bin/mysql -u root -e "CREATE SCHEMA wordpress;" yum install -y http://rpms.remirepo.net/enterprise/remi-release-8.rpm yum upgrade -y yum install -y httpd mod_ssl systemctl enable httpd.service chkconfig httpd on echo "$SYSAPACHEPWD" | passwd --stdin apache sed -i "s/apache:x:48:48:Apache:\/usr\/share\/httpd:\/sbin\/nologin/apache:x:48:48:Apache:\/work\/www:\/bin\/bash/g" /etc/passwd mkdir /var/run/php chown -R apache:apache /var/run/php chown -R apache:apache /work/www chmod -R 755 /work/www setfacl -Rdm u:apache:rwx,g:apache:rwx,o::rx /work/www yum install -y php56-php-fpm php56-php-cli php56-php-mysqlnd php56-php-intl php56-php-xml php56-php-gd php56-php-mbstring php56-php-mcrypt php56-php-bcmath php56-php-soap php56-php-imap php56-php-pecl-zip php56-php-imagick systemctl enable php56-php-fpm.service chkconfig php56-php-fpm on cd /etc/opt/remi/php56/php.d/ ln -s /work/php.d/zz_tuning.ini sed -i "s/listen = 127.0.0.1:9000/listen = \/var\/run\/php\/www-56.sock/g" /etc/opt/remi/php56/php-fpm.d/www.conf sed -i "s/listen = \/var\/opt\/remi\/php56\/run\/php-fpm\/www.sock/listen = \/var\/run\/php\/www-56.sock/g" /etc/opt/remi/php56/php-fpm.d/www.conf sed -i "s/;listen.owner = nobody/listen.owner = apache/g" /etc/opt/remi/php56/php-fpm.d/www.conf sed -i "s/;listen.group = nobody/listen.group = apache/g" /etc/opt/remi/php56/php-fpm.d/www.conf sed -i "s/;listen.mode/listen.mode/g" /etc/opt/remi/php56/php-fpm.d/www.conf service php56-php-fpm start yum install -y php70-php-fpm php70-php-cli php70-php-mysqlnd php70-php-intl php70-php-xml php70-php-gd php70-php-mbstring php70-php-mcrypt php70-php-bcmath php70-php-soap php70-php-imap php70-php-pecl-zip php70-php-imagick systemctl enable php70-php-fpm.service chkconfig php70-php-fpm on cd /etc/opt/remi/php70/php.d ln -s /work/php.d/zz_tuning.ini sed -i "s/listen = 127.0.0.1:9000/listen = \/var\/run\/php\/www-70.sock/g" /etc/opt/remi/php70/php-fpm.d/www.conf sed -i "s/listen = \/var\/opt\/remi\/php70\/run\/php-fpm\/www.sock/listen = \/var\/run\/php\/www-70.sock/g" /etc/opt/remi/php70/php-fpm.d/www.conf sed -i "s/;listen.owner = nobody/listen.owner = apache/g" /etc/opt/remi/php70/php-fpm.d/www.conf sed -i "s/;listen.group = nobody/listen.group = apache/g" /etc/opt/remi/php70/php-fpm.d/www.conf sed -i "s/;listen.mode/listen.mode/g" /etc/opt/remi/php70/php-fpm.d/www.conf service php70-php-fpm start yum install -y php71-php-fpm php71-php-cli php71-php-mysqlnd php71-php-intl php71-php-xml php71-php-gd php71-php-mbstring php71-php-mcrypt php71-php-bcmath php71-php-soap php71-php-imap php71-php-pecl-zip php71-php-imagick systemctl enable php71-php-fpm.service chkconfig php71-php-fpm on cd /etc/opt/remi/php71/php.d ln -s /work/php.d/zz_tuning.ini sed -i "s/listen = 127.0.0.1:9000/listen = \/var\/run\/php\/www-71.sock/g" /etc/opt/remi/php71/php-fpm.d/www.conf sed -i "s/listen = \/var\/opt\/remi\/php71\/run\/php-fpm\/www.sock/listen = \/var\/run\/php\/www-71.sock/g" /etc/opt/remi/php71/php-fpm.d/www.conf sed -i "s/;listen.owner = nobody/listen.owner = apache/g" /etc/opt/remi/php71/php-fpm.d/www.conf sed -i "s/;listen.group = nobody/listen.group = apache/g" /etc/opt/remi/php71/php-fpm.d/www.conf sed -i "s/;listen.mode/listen.mode/g" /etc/opt/remi/php71/php-fpm.d/www.conf service php71-php-fpm start yum install -y php72-php-fpm php72-php-cli php72-php-mysqlnd php72-php-intl php72-php-xml php72-php-gd php72-php-mbstring php72-php-mcrypt php72-php-bcmath php72-php-soap php72-php-imap php72-php-pecl-zip php72-php-imagick systemctl enable php72-php-fpm.service chkconfig php72-php-fpm on cd /etc/opt/remi/php72/php.d ln -s /work/php.d/zz_tuning.ini sed -i "s/listen = 127.0.0.1:9000/listen = \/var\/run\/php\/www-72.sock/g" /etc/opt/remi/php72/php-fpm.d/www.conf sed -i "s/listen = \/var\/opt\/remi\/php72\/run\/php-fpm\/www.sock/listen = \/var\/run\/php\/www-72.sock/g" /etc/opt/remi/php72/php-fpm.d/www.conf sed -i "s/;listen.owner = nobody/listen.owner = apache/g" /etc/opt/remi/php72/php-fpm.d/www.conf sed -i "s/;listen.group = nobody/listen.group = apache/g" /etc/opt/remi/php72/php-fpm.d/www.conf sed -i "s/;listen.mode/listen.mode/g" /etc/opt/remi/php72/php-fpm.d/www.conf service php72-php-fpm start yum install -y php73-php-fpm php73-php-cli php73-php-mysqlnd php73-php-intl php73-php-xml php73-php-gd php73-php-mbstring php73-php-mcrypt php73-php-bcmath php73-php-soap php73-php-imap php73-php-pecl-zip php73-php-imagick systemctl enable php73-php-fpm.service chkconfig php73-php-fpm on cd /etc/opt/remi/php73/php.d ln -s /work/php.d/zz_tuning.ini sed -i "s/listen = 127.0.0.1:9000/listen = \/var\/run\/php\/www-73.sock/g" /etc/opt/remi/php73/php-fpm.d/www.conf sed -i "s/listen = \/var\/opt\/remi\/php73\/run\/php-fpm\/www.sock/listen = \/var\/run\/php\/www-73.sock/g" /etc/opt/remi/php73/php-fpm.d/www.conf sed -i "s/;listen.owner = nobody/listen.owner = apache/g" /etc/opt/remi/php73/php-fpm.d/www.conf sed -i "s/;listen.group = nobody/listen.group = apache/g" /etc/opt/remi/php73/php-fpm.d/www.conf sed -i "s/;listen.mode/listen.mode/g" /etc/opt/remi/php73/php-fpm.d/www.conf service php73-php-fpm start yum install -y php74-php-fpm php74-php-cli php74-php-mysqlnd php74-php-intl php74-php-xml php74-php-gd php74-php-mbstring php74-php-mcrypt php74-php-bcmath php74-php-soap php74-php-imap php74-php-pecl-zip php74-php-imagick systemctl enable php74-php-fpm.service chkconfig php74-php-fpm on cd /etc/opt/remi/php74/php.d ln -s /work/php.d/zz_tuning.ini sed -i "s/listen = 127.0.0.1:9000/listen = \/var\/run\/php\/www-74.sock/g" /etc/opt/remi/php74/php-fpm.d/www.conf sed -i "s/listen = \/var\/opt\/remi\/php74\/run\/php-fpm\/www.sock/listen = \/var\/run\/php\/www-74.sock/g" /etc/opt/remi/php74/php-fpm.d/www.conf sed -i "s/;listen.owner = nobody/listen.owner = apache/g" /etc/opt/remi/php74/php-fpm.d/www.conf sed -i "s/;listen.group = nobody/listen.group = apache/g" /etc/opt/remi/php74/php-fpm.d/www.conf sed -i "s/;listen.mode/listen.mode/g" /etc/opt/remi/php74/php-fpm.d/www.conf service php74-php-fpm start yum install -y php80-php-fpm php80-php-cli php80-php-mysqlnd php80-php-intl php80-php-xml php80-php-gd php80-php-mbstring php80-php-mcrypt php80-php-bcmath php80-php-soap php80-php-imap php80-php-pecl-zip php80-php-imagick systemctl enable php80-php-fpm.service chkconfig php80-php-fpm on cd /etc/opt/remi/php80/php.d ln -s /work/php.d/zz_tuning.ini sed -i "s/listen = 127.0.0.1:9000/listen = \/var\/run\/php\/www-80.sock/g" /etc/opt/remi/php80/php-fpm.d/www.conf sed -i "s/listen = \/var\/opt\/remi\/php80\/run\/php-fpm\/www.sock/listen = \/var\/run\/php\/www-80.sock/g" /etc/opt/remi/php80/php-fpm.d/www.conf sed -i "s/;listen.owner = nobody/listen.owner = apache/g" /etc/opt/remi/php80/php-fpm.d/www.conf sed -i "s/;listen.group = nobody/listen.group = apache/g" /etc/opt/remi/php80/php-fpm.d/www.conf sed -i "s/;listen.mode/listen.mode/g" /etc/opt/remi/php80/php-fpm.d/www.conf service php80-php-fpm start yum install -y php81-php-fpm php81-php-cli php81-php-mysqlnd php81-php-intl php81-php-xml php81-php-gd php81-php-mbstring php81-php-mcrypt php81-php-bcmath php81-php-soap php81-php-imap php81-php-pecl-zip php81-php-imagick systemctl enable php81-php-fpm.service chkconfig php81-php-fpm on cd /etc/opt/remi/php81/php.d ln -s /work/php.d/zz_tuning.ini sed -i "s/listen = 127.0.0.1:9000/listen = \/var\/run\/php\/www-81.sock/g" /etc/opt/remi/php81/php-fpm.d/www.conf sed -i "s/listen = \/var\/opt\/remi\/php81\/run\/php-fpm\/www.sock/listen = \/var\/run\/php\/www-81.sock/g" /etc/opt/remi/php81/php-fpm.d/www.conf sed -i "s/;listen.owner = nobody/listen.owner = apache/g" /etc/opt/remi/php81/php-fpm.d/www.conf sed -i "s/;listen.group = nobody/listen.group = apache/g" /etc/opt/remi/php81/php-fpm.d/www.conf sed -i "s/;listen.mode/listen.mode/g" /etc/opt/remi/php81/php-fpm.d/www.conf service php81-php-fpm start rm /etc/httpd/conf.d/php* ln -s /usr/bin/php81 /usr/bin/php cd /etc/cron.d ln -s /work/cron.d/acmerenew ln -s /work/cron.d/backup ln -s /work/cron.d/makestats ln -s /work/cron.d/rsynccdn ln -s /work/cron.d/sitecron ln -s /work/cron.d/status ln -s /work/cron.d/update ln -s /work/cron.d/watchdog cd /etc/httpd/conf.d ln -s /work/conf.d/00_settings.conf ln -s /work/conf.d/00_php.conf ln -s /work/conf.d/00_tuning.conf sed -i "s/www-XX.sock/www-81.sock/g" /work/conf.d/00_php.conf sed -i "s/SERVERURL/$SYSURL/g" /work/conf.d/00_settings.conf sed -i "s/SERVERURL/$SYSURL/g" /work/conf.d/default.conf sed -i "s/SERVERURL/$SYSURL/g" /work/hosts/conf/server.xml service httpd restart service crond restart /root/.acme.sh/acme.sh --stateless --issue --server letsencrypt $ACMESTAGING -d $SYSURL -d $SRVINT ln -s /work/conf.d/default.conf service httpd stop rm /etc/httpd/conf.d/php* service httpd start #------------------------------------------------------------------------------- # WP-CLI #------------------------------------------------------------------------------- curl https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar -o /work/scripts/wp-cli.phar mkdir /root/.wp-cli ln -s /root/.wp-cli /.wp-cli mkdir -p /work/wprepository/default /work/scripts/wpinstall /work/wprepository/default wordpress root $MYSQLROOTPWD http://$SYSURL admin $OWNER admin@$OWNER.it wordpress it_IT #------------------------------------------------------------------------------- # gPanel #------------------------------------------------------------------------------- chkconfig tomcat on TMPID=$(date +%s%N) CNF=/tmp/$TMPID/my.cnf mkdir -p /tmp/$TMPID echo "[client]" > $CNF echo "password=$MYSQLROOTPWD" >> $CNF cd /tmp/$TMPID curl -O https://$SRC/gpanel/gpanel.sql.gz gzip -d gpanel.sql.gz /usr/local/mysql/bin/mysql --defaults-extra-file=$CNF -h 127.0.0.1 -u root < /tmp/$TMPID/gpanel.sql cd / rm -r /tmp/$TMPID mkdir /storage sqlite3 /work/hosts/default/conf/db/settings.sqlite "insert into settings(code, value) values('MYSQL-ROOT-PASSWORD', '$MYSQLROOTPWD')" sqlite3 /work/hosts/default/conf/db/settings.sqlite "insert into settings(code, value) values('SRV-NUMBER', '$SRVNUM')" sqlite3 /work/hosts/default/conf/db/settings.sqlite "insert into settings(code, value) values('SRV-SIZE', '$SRVSIZE')" service tomcat start #------------------------------------------------------------------------------- #------------------------------------------------------------------------------- rm $0