48 lines
3.9 KiB
Shell
48 lines
3.9 KiB
Shell
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
dnf upgrade --assumeyes
|
||
|
|
dnf install --assumeyes \
|
||
|
|
ca-certificates-2025.2.80_v9.0.305-102.el10_1 \
|
||
|
|
iproute-6.14.0-2.el10 \
|
||
|
|
iproute-tc-6.14.0-2.el10 \
|
||
|
|
nftables-1:1.1.1-9.el10_1 \
|
||
|
|
systemd-journal-remote-257-13.0.1.el10_1.3 \
|
||
|
|
wireguard-tools-1.0.20210914-6.el10
|
||
|
|
getent group oci-l4-relay-logs >/dev/null || useradd --system --user-group --home-dir /nonexistent --shell /sbin/nologin oci-l4-relay-logs
|
||
|
|
install -d -o root -g oci-l4-relay-logs -m 0710 /etc/oci-l4-relay
|
||
|
|
install -d -m 0700 /var/lib/oci-l4-relay/web-allow
|
||
|
|
install -d -m 0700 /var/lib/oci-l4-relay/smtp-deny
|
||
|
|
install -m 0755 /tmp/oci-l4-relay-guest /usr/local/sbin/oci-l4-relay-guest
|
||
|
|
install -m 0755 /tmp/oci-l4-relay-admission /usr/local/libexec/oci-l4-relay-admission
|
||
|
|
install -m 0755 /tmp/oci-l4-relay-smtp-deny /usr/local/libexec/oci-l4-relay-smtp-deny
|
||
|
|
install -m 0755 /tmp/oci-l4-relay-smtp-evidence /usr/local/libexec/oci-l4-relay-smtp-evidence
|
||
|
|
install -m 0755 /tmp/vlagent /usr/local/bin/vlagent
|
||
|
|
install -m 0600 /tmp/nftables.conf /etc/sysconfig/nftables.conf
|
||
|
|
install -m 0644 /tmp/modules-load.conf /etc/modules-load.d/oci-l4-relay.conf
|
||
|
|
install -m 0440 /tmp/100-oracle-cloud-agent-run-command /etc/sudoers.d/100-oracle-cloud-agent-run-command
|
||
|
|
install -m 0644 /tmp/[email protected] /etc/systemd/[email protected]
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-bootstrap.service /etc/systemd/system/oci-l4-relay-bootstrap.service
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-admission.service /etc/systemd/system/oci-l4-relay-admission.service
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-admission.timer /etc/systemd/system/oci-l4-relay-admission.timer
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-smtp-deny.service /etc/systemd/system/oci-l4-relay-smtp-deny.service
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-smtp-deny.timer /etc/systemd/system/oci-l4-relay-smtp-deny.timer
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-smtp-evidence.service /etc/systemd/system/oci-l4-relay-smtp-evidence.service
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-journal-upload.service /etc/systemd/system/oci-l4-relay-journal-upload.service
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-log-credential.service /etc/systemd/system/oci-l4-relay-log-credential.service
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-log-credential.timer /etc/systemd/system/oci-l4-relay-log-credential.timer
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-logs.path /etc/systemd/system/oci-l4-relay-logs.path
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-logs.slice /etc/systemd/system/oci-l4-relay-logs.slice
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-logs.target /etc/systemd/system/oci-l4-relay-logs.target
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-telemetry.service /etc/systemd/system/oci-l4-relay-telemetry.service
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-telemetry.timer /etc/systemd/system/oci-l4-relay-telemetry.timer
|
||
|
|
install -m 0644 /tmp/oci-l4-relay-vlagent.service /etc/systemd/system/oci-l4-relay-vlagent.service
|
||
|
|
rpm -q ca-certificates iproute iproute-tc kernel-uek-core kernel-uek-modules nftables systemd-journal-remote wireguard-tools | sort > /usr/share/oci-l4-relay-package-manifest.txt
|
||
|
|
sha256sum /usr/local/bin/vlagent /usr/local/sbin/oci-l4-relay-guest /usr/local/libexec/oci-l4-relay-admission /usr/local/libexec/oci-l4-relay-smtp-deny /usr/local/libexec/oci-l4-relay-smtp-evidence > /usr/share/oci-l4-relay-binary-manifest.txt
|
||
|
|
systemd-analyze verify /etc/systemd/system/oci-l4-relay-*.service /etc/systemd/system/oci-l4-relay-*.timer /etc/systemd/system/oci-l4-relay-logs.path /etc/systemd/system/oci-l4-relay-logs.slice /etc/systemd/system/oci-l4-relay-logs.target
|
||
|
|
systemctl disable firewalld.service dnf-makecache.timer
|
||
|
|
systemctl mask sshd.service sshd.socket
|
||
|
|
systemctl enable nftables.service oci-l4-relay-bootstrap.service oci-l4-relay-admission.timer oci-l4-relay-smtp-deny.timer oci-l4-relay-smtp-evidence.service oci-l4-relay-log-credential.timer oci-l4-relay-logs.path oci-l4-relay-telemetry.timer
|
||
|
|
visudo -cf /etc/sudoers
|
||
|
|
rm -f /root/.ssh/authorized_keys /home/opc/.ssh/authorized_keys
|
||
|
|
cloud-init clean --logs --machine-id
|