From a2923b42dbd061cd1bfe46c56dc0aff43ccb33f1 Mon Sep 17 00:00:00 2001 From: Filip Pytloun Date: Fri, 4 Mar 2016 14:07:10 +0100 Subject: Cleanup code by spliting files --- files/config.txt | 43 +++++++++++++++++++++++ files/firstboot/10-begin.sh | 2 ++ files/firstboot/21-generate-ssh-keys.sh | 8 +++++ files/firstboot/22-expandroot.sh | 52 ++++++++++++++++++++++++++++ files/firstboot/99-finish.sh | 3 ++ files/fstab | 2 ++ files/iptables/flush-ip6tables.sh | 15 ++++++++ files/iptables/flush-iptables.sh | 10 ++++++ files/iptables/ip6tables.rules | 48 ++++++++++++++++++++++++++ files/iptables/ip6tables.service | 15 ++++++++ files/iptables/iptables.rules | 43 +++++++++++++++++++++++ files/iptables/iptables.service | 15 ++++++++ files/modprobe.d/raspi-blacklist.conf | 9 +++++ files/sysctl.d/81-rpi-vm.conf | 6 ++++ files/sysctl.d/82-rpi-net-hardening.conf | 59 ++++++++++++++++++++++++++++++++ 15 files changed, 330 insertions(+) create mode 100644 files/config.txt create mode 100644 files/firstboot/10-begin.sh create mode 100644 files/firstboot/21-generate-ssh-keys.sh create mode 100644 files/firstboot/22-expandroot.sh create mode 100644 files/firstboot/99-finish.sh create mode 100644 files/fstab create mode 100644 files/iptables/flush-ip6tables.sh create mode 100644 files/iptables/flush-iptables.sh create mode 100644 files/iptables/ip6tables.rules create mode 100644 files/iptables/ip6tables.service create mode 100644 files/iptables/iptables.rules create mode 100644 files/iptables/iptables.service create mode 100644 files/modprobe.d/raspi-blacklist.conf create mode 100644 files/sysctl.d/81-rpi-vm.conf create mode 100644 files/sysctl.d/82-rpi-net-hardening.conf (limited to 'files') diff --git a/files/config.txt b/files/config.txt new file mode 100644 index 0000000..7491765 --- /dev/null +++ b/files/config.txt @@ -0,0 +1,43 @@ +# For more options and information see +# http://www.raspberrypi.org/documentation/configuration/config-txt.md +# Some settings may impact device functionality. See link above for details + +# uncomment if you get no picture on HDMI for a default "safe" mode +#hdmi_safe=1 + +# uncomment this if your display has a black border of unused pixels visible +# and your display can output without overscan +#disable_overscan=1 + +# uncomment the following to adjust overscan. Use positive numbers if console +# goes off screen, and negative if there is too much border +#overscan_left=16 +#overscan_right=16 +#overscan_top=16 +#overscan_bottom=16 + +# uncomment to force a console size. By default it will be display's size minus +# overscan. +#framebuffer_width=1280 +#framebuffer_height=720 + +# uncomment if hdmi display is not detected and composite is being output +#hdmi_force_hotplug=1 + +# uncomment to force a specific HDMI mode (this will force VGA) +#hdmi_group=1 +#hdmi_mode=1 + +# uncomment to force a HDMI mode rather than DVI. This can make audio work in +# DMT (computer monitor) modes +#hdmi_drive=2 + +# uncomment to increase signal to HDMI, if you have interference, blanking, or +# no display +#config_hdmi_boost=4 + +# uncomment for composite PAL +#sdtv_mode=2 + +# uncomment to overclock the arm. 700 MHz is the default. +#arm_freq=800 diff --git a/files/firstboot/10-begin.sh b/files/firstboot/10-begin.sh new file mode 100644 index 0000000..6258bb7 --- /dev/null +++ b/files/firstboot/10-begin.sh @@ -0,0 +1,2 @@ +#!/bin/sh -e +logger -t "rc.firstboot" "Starting first boot actions" diff --git a/files/firstboot/21-generate-ssh-keys.sh b/files/firstboot/21-generate-ssh-keys.sh new file mode 100644 index 0000000..a6c567c --- /dev/null +++ b/files/firstboot/21-generate-ssh-keys.sh @@ -0,0 +1,8 @@ +logger -t "rc.firstboot" "Generating SSH host keys" +rm -f /etc/ssh/ssh_host_* +ssh-keygen -q -t rsa -N "" -f /etc/ssh/ssh_host_rsa_key +ssh-keygen -q -t dsa -N "" -f /etc/ssh/ssh_host_dsa_key +ssh-keygen -q -t ecdsa -N "" -f /etc/ssh/ssh_host_ecdsa_key +ssh-keygen -q -t ed25519 -N "" -f /etc/ssh/ssh_host_ed25519_key + +systemctl restart sshd diff --git a/files/firstboot/22-expandroot.sh b/files/firstboot/22-expandroot.sh new file mode 100644 index 0000000..00b94af --- /dev/null +++ b/files/firstboot/22-expandroot.sh @@ -0,0 +1,52 @@ +logger -t "rc.firstboot" "Expanding root" +ROOT_PART=$(mount | sed -n 's|^/dev/\(.*\) on / .*|\1|p') +PART_NUM=$(echo ${ROOT_PART} | grep -o '[1-9][0-9]*$') +case "${ROOT_PART}" in + mmcblk0*) ROOT_DEV=mmcblk0 ;; + sda*) ROOT_DEV=sda ;; +esac +if [ "$PART_NUM" = "$ROOT_PART" ]; then + logger -t "rc.firstboot" "$ROOT_PART is not an SD card. Don't know how to expand" + return 0 +fi + +# NOTE: the NOOBS partition layout confuses parted. For now, let's only +# agree to work with a sufficiently simple partition layout +if [ "$PART_NUM" -gt 2 ]; then + logger -t "rc.firstboot" "Your partition layout is not currently supported by this tool." + return 0 +fi +LAST_PART_NUM=$(parted /dev/${ROOT_DEV} -ms unit s p | tail -n 1 | cut -f 1 -d:) +if [ $LAST_PART_NUM -ne $PART_NUM ]; then + logger -t "rc.firstboot" "$ROOT_PART is not the last partition. Don't know how to expand" + return 0 +fi + +# Get the starting offset of the root partition +PART_START=$(parted /dev/${ROOT_DEV} -ms unit s p | grep "^${PART_NUM}" | cut -f 2 -d: | sed 's/[^0-9]//g') +[ "$PART_START" ] || return 1 + +# Get the possible last sector for the root partition +PART_LAST=$(fdisk -l /dev/${ROOT_DEV} | grep '^Disk.*sectors' | awk '{ print $7 - 1 }') +[ "$PART_LAST" ] || return 1 + +# Return value will likely be error for fdisk as it fails to reload the +# partition table because the root fs is mounted +### Since rc.local is run with "sh -e", let's add "|| true" to prevent premature exit +fdisk /dev/${ROOT_DEV} <