Jun 1, 2020: update

2020-06-01 11:02:23 -07:00
parent 7707eb5865
commit b5674dda38
38 changed files with 320 additions and 51 deletions
--- a/jails/config/auto/portfolio
+++ b/jails/config/auto/portfolio
@ -1,3 +1,5 @@
+#!/bin/sh
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,8 +8,6 @@
 #
 #

-#!/bin/sh
-
 # the two lines below are not just comments but required by rcorder; service -e
 # PROVIDE: portfolio
 # REQUIRE: NETWORKING DAEMON
--- a/jails/config/auto/producthunt
+++ b/jails/config/auto/producthunt
@ -1,3 +1,5 @@
+#!/bin/sh
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,8 +8,6 @@
 #
 #

-#!/bin/sh
-
 # the two lines below are not just comments but required by rcorder; service -e
 # PROVIDE: producthunt
 # REQUIRE: NETWORKING DAEMON
--- a/jails/config/book/cps
+++ b/jails/config/book/cps
@ -1,3 +1,5 @@
+#!/bin/sh
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,8 +8,6 @@
 #
 #

-#!/bin/sh
-
 # the two lines below are not just comments but required by rcorder; service -e
 # PROVIDE: cpsserver
 # REQUIRE: NETWORKING DAEMON
--- a/jails/config/calibre/.keep
+++ b/jails/config/calibre/.keep
--- a/jails/config/cam/camserver
+++ b/jails/config/cam/camserver
@ -1,3 +1,5 @@
+#!/bin/sh
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,8 +8,6 @@
 #
 #

-#!/bin/sh
-
 # the two lines below are not just comments but required by rcorder; service -e
 # PROVIDE: camserver
 # REQUIRE: NETWORKING SERVERS DAEMON ldconfig resolv
@ -27,12 +27,12 @@ restart_cmd="camserver_restart"
 
 camserver_start()
 {
-        $camserver startserver -b -c /mnt/config/secret/motioneye/motioneye.conf
+	$camserver startserver -b -c /mnt/config/secret/motioneye/motioneye.conf
 }
 
 camserver_stop()
 {
-        $camserver stopserver
+	$camserver stopserver
 }
 camserver_restart()
 {
--- a/jails/config/cert/.keep
+++ b/jails/config/cert/.keep
--- a/jails/config/common/snip-sendmail.sh
+++ b/jails/config/common/snip-sendmail.sh
@ -1,3 +1,5 @@
+#! /usr/local/bin/bash
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,7 +8,6 @@
 #
 #

-#! /usr/local/bin/bash
 # smart_host - mail - is the mail server's dns name
 # TO_IDENT sets O Timeout.ident=0s - to stop sendmail from making ident connections
 echo "define(\`SMART_HOST', \`mail')" >> /etc/mail/$HOSTNAME.mc
--- a/jails/config/common/vncserver
+++ b/jails/config/common/vncserver
@ -1,3 +1,5 @@
+#!/bin/sh
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,8 +8,6 @@
 #
 #

-#!/bin/sh
-
 # the two lines below are not just comments but required by rcorder; service -e
 # PROVIDE: vncserver
 # REQUIRE: NETWORKING SERVERS DAEMON ldconfig resolv
--- a/jails/config/hub/smb4.conf
+++ b/jails/config/hub/smb4.conf
@ -36,20 +36,20 @@
    sync always = no
    workgroup = HUBX_Group

-[stmp]
-        path = /tmp
-        directory mask = 0700
-        create mask = 0400
-        writeable = yes
-        valid users = p
+#[stmp]
+#        path = /tmp
+#        directory mask = 0700
+#        create mask = 0400
+#        writeable = yes
+#        valid users = p

-[usb]
-    path = /mnt/usb
-    read only = yes
-#    valid users = p
-    browseable = yes
-    dos filemode = yes
-    guest ok = yes
+#[usb]
+#    path = /mnt/usb
+#    read only = yes
+##    valid users = p
+#    browseable = yes
+#    dos filemode = yes
+#    guest ok = yes

 [sw]
    path = /mnt/sw
@ -57,6 +57,12 @@
    valid users = p
    browseable = yes

+[imax-4k]
+    path = /mnt/imax-4k
+    read only = yes
+    valid users = p
+    browseable = yes
+
 [movies-4k]
    path = /mnt/movies-4k
    read only = yes
@ -86,3 +92,15 @@
    read only = yes
    valid users = p
    browseable = yes
+
+[tor-trgs]
+    path = /mnt/tor-trgs
+    read only = yes
+    valid users = p
+    browseable = yes
+
+[conf]
+    path = /mnt/conf
+    read only = yes
+    valid users = p
+    browseable = yes
--- a/jails/config/hub/sshd_config
+++ b/jails/config/hub/sshd_config
@ -33,7 +33,7 @@
 # Authentication:

 #LoginGraceTime 2m
-PermitRootLogin yes
+PermitRootLogin no
 #StrictModes yes
 MaxAuthTries 2
 MaxSessions 2
@ -50,16 +50,16 @@ AuthorizedKeysFile	.ssh/authorized_keys
 #AuthorizedKeysCommandUser nobody

 # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
-#HostbasedAuthentication no
+HostbasedAuthentication no
 # Change to yes if you don't trust ~/.ssh/known_hosts for
 # HostbasedAuthentication
 #IgnoreUserKnownHosts no
 # Don't read the user's ~/.rhosts and ~/.shosts files
-#IgnoreRhosts yes
+IgnoreRhosts yes

 # Change to yes to enable built-in password authentication.
 PasswordAuthentication no
-#PermitEmptyPasswords no
+PermitEmptyPasswords no

 # Change to no to disable PAM authentication
 ChallengeResponseAuthentication no
@ -97,8 +97,8 @@ ChallengeResponseAuthentication no
 #TCPKeepAlive yes
 #PermitUserEnvironment no
 #Compression delayed
-#ClientAliveInterval 0
-#ClientAliveCountMax 3
+ClientAliveInterval 300
+ClientAliveCountMax 1
 #UseDNS yes
 #PidFile /var/run/sshd.pid
 #MaxStartups 10:30:100
@ -119,3 +119,5 @@ Subsystem	sftp	/usr/libexec/sftp-server
 #	AllowTcpForwarding no
 #	PermitTTY no
 #	ForceCommand cvs server
+
+AllowUsers p
--- a/jails/config/ibm/create_tuns.sh
+++ b/jails/config/ibm/create_tuns.sh
@ -1,3 +1,5 @@
+#!/bin/sh
+#
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,9 +8,6 @@
 #
 #

-#!/bin/sh
-#
-
 ifconfig tun181 create
 #ifconfig bridge1 addm tap181 up
 #ifconfig tap181 up
--- a/jails/config/ibm/ibm.sh
+++ b/jails/config/ibm/ibm.sh
@ -1,3 +1,5 @@
+#!/usr/local/bin/bash
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,7 +8,6 @@
 #
 #

-#!/usr/local/bin/bash
 # ./ibm.sh under tmux

 ifconfig tun186 create
--- a/jails/config/ibm/startemu.sh
+++ b/jails/config/ibm/startemu.sh
@ -1,3 +1,5 @@
+#!/bin/sh
+#
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,8 +8,6 @@
 #
 #

-#!/bin/sh
-#
 session="emu_tmux"

 # set up tmux
--- a/jails/config/plex/plexconnect
+++ b/jails/config/plex/plexconnect
@ -1,3 +1,5 @@
+#!/bin/sh
+#
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,8 +8,6 @@
 #
 #

-#!/bin/sh
-#
 # PROVIDE: plexconnect
 # REQUIRE: DAEMON
 # KEYWORD: shutdown
--- a/jails/config/test/.keep
+++ b/jails/config/test/.keep
--- a/jails/config/vm/create_taps.sh
+++ b/jails/config/vm/create_taps.sh
@ -1,3 +1,5 @@
+#!/bin/sh
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,9 +8,6 @@
 #
 #

-#!/bin/sh
-#
-
 ifconfig tap81 create
 ifconfig bridge1 addm tap81 up
 ifconfig tap81 up
--- a/jails/config/vm/freebsd.sh
+++ b/jails/config/vm/freebsd.sh
@ -1,3 +1,5 @@
+#!/usr/local/bin/bash
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,7 +8,6 @@
 #
 #

-#!/usr/local/bin/bash
 # ./freebsd.sh under tmux

 # clean cached state
--- a/jails/config/vm/pbx.sh
+++ b/jails/config/vm/pbx.sh
@ -1,3 +1,5 @@
+#!/usr/local/bin/bash
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,7 +8,6 @@
 #
 #

-#!/usr/local/bin/bash
 # ./pbx.sh under tmux

 # clean cached state
--- a/jails/config/vm/r-windows.sh
+++ b/jails/config/vm/r-windows.sh
@ -1,3 +1,5 @@
+#!/usr/local/bin/bash
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,7 +8,6 @@
 #
 #

-#!/usr/local/bin/bash
 # ./r-windows.sh under tmux

 # clean cached state
--- a/jails/config/vm/startvms.sh
+++ b/jails/config/vm/startvms.sh
@ -1,3 +1,5 @@
+#!/bin/sh
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,8 +8,6 @@
 #
 #

-#!/bin/sh
-#
 session="vm_tmux"

 # set up tmux
--- a/jails/config/vm/ubuntu.sh
+++ b/jails/config/vm/ubuntu.sh
@ -1,3 +1,5 @@
+#!/usr/local/bin/bash
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,7 +8,6 @@
 #
 #

-#!/usr/local/bin/bash
 # ./ubuntu.sh under tmux

 # clean cached state
--- a/jails/config/vm/w2019.sh
+++ b/jails/config/vm/w2019.sh
@ -1,3 +1,5 @@
+#!/usr/local/bin/bash
+
 # Copyright (c) 2018-2020, diyIT.org
 # All rights reserved.
 #
@ -6,7 +8,6 @@
 #
 #

-#!/usr/local/bin/bash
 # ./w2019.sh under tmux

 # clean cached state
--- a/jails/create.sh
+++ b/jails/create.sh
@ -99,6 +99,7 @@ iocage exec $JAIL "[ -f /mnt/config/nanorc ] && cp /mnt/config/nanorc /usr/local
 iocage exec $JAIL "cp -r /mnt/common/nano /usr/local/etc/"

 #iocage exec $JAIL "passwd root"
+iocage exec $JAIL "chsh -s /usr/sbin/nologin toor"
 iocage exec $JAIL "pw usermod -n root -s /usr/local/bin/bash -c jail-$JAIL"

 iocage exec $JAIL "[ -f /mnt/config/.bash_profile ] && cp /mnt/config/.bash_profile /root/ || cp /mnt/common/.bash_profile /root/"
--- a/jails/update.sh
+++ b/jails/update.sh
@ -27,7 +27,8 @@ update_jail ()
    iocage update $JAIL

    iocage exec $JAIL "pkg upgrade -f -y"
-    iocage exec $JAIL "mergemaster"
+    iocage exec $JAIL "rm -rf /var/tmp/temproot*"
+    iocage exec $JAIL "mergemaster -a"

    iocage exec $JAIL "freebsd-version"