303 lines
11 KiB
Bash
Executable file
303 lines
11 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# ============================================================
|
|
# BastionGuard Universal Setup Script
|
|
# - Configura loopback + DNS cross-distro
|
|
# - Aggiorna /etc/hosts (safe, non distruttivo)
|
|
# - Installa/abilita Nginx proxy per LocalWarningServer
|
|
#
|
|
# UPDATE (dnsmasq su 127.0.0.1:53 senza stravolgere nulla):
|
|
# - Se systemd-resolved è attivo:
|
|
# * Imposta DNS=127.0.0.1 (upstream verso dnsmasq)
|
|
# * Mantiene lo stub su 127.0.0.53:53 (NON lo disabilita)
|
|
# * Assicura che /etc/resolv.conf punti allo stub (127.0.0.53),
|
|
# così le app continuano ad usare resolved e resolved inoltra a dnsmasq.
|
|
# - Se NM/altro: fallback non distruttivo su resolv.conf append.
|
|
# ============================================================
|
|
|
|
set -euo pipefail
|
|
export XDG_RUNTIME_DIR="/run/user/0"
|
|
export DBUS_SESSION_BUS_ADDRESS="unix:path=/run/dbus/system_bus_socket"
|
|
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH"
|
|
|
|
echo "🧠 [BastionGuard Setup] Avvio configurazione universale..."
|
|
DISTRO_ID=$(grep -E '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"')
|
|
DISTRO_LIKE=$(grep -E '^ID_LIKE=' /etc/os-release | cut -d= -f2 | tr -d '"' || true)
|
|
|
|
detect_netmgr() {
|
|
if systemctl is-active --quiet NetworkManager 2>/dev/null; then
|
|
echo "NetworkManager"
|
|
elif systemctl is-active --quiet systemd-networkd 2>/dev/null; then
|
|
echo "systemd-networkd"
|
|
elif pgrep -x connmand >/dev/null 2>&1; then
|
|
echo "connman"
|
|
elif [ -d /etc/netplan ]; then
|
|
echo "netplan"
|
|
elif [ -f /etc/network/interfaces ]; then
|
|
echo "ifupdown"
|
|
else
|
|
echo "unknown"
|
|
fi
|
|
}
|
|
|
|
NETMGR=$(detect_netmgr)
|
|
echo "➡ Gestore rete rilevato: $NETMGR"
|
|
|
|
# ============================================================
|
|
# STEP 1: ensure loopback 127.0.0.1
|
|
# ============================================================
|
|
echo "🧱 [Step 1] Verifica loopback 127.0.0.1..."
|
|
if ! ip addr show dev lo | grep -q "127\.0\.0\.1"; then
|
|
ip addr add 127.0.0.1/8 dev lo || true
|
|
echo "✅ 127.0.0.1 aggiunto a loopback."
|
|
else
|
|
echo "ℹ️ 127.0.0.1 già presente."
|
|
fi
|
|
ip link set lo up
|
|
|
|
# ============================================================
|
|
# STEP 2: DNS 127.0.0.1 (cross-distro, non distruttivo)
|
|
# - Obiettivo: far sì che il sistema risolva tramite dnsmasq (127.0.0.1:53)
|
|
# - Con systemd-resolved: resolved -> dnsmasq; app -> stub 127.0.0.53
|
|
# ============================================================
|
|
echo "🌐 [Step 2] Configurazione DNS locale (safe, non distruttiva)..."
|
|
|
|
dns_report() {
|
|
echo "🔎 [DNS report]"
|
|
echo "- /etc/resolv.conf -> $(readlink -f /etc/resolv.conf 2>/dev/null || echo /etc/resolv.conf)"
|
|
echo "- nameserver attuali:"
|
|
grep -E '^\s*nameserver\s+' /etc/resolv.conf 2>/dev/null || echo " (nessuno trovato in /etc/resolv.conf)"
|
|
if command -v resolvectl >/dev/null 2>&1; then
|
|
echo "- resolvectl status (estratto):"
|
|
resolvectl status 2>/dev/null | sed -n '1,120p' || true
|
|
fi
|
|
echo "- systemd-resolved: $(systemctl is-active systemd-resolved 2>/dev/null || echo unknown)"
|
|
echo "- NetworkManager: $(systemctl is-active NetworkManager 2>/dev/null || echo unknown)"
|
|
echo "- connman: $(pgrep -x connmand >/dev/null 2>&1 && echo active || echo inactive)"
|
|
}
|
|
|
|
append_nameserver_resolvconf() {
|
|
local rc="/etc/resolv.conf"
|
|
[ -e "$rc" ] || touch "$rc"
|
|
|
|
if grep -Eq '^\s*nameserver\s+127\.0\.0\.1\s*$' "$rc"; then
|
|
echo "ℹ️ nameserver 127.0.0.1 già presente in $rc"
|
|
else
|
|
echo "nameserver 127.0.0.1" >> "$rc"
|
|
echo "✅ Aggiunto nameserver 127.0.0.1 in $rc"
|
|
fi
|
|
}
|
|
|
|
# systemd-resolved: imposta upstream DNS=127.0.0.1 senza disabilitare lo stub
|
|
ensure_resolved_dns() {
|
|
local conf="/etc/systemd/resolved.conf"
|
|
[ -f "$conf" ] || touch "$conf"
|
|
|
|
if ! grep -Eq '^\s*\[Resolve\]\s*$' "$conf"; then
|
|
echo -e "\n[Resolve]" >> "$conf"
|
|
fi
|
|
|
|
# aggiunge 127.0.0.1 alla riga DNS=, o la crea in [Resolve]
|
|
if grep -Eq '^\s*DNS=' "$conf"; then
|
|
if grep -Eq '^\s*DNS=.*\b127\.0\.0\.1\b' "$conf"; then
|
|
echo "ℹ️ systemd-resolved: DNS già include 127.0.0.1 in $conf"
|
|
else
|
|
sed -i -E '0,/^\s*DNS=/{s/^\s*DNS=(.*)$/DNS=\1 127.0.0.1/}' "$conf"
|
|
echo "✅ systemd-resolved: aggiunto 127.0.0.1 alla riga DNS= in $conf"
|
|
fi
|
|
else
|
|
sed -i -E '0,/^\s*\[Resolve\]\s*$/{s/^\s*\[Resolve\]\s*$/[Resolve]\nDNS=127.0.0.1/}' "$conf"
|
|
echo "✅ systemd-resolved: aggiunto DNS=127.0.0.1 in $conf"
|
|
fi
|
|
|
|
systemctl restart systemd-resolved || true
|
|
}
|
|
|
|
# Assicura che /etc/resolv.conf punti allo stub di systemd-resolved (127.0.0.53)
|
|
ensure_resolvconf_stub() {
|
|
local stub="/run/systemd/resolve/stub-resolv.conf"
|
|
if [ -f "$stub" ]; then
|
|
local cur
|
|
cur="$(readlink -f /etc/resolv.conf 2>/dev/null || echo /etc/resolv.conf)"
|
|
if [ "$cur" = "$stub" ]; then
|
|
echo "ℹ️ /etc/resolv.conf già punta a stub-resolv.conf"
|
|
return 0
|
|
fi
|
|
|
|
# se è symlink, la rimpiazzo. se è file normale, faccio backup e poi link.
|
|
if [ -L /etc/resolv.conf ]; then
|
|
ln -sf "$stub" /etc/resolv.conf
|
|
echo "✅ /etc/resolv.conf -> $stub (symlink aggiornato)"
|
|
else
|
|
cp -a /etc/resolv.conf "/etc/resolv.conf.bak.$(date +%Y%m%d%H%M%S)" || true
|
|
ln -sf "$stub" /etc/resolv.conf
|
|
echo "✅ /etc/resolv.conf -> $stub (backup creato, symlink impostato)"
|
|
fi
|
|
else
|
|
echo "⚠️ stub-resolv.conf non trovato ($stub). Lascio /etc/resolv.conf invariato."
|
|
fi
|
|
}
|
|
|
|
dns_report
|
|
|
|
if systemctl is-active --quiet systemd-resolved 2>/dev/null; then
|
|
echo "➡ systemd-resolved attivo: imposto upstream DNS=127.0.0.1 (dnsmasq) e mantengo stub 127.0.0.53."
|
|
ensure_resolved_dns
|
|
ensure_resolvconf_stub
|
|
elif systemctl is-active --quiet NetworkManager 2>/dev/null; then
|
|
echo "➡ NetworkManager attivo: imposto dns 127.0.0.1 senza toccare resolv.conf."
|
|
CONN=$(nmcli -t -f NAME,DEVICE connection show --active | head -n1 | cut -d: -f1 || true)
|
|
if [ -n "${CONN:-}" ]; then
|
|
CUR_DNS=$(nmcli -g ipv4.dns connection show "$CONN" 2>/dev/null | tr -d '\n' || true)
|
|
if echo "$CUR_DNS" | grep -qw "127.0.0.1"; then
|
|
echo "ℹ️ NM: 127.0.0.1 già presente per $CONN"
|
|
else
|
|
if [ -n "$CUR_DNS" ]; then
|
|
nmcli connection modify "$CONN" ipv4.dns "$CUR_DNS,127.0.0.1"
|
|
else
|
|
nmcli connection modify "$CONN" ipv4.dns "127.0.0.1"
|
|
fi
|
|
nmcli connection up "$CONN" || true
|
|
echo "✅ NM: aggiunto 127.0.0.1 ai DNS di $CONN"
|
|
fi
|
|
else
|
|
echo "⚠️ Nessuna connessione NM attiva trovata; fallback resolv.conf (append)."
|
|
append_nameserver_resolvconf
|
|
fi
|
|
elif pgrep -x connmand >/dev/null 2>&1; then
|
|
echo "➡ ConnMan attivo: fallback prudente su resolv.conf (append)."
|
|
append_nameserver_resolvconf
|
|
else
|
|
echo "➡ Nessun gestore DNS riconosciuto: fallback resolv.conf (append)."
|
|
append_nameserver_resolvconf
|
|
fi
|
|
|
|
echo "🔎 [DNS post-check]"
|
|
dns_report
|
|
|
|
# ============================================================
|
|
# STEP 2.5: /etc/hosts (non distruttivo)
|
|
# Richieste:
|
|
# - 127.0.0.2 localhost
|
|
# - 127.0.0.1 bastionguard.local
|
|
# - 127.0.0.2 warning.BastionGuard.local
|
|
# ============================================================
|
|
echo "🧾 [Step 2.5] Aggiornamento /etc/hosts (safe, non distruttivo)..."
|
|
|
|
ensure_hosts_entry() {
|
|
local ip="$1"
|
|
local name="$2"
|
|
local hosts="/etc/hosts"
|
|
|
|
[ -f "$hosts" ] || touch "$hosts"
|
|
|
|
# Se il nome è già presente (anche su IP diverso), non duplico
|
|
if grep -Eq "^[[:space:]]*[^#]*\b${name}\b" "$hosts"; then
|
|
echo "ℹ️ /etc/hosts: '${name}' già presente, salto."
|
|
return 0
|
|
fi
|
|
|
|
printf "%s\t%s\n" "$ip" "$name" >> "$hosts"
|
|
echo "✅ Aggiunto: ${ip} ${name}"
|
|
}
|
|
|
|
ensure_hosts_entry "127.0.0.2" "localhost"
|
|
ensure_hosts_entry "127.0.0.1" "bastionguard.local"
|
|
ensure_hosts_entry "127.0.0.2" "warning.BastionGuard.local"
|
|
|
|
echo "🔎 [hosts check]"
|
|
tail -n 25 /etc/hosts || true
|
|
|
|
# ============================================================
|
|
# STEP 3: Install or enable nginx
|
|
# ============================================================
|
|
echo "🧩 [Step 3] Configurazione NGINX..."
|
|
|
|
install_nginx() {
|
|
echo "🔍 Verifico Nginx..."
|
|
if command -v nginx >/dev/null 2>&1; then
|
|
echo "✅ Nginx già installato."
|
|
else
|
|
echo "⬇️ Installazione Nginx..."
|
|
if [[ "$DISTRO_ID" == "arch" || "$DISTRO_LIKE" == *"arch"* ]]; then
|
|
pacman -S --noconfirm nginx
|
|
elif [[ "$DISTRO_ID" == "fedora" || "$DISTRO_LIKE" == *"rhel"* ]]; then
|
|
dnf install -y nginx
|
|
elif [[ "$DISTRO_ID" == "debian" || "$DISTRO_LIKE" == *"debian"* || "$DISTRO_LIKE" == *"ubuntu"* ]]; then
|
|
apt update -y && apt install -y nginx
|
|
elif [[ "$DISTRO_ID" == "opensuse"* ]]; then
|
|
zypper install -y nginx
|
|
else
|
|
echo "⚠️ Distribuzione non riconosciuta, installa manualmente nginx."
|
|
fi
|
|
fi
|
|
}
|
|
|
|
install_nginx
|
|
|
|
if nginx -t; then
|
|
systemctl enable --now nginx
|
|
systemctl reload nginx
|
|
echo "✅ Nginx configurato e attivo."
|
|
else
|
|
echo "❌ Errore nella configurazione nginx."
|
|
nginx -t || true
|
|
fi
|
|
|
|
# ============================================================
|
|
# STEP 4: Report
|
|
# ============================================================
|
|
echo
|
|
echo "📋 [Report finale]"
|
|
echo "Gestore rete: $NETMGR"
|
|
echo "Distribuzione: $DISTRO_ID ($DISTRO_LIKE)"
|
|
echo
|
|
echo "🔹 Loopback:"
|
|
ip addr show dev lo | grep 127 || true
|
|
echo
|
|
echo "🔹 DNS attuale:"
|
|
grep -E '^\s*nameserver\s+' /etc/resolv.conf || echo "(nessuno trovato)"
|
|
echo
|
|
echo "🔹 /etc/hosts (estratto):"
|
|
tail -n 25 /etc/hosts || true
|
|
echo
|
|
echo "🔹 Nginx listener:"
|
|
ss -ltnp | grep -E "127\.0\.0\.2:80|127\.0\.0\.2:443" || echo "(nessun listener trovato)"
|
|
echo
|
|
echo "🔹 Proxy test rapido:"
|
|
curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1/ || true
|
|
echo
|
|
echo "✅ Setup completo BastionGuard (rete + dns + hosts + nginx)"
|
|
|
|
# ============================================================
|
|
# STEP 5: Riavvio servizi
|
|
# ============================================================
|
|
echo "🔄 [Step 5] Riavvio dei servizi di rete e proxy..."
|
|
|
|
if systemctl is-active --quiet NetworkManager 2>/dev/null; then
|
|
echo "🔁 Riavvio NetworkManager..."
|
|
systemctl restart NetworkManager || true
|
|
elif systemctl is-active --quiet systemd-networkd 2>/dev/null; then
|
|
echo "🔁 Riavvio systemd-networkd..."
|
|
systemctl restart systemd-networkd || true
|
|
fi
|
|
|
|
if systemctl is-active --quiet systemd-resolved 2>/dev/null; then
|
|
echo "🔁 Riavvio systemd-resolved..."
|
|
systemctl restart systemd-resolved || true
|
|
fi
|
|
|
|
if systemctl is-active --quiet nginx 2>/dev/null; then
|
|
echo "🔁 Riavvio nginx..."
|
|
systemctl reload nginx || systemctl restart nginx || true
|
|
fi
|
|
|
|
echo "✅ Tutti i servizi rilevanti sono stati riavviati."
|
|
|
|
# ============================================================
|
|
# NOTE OPERATIVE
|
|
# - Questo script NON installa/configura dnsmasq: lo fa il wizard.
|
|
# - Per usare dnsmasq su 127.0.0.1:53 con systemd-resolved attivo:
|
|
# * le app -> 127.0.0.53 (stub)
|
|
# * resolved -> 127.0.0.1 (dnsmasq)
|
|
# - Se dnsmasq non è attivo/porta 53 occupata, la risoluzione può fallire.
|
|
# ============================================================
|