Skip to content

Commit eaf1bdf

Browse files
author
Ernesto Nicolás Carrea
authored
CentOS/Fedora build script and related files (hestiacp#1360)
* CentOS/Fedora build script and related files * Fix use of use_src_folder * Check before delete, don't chown nonexistent postinst * Missing dependencies, don't be silent * Fix typo * Add config-manager in case it's missing
1 parent b4fabfc commit eaf1bdf

File tree

205 files changed

+14639
-327
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

205 files changed

+14639
-327
lines changed

install/rhel/bind/named.conf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
include "/etc/named.rfc1912.zones";
2+
include "/etc/named.root.key";
3+
include "/etc/named.conf.options";
Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
options {
2+
directory "/var/named";
3+
// If there is a firewall between you and nameservers you want
4+
// to talk to, you may need to fix the firewall to allow multiple
5+
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
6+
// If your ISP provided one or more IP addresses for stable
7+
// nameservers, you probably want to use them as forwarders.
8+
// Uncomment the following block, and insert the addresses replacing
9+
// the all-0's placeholder.
10+
// forwarders {
11+
// 0.0.0.0;
12+
// };
13+
//========================================================================
14+
// If BIND logs error messages about the root key being expired,
15+
// you will need to update your keys. See https://www.isc.org/bind-keys
16+
//========================================================================
17+
dnssec-validation auto;
18+
auth-nxdomain no;
19+
allow-recursion { 127.0.0.1; ::1; };
20+
allow-transfer {"none";};
21+
hostname none;
22+
server-id none;
23+
version none;
24+
};

install/rhel/clamav/clamd.conf

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#Automatically Generated by clamav-base postinst
2+
#To reconfigure clamd run #dpkg-reconfigure clamav-base
3+
#Please read /usr/share/doc/clamav-base/README.Debian.gz for details
4+
LocalSocket /var/run/clamav/clamd.ctl
5+
FixStaleSocket true
6+
LocalSocketGroup clamav
7+
LocalSocketMode 666
8+
# TemporaryDirectory is not set to its default /tmp here to make overriding
9+
# the default with environment variables TMPDIR/TMP/TEMP possible
10+
User clamav
11+
# AllowSupplementaryGroups true
12+
ScanMail true
13+
ScanArchive true
14+
ArchiveBlockEncrypted false
15+
MaxDirectoryRecursion 15
16+
FollowDirectorySymlinks false
17+
FollowFileSymlinks false
18+
ReadTimeout 180
19+
MaxThreads 12
20+
MaxConnectionQueueLength 15
21+
LogSyslog false
22+
LogFacility LOG_LOCAL6
23+
LogClean false
24+
LogVerbose true
25+
PidFile /var/run/clamav/clamd.pid
26+
DatabaseDirectory /var/lib/clamav
27+
SelfCheck 3600
28+
Foreground false
29+
Debug false
30+
ScanPE true
31+
ScanOLE2 true
32+
ScanHTML true
33+
ExitOnOOM false
34+
LeaveTemporaryFiles false
35+
AlgorithmicDetection true
36+
ScanELF true
37+
IdleTimeout 30
38+
PhishingSignatures true
39+
PhishingScanURLs true
40+
PhishingAlwaysBlockSSLMismatch false
41+
PhishingAlwaysBlockCloak false
42+
DetectPUA false
43+
ScanPartialMessages false
44+
HeuristicScanPrecedence false
45+
StructuredDataDetection false
46+
CommandReadTimeout 5
47+
SendBufTimeout 200
48+
MaxQueue 100
49+
ExtendedDetectionInfo true
50+
OLE2BlockMacros false
51+
StreamMaxLength 25M
52+
LogFile /var/log/clamav/clamav.log
53+
LogTime true
54+
LogFileUnlock false
55+
LogFileMaxSize 0
56+
Bytecode true
57+
BytecodeSecurity TrustSigned
58+
BytecodeTimeout 60000
59+
OfficialDatabaseOnly false
60+
CrossFilesystems true

install/rhel/clamav/clamd.service

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[Unit]
2+
Description = clamd scanner (%i) daemon
3+
After = syslog.target nss-lookup.target network.target
4+
5+
[Service]
6+
Type = simple
7+
ExecStartPre = /usr/bin/mkdir -p /var/run/clamav
8+
ExecStartPre = /usr/bin/chown -R clamav:clamav /var/run/clamav
9+
ExecStart = /usr/sbin/clamd -c /etc/clamd.conf
10+
Restart = on-failure
11+
PrivateTmp = true
12+
13+
[Install]
14+
WantedBy=multi-user.target

install/rhel/clamav/freshclam.conf

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
##
2+
## Example config file for freshclam
3+
## Please read the freshclam.conf(5) manual before editing this file.
4+
##
5+
6+
7+
# Comment or remove the line below.
8+
#Example
9+
10+
# Path to the database directory.
11+
# WARNING: It must match clamd.conf's directive!
12+
# Default: hardcoded (depends on installation options)
13+
#DatabaseDirectory /var/lib/clamav
14+
15+
# Path to the log file (make sure it has proper permissions)
16+
# Default: disabled
17+
#UpdateLogFile /var/log/freshclam.log
18+
19+
# Maximum size of the log file.
20+
# Value of 0 disables the limit.
21+
# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
22+
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes).
23+
# in bytes just don't use modifiers. If LogFileMaxSize is enabled,
24+
# log rotation (the LogRotate option) will always be enabled.
25+
# Default: 1M
26+
#LogFileMaxSize 2M
27+
28+
# Log time with each message.
29+
# Default: no
30+
#LogTime yes
31+
32+
# Enable verbose logging.
33+
# Default: no
34+
#LogVerbose yes
35+
36+
# Use system logger (can work together with UpdateLogFile).
37+
# Default: no
38+
#LogSyslog yes
39+
40+
# Specify the type of syslog messages - please refer to 'man syslog'
41+
# for facility names.
42+
# Default: LOG_LOCAL6
43+
#LogFacility LOG_MAIL
44+
45+
# Enable log rotation. Always enabled when LogFileMaxSize is enabled.
46+
# Default: no
47+
#LogRotate yes
48+
49+
# This option allows you to save the process identifier of the daemon
50+
# Default: disabled
51+
#PidFile /var/run/freshclam.pid
52+
53+
# By default when started freshclam drops privileges and switches to the
54+
# "clamav" user. This directive allows you to change the database owner.
55+
# Default: clamav (may depend on installation options)
56+
DatabaseOwner clamav
57+
58+
# Use DNS to verify virus database version. Freshclam uses DNS TXT records
59+
# to verify database and software versions. With this directive you can change
60+
# the database verification domain.
61+
# WARNING: Do not touch it unless you're configuring freshclam to use your
62+
# own database verification domain.
63+
# Default: current.cvd.clamav.net
64+
#DNSDatabaseInfo current.cvd.clamav.net
65+
66+
# database.clamav.net is now the primary domain name to be used world-wide.
67+
# Now that CloudFlare is being used as our Content Delivery Network (CDN),
68+
# this one domain name works world-wide to direct freshclam to the closest
69+
# geographic endpoint.
70+
# If the old db.XY.clamav.net domains are set, freshclam will automatically
71+
# use database.clamav.net instead.
72+
DatabaseMirror database.clamav.net
73+
74+
# How many attempts to make before giving up.
75+
# Default: 3 (per mirror)
76+
#MaxAttempts 5
77+
78+
# With this option you can control scripted updates. It's highly recommended
79+
# to keep it enabled.
80+
# Default: yes
81+
#ScriptedUpdates yes
82+
83+
# By default freshclam will keep the local databases (.cld) uncompressed to
84+
# make their handling faster. With this option you can enable the compression;
85+
# the change will take effect with the next database update.
86+
# Default: no
87+
#CompressLocalDatabase no
88+
89+
# With this option you can provide custom sources for database files.
90+
# This option can be used multiple times. Support for:
91+
# http(s)://, ftp(s)://, or file://
92+
# Default: no custom URLs
93+
#DatabaseCustomURL http://myserver.example.com/mysigs.ndb
94+
#DatabaseCustomURL https://myserver.example.com/mysigs.ndb
95+
#DatabaseCustomURL https://myserver.example.com:4567/whitelist.wdb
96+
#DatabaseCustomURL ftp://myserver.example.com/example.ldb
97+
#DatabaseCustomURL ftps://myserver.example.com:4567/example.ndb
98+
#DatabaseCustomURL file:///mnt/nfs/local.hdb
99+
100+
# This option allows you to easily point freshclam to private mirrors.
101+
# If PrivateMirror is set, freshclam does not attempt to use DNS
102+
# to determine whether its databases are out-of-date, instead it will
103+
# use the If-Modified-Since request or directly check the headers of the
104+
# remote database files. For each database, freshclam first attempts
105+
# to download the CLD file. If that fails, it tries to download the
106+
# CVD file. This option overrides DatabaseMirror, DNSDatabaseInfo
107+
# and ScriptedUpdates. It can be used multiple times to provide
108+
# fall-back mirrors.
109+
# Default: disabled
110+
#PrivateMirror mirror1.example.com
111+
#PrivateMirror mirror2.example.com
112+
113+
# Number of database checks per day.
114+
# Default: 12 (every two hours)
115+
#Checks 24
116+
117+
# Proxy settings
118+
# The HTTPProxyServer may be prefixed with [scheme]:// to specify which kind
119+
# of proxy is used.
120+
# http:// HTTP Proxy. Default when no scheme or proxy type is specified.
121+
# https:// HTTPS Proxy. (Added in 7.52.0 for OpenSSL, GnuTLS and NSS)
122+
# socks4:// SOCKS4 Proxy.
123+
# socks4a:// SOCKS4a Proxy. Proxy resolves URL hostname.
124+
# socks5:// SOCKS5 Proxy.
125+
# socks5h:// SOCKS5 Proxy. Proxy resolves URL hostname.
126+
# Default: disabled
127+
#HTTPProxyServer https://proxy.example.com
128+
#HTTPProxyPort 1234
129+
#HTTPProxyUsername myusername
130+
#HTTPProxyPassword mypass
131+
132+
# If your servers are behind a firewall/proxy which applies User-Agent
133+
# filtering you can use this option to force the use of a different
134+
# User-Agent header.
135+
# Default: clamav/version_number
136+
#HTTPUserAgent SomeUserAgentIdString
137+
138+
# Use aaa.bbb.ccc.ddd as client address for downloading databases. Useful for
139+
# multi-homed systems.
140+
# Default: Use OS'es default outgoing IP address.
141+
#LocalIPAddress aaa.bbb.ccc.ddd
142+
143+
# Send the RELOAD command to clamd.
144+
# Default: no
145+
#NotifyClamd /path/to/clamd.conf
146+
147+
# Run command after successful database update.
148+
# Default: disabled
149+
#OnUpdateExecute command
150+
151+
# Run command when database update process fails.
152+
# Default: disabled
153+
#OnErrorExecute command
154+
155+
# Run command when freshclam reports outdated version.
156+
# In the command string %v will be replaced by the new version number.
157+
# Default: disabled
158+
#OnOutdatedExecute command
159+
160+
# Don't fork into background.
161+
# Default: no
162+
#Foreground yes
163+
164+
# Enable debug messages in libclamav.
165+
# Default: no
166+
#Debug yes
167+
168+
# Timeout in seconds when connecting to database server.
169+
# Default: 30
170+
#ConnectTimeout 60
171+
172+
# Timeout in seconds when reading from database server.
173+
# Default: 0
174+
#ReceiveTimeout 1800
175+
176+
# With this option enabled, freshclam will attempt to load new
177+
# databases into memory to make sure they are properly handled
178+
# by libclamav before replacing the old ones.
179+
# Default: yes
180+
#TestDatabases yes
181+
182+
# This option enables support for Google Safe Browsing. When activated for
183+
# the first time, freshclam will download a new database file
184+
# (safebrowsing.cvd) which will be automatically loaded by clamd and
185+
# clamscan during the next reload, provided that the heuristic phishing
186+
# detection is turned on. This database includes information about websites
187+
# that may be phishing sites or possible sources of malware. When using this
188+
# option, it's mandatory to run freshclam at least every 30 minutes.
189+
# Freshclam uses the ClamAV's mirror infrastructure to distribute the
190+
# database and its updates but all the contents are provided under Google's
191+
# terms of use.
192+
# See https://transparencyreport.google.com/safe-browsing/overview
193+
# and https://www.clamav.net/documents/safebrowsing for more information.
194+
# Default: no
195+
#SafeBrowsing yes
196+
197+
# This option enables downloading of bytecode.cvd, which includes additional
198+
# detection mechanisms and improvements to the ClamAV engine.
199+
# Default: yes
200+
#Bytecode no
201+
202+
# Include an optional signature databases (opt-in).
203+
# This option can be used multiple times.
204+
#ExtraDatabase dbname1
205+
#ExtraDatabase dbname2
206+
207+
# Exclude a standard signature database (opt-out).
208+
# This option can be used multiple times.
209+
#ExcludeDatabase dbname1
210+
#ExcludeDatabase dbname2
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
disable_plaintext_auth = no
2+
auth_username_format = %u
3+
auth_verbose = yes
4+
auth_mechanisms = plain login
5+
!include auth-passwdfile.conf.ext
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
log_path = /var/log/dovecot.log
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
mail_privileged_group = mail
2+
mail_access_groups = mail
3+
mail_location = maildir:%h/mail/%d/%n
4+
pop3_uidl_format = %08Xu%08Xv
5+
6+
mailbox_list_index = yes
7+
mailbox_idle_check_interval = 30 secs
8+
maildir_copy_with_hardlinks = yes
Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
service imap-login {
2+
inet_listener imap {
3+
}
4+
inet_listener imaps {
5+
}
6+
}
7+
8+
service pop3-login {
9+
inet_listener pop3 {
10+
}
11+
inet_listener pop3s {
12+
}
13+
}
14+
15+
16+
service imap {
17+
}
18+
19+
service pop3 {
20+
}
21+
22+
service auth {
23+
unix_listener auth-client {
24+
group = mail
25+
mode = 0660
26+
user = dovecot
27+
}
28+
user = dovecot
29+
}
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
ssl = yes
2+
#ssl_protocols = !SSLv3 !TLSv1
3+
ssl_prefer_server_ciphers = yes
4+
ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
5+
6+
ssl_cert = </usr/local/hestia/ssl/certificate.crt
7+
ssl_key = </usr/local/hestia/ssl/certificate.key
8+
9+
# From and up to version 2.2
10+
#ssl_dh_parameters_length = 4096
11+
12+
# From version 2.3
13+
#ssl_dh = </etc/ssl/dhparam.pem

0 commit comments

Comments
 (0)