Robert
2 years ago
parent
1412fd6a41
commit
ece03017fa
@ -0,0 +1,72 @@ |
||||
<?php |
||||
Configure::set('display', true); // Show Output |
||||
Configure::set('logfile', false); // Save to log folder |
||||
Configure::set('syslog', false); |
||||
|
||||
Configure::set('pre_actions', [ |
||||
'make_dir' => ['/etc/containers'=>''], |
||||
'chmod_file_or_dir' => |
||||
['/etc/containers' => 'dir'], |
||||
]); |
||||
|
||||
force_root(); |
||||
|
||||
file_loop(Configure::get('pre_actions')); |
||||
|
||||
$is_podman_installed = do_command('is_installed', "podman"); |
||||
if ($is_podman_installed['installed'] === false) { |
||||
do_command('install', "software-properties-common"); |
||||
//do_command("add_repo", "ppa:projectatomic/ppa"); |
||||
do_command('update'); |
||||
do_command('install', "podman"); |
||||
} |
||||
|
||||
$policy = ' |
||||
{ |
||||
"default": [ |
||||
{ |
||||
"type": "insecureAcceptAnything" |
||||
} |
||||
], |
||||
"transports": |
||||
{ |
||||
"docker-daemon": |
||||
{ |
||||
"": [{"type":"insecureAcceptAnything"}] |
||||
} |
||||
} |
||||
}'; |
||||
if (! file_exists("/etc/containers/policy.json")) { |
||||
append_to_file("/etc/containers/policy.json", $policy); |
||||
chmod_file_or_dir("/etc/containers/policy.json", "config"); |
||||
} |
||||
|
||||
$reg = "# This is a system-wide configuration file used to |
||||
# keep track of registries for various container backends. |
||||
# It adheres to TOML format and does not support recursive |
||||
# lists of registries. |
||||
|
||||
# The default location for this configuration file is /etc/containers/registries.conf. |
||||
|
||||
# The only valid categories are: 'registries.search', 'registries.insecure', |
||||
# and 'registries.block'. |
||||
|
||||
[registries.search] |
||||
registries = ['docker.io', 'registry.fedoraproject.org', 'registry.access.redhat.com'] |
||||
|
||||
# If you need to access insecure registries, add the registry's fully-qualified name. |
||||
# An insecure registry is one that does not have a valid SSL certificate or only does HTTP. |
||||
[registries.insecure] |
||||
registries = [] |
||||
|
||||
|
||||
# If you need to block pull access from a registry, uncomment the section below |
||||
# and add the registries fully-qualified name. |
||||
# |
||||
# Docker only |
||||
[registries.block] |
||||
registries = []"; |
||||
if (! file_exists("/etc/containers/registries.conf")) { |
||||
append_to_file("/etc/containers/registries.conf", $reg); |
||||
chmod_file_or_dir("/etc/containers/registries.conf", "config"); |
||||
} |
||||
@ -1,6 +0,0 @@ |
||||
<VirtualHost *:80> |
||||
Include /etc/apache2/sites/allsites.conf |
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/error.log |
||||
CustomLog ${APACHE_LOG_DIR}/access.log combined |
||||
</VirtualHost> |
||||
@ -1,9 +0,0 @@ |
||||
ServerName dev |
||||
ServerAlias prod |
||||
|
||||
ServerAdmin fake@localhost |
||||
Alias /www /var/www/html |
||||
Alias /tests /var/www/tests |
||||
|
||||
DocumentRoot /var/www/toolz |
||||
|
||||
@ -1,36 +0,0 @@ |
||||
<IfModule mod_ssl.c> |
||||
<VirtualHost _default_:443> |
||||
ServerAdmin webmaster@localhost |
||||
|
||||
Include /etc/apache2/sites/allsites.conf |
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/error.log |
||||
CustomLog ${APACHE_LOG_DIR}/access.log combined |
||||
|
||||
SSLEngine on |
||||
|
||||
SSLCertificateFile /etc/ssl/certs/mainsite.crt |
||||
SSLCertificateKeyFile /etc/ssl/private/mainsite.key |
||||
SSLCACertificateFile /etc/apache2/ssl/mainsite_bundle.crt |
||||
|
||||
|
||||
#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt |
||||
#SSLCACertificatePath /etc/ssl/certs/ |
||||
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt |
||||
|
||||
#SSLCARevocationPath /etc/apache2/ssl.crl/ |
||||
#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl |
||||
|
||||
#SSLVerifyClient require |
||||
#SSLVerifyDepth 10 |
||||
|
||||
<FilesMatch "\.(cgi|shtml|phtml|php)$"> |
||||
SSLOptions +StdEnvVars |
||||
</FilesMatch> |
||||
<Directory /usr/lib/cgi-bin> |
||||
SSLOptions +StdEnvVars |
||||
</Directory> |
||||
</VirtualHost> |
||||
</IfModule> |
||||
|
||||
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet |
||||
@ -1,87 +0,0 @@ |
||||
LimitRequestBody 204800 |
||||
ServerTokens Prod |
||||
ServerSignature Off |
||||
TraceEnable Off |
||||
MaxClients 150 |
||||
TimeOut 200 |
||||
KeepAliveTimeout 3 |
||||
LimitRequestFields 60 |
||||
LimitRequestFieldSize 4094 |
||||
|
||||
Options -Includes |
||||
Options -ExecCGI |
||||
#Options -FollowSymLinks |
||||
|
||||
HostnameLookups off |
||||
|
||||
# <LimitExcept POST GET PUT UPDATE DELETE> |
||||
# deny from all |
||||
# </LimitExcept> |
||||
|
||||
RewriteEngine ON |
||||
RewriteCond %{THE_REQUEST} !HTTP/1.1$ |
||||
RewriteRule .* - [F] |
||||
|
||||
# Forbid access to version control directories |
||||
# |
||||
# If you use version control systems in your document root, you should |
||||
# probably deny access to their directories. For example, for GIT: |
||||
# |
||||
<DirectoryMatch "^/.*/\.git"> |
||||
Order deny,allow |
||||
Deny from all |
||||
</DirectoryMatch> |
||||
|
||||
<FilesMatch "php_error_log"> |
||||
Order deny,allow |
||||
Deny from all |
||||
</FilesMatch> |
||||
|
||||
<Location /server-status> |
||||
SetHandler server-status |
||||
#AuthType basic |
||||
#AuthName "Apache status" |
||||
#AuthUserFile /etc/apache2/conf/server-status_htpasswd |
||||
#Require valid-user |
||||
Order deny,allow |
||||
Deny from all |
||||
Allow from none |
||||
</Location> |
||||
|
||||
# |
||||
# Setting this header will prevent MSIE from interpreting files as something |
||||
# else than declared by the content type in the HTTP headers. |
||||
# Requires mod_headers to be enabled. |
||||
# |
||||
#Header set X-Content-Type-Options: "nosniff" |
||||
|
||||
# |
||||
# Setting this header will prevent other sites from embedding pages from this |
||||
# site as frames. This defends against clickjacking attacks. |
||||
# Requires mod_headers to be enabled. |
||||
# |
||||
#Header set X-Frame-Options: "sameorigin" |
||||
|
||||
ExtendedStatus Off |
||||
Header unset ETag |
||||
Header always unset X-Powered-By |
||||
FileETag None |
||||
|
||||
Header always append X-Frame-Options SAMEORIGIN |
||||
#Header set X-XSS-Protection "1; mode=block" |
||||
|
||||
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure |
||||
|
||||
Header set Feature-Policy: "geolocation 'none'; microphone 'none'; camera 'self';" |
||||
Header set Referer-Policy: "strict-origin" |
||||
|
||||
SSLProtocol -ALL +TLSv1.2 |
||||
# +TLSv1.3 |
||||
SSLOpenSSLConfCmd Protocol "-ALL, TLSv1.2" |
||||
# , TLSv1.3 |
||||
|
||||
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM |
||||
|
||||
Header set Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload;" |
||||
|
||||
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet |
||||
@ -1,4 +0,0 @@ |
||||
APT::Periodic::Update-Package-Lists "1"; |
||||
APT::Periodic::Download-Upgradeable-Packages "1"; |
||||
APT::Periodic::AutocleanInterval "7"; |
||||
APT::Periodic::Unattended-Upgrade "1"; |
||||
@ -1,58 +0,0 @@ |
||||
#!/bin/bash |
||||
|
||||
CERT_HOSTNAME=10.32.0.1,<controller node 1 Private IP>,<controller node 1 hostname>,<controller node 2 Private IP>,<controller node 2 hostname>,<API load balancer Private IP>,<API load balancer hostname>,127.0.0.1,localhost,kubernetes.default |
||||
|
||||
cd ~/kthw |
||||
|
||||
cat > kubernetes-csr.json << EOF |
||||
{ |
||||
"CN": "kubernetes", |
||||
"key": { |
||||
"algo": "rsa", |
||||
"size": 2048 |
||||
}, |
||||
"names": [ |
||||
{ |
||||
"C": "US", |
||||
"L": "Flint", |
||||
"O": "Kubernetes", |
||||
"OU": "Kubernetes The Hard Way", |
||||
"ST": "Michigan" |
||||
} |
||||
] |
||||
} |
||||
EOF |
||||
|
||||
cfssl gencert \ |
||||
-ca=ca.pem \ |
||||
-ca-key=ca-key.pem \ |
||||
-config=ca-config.json \ |
||||
-hostname=${CERT_HOSTNAME} \ |
||||
-profile=kubernetes \ |
||||
kubernetes-csr.json | cfssljson -bare kubernetes |
||||
|
||||
cat > service-account-csr.json << EOF |
||||
{ |
||||
"CN": "service-accounts", |
||||
"key": { |
||||
"algo": "rsa", |
||||
"size": 2048 |
||||
}, |
||||
"names": [ |
||||
{ |
||||
"C": "US", |
||||
"L": "Flint", |
||||
"O": "Kubernetes", |
||||
"OU": "Kubernetes The Hard Way", |
||||
"ST": "Michigan" |
||||
} |
||||
] |
||||
} |
||||
EOF |
||||
|
||||
cfssl gencert \ |
||||
-ca=ca.pem \ |
||||
-ca-key=ca-key.pem \ |
||||
-config=ca-config.json \ |
||||
-profile=kubernetes \ |
||||
service-account-csr.json | cfssljson -bare service-account |
||||
@ -1,45 +0,0 @@ |
||||
#!/bin/bash |
||||
cd ~/ |
||||
mkdir kthw |
||||
cd kthw |
||||
sudo curl -s -L -o /bin/cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 |
||||
sudo curl -s -L -o /bin/cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 |
||||
sudo curl -s -L -o /bin/cfssl-certinfo https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 |
||||
sudo chmod +x /bin/cfssl* |
||||
|
||||
cat > ca-config.json << EOF |
||||
{ |
||||
"signing": { |
||||
"default": { |
||||
"expiry": "8760h" |
||||
}, |
||||
"profiles": { |
||||
"kubernetes": { |
||||
"usages": ["signing", "key encipherment", "server auth", "client auth"], |
||||
"expiry": "8760h" |
||||
} |
||||
} |
||||
} |
||||
} |
||||
EOF |
||||
|
||||
cat > ca-csr.json << EOF |
||||
{ |
||||
"CN": "Kubernetes", |
||||
"key": { |
||||
"algo": "rsa", |
||||
"size": 2048 |
||||
}, |
||||
"names": [ |
||||
{ |
||||
"C": "US", |
||||
"L": "Flint", |
||||
"O": "Kubernetes", |
||||
"OU": "CA", |
||||
"ST": "Michigan" |
||||
} |
||||
] |
||||
} |
||||
EOF |
||||
|
||||
cfssl gencert -initca ca-csr.json | cfssljson -bare ca |
||||
@ -1,10 +0,0 @@ |
||||
Move certificate files to the worker nodes: |
||||
|
||||
scp ca.pem <worker 1 hostname>-key.pem <worker 1 hostname>.pem user@<worker 1 public IP>:~/ |
||||
scp ca.pem <worker 2 hostname>-key.pem <worker 2 hostname>.pem user@<worker 2 public IP>:~/ |
||||
Move certificate files to the controller nodes: |
||||
|
||||
scp ca.pem ca-key.pem kubernetes-key.pem kubernetes.pem \ |
||||
service-account-key.pem service-account.pem user@<controller 1 public IP>:~/ |
||||
scp ca.pem ca-key.pem kubernetes-key.pem kubernetes.pem \ |
||||
service-account-key.pem service-account.pem user@<controller 2 public IP>:~/ |
||||
@ -1,166 +0,0 @@ |
||||
#!/bin/bash |
||||
|
||||
#WORKER0_HOST=<Public hostname of your first worker node cloud server> |
||||
#WORKER0_IP=<Private IP of your first worker node cloud server> |
||||
#WORKER1_HOST=<Public hostname of your second worker node cloud server> |
||||
#WORKER1_IP=<Private IP of your second worker node cloud server> |
||||
|
||||
cd ~/kthw |
||||
|
||||
cat > admin-csr.json << EOF |
||||
{ |
||||
"CN": "admin", |
||||
"key": { |
||||
"algo": "rsa", |
||||
"size": 2048 |
||||
}, |
||||
"names": [ |
||||
{ |
||||
"C": "US", |
||||
"L": "Flint", |
||||
"O": "system:masters", |
||||
"OU": "Kubernetes The Hard Way", |
||||
"ST": "Michigan" |
||||
} |
||||
] |
||||
} |
||||
EOF |
||||
|
||||
cfssl gencert \ |
||||
-ca=ca.pem \ |
||||
-ca-key=ca-key.pem \ |
||||
-config=ca-config.json \ |
||||
-profile=kubernetes \ |
||||
admin-csr.json | cfssljson -bare admin |
||||
|
||||
cat > ${WORKER0_HOST}-csr.json << EOF |
||||
{ |
||||
"CN": "system:node:${WORKER0_HOST}", |
||||
"key": { |
||||
"algo": "rsa", |
||||
"size": 2048 |
||||
}, |
||||
"names": [ |
||||
{ |
||||
"C": "US", |
||||
"L": "Flint", |
||||
"O": "system:nodes", |
||||
"OU": "Kubernetes The Hard Way", |
||||
"ST": "Oregon" |
||||
} |
||||
] |
||||
} |
||||
EOF |
||||
|
||||
cfssl gencert \ |
||||
-ca=ca.pem \ |
||||
-ca-key=ca-key.pem \ |
||||
-config=ca-config.json \ |
||||
-hostname=${WORKER0_IP},${WORKER0_HOST} \ |
||||
-profile=kubernetes \ |
||||
${WORKER0_HOST}-csr.json | cfssljson -bare ${WORKER0_HOST} |
||||
|
||||
cat > ${WORKER1_HOST}-csr.json << EOF |
||||
{ |
||||
"CN": "system:node:${WORKER1_HOST}", |
||||
"key": { |
||||
"algo": "rsa", |
||||
"size": 2048 |
||||
}, |
||||
"names": [ |
||||
{ |
||||
"C": "US", |
||||
"L": "Flint", |
||||
"O": "system:nodes", |
||||
"OU": "Kubernetes The Hard Way", |
||||
"ST": "Michigan" |
||||
} |
||||
] |
||||
} |
||||
EOF |
||||
|
||||
cfssl gencert \ |
||||
-ca=ca.pem \ |
||||
-ca-key=ca-key.pem \ |
||||
-config=ca-config.json \ |
||||
-hostname=${WORKER1_IP},${WORKER1_HOST} \ |
||||
-profile=kubernetes \ |
||||
${WORKER1_HOST}-csr.json | cfssljson -bare ${WORKER1_HOST} |
||||
|
||||
cat > kube-controller-manager-csr.json << EOF |
||||
{ |
||||
"CN": "system:kube-controller-manager", |
||||
"key": { |
||||
"algo": "rsa", |
||||
"size": 2048 |
||||
}, |
||||
"names": [ |
||||
{ |
||||
"C": "US", |
||||
"L": "Flint", |
||||
"O": "system:kube-controller-manager", |
||||
"OU": "Kubernetes The Hard Way", |
||||
"ST": "Michigan" |
||||
} |
||||
] |
||||
} |
||||
EOF |
||||
|
||||
cfssl gencert \ |
||||
-ca=ca.pem \ |
||||
-ca-key=ca-key.pem \ |
||||
-config=ca-config.json \ |
||||
-profile=kubernetes \ |
||||
kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager |
||||
|
||||
cat > kube-proxy-csr.json << EOF |
||||
{ |
||||
"CN": "system:kube-proxy", |
||||
"key": { |
||||
"algo": "rsa", |
||||
"size": 2048 |
||||
}, |
||||
"names": [ |
||||
{ |
||||
"C": "US", |
||||
"L": "Flint", |
||||
"O": "system:node-proxier", |
||||
"OU": "Kubernetes The Hard Way", |
||||
"ST": "Michigan" |
||||
} |
||||
] |
||||
} |
||||
EOF |
||||
|
||||
cfssl gencert \ |
||||
-ca=ca.pem \ |
||||
-ca-key=ca-key.pem \ |
||||
-config=ca-config.json \ |
||||
-profile=kubernetes \ |
||||
kube-proxy-csr.json | cfssljson -bare kube-proxy |
||||
|
||||
cat > kube-scheduler-csr.json << EOF |
||||
{ |
||||
"CN": "system:kube-scheduler", |
||||
"key": { |
||||
"algo": "rsa", |
||||
"size": 2048 |
||||
}, |
||||
"names": [ |
||||
{ |
||||
"C": "US", |
||||
"L": "Flint", |
||||
"O": "system:kube-scheduler", |
||||
"OU": "Kubernetes The Hard Way", |
||||
"ST": "Michigan" |
||||
} |
||||
] |
||||
} |
||||
EOF |
||||
|
||||
cfssl gencert \ |
||||
-ca=ca.pem \ |
||||
-ca-key=ca-key.pem \ |
||||
-config=ca-config.json \ |
||||
-profile=kubernetes \ |
||||
kube-scheduler-csr.json | cfssljson -bare kube-scheduler |
||||
@ -1,67 +0,0 @@ |
||||
[mysqld_safe] |
||||
socket = /var/run/mysqld/mysqld.sock |
||||
nice = 0 |
||||
|
||||
[mysqld] |
||||
user = mysql |
||||
basedir = /usr |
||||
tmpdir = /tmp |
||||
skip-external-locking |
||||
default-authentication-plugin = mysql_native_password |
||||
pid-file = /var/run/mysqld/mysqld.pid |
||||
socket = /var/run/mysqld/mysqld.sock |
||||
port = 3306 |
||||
bind-address = 127.0.0.1 |
||||
datadir = /var/lib/mysql |
||||
|
||||
innodb_log_file_size = 128MB |
||||
max_connect_errors = 5 |
||||
local-infile=0 |
||||
skip-show-database |
||||
# |
||||
# * Fine Tuning |
||||
# |
||||
key_buffer_size = 16M |
||||
max_allowed_packet = 16M |
||||
thread_stack = 192K |
||||
thread_cache_size = 8 |
||||
# This replaces the startup script and checks MyISAM tables if needed |
||||
# the first time they are touched |
||||
myisam-recover-options = BACKUP |
||||
#max_connections = 100 |
||||
#table_open_cache = 64 |
||||
#thread_concurrency = 10 |
||||
# |
||||
|
||||
# |
||||
# * Logging and Replication |
||||
# |
||||
# Both location gets rotated by the cronjob. |
||||
# Be aware that this log type is a performance killer. |
||||
# As of 5.1 you can enable the log at runtime! |
||||
#general_log_file = /var/log/mysql/mysql.log |
||||
#general_log = 1 |
||||
# |
||||
# Error log - should be very few entries. |
||||
# |
||||
log_error = /var/log/mysql/error.log |
||||
# |
||||
# Here you can see queries with especially long duration |
||||
#slow_query_log = 1 |
||||
#slow_query_log_file = /var/log/mysql/mysql-slow.log |
||||
#long_query_time = 2 |
||||
#log-queries-not-using-indexes |
||||
# |
||||
# The following can be used as easy to replay backup logs or for replication. |
||||
# note: if you are setting up a replication slave, see README.Debian about |
||||
# other settings you may need to change. |
||||
#server-id = 1 |
||||
#log_bin = /var/log/mysql/mysql-bin.log |
||||
max_binlog_size = 100M |
||||
#binlog_do_db = include_database_name |
||||
#binlog_ignore_db = include_database_name |
||||
|
||||
# * Security Features |
||||
# |
||||
# Read the manual, too, if you want chroot! |
||||
# chroot = /var/lib/mysql/ |
||||
@ -1,25 +0,0 @@ |
||||
*************************************************************************** |
||||
NOTICE TO USERS |
||||
|
||||
|
||||
This computer system is the private property of its owner, whether |
||||
individual, corporate or government. It is for authorized use only. |
||||
Users (authorized or unauthorized) have no explicit or implicit |
||||
expectation of privacy. |
||||
|
||||
Any or all uses of this system and all files on this system may be |
||||
intercepted, monitored, recorded, copied, audited, inspected, and |
||||
disclosed to your employer, to authorized site, government, and law |
||||
enforcement personnel, as well as authorized officials of government |
||||
agencies, both domestic and foreign. |
||||
|
||||
By using this system, the user consents to such interception, monitoring, |
||||
recording, copying, auditing, inspection, and disclosure at the |
||||
discretion of such personnel or officials. Unauthorized or improper use |
||||
of this system may result in civil and criminal penalties and |
||||
administrative or disciplinary action, as appropriate. By continuing to |
||||
use this system you indicate your awareness of and consent to these terms |
||||
and conditions of use. LOG OFF IMMEDIATELY if you do not agree to the |
||||
conditions stated in this warning. |
||||
|
||||
**************************************************************************** |
||||
@ -1,247 +0,0 @@ |
||||
[PHP] |
||||
engine = On |
||||
short_open_tag = Off |
||||
precision = 14 |
||||
output_buffering = 4096 |
||||
zlib.output_compression = Off |
||||
implicit_flush = Off |
||||
unserialize_callback_func = |
||||
serialize_precision = -1 |
||||
open_basedir = "/var/www:/var/lib/php/tmp_upload:/var/lib/php/sessions:/usr/share/phpmyadmin:/etc/phpmyadmin:/usr/share/php/php-php-gettext" |
||||
disable_functions = ini_set,php_uname,getmyuid,getmypid,passthru,leak,listen,diskfreespace,tmpfile,link,ignore_user_abord,shell_exec,dl,set_time_limit,exec,system,highlight_file,source,show_source,fpaththru,virtual,posix_ctermid,posix_getcwd,posix_getegid,posix_geteuid,posix_getgid,posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getlogin,posix_getpgid,posix_getpgrp,posix_getpid,posix,_getppid,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_getsid,posix_getuid,posix_isatty,posix_kill,posix_mkfifo,posix_setegid,posix_seteuid,posix_setgid,posix_setpgid,posix_setsid,posix_setuid,posix_times,posix_ttyname,posix_uname,proc_open,proc_close,proc_get_status,proc_nice,proc_terminate,phpinfo,popen,curl_exec,curl_multi_exec,parse_ini_file,allow_url_fopen,allow_url_include,pcntl_exec,chgrp,chmod,chown,lchgrp,lchown,putenv |
||||
disable_classes = |
||||
zend.enable_gc = On |
||||
expose_php = Off |
||||
max_execution_time = 30 |
||||
max_input_time = 60 |
||||
memory_limit = 128M |
||||
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT |
||||
display_errors = Off |
||||
display_startup_errors = Off |
||||
log_errors = On |
||||
log_errors_max_len = 1024 |
||||
ignore_repeated_errors = Off |
||||
ignore_repeated_source = Off |
||||
report_memleaks = On |
||||
track_errors = Off |
||||
html_errors = On |
||||
variables_order = "GPCS" |
||||
request_order = "GP" |
||||
register_argc_argv = Off |
||||
auto_globals_jit = On |
||||
post_max_size = 8M |
||||
auto_prepend_file = |
||||
auto_append_file = |
||||
default_mimetype = "text/html" |
||||
default_charset = "UTF-8" |
||||
doc_root = |
||||
user_dir = |
||||
enable_dl = Off |
||||
file_uploads = On |
||||
upload_max_filesize = 20M |
||||
max_file_uploads = 20 |
||||
post_max_size = 20M |
||||
; 256K if no uploading files |
||||
max_input_vars = 100 |
||||
allow_url_fopen = Off |
||||
allow_url_include = Off |
||||
default_socket_timeout = 60 |
||||
error_log = /var/www/php_error_log |
||||
upload_tmp_dir = /var/lib/php/tmp_upload |
||||
|
||||
[Session] |
||||
session.save_handler = files |
||||
session.hash_function = sha512 |
||||
session.bug_compat_42 = 0 |
||||
session.bug_compat_warn = 0 |
||||
session.save_path = "/var/lib/php/sessions" |
||||
session.use_strict_mode = 1 |
||||
session.use_cookies = 1 |
||||
session.cookie_secure = 1 |
||||
session.use_only_cookies = 1 |
||||
session.name = ToolzID |
||||
session.auto_start = 0 |
||||
session.cookie_lifetime = 0 |
||||
session.cookie_path = / |
||||
session.cookie_domain = |
||||
session.cookie_httponly = |
||||
session.serialize_handler = php |
||||
session.gc_probability = 0 |
||||
session.gc_divisor = 1000 |
||||
session.gc_maxlifetime = 1440 |
||||
session.referer_check = |
||||
session.cache_limiter = nocache |
||||
session.cache_expire = 180 |
||||
session.use_trans_sid = 0 |
||||
session.sid_length = 26 |
||||
session.trans_sid_tags = "a=href,area=href,frame=src,form=" |
||||
session.sid_bits_per_character = 5 |
||||
|
||||
[CLI Server] |
||||
cli_server.color = On |
||||
|
||||
[Date] |
||||
date.timezone = UTC |
||||
;date.default_latitude = 31.7667 |
||||
;date.default_longitude = 35.2333 |
||||
;date.sunrise_zenith = 90.583333 |
||||
;date.sunset_zenith = 90.583333 |
||||
|
||||
[filter] |
||||
;filter.default = unsafe_raw |
||||
;filter.default_flags = |
||||
|
||||
[intl] |
||||
;intl.default_locale = |
||||
; This directive allows you to produce PHP errors when some error |
||||
; happens within intl functions. The value is the level of the error produced. |
||||
; Default is 0, which does not produce any errors. |
||||
;intl.error_level = E_WARNING |
||||
;intl.use_exceptions = 0 |
||||
|
||||
[sqlite3] |
||||
;sqlite3.extension_dir = |
||||
|
||||
[Pcre] |
||||
;PCRE library backtracking limit. |
||||
; http://php.net/pcre.backtrack-limit |
||||
;pcre.backtrack_limit=100000 |
||||
|
||||
;PCRE library recursion limit. |
||||
;Please note that if you set this value to a high number you may consume all |
||||
;the available process stack and eventually crash PHP (due to reaching the |
||||
;stack size limit imposed by the Operating System). |
||||
; http://php.net/pcre.recursion-limit |
||||
;pcre.recursion_limit=100000 |
||||
|
||||
;Enables or disables JIT compilation of patterns. This requires the PCRE |
||||
;library to be compiled with JIT support. |
||||
;pcre.jit=1 |
||||
|
||||
[Pdo] |
||||
; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" |
||||
; http://php.net/pdo-odbc.connection-pooling |
||||
;pdo_odbc.connection_pooling=strict |
||||
|
||||
;pdo_odbc.db2_instance_name |
||||
|
||||
[Pdo_mysql] |
||||
pdo_mysql.cache_size = 2000 |
||||
pdo_mysql.default_socket= |
||||
|
||||
[Phar] |
||||
; http://php.net/phar.readonly |
||||
;phar.readonly = On |
||||
|
||||
; http://php.net/phar.require-hash |
||||
;phar.require_hash = On |
||||
|
||||
;phar.cache_list = |
||||
|
||||
[mail function] |
||||
; For Win32 only. |
||||
; http://php.net/smtp |
||||
SMTP = localhost |
||||
; http://php.net/smtp-port |
||||
smtp_port = 25 |
||||
|
||||
; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). |
||||
; http://php.net/sendmail-path |
||||
;sendmail_path = |
||||
; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename |
||||
mail.add_x_header = On |
||||
|
||||
[SQL] |
||||
; http://php.net/sql.safe-mode |
||||
sql.safe_mode = Off |
||||
|
||||
[ODBC] |
||||
odbc.allow_persistent = On |
||||
odbc.check_persistent = On |
||||
odbc.max_persistent = -1 |
||||
odbc.max_links = -1 |
||||
odbc.defaultlrl = 4096 |
||||
odbc.defaultbinmode = 1 |
||||
|
||||
[MySQLi] |
||||
mysqli.max_persistent = -1 |
||||
;mysqli.allow_local_infile = On |
||||
mysqli.allow_persistent = On |
||||
mysqli.max_links = -1 |
||||
mysqli.cache_size = 2000 |
||||
mysqli.default_port = 3306 |
||||
mysqli.default_socket = |
||||
mysqli.default_host = |
||||
mysqli.default_user = |
||||
mysqli.default_pw = |
||||
mysqli.reconnect = Off |
||||
|
||||
[mysqlnd] |
||||
mysqlnd.collect_statistics = On |
||||
mysqlnd.collect_memory_statistics = Off |
||||
|
||||
[bcmath] |
||||
bcmath.scale = 0 |
||||
|
||||
[Assertion] |
||||
zend.assertions = -1 |
||||
|
||||
[Tidy] |
||||
;tidy.default_config = /usr/local/lib/php/default.tcfg |
||||
tidy.clean_output = Off |
||||
|
||||
[soap] |
||||
soap.wsdl_cache_enabled=1 |
||||
soap.wsdl_cache_dir="/var/lib/php/soap_cache" |
||||
soap.wsdl_cache_ttl=86400 |
||||
soap.wsdl_cache_limit = 5 |
||||
|
||||
[ldap] |
||||
; Sets the maximum number of open links or -1 for unlimited. |
||||
ldap.max_links = -1 |
||||
|
||||
[opcache] |
||||
;opcache.enable=1 |
||||
;opcache.enable_cli=0 |
||||
;opcache.memory_consumption=128 |
||||
;opcache.interned_strings_buffer=8 |
||||
;opcache.max_accelerated_files=10000 |
||||
;opcache.max_wasted_percentage=5 |
||||
;opcache.use_cwd=1 |
||||
;opcache.validate_timestamps=1 |
||||
;opcache.revalidate_freq=2 |
||||
;opcache.revalidate_path=0 |
||||
;opcache.save_comments=1 |
||||
;opcache.fast_shutdown=0 |
||||
;opcache.enable_file_override=0 |
||||
;opcache.optimization_level=0xffffffff |
||||
;opcache.inherited_hack=1 |
||||
;opcache.dups_fix=0 |
||||
;opcache.blacklist_filename= |
||||
;opcache.max_file_size=0 |
||||
;opcache.consistency_checks=0 |
||||
;opcache.force_restart_timeout=180 |
||||
;opcache.error_log= |
||||
;opcache.log_verbosity_level=1 |
||||
;opcache.preferred_memory_model= |
||||
;opcache.protect_memory=0 |
||||
;opcache.restrict_api= |
||||
;opcache.mmap_base= |
||||
;opcache.file_cache= |
||||
;opcache.file_cache_only=0 |
||||
;opcache.file_cache_consistency_checks=1 |
||||
;opcache.file_cache_fallback=1 |
||||
;opcache.huge_code_pages=1 |
||||
;opcache.validate_permission=0 |
||||
;opcache.validate_root=0 |
||||
|
||||
[curl] |
||||
;curl.cainfo = |
||||
|
||||
[openssl] |
||||
;openssl.cafile= |
||||
;openssl.capath= |
||||
|
||||
; Local Variables: |
||||
; tab-width: 4 |
||||
; End: |
||||
@ -1,94 +0,0 @@ |
||||
# Package generated configuration file |
||||
# See the sshd_config(5) manpage for details |
||||
|
||||
# What ports, IPs and protocols we listen for |
||||
Port 2299 |
||||
# Use these options to restrict which interfaces/protocols sshd will bind to |
||||
#ListenAddress :: |
||||
#ListenAddress 0.0.0.0 |
||||
Protocol 2 |
||||
# HostKeys for protocol version 2 |
||||
HostKey /etc/ssh/ssh_host_rsa_key |
||||
#HostKey /etc/ssh/ssh_host_dsa_key |
||||
#HostKey /etc/ssh/ssh_host_ecdsa_key |
||||
HostKey /etc/ssh/ssh_host_ed25519_key |
||||
#Privilege Separation is turned on for security |
||||
UsePrivilegeSeparation yes |
||||
|
||||
# Lifetime and size of ephemeral version 1 server key |
||||
KeyRegenerationInterval 3600 |
||||
ServerKeyBits 1024 |
||||
|
||||
# Logging |
||||
SyslogFacility AUTH |
||||
LogLevel INFO |
||||
|
||||
# Authentication: |
||||
LoginGraceTime 120 |
||||
PermitRootLogin no |
||||
StrictModes yes |
||||
AllowUsers bobs chrisa robot git |
||||
|
||||
RSAAuthentication yes |
||||
PubkeyAuthentication yes |
||||
AuthorizedKeysFile %h/.ssh/authorized_keys |
||||
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files |
||||
IgnoreRhosts yes |
||||
# For this to work you will also need host keys in /etc/ssh_known_hosts |
||||
RhostsRSAAuthentication no |
||||
# similar for protocol version 2 |
||||
HostbasedAuthentication no |
||||
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication |
||||
#IgnoreUserKnownHosts yes |
||||
|
||||
# To enable empty passwords, change to yes (NOT RECOMMENDED) |
||||
PermitEmptyPasswords no |
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with |
||||
# some PAM modules and threads) |
||||
ChallengeResponseAuthentication no |
||||
|
||||
# Change to no to disable tunnelled clear text passwords |
||||
PasswordAuthentication no |
||||
|
||||
# Kerberos options |
||||
#KerberosAuthentication no |
||||
#KerberosGetAFSToken no |
||||
#KerberosOrLocalPasswd yes |
||||
#KerberosTicketCleanup yes |
||||
|
||||
# GSSAPI options |
||||
#GSSAPIAuthentication no |
||||
#GSSAPICleanupCredentials yes |
||||
|
||||
X11Forwarding no |
||||
X11DisplayOffset 10 |
||||
PrintMotd no |
||||
PrintLastLog yes |
||||
TCPKeepAlive yes |
||||
AllowTcpForwarding no |
||||
AllowStreamLocalForwarding no |
||||
GatewayPorts no |
||||
PermitTunnel no |
||||
#UseLogin no |
||||
|
||||
#MaxStartups 10:30:60 |
||||
DebianBanner no |
||||
Banner /etc/notice.txt |
||||
|
||||
# Allow client to pass locale environment variables |
||||
AcceptEnv LANG LC_* |
||||
|
||||
Subsystem sftp /bin/sh -c 'umask 0002; /usr/lib/openssh/sftp-server' |
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing, |
||||
# and session processing. If this is enabled, PAM authentication will |
||||
# be allowed through the ChallengeResponseAuthentication and |
||||
# PasswordAuthentication. Depending on your PAM configuration, |
||||
# PAM authentication via ChallengeResponseAuthentication may bypass |
||||
# the setting of "PermitRootLogin without-password". |
||||
# If you just want the PAM account and session checks to run without |
||||
# PAM authentication, then enable this but set PasswordAuthentication |
||||
# and ChallengeResponseAuthentication to 'no'. |
||||
UsePAM yes |
||||
@ -1,45 +0,0 @@ |
||||
# |
||||
# Configuration file for setting network variables. Please note these settings |
||||
# override /etc/sysctl.conf and /etc/sysctl.d. If you prefer to use |
||||
# /etc/sysctl.conf, please adjust IPT_SYSCTL in /etc/default/ufw. See |
||||
# Documentation/networking/ip-sysctl.txt in the kernel source code for more |
||||
# information. |
||||
# |
||||
|
||||
# Disable ICMP redirects. ICMP redirects are rarely used but can be used in |
||||
# MITM (man-in-the-middle) attacks. Disabling ICMP may disrupt legitimate |
||||
# traffic to those sites. |
||||
net/ipv4/conf/all/accept_redirects=0 |
||||
net/ipv4/conf/default/accept_redirects=0 |
||||
net/ipv6/conf/all/accept_redirects=0 |
||||
net/ipv6/conf/default/accept_redirects=0 |
||||
|
||||
# Ignore bogus ICMP errors |
||||
net/ipv4/icmp_echo_ignore_broadcasts=1 |
||||
net/ipv4/icmp_ignore_bogus_error_responses=1 |
||||
net/ipv4/icmp_echo_ignore_all=0 |
||||
|
||||
# Don't log Martian Packets (impossible addresses) |
||||
# packets |
||||
net/ipv4/conf/all/log_martians=0 |
||||
net/ipv4/conf/default/log_martians=0 |
||||
|
||||
net/ipv4/tcp/syncookies=1 # Enable syn flood protection |
||||
net/ipv4/conf/all/accept_source_route=0 # Ignore source-routed packets |
||||
net/ipv6/conf/all/accept_source_route=0 # IPv6 - Ignore ICMP redirects |
||||
net/ipv4/conf/default/accept_source_route=0 # Ignore source-routed packets |
||||
net/ipv6/conf/default/accept_source_route=0 # IPv6 - Ignore source-routed packets |
||||
net/ipv4/conf/all/secure_redirects=1 # Ignore ICMP redirects from non-GW hosts |
||||
net/ipv4/conf/default/secure_redirects=1 # Ignore ICMP redirects from non-GW hosts |
||||
net/ipv4/ip_forward=0 # Do not allow traffic between networks or act as a router |
||||
net/ipv6/conf/all/forwarding=0 # IPv6 - Do not allow traffic between networks or act as a router |
||||
net/ipv4/conf/all/send_redirects=0 # Don't allow traffic between networks or act as a router |
||||
net/ipv4/conf/default/send_redirects=0 # Don't allow traffic between networks or act as a router |
||||
net/ipv4/conf/all/rp_filter=1 # Reverse path filtering - IP spoofing protection |
||||
net/ipv4/conf/default/rp_filter=1 # Reverse path filtering - IP spoofing protection |
||||
net/ipv4/tcp_rfc1337=1 # Implement RFC 1337 fix |
||||
kernel/randomize_va_space=2 # Randomize addresses of mmap base, heap, stack and VDSO page |
||||
fs/protected_hardlinks=1 # Provide protection from ToCToU races |
||||
fs/protected_symlinks=1 # Provide protection from ToCToU races |
||||
kernel/kptr_restrict=1 # Make locating kernel addresses more difficult |
||||
kernel/perf_event_paranoid=2 # Set perf only available to root |
||||
@ -1,9 +0,0 @@ |
||||
#!/bin/bash |
||||
sudo apt update |
||||
sudo apt -y install software-properties-common |
||||
sudo add-apt-repository -y ppa:projectatomic/ppa |
||||
sudo apt update |
||||
sudo apt -y install podman |
||||
sudo mkdir -p /etc/containers |
||||
sudo curl https://raw.githubusercontent.com/projectatomic/registries/master/registries.fedora -o /etc/containers/registries.conf |
||||
sudo curl https://raw.githubusercontent.com/containers/skopeo/master/default-policy.json -o /etc/containers/policy.json |
||||
Loading…
Reference in new issue