96 lines
4.1 KiB
Bash
96 lines
4.1 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
APP_DIR="${APP_DIR:-/opt/cmpp-platform}"
|
|
if [[ "$(id -u)" -ne 0 ]]; then echo "Run as root." >&2; exit 1; fi
|
|
for command_name in fail2ban-client nft nginx systemctl; do command -v "$command_name" >/dev/null || { echo "Missing command: $command_name" >&2; exit 1; }; done
|
|
agent_binary="$APP_DIR/dist/cmpp-security-agent"
|
|
[[ -x "$agent_binary" ]] || { echo "Missing built security agent: $agent_binary" >&2; exit 1; }
|
|
|
|
getent group cmpp-security >/dev/null || groupadd --system cmpp-security
|
|
id cmpp-api >/dev/null 2>&1 || useradd --system --home-dir /nonexistent --shell /usr/sbin/nologin cmpp-api
|
|
usermod -a -G cmpp-security cmpp-api
|
|
install -d -o root -g cmpp-security -m 0770 /run/cmpp-security-agent
|
|
install -d -o root -g cmpp-security -m 0750 /var/lib/cmpp-security-agent
|
|
install -d -o cmpp-api -g cmpp-security -m 0750 "$APP_DIR/logs/api"
|
|
install -d -o cmpp-api -g cmpp-security -m 0750 "$APP_DIR/logs/send-worker"
|
|
install -d -o cmpp-api -g cmpp-security -m 0750 "$APP_DIR/logs/submit-outbox"
|
|
install -d -o cmpp-api -g cmpp-security -m 0750 "$APP_DIR/logs/gateway-callback"
|
|
[[ -d /var/lib/cmpp-platform/object-storage ]] && chown -R cmpp-api:cmpp-security /var/lib/cmpp-platform/object-storage
|
|
|
|
sed "s#@CMPP_SECURITY_AGENT_BIN@#$agent_binary#g" "$APP_DIR/deploy/security/cmpp-report-only.conf" >/etc/fail2ban/action.d/cmpp-report-only.conf
|
|
chmod 0640 /etc/fail2ban/action.d/cmpp-report-only.conf
|
|
install -m 0640 "$APP_DIR/deploy/security/cmpp-http-scan.conf" /etc/fail2ban/filter.d/cmpp-http-scan.conf
|
|
install -d -m 0750 /etc/nginx/snippets /etc/nftables.d
|
|
touch /etc/nginx/snippets/cmpp-security-deny.conf
|
|
chmod 0640 /etc/nginx/snippets/cmpp-security-deny.conf
|
|
|
|
cat >/etc/nftables.d/cmpp-security.nft <<'EOF'
|
|
table inet cmpp_security {
|
|
set blocked_ipv4 { type ipv4_addr; flags timeout; }
|
|
set blocked_ipv6 { type ipv6_addr; flags timeout; }
|
|
chain input { type filter hook input priority -10; policy accept; ip saddr @blocked_ipv4 drop; ip6 saddr @blocked_ipv6 drop; }
|
|
}
|
|
EOF
|
|
|
|
install -d -m 0755 /etc/systemd/system/cmpp-send-worker.service.d
|
|
cat >/etc/systemd/system/cmpp-send-worker.service.d/security-boundary.conf <<EOF
|
|
[Service]
|
|
User=cmpp-api
|
|
Group=cmpp-security
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectHome=true
|
|
ProtectSystem=true
|
|
ReadWritePaths=$APP_DIR/logs/send-worker /var/lib/cmpp-platform/object-storage
|
|
EOF
|
|
install -d -m 0755 /etc/systemd/system/cmpp-submit-outbox.service.d
|
|
cat >/etc/systemd/system/cmpp-submit-outbox.service.d/security-boundary.conf <<EOF
|
|
[Service]
|
|
User=cmpp-api
|
|
Group=cmpp-security
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectHome=true
|
|
ProtectSystem=true
|
|
ReadWritePaths=$APP_DIR/logs/submit-outbox
|
|
EOF
|
|
install -d -m 0755 /etc/systemd/system/cmpp-gateway-callback.service.d
|
|
cat >/etc/systemd/system/cmpp-gateway-callback.service.d/security-boundary.conf <<EOF
|
|
[Service]
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
ReadWritePaths=$APP_DIR/logs/gateway-callback
|
|
EOF
|
|
grep -q 'cmpp-security.nft' /etc/nftables.conf || printf '\ninclude "/etc/nftables.d/cmpp-security.nft"\n' >>/etc/nftables.conf
|
|
nft -c -f /etc/nftables.conf
|
|
nft list table inet cmpp_security >/dev/null 2>&1 || nft -f /etc/nftables.d/cmpp-security.nft
|
|
|
|
sed "s#@CMPP_SECURITY_AGENT_BIN@#$agent_binary#g" "$APP_DIR/deploy/security/cmpp-security-agent.service" >/etc/systemd/system/cmpp-security-agent.service
|
|
if grep -Rqs '@CMPP_SECURITY_AGENT_BIN@' /etc/systemd/system/cmpp-security-agent.service /etc/fail2ban/action.d/cmpp-report-only.conf; then
|
|
echo "Security agent executable placeholder was not rendered." >&2
|
|
exit 1
|
|
fi
|
|
install -d -m 0755 /etc/systemd/system/cmpp-api.service.d
|
|
cat >/etc/systemd/system/cmpp-api.service.d/security-boundary.conf <<EOF
|
|
[Service]
|
|
User=cmpp-api
|
|
Group=cmpp-security
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectHome=true
|
|
ProtectSystem=true
|
|
ReadWritePaths=$APP_DIR/logs/api /var/lib/cmpp-platform/object-storage
|
|
EOF
|
|
|
|
fail2ban-client -t
|
|
nginx -t
|
|
systemctl daemon-reload
|
|
systemctl enable cmpp-security-agent
|
|
echo "Security boundary installed. Restart cmpp-security-agent, cmpp-api and cmpp-send-worker only in the approved release window."
|