Machine Virtuelle "Debian Stretch" ouestline.net (VirtualBox/PC1)

su
cd ~
userdel dbsuser  

nano /etc/ssh/sshd_config

nano /etc/network/interfaces

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug enp0s3
iface enp0s3 inet dhcp
# This is an autoconfigured IPv6 interface
iface enp0s3 inet6 static
 address 2a01:e34:ee6a:b274::1
 netmask 64
 post-up ip -6 route add default via fe80::224:d4ff:fea6:aa20 dev enp0s3

reboot

ssh root@192.168.0.47

ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 08:00:27:a1:75:8e brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.47/24 brd 192.168.0.255 scope global enp0s3
       valid_lft forever preferred_lft forever
    inet6 2a01:e34:ee6a:b274::1/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fea1:758e/64 scope link 
       valid_lft forever preferred_lft forever

rm -r /home/dbsuser

$TTL 3600
@	IN SOA dns111.ovh.net. tech.ovh.net. (2018110102 86400 3600 3600000 300)
         3600 IN NS     ns111.ovh.net.
         3600 IN NS     dns111.ovh.net.
         3600 IN AAAA   2a01:e34:ee6a:b274::1
*        3600 IN CNAME  ouestline.net.

bash <(wget -q -O- https://install.yunohost.org/)

===============================================================================
You should now proceed with Yunohost post-installation. This is where you will
be asked for :
  - the main domain of your server ;
  - the administration password.

You can perform this step :
  - from the command line, by running 'yunohost tools postinstall' as root
  - or from your web browser, by accessing : 
    - https://192.168.0.47/ (local IP, if self-hosting at home)
    - https://78.235.240.223/ (global IP, if you're on a VPS)

If this is your first time with YunoHost, it is strongly recommended to take
time to read the administator documentation and in particular the sections
'Finalizing your setup' and 'Getting to know YunoHost'. It is available at
the following URL : https://yunohost.org/admindoc
===============================================================================

yunohost tools postinstall   

yunohost user create ouest

fullname: ouest line
mail: ouest@ouestline.net
username: ouest

yunohost domain cert-install

Info : Now attempting install of certificate for domain ouestline.net!
Erreur : Aucun enregistrement DNS 'A' n’a été trouvé pour ouestline.net. Vous devez faire pointer votre nom de domaine vers votre machine pour être en mesure d’installer un certificat Let’s Encrypt ! (Si vous savez ce que vous faites, utilisez --no-checks pour désactiver ces contrôles)

ssh admin@192.168.0.47

ssh-keygen -t ed25519 -o -a 100 -f ~/.ssh/vbox-ouestline   

scp ~/.ssh/vbox-ouestline.pub admin@192.168.0.47:/home/admin/

ssh admin@192.168.0.47

cd ~

mkdir .ssh
cat /home/$USER/vbox-ouestline.pub >> /home/$USER/.ssh/authorized_keys

chmod 600 /home/$USER/.ssh/authorized_keys

rm /home/$USER/vbox-ouestline.pub

sudo nano /etc/ssh/sshd_config

Port = 55040
PermitRootLogin no
PasswordAuthentication no

  sudo apt install libpam-systemd

sudo yunohost firewall allow TCP 55040
sudo yunohost firewall disallow TCP 22

sudo systemctl restart sshd

ssh -p 55040 -i ~/.ssh/vbox-ouestline admin@192.168.0.47

sudo apt install curl jq figlet tmux    # outils supplémentaires

#!/bin/bash

get_infos() {
    seconds="$(< /proc/uptime)"
    seconds="${seconds/.*}"
    days="$((seconds / 60 / 60 / 24)) jour(s)"
    hours="$((seconds / 60 / 60 % 24)) heure(s)"
    mins="$((seconds / 60 % 60)) minute(s)"
    
    # Remove plural if < 2.
    ((${days/ *} == 1))  && days="${days/s}"
    ((${hours/ *} == 1)) && hours="${hours/s}"
    ((${mins/ *} == 1))  && mins="${mins/s}"
    
    # Hide empty fields.
    ((${days/ *} == 0))  && unset days
    ((${hours/ *} == 0)) && unset hours
    ((${mins/ *} == 0))  && unset mins
    
    uptime="${days:+$days, }${hours:+$hours, }${mins}"
    uptime="${uptime%', '}"
    uptime="${uptime:-${seconds} seconds}"

   if [[ -f "/sys/devices/virtual/dmi/id/board_vendor" ||
                    -f "/sys/devices/virtual/dmi/id/board_name" ]]; then
	model="$(< /sys/devices/virtual/dmi/id/board_vendor)"
	model+=" $(< /sys/devices/virtual/dmi/id/board_name)"
   fi

   if [[ -f "/sys/devices/virtual/dmi/id/bios_vendor" ||
                    -f "/sys/devices/virtual/dmi/id/bios_version" ]]; then
        bios="$(< /sys/devices/virtual/dmi/id/bios_vendor)"
        bios+=" $(< /sys/devices/virtual/dmi/id/bios_version)"
        bios+=" $(< /sys/devices/virtual/dmi/id/bios_date)"
   fi
}

#clear
PROCCOUNT=`ps -Afl | wc -l`  		# nombre de lignes
PROCCOUNT=`expr $PROCCOUNT - 5`		# on ote les non concernées
GROUPZ=`users`
ipinfo=$(curl -s ipinfo.io) 		# info localisation format json
#ipinfo=$(curl -s iplocality.com) 		# info localisation format json
publicip=$(echo $ipinfo | jq -r '.ip')  # extraction des données , installer préalablement "jq"
ville=$(echo $ipinfo | jq -r '.city')
pays=$(echo $ipinfo | jq -r '.country')
cpuname=`cat /proc/cpuinfo |grep 'model name' | cut -d: -f2 | sed -n 1p`
iplink=`ip link show |grep -m 1 "2:" | awk '{print $2}' | cut -d: -f1`

if [[ $GROUPZ == *irc* ]]; then
ENDSESSION=`cat /etc/security/limits.conf | grep "@irc" | grep maxlogins | awk {'print $4'}`
PRIVLAGED="IRC Account"
else
ENDSESSION="Unlimited"
PRIVLAGED="Regular User"
fi
get_infos
logo=$(figlet "`hostname --fqdn`")
meteo=$(curl fr.wttr.in/$ville?0)
lvm_entet="Sys. fichiers\tTaille\tUtilisé\tDispo\tUti%\tMonté sur"
lvm=$(df -h |grep mapper)    # les montages lvm
sdx=$(df -h |grep "/dev/sd") # les montages /dev/sd
distri=$(lsb_release -sd)
distri+=" $(uname -m)"

echo -e "
\e[1;31m$logo
\e[1;35m   \e[1;37mHostname \e[1;35m= \e[1;32m`hostname`
\e[1;35m \e[1;37mWired IpV4 \e[1;35m= \e[1;32m`ip addr show $iplink | grep 'inet\b' | awk '{print $2}' | cut -d/ -f1`
\e[1;35m \e[1;37mWired IpV6 \e[1;35m= \e[1;32m`ip addr show $iplink | grep -E 'inet6' |grep -E 'scope link' | awk '{print $2}' | cut -d/ -f1`
\e[1;35m     \e[1;37mKernel \e[1;35m= \e[1;32m`uname -r`
\e[1;35m    \e[1;37mDistrib \e[1;35m= \e[1;32m$distri
\e[1;35m     \e[1;37mUptime \e[1;35m= \e[1;32m`echo $uptime`
\e[1;35m       \e[1;37mBios \e[1;35m= \e[1;32m`echo $bios`
\e[1;35m      \e[1;37mBoard \e[1;35m= \e[1;32m`echo $model`
\e[1;35m        \e[1;37mCPU \e[1;35m= \e[1;32m`echo $cpuname`
\e[1;35m \e[1;37mMemory Use \e[1;35m= \e[1;32m`free -m | awk 'NR==2{printf "%s/%sMB (%.2f%%)\n", $3,$2,$3*100/$2 }'`
\e[1;35m   \e[1;37mUsername \e[1;35m= \e[1;32m`whoami`
\e[1;35m   \e[1;37mSessions \e[1;35m= \e[1;32m`who | grep $USER | wc -l`
\e[1;35m\e[1;37mPublic IpV4 \e[1;35m= \e[1;32m`echo $publicip`
\e[1;35m\e[1;37mPublic IpV6 \e[1;35m= \e[1;32m`ip addr show $iplink | grep -m 1 'inet6\b'  | awk '{print $2}' | cut -d/ -f1`
\e[1;35m\e[1;96m$lvm_entet\e[1;35m\e[1;49m
\e[1;35m\e[1;33m$sdx
\e[1;35m\e[1;33m$lvm
\e[1;35m\e[1;32m$meteo
\e[1;0m
"

chmod +x ~/ssh_rc_bash

sudo rm /etc/motd && sudo nano /etc/motd  

     _       _     _                       _       _               _ 
  __| | ___ | |__ (_) __ _  _ _  ___ __ __(_) _ _ | |_  _  _  ___ | |
 / _` |/ -_)| '_ \| |/ _` || ' \|___|\ V /| || '_||  _|| || |/ -_)| |
 \__,_|\___||_.__/|_|\__,_||_||_|     \_/ |_||_|   \__| \_,_|\___||_|
                        _    _  _                           _        
    ___  _  _  ___  ___| |_ | |(_) _ _   ___     _ _   ___ | |_      
   / _ \| || |/ -_)(_-<|  _|| || || ' \ / -_) _ | ' \ / -_)|  _|     
   \___/ \_,_|\___|/__/ \__||_||_||_||_|\___|(_)|_||_|\___| \__|     
                                                                     

[Unit]
Description=Debian Stretch vm service
After=network.target vboxdrv.service

[Service]
ExecStart=/usr/bin/vboxheadless -s 'Debian Stretch'
ExecStop=/usr/bin/vboxmanage controlvm 'Debian Stretch' poweroff

[Install]
WantedBy=default.target

systemctl --user daemon-reload
systemctl start --user debian-virtuel.service
systemctl enable --user debian-virtuel.service
systemctl status --user debian-virtuel.service

sudo apt install socat # prérequis

cd ~
git clone https://github.com/Neilpang/acme.sh.git
cd acme.sh
./acme.sh --install 

export OVH_AK="votre application key"
export OVH_AS="votre application secret"

acme.sh --dns dns_ovh --issue --keylength ec-384 -d 'ouestline.net' -d '*.ouestline.net'

[Sat Mar 28 12:16:19 CET 2020] Your cert is in  /home/admin/.acme.sh/ouestline.net_ecc/ouestline.net.cer 
[Sat Mar 28 12:16:19 CET 2020] Your cert key is in  /home/admin/.acme.sh/ouestline.net_ecc/ouestline.net.key 
[Sat Mar 28 12:16:19 CET 2020] The intermediate CA cert is in  /home/admin/.acme.sh/ouestline.net_ecc/ca.cer 
[Sat Mar 28 12:16:19 CET 2020] And the full chain certs is there:  /home/admin/.acme.sh/ouestline.net_ecc/fullchain.cer 

mkdir -p /etc/yunohost/certs/ouestline.net-history/20200328.131000-letsencrypt

sudo ln -s /home/admin/.acme.sh/ouestline.net_ecc/ouestline.net.key /etc/yunohost/certs/ouestline.net-history/20200328.131000-letsencrypt/key.pem     # cert key
sudo ln -s /home/admin/.acme.sh/ouestline.net_ecc/fullchain.cer /etc/yunohost/certs/ouestline.net-history/20200328.131000-letsencrypt/crt.pem   # full chain certs

sudo rm /etc/yunohost/certs/ouestline.net # efface le lien certificat non signé
sudo ln -s /etc/yunohost/certs/ouestline.net-history/20200328.131000-letsencrypt /etc/yunohost/certs/ouestline.net # Création lien sur les certificats let's encrypt 

/etc/yunohost/certs/
├── ouestline.net -> /etc/yunohost/certs/ouestline.net-history/20200328.131000-letsencrypt
├── ouestline.net-history
│   ├── 20200328.094607-selfsigned
│   │   ├── ca.pem -> /etc/ssl/certs/ca-yunohost_crt.pem
│   │   ├── crt.pem
│   │   ├── key.pem
│   │   └── openssl.cnf
│   └── 20200328.131000-letsencrypt
│       ├── crt.pem -> /home/admin/.acme.sh/ouestline.net_ecc/fullchain.cer
│       └── key.pem -> /home/admin/.acme.sh/ouestline.net_ecc/ouestline.net.key
└── yunohost.org
    ├── ca.pem
    ├── crt.pem
    └── key.pem

sudo systemctl reboot

openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 80;
    listen [::]:80;
    server_name ouestline.net;

    access_by_lua_file /usr/share/ssowat/access.lua;

    include /etc/nginx/conf.d/ouestline.net.d/*.conf;

    location /yunohost/admin {
        return 301 https://$http_host$request_uri;
    }

    location /.well-known/autoconfig/mail/ {
        alias /var/www/.well-known/ouestline.net/autoconfig/mail/;
    }

    access_log /var/log/nginx/ouestline.net-access.log;
    error_log /var/log/nginx/ouestline.net-error.log;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name ouestline.net;

    ssl_certificate /etc/yunohost/certs/ouestline.net/crt.pem;
    ssl_certificate_key /etc/yunohost/certs/ouestline.net/key.pem;
    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;

    
    # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS and https://en.wikipedia.org/wiki/Curve25519
    ssl_ecdh_curve secp521r1:secp384r1:prime256v1;
    ssl_prefer_server_ciphers on;

    # Ciphers with intermediate compatibility
    # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.6.2&openssl=1.0.1t&hsts=yes&profile=intermediate
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';

    # Uncomment the following directive after DH generation
    # > openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048
    ssl_dhparam /etc/ssl/private/dh2048.pem;
    

    # Follows the Web Security Directives from the Mozilla Dev Lab and the Mozilla Obervatory + Partners
    # https://wiki.mozilla.org/Security/Guidelines/Web_Security
    # https://observatory.mozilla.org/ 
    
    more_set_headers "Content-Security-Policy : upgrade-insecure-requests";
    more_set_headers "Content-Security-Policy-Report-Only : default-src https: data: 'unsafe-inline' 'unsafe-eval'";
    more_set_headers "X-Content-Type-Options : nosniff";
    more_set_headers "X-XSS-Protection : 1; mode=block";
    more_set_headers "X-Download-Options : noopen";
    more_set_headers "X-Permitted-Cross-Domain-Policies : none";
    more_set_headers "X-Frame-Options : SAMEORIGIN";


    # Disable gzip to protect against BREACH
    # Read https://trac.nginx.org/nginx/ticket/1720 (text/html cannot be disabled!)
    gzip off;

    access_by_lua_file /usr/share/ssowat/access.lua;

    include /etc/nginx/conf.d/ouestline.net.d/*.conf;

    include /etc/nginx/conf.d/yunohost_admin.conf.inc;
    include /etc/nginx/conf.d/yunohost_api.conf.inc;

    access_log /var/log/nginx/ouestline.net-access.log;
    error_log /var/log/nginx/ouestline.net-error.log;

nginx -t
systemctl restart nginx

                       IN MX     10 ouestline.net.
_dmarc                 IN TXT    "v=DMARC1;p=none;"
mail._domainkey        IN TXT    ( "v=DKIM1;h=sha256;k=rsa;p=MKKKJJJ........hgFRD888jk;" )

yunohost domain dns-conf ouestline.net

 Avertissements de sécurité & configuration

Il est important pour la sécurité et la performance de votre instance que celle-ci soit correctement configurée. Afin de vous aider, votre instance Nextcloud effectue des vérifications automatiques. Pour de plus amples informations, veuillez consulter la documentation liée.
Il y a quelques avertissements concernant votre configuration.

    MySQL est utilisée comme base de données mais ne supporte pas les caractères codés sur 4 octets. Pour pouvoir manipuler les caractères sur 4 octets (comme les émoticônes) sans problème dans les noms de fichiers ou les commentaires par exemple, il est recommandé d'activer le support 4 octets dans MySQL. Pour plus de détails, lisez la page de documentation à ce sujet

Merci de consulter les guides d'installation ↗ et de vérifier les erreurs ou avertissements des logs.

Vérifier la sécurité de votre Nextcloud grâce à notre scan de sécurité ↗	

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 76
Server version: 10.1.44-MariaDB-0+deb9u1 Debian 9.11

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> show variables like 'innodb_file_format';
+--------------------+----------+
| Variable_name      | Value    |
+--------------------+----------+
| innodb_file_format | Antelope |
+--------------------+----------+
1 row in set (0.01 sec)

MariaDB [nextcloud]> SET GLOBAL innodb_file_format=Barracuda;
Query OK, 0 rows affected (0.00 sec)

MariaDB [nextcloud]> show variables like 'innodb_file_per_table';
+-----------------------+-------+
| Variable_name         | Value |
+-----------------------+-------+
| innodb_file_per_table | ON    |
+-----------------------+-------+
1 row in set (0.00 sec)

MariaDB [(none)]> quit

cd /var/www/nextcloud
sudo -u nextcloud /usr/bin/php7.3 occ maintenance:mode --on

systemctl restart mysqld

mysql -uroot -p$(cat /etc/yunohost/mysql )

MariaDB [(none)]> ALTER DATABASE nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> quit

An exception occurred while executing ‘ALTER TABLE [TABLE_NAME] CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;’:
SQLSTATE[42000]: Syntax error or access violation: 1071 Specified key was too long; max key length is 767 bytes

mysql -uroot -p$(cat /etc/yunohost/mysql ) nextcloud

MariaDB [nextcloud]> set global innodb_large_prefix=on;
Query OK, 0 rows affected (0.00 sec)

MariaDB [nextcloud]> set global innodb_file_format=Barracuda;
Query OK, 0 rows affected (0.00 sec)

MariaDB [nextcloud]> quit
Bye

sudo -u nextcloud /usr/bin/php7.3 occ config:system:set mysql.utf8mb4 --type boolean --value="true"    

Nextcloud is in maintenance mode - no apps have been loaded

System config value mysql.utf8mb4 set to boolean true

sudo -u nextcloud /usr/bin/php7.3 occ maintenance:repair # patienter

sudo -u nextcloud /usr/bin/php7.3 occ maintenance:mode --off

 Avertissements de sécurité & configuration

Il est important pour la sécurité et la performance de votre instance que celle-ci soit correctement configurée. Afin de vous aider, votre instance Nextcloud effectue des vérifications automatiques. Pour de plus amples informations, veuillez consulter la documentation liée.
Il y a quelques erreurs concernant votre configuration.

    Dernière tâche de fond a fonctionné il y a Il y a 1 heure. Quelque chose s'est mal passé. Vérifier les paramètres des tâches de fond

Merci de consulter les guides d'installation ↗ et de vérifier les erreurs ou avertissements des logs.

Vérifier la sécurité de votre Nextcloud grâce à notre scan de sécurité ↗	

sudo -s
crontab -u nextcloud -e

*/5 * * * * /usr/bin/php7.3 -f /var/www/nextcloud/cron.php > /dev/null 2>&1