158 lines
6.0 KiB
Bash
Executable File
158 lines
6.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ==============================================================================
|
|
# NexusPBX - Script de Réparation Automatique des Permissions & Services
|
|
# ==============================================================================
|
|
|
|
set -e
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "[ERREUR] Ce script doit être exécuté en root."
|
|
exit 1
|
|
fi
|
|
|
|
echo "-> Correction des répertoires Git et mise à jour..."
|
|
git config --global --add safe.directory /var/www/nexus-pbx 2>/dev/null || true
|
|
cd /var/www/nexus-pbx
|
|
git fetch origin main
|
|
git reset --hard origin/main
|
|
|
|
echo "-> Installation des outils de droits (ACL)..."
|
|
which setfacl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y acl)
|
|
|
|
echo "-> Création des dossiers et des fichiers de journalisation..."
|
|
mkdir -p /etc/fail2ban/filter.d /etc/asterisk /var/log/asterisk /var/log/nexus-pbx /var/www/nexus-pbx/storage/backups
|
|
|
|
touch /var/log/asterisk/messages /var/log/asterisk/security.log /var/log/nexus_security.log
|
|
chown asterisk:asterisk /var/log/asterisk/messages /var/log/asterisk/security.log 2>/dev/null || true
|
|
chmod 0664 /var/log/asterisk/messages /var/log/asterisk/security.log 2>/dev/null || true
|
|
chown www-data:asterisk /var/log/nexus_security.log 2>/dev/null || true
|
|
chmod 0664 /var/log/nexus_security.log 2>/dev/null || true
|
|
|
|
echo "-> Filtres Fail2ban Asterisk & Nexus-Web..."
|
|
cat << 'EOF' > /etc/fail2ban/filter.d/asterisk.conf
|
|
[INCLUDES]
|
|
before = common.conf
|
|
|
|
[Definition]
|
|
failregex = ^(%(__prefix_line)s|\[\]\s*)*(?:NOTICE|SECURITY)\[\d+\]:? (?:\S+: )?(?:Registration from |Call from |Invalid password for |Sending fake auth challenge to |No matching endpoint found for )?'<HOST>'(?::\d+)?
|
|
^(%(__prefix_line)s|\[\]\s*)*SECURITY\[\d+\]:? (?:\S+: )?SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword|AuthFailed)"(?:.*?)RemoteAddress="IPV[46]/(?:UDP|TCP|TLS)/<HOST>/\d+"
|
|
ignoreregex =
|
|
EOF
|
|
chmod 0644 /etc/fail2ban/filter.d/asterisk.conf
|
|
|
|
cat << 'EOF' > /etc/fail2ban/filter.d/nexus-web.conf
|
|
[Definition]
|
|
failregex = ^.*\[NEXUS-WEB-AUTH-FAIL\]:\s*<HOST>.*$
|
|
ignoreregex =
|
|
EOF
|
|
chmod 0644 /etc/fail2ban/filter.d/nexus-web.conf
|
|
|
|
cat << 'EOF' > /etc/fail2ban/jail.local
|
|
[DEFAULT]
|
|
bantime = 3600
|
|
findtime = 600
|
|
maxretry = 3
|
|
usedns = no
|
|
ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
|
|
|
|
[asterisk]
|
|
enabled = true
|
|
port = 5060,5061
|
|
protocol = udp
|
|
filter = asterisk
|
|
logpath = /var/log/asterisk/messages
|
|
action = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
|
maxretry = 3
|
|
bantime = 3600
|
|
|
|
[nginx-http-auth]
|
|
enabled = true
|
|
port = http,https,8443
|
|
logpath = /var/log/nginx/*error.log
|
|
maxretry = 5
|
|
bantime = 3600
|
|
|
|
[nexus-web]
|
|
enabled = true
|
|
port = http,https,8443
|
|
filter = nexus-web
|
|
logpath = /var/log/nexus_security.log
|
|
maxretry = 3
|
|
findtime = 600
|
|
bantime = 3600
|
|
EOF
|
|
|
|
echo "-> Droits applicatifs et ACL POSIX (/etc/asterisk et /var/www/nexus-pbx)..."
|
|
usermod -aG asterisk www-data 2>/dev/null || true
|
|
usermod -aG www-data asterisk 2>/dev/null || true
|
|
|
|
chown -R www-data:asterisk /var/www/nexus-pbx
|
|
chmod 2775 /var/www/nexus-pbx/storage /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/public/avatars 2>/dev/null || true
|
|
|
|
touch /etc/asterisk/pjsip.conf \
|
|
/etc/asterisk/pjsip.custom.conf \
|
|
/etc/asterisk/extensions.conf \
|
|
/etc/asterisk/extensions.custom.conf \
|
|
/etc/asterisk/musiconhold.custom.conf \
|
|
/etc/asterisk/voicemail.custom.conf \
|
|
/etc/asterisk/rtp.conf \
|
|
/etc/asterisk/features.conf 2>/dev/null || true
|
|
|
|
chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/spool/asterisk /var/log/asterisk 2>/dev/null || true
|
|
chmod -R 775 /etc/asterisk
|
|
chmod 2775 /etc/asterisk
|
|
chmod 2750 /etc/asterisk/keys 2>/dev/null || true
|
|
chmod 0664 /etc/asterisk/*.conf /etc/asterisk/*.custom.conf 2>/dev/null || true
|
|
|
|
setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true
|
|
setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true
|
|
|
|
chown root:asterisk /etc/fail2ban/jail.local /etc/nginx/sites-available/nexus-pbx 2>/dev/null || true
|
|
chmod 0664 /etc/fail2ban/jail.local /etc/nginx/sites-available/nexus-pbx 2>/dev/null || true
|
|
setfacl -m u:www-data:rw /etc/fail2ban/jail.local /etc/nginx/sites-available/nexus-pbx 2>/dev/null || true
|
|
|
|
cat << 'EOF' > /etc/sudoers.d/nexus-pbx
|
|
www-data ALL=(ALL) NOPASSWD: /usr/sbin/asterisk, /usr/sbin/nginx, /usr/bin/systemctl, /usr/bin/fail2ban-client, /var/www/nexus-pbx/scripts/nexus-firewall, /usr/bin/certbot, /usr/sbin/nft, /usr/sbin/iptables
|
|
EOF
|
|
chmod 0440 /etc/sudoers.d/nexus-pbx
|
|
|
|
echo "-> Autorisation d'écriture systemd pour PHP-FPM (Debian 12/13 ProtectSystem)..."
|
|
for fpm_svc in /lib/systemd/system/php*-fpm.service /usr/lib/systemd/system/php*-fpm.service; do
|
|
if [ -f "$fpm_svc" ]; then
|
|
svc_name=$(basename "$fpm_svc")
|
|
mkdir -p "/etc/systemd/system/${svc_name}.d"
|
|
cat << 'EOF_OVERRIDE' > "/etc/systemd/system/${svc_name}.d/override.conf"
|
|
[Service]
|
|
ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log
|
|
EOF_OVERRIDE
|
|
fi
|
|
done
|
|
systemctl daemon-reload
|
|
|
|
echo "-> Génération des configurations Asterisk..."
|
|
php -r '
|
|
require_once "/var/www/nexus-pbx/src/Database.php";
|
|
require_once "/var/www/nexus-pbx/src/ConfigGenerator.php";
|
|
$db = App\Database::getConnection();
|
|
$gen = new App\ConfigGenerator($db);
|
|
$gen->writeAllConfigs();
|
|
' 2>/dev/null || true
|
|
|
|
echo "-> Redémarrage des services..."
|
|
systemctl daemon-reload
|
|
systemctl restart php*-fpm 2>/dev/null || true
|
|
PHP_SVC=$(systemctl list-unit-files --type=service 2>/dev/null | grep -E "php.*-fpm" | awk '{print $1}' | head -n 1 || echo "")
|
|
if [ -n "$PHP_SVC" ]; then
|
|
systemctl restart "$PHP_SVC" 2>/dev/null || true
|
|
fi
|
|
systemctl restart asterisk 2>/dev/null || true
|
|
systemctl restart fail2ban 2>/dev/null || true
|
|
systemctl restart nginx 2>/dev/null || true
|
|
|
|
echo ""
|
|
echo "=========================================================="
|
|
echo " [OK] Réparation terminée ! Toutes les permissions sont actives."
|
|
echo "=========================================================="
|
|
/var/www/nexus-pbx/scripts/nexus-banner.sh --force || true
|
|
|