fcos-base-tmplt.yaml

# motd script
    - path: /usr/local/bin/geco-motd
      mode: 0755
      contents:
        inline: |
          #!/bin/bash
          
          OUT=/etc/console-login-helper-messages/issue.d/22_geco.motd
          
          echo -e "\nWelcome on a server powered by\n" > ${OUT}
          echo -e "\e[33m Welcome this server" >> ${OUT}
          echo -e "\e[33m By accessing this system, you consent to the following conditions:" >> ${OUT}
          echo -e "\e[33m - This system is for authorized use only." >> ${OUT}
          echo -e "\e[33m - Any or all uses of this system and all files on this system may be monitored." >> ${OUT}
          echo -e "\e[33m - Communications using, or data stored on, this system are not private." >> ${OUT}
          eval "$(grep -E "^(NAME=|VARIANT=)" /etc/os-release)" && echo -e "\e[33mOperating System:\e[0m ${NAME} ${VARIANT}" >> ${OUT}
          eval "$(grep ^OSTREE_VERSION /etc/os-release)" && echo -e "\e[33mVersion:\e[0m ${OSTREE_VERSION}" >> ${OUT}
          echo -e "\e[33mKernel:\e[0m $(uname -r)" >> ${OUT}
          echo -ne "\e[33mCPU:\e[0m $(grep ^processor /proc/cpuinfo | wc -l)" >> ${OUT}
          echo "$(grep "^model name" /proc/cpuinfo | head -n1 | awk -F: '{print $2}' | awk -F@ '{print $1}')" >> ${OUT}
          echo -e "\e[33mRAM:\e[0m $(free | grep Mem | awk '{print $2}' | xargs -i expr {} / 1000 / 1000 | xargs -i printf '%.0fG\n' {})" >> ${OUT}
          i=0; for disk in $(ls /dev/sd[a-z] /dev/vd[a-z] 2>/dev/null); do
                lsblk > /dev/null 2>&1 || break
                echo -e "\e[33mHDD${i} ($(basename ${disk})):\e[0m$(lsblk -n --nodeps ${disk} -o size)" >> ${OUT}
                i=$((i+1))
          done
          echo -e "\n\e[33mHostname:\e[0m "$(hostname -f) >> ${OUT}  
          sleep 1; echo -e "\e[33mIPv4 Address:\e[0m $(ip route get 8.8.8.8 | awk 'NR==1 {print $7}')" >> ${OUT}
          echo -e "\e[33mPublic IPv4 Address:\e[0m $(curl https://ipv4.icanhazip.com)\n" >> ${OUT}

# apply cloudinit script
    - path: /usr/local/bin/geco-cloudinit
      mode: 0755
      contents:
        inline: |
          #!/bin/bash
          #
          #
          #  Apply Basic Cloudinit Settings
          #
          # ===================================================================================
          declare -r VERSION=1.2011

          set -e
          trap 'catch $?' EXIT

          CIPATH=/run/cloudinit
          YQ="yq read --exitStatus --printMode v --stripComments --"

          # ===================================================================================
          # functions()
          catch() {
            ${MOUNTED:-false} && umount ${CIPATH} && rmdir ${CIPATH}
          }
          mount | grep -q /run/cloudinit && MOUNTED=true # init

          # use for vm clone
          sysprep() {
            echo "Remove all ssh system keys..."
            rm -f /etc/ssh/ssh_host_*
            
            echo "Clean ostree database..."
            rpm-ostree cleanup --base --pending --rollback --repomd

            echo "Remove all local user..."
            for user in $(awk -F: -v uiduser="1000" '{if ($3>=uiduser) print $1}' /etc/passwd); do
              userdel --force --remove ${user}
            done

            echo "Purge all docker ressources..."
            docker system prune --all --force

            echo "Remove all network/machine settings..."
            rm -f /var/lib/NetworkManager/*
            echo "" > /etc/machine-id

            echo "Purge all system logs..."
            journalctl --rotate --vacuum-time=1s
            systemctl stop systemd-journald*
            rm -rf /var/log/journal/*
            rm -rf /var/log/ssd/*

            echo "Force run cloudinit on next reboot..."
            echo "fake" > /var/.cloudinit

            echo -e "\nShutdown now..."
            poweroff

            exit 0  
          }
          [[ "x${1}" == "xsysprep" ]]&& sysprep          

          setup_yq() {
            local VER=3.4.1

            [[ -x /usr/bin/wget ]]&& download_command="wget --quiet --show-progress --output-document"  || download_command="curl -s --location --output"
            [[ -x /usr/local/bin/yq ]]&& [[ "x$(/usr/local/bin/yq --version | awk '{print $NF}')" == "x${VER}" ]]&& return 0
            echo "Setup yaml parser tools yq..."
            rm -f /usr/local/bin/yq
            ${download_command} /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/${VER}/yq_linux_amd64
            chmod 755 /usr/local/bin/yq
          }
          setup_yq

          # network
          mask2cdr()
          {
            # Assumes there's no "255." after a non-255 byte in the mask
            local x=${1##*255.}
            set -- 0^^^128^192^224^240^248^252^254^ $(( (${#1} - ${#x})*2 )) ${x%%.*}
            x=${1%%$3*}
            echo $(( $2 + (${#x}/4) ))
          }

          cdr2mask()
          {
            # Number of args to shift, 255..255, first non-255 byte, zeroes
            set -- $(( 5 - ($1 / 8) )) 255 255 255 255 $(( (255 << (8 - ($1 % 8))) & 255 )) 0 0 0
            [[ $1 -gt 1 ]] && shift $1 || shift
            echo ${1-0}.${2-0}.${3-0}.${4-0}
          }

          # ===================================================================================
          # main()
          [[ ! -e /dev/sr0 ]]&& {
            echo "[INFO]: Cloudinit: any drive found..."
            exit 0
          }
          mkdir -p ${CIPATH}
          mount -o ro /dev/sr0 ${CIPATH}
          MOUNTED=true

          [[ ! -e ${CIPATH}/meta-data ]]&& {
            echo "[ERROR]: Cloudinit: nocloud metada not found..."
            exit 1
          }

          cloudinit_instanceid="$(${YQ} ${CIPATH}/meta-data 'instance-id')"
          if [[ -e /var/.cloudinit ]]
          then
            [[ "x$(cat /var/.cloudinit)" == "x${cloudinit_instanceid}" ]]&& {
            echo "[INFO]: Cloudinit any change detected..."
            exit 0
            }

            # hostname
            NEWHOSTNAME="$(${YQ} ${CIPATH}/user-data 'hostname' 2> /dev/null)"
            [[ -n "${NEWHOSTNAME}" ]]&& [[ "x${NEWHOSTNAME,,}" != "x$(hostname)" ]]&& {
              echo -n "[INFO]: Cloudinit: set hostname to ${NEWHOSTNAME,,}... "
              hostnamectl set-hostname ${NEWHOSTNAME,,} || { echo "[failed]"; exit 1; }
              MUST_REBOOT=true
              echo "[done]"
            }
            # username
            NEWUSERNAME="$(${YQ} ${CIPATH}/user-data 'user' 2> /dev/null)" || true # cant be empty if no cloudinit user defined
            [[ "x${NEWUSERNAME}" == "x" ]] && NEWUSERNAME="admin" # NEWUSERNAME="core" use "admin" on geco-template
            getent passwd ${NEWUSERNAME} &> /dev/null || {
              echo -n "[INFO]: Cloudinit: add sytem user: ${NEWUSERNAME}... "
              useradd --comment "Geco-iT CoreOS Administrator" --create-home \
                      --groups adm,wheel,sudo,systemd-journal,docker ${NEWUSERNAME} &> /dev/null || { echo "[failed]"; exit 1; }
              echo "[done]"
            }
            # passwd
            NEWPASSWORD="$(${YQ} ${CIPATH}/user-data 'password' 2> /dev/null)"
            [[ -n "${NEWPASSWORD}" ]]&& [[ "x${NEWPASSWORD}" != "x$(grep ^${NEWUSERNAME} /etc/shadow | awk -F: '{print $2}')" ]]&& {
              echo -n "[INFO]: Cloudinit: set password for user ${NEWUSERNAME}... "
              sed -e "/^${NEWUSERNAME}/d" -i /etc/shadow &> /dev/null || { echo "[failed]"; exit 1; }
              echo "${NEWUSERNAME}:${NEWPASSWORD}:18000:0:99999:7:::" >> /etc/shadow || { echo "[failed]"; exit 1; }
              chage --lastday "$(date +%Y-%m-%d)" ${NEWUSERNAME} &> /dev/null || { echo "[failed]"; exit 1; }
              echo "[done]"
            }
            # ssh key
            [[ -e /var/home/${NEWUSERNAME}/.ssh/authorized_keys.d/ignition ]] || {
              install --directory --owner=${NEWUSERNAME} --group=${NEWUSERNAME} \
                      --mode=0700 /var/home/${NEWUSERNAME}/.ssh &> /dev/null || { echo "[failed]"; exit 1; }
              install --directory --owner=${NEWUSERNAME} --group=${NEWUSERNAME} \
                      --mode=0700 /var/home/${NEWUSERNAME}/.ssh/authorized_keys.d &> /dev/null || { echo "[failed]"; exit 1; }
              install --owner=${NEWUSERNAME} --group=${NEWUSERNAME} \
                      --mode=0600 /dev/null /var/home/${NEWUSERNAME}/.ssh/authorized_keys.d/ignition &> /dev/null || { echo "[failed]"; exit 1; }
            }
            echo -n "[INFO]: Cloudinit: wrote ssh authorized keys file for user: ${NEWUSERNAME}... "
            ${YQ} ${CIPATH}/user-data 'ssh_authorized_keys[*]' > /var/home/${NEWUSERNAME}/.ssh/authorized_keys.d/ignition 2> /dev/null || { echo "[failed]"; exit 1; }
            echo "[done]"
            # Network => ipv6: TODO
            netcards="$(${YQ} ${CIPATH}/network-config 'config[*].name' 2> /dev/null | wc -l)"
            nameservers="$(${YQ} ${CIPATH}/network-config "config[${netcards}].address[*]" 2> /dev/null | paste -s -d ";" -)"
            searchdomain="$(${YQ} ${CIPATH}/network-config "config[${netcards}].search[*]" 2> /dev/null | paste -s -d ";" -)"
            echo "[INFO]: Cloudinit: DNS Server=$nameservers - DNS Search=$searchdomain"
            for (( i=O; i<${netcards}; i++ )); do
              ipv4="" netmask="" gw="" macaddr="" # reset on each run
              ipv4="$(${YQ} ${CIPATH}/network-config config[${i}].subnets[0].address 2> /dev/null)" || {
                [[ -e /etc/NetworkManager/system-connections/net${i}.nmconnection ]]&& MUST_NETWORK_RELOAD=true
                rm -f /etc/NetworkManager/system-connections/net${i}.nmconnection
                continue # dhcp mode
              }
              netmask="$(${YQ} ${CIPATH}/network-config config[${i}].subnets[0].netmask 2> /dev/null)"
              cidr="$(mask2cdr ${netmask})"
              gw="$(${YQ} ${CIPATH}/network-config config[${i}].subnets[0].gateway 2> /dev/null)" || true # can be empty
              macaddr="$(${YQ} ${CIPATH}/network-config config[${i}].mac_address 2> /dev/null)"
              echo "[INFO]: Cloudinit: NET$i IPv4 Network: IP=${ipv4}/${netmask} - GW=${gw:-none} - MAC=${macaddr}"
              rm -f /etc/NetworkManager/system-connections/default_connection.nmconnection # remove default connexion settings
              if [[ -e /etc/NetworkManager/system-connections/net${i}.nmconnection ]]
              then
                [[ "x${ipv4}/${cidr}" != "x$(nmcli connection show net${i} 2> /dev/null | grep ^ipv4.addresses: | awk '{print $2}')" ]]&& {
                  echo -n "[INFO]: Cloudinit: update Network config ipv4 for net${i}... "
                  nmcli c modify net${i} ipv4.addresses "${ipv4}/${cidr}"
                  MUST_NET_RECONFIG=true
                  echo "[done]"
                }
                [[ "x${gw}" != "x$(nmcli connection show net${i} 2> /dev/null | grep ^ipv4.gateway: | awk '{print $2}')" ]] && {
                  echo -n "[INFO]: Cloudinit: update Network config gateway for net${i}... "
                  nmcli c modify net${i} ipv4.gateway "${gw}"
                  MUST_NET_RECONFIG=true
                  echo "[done]"
                }
                [[ "x${searchdomain}" != "x$(nmcli connection show net${i} 2> /dev/null | grep ^ipv4.dns-search: | awk '{print $2}' | tr ',' ';')" ]]&& {
                  echo -n "[INFO]: Cloudinit: update Network config dns seach for net${i}... "
                  nmcli c modify net${i} ipv4.dns-search "$(echo ${searchdomain} | tr ";" ",")"
                  MUST_NET_RECONFIG=true
                  echo "[done]"
                }
                [[ "x${nameservers}" != "x$(nmcli connection show net${i} 2> /dev/null | grep ^ipv4.dns: | awk '{print $2}' | tr ',' ';')" ]]&& {
                  echo -n "[INFO]: Cloudinit: update Network config dns server for net${i}... "
                  nmcli c modify net${i} ipv4.dns "$(echo ${nameservers} | tr ";" ",")"
                  MUST_NET_RECONFIG=true
                  echo "[done]"
                }
              else
                echo -n "[INFO]: Cloudinit: wrote NetworkManager config for net${i}... "
                install --mode=0600 /dev/null /etc/NetworkManager/system-connections/net${i}.nmconnection &> /dev/null || { echo "[failed]"; exit 1; }
                echo -e "[connection]\ntype=ethernet\nid=net${i}\n#interface-name=eth${i}\n" >> /etc/NetworkManager/system-connections/net${i}.nmconnection
                echo -e "[ethernet]\nmac-address=${macaddr}\n" >> /etc/NetworkManager/system-connections/net${i}.nmconnection
                echo -e "[ipv4]\nmethod=manual\naddresses=${ipv4}/${netmask}\ngateway=${gw}\ndns=${nameservers}\ndns-search=${searchdomain}" >> /etc/NetworkManager/system-connections/net${i}.nmconnection
                MUST_NET_RECONFIG=true
                echo "[done]"
              fi
            done
          fi

          ${MUST_NET_RECONFIG:-false}&& {
            echo "[INFO]: Cloudinit: must reload network..."
            nmcli connection reload
            nmcli networking off
            nmcli networking on
            systemctl restart geco-motd.service
            systemctl restart console-login-helper-messages-motdgen.service
          }

          echo -n "[INFO]: Cloudinit: save instance id... "
          echo "${cloudinit_instanceid}" > /var/.cloudinit
          echo "[done]"
          ${MUST_REBOOT:-false}&& {
            echo "[INFO]: Cloudinit: applied settings; must reboot..."
            /bin/systemctl --no-block reboot
          }

          exit 0 

# issue
    - path: /etc/console-login-helper-messages/issue.d/00_warning.issue
      mode: 0644
      contents:
        inline: |

          Welcome this server

           By accessing this system, you consent to the following conditions:
           - This system is for authorized use only.
           - Any or all uses of this system and all files on this system may be monitored.
           - Communications using, or data stored on, this system are not private.

# ssh banner
    - path: /etc/issue
      overwrite: true
      mode: 0644
      contents:
        inline: |

          Welcome this server

           By accessing this system, you consent to the following conditions:
           - This system is for authorized use only.
           - Any or all uses of this system and all files on this system may be monitored.
           - Communications using, or data stored on, this system are not private.

# ssh banner
    - path: /etc/issue.net
      overwrite: true
      mode: 0644
      contents:
        inline: |

          Welcome this server

           By accessing this system, you consent to the following conditions:
           - This system is for authorized use only.
           - Any or all uses of this system and all files on this system may be monitored.
           - Communications using, or data stored on, this system are not private.

#blacklist protocol/drivers
    - path: /etc/modprobe.d/blacklist.conf
      mode: 0644
      contents:
        inline: |
          install cramfs /bin/true
          install hfs /bin/true
          install hfsplus /bin/true
          install jffs2 /bin/true
          install squashfs /bin/true
          install udf /bin/true
          blacklist firewire-core
          blacklist usb-storage
          install tipc /bin/true
          blacklist tipc
          install rds /bin/true
          blacklist rds
          install sctp /bin/true
          blacklist sctp
          install dccp /bin/true
          blacklist dccp

#harden ssh
    - path: /etc/ssh/sshd_config.d/hardening.conf
      mode: 0644
      contents:
        inline: |
          AllowAgentForwarding no
          X11Forwarding NO
          TCPKeepAlive no
          MaxSessions 2
          MaxAuthTries 3
          LogLevel VERBOSE
          Compression no
          ClientAliveCountMax 2
          AllowTcpForwarding no
          port 59500
          Banner /etc/issue.net
          
#Disabling core dumps
    - path: /etc/security/limits.d/disablecoredumps.conf
      mode: 0644
      contents:
        inline: |
          * hard core 0
          * soft core 0

# kernel config
    - path: /etc/sysctl.d/20-silence-audit.conf
      mode: 0644      
      contents:
        inline: |
          # Raise console message logging level from DEBUG (7) to WARNING (4)
          # to hide audit messages from the interactive console
          kernel.printk = 4

    - path: /etc/sysctl.d/90-sysctl.conf
      mode: 0644      
      contents:
        inline: |
          fs.protected_fifos = 2
          dev.tty.ldisc_autoload = 0
          fs.protected_hardlinks = 1
          fs.protected_symlinks = 1
          fs.protected_regular = 2
          fs.suid_dumpable = 0
          kernel.core_uses_pid = 1
          kernel.dmesg_restrict = 1
          kernel.kptr_restrict = 2
          kernel.panic = 60
          kernel.panic_on_oops = 60
          kernel.perf_event_paranoid = 3
          kernel.randomize_va_space = 2
          kernel.sysrq = 0
          kernel.unprivileged_bpf_disabled = 1
          kernel.yama.ptrace_scope = 2
          net.core.bpf_jit_harden = 2
          net.ipv4.conf.all.forwarding = 0
          net.ipv4.conf.all.accept_redirects = 0
          net.ipv4.conf.all.accept_source_route = 0
          net.ipv4.conf.all.log_martians = 1
          net.ipv4.conf.all.rp_filter = 1
          net.ipv4.conf.all.secure_redirects = 0
          net.ipv4.conf.all.send_redirects = 0
          net.ipv4.conf.all.shared_media = 0
          net.ipv4.conf.default.accept_redirects = 0
          net.ipv4.conf.default.accept_source_route = 0
          net.ipv4.conf.default.log_martians = 1
          net.ipv4.conf.default.rp_filter= 1
          net.ipv4.conf.default.secure_redirects = 0
          net.ipv4.conf.default.send_redirects = 0
          net.ipv4.conf.default.shared_media = 0
          net.ipv4.icmp_echo_ignore_broadcasts = 1
          net.ipv4.icmp_ignore_bogus_error_responses = 1
          net.ipv4.ip_forward = 0
          net.ipv4.tcp_challenge_ack_limit = 1000000
          net.ipv4.tcp_invalid_ratelimit = 500
          net.ipv4.tcp_max_syn_backlog = 20480
          net.ipv4.tcp_rfc1337 = 1
          net.ipv4.tcp_syn_retries = 5
          net.ipv4.tcp_synack_retries = 2
          net.ipv4.tcp_syncookies = 1
          net.ipv4.tcp_timestamps = 0
          net.ipv6.conf.all.accept_ra = 0
          net.ipv6.conf.all.accept_redirects = 0
          net.ipv6.conf.all.accept_source_route = 0
          net.ipv6.conf.all.forwarding = 0
          net.ipv6.conf.all.use_tempaddr = 2
          net.ipv6.conf.default.accept_ra = 0
          net.ipv6.conf.default.accept_ra_defrtr = 0
          net.ipv6.conf.default.accept_ra_pinfo = 0
          net.ipv6.conf.default.accept_ra_rtr_pref = 0
          net.ipv6.conf.default.accept_redirects = 0
          net.ipv6.conf.default.accept_source_route = 0
          net.ipv6.conf.default.autoconf = 0
          net.ipv6.conf.default.dad_transmits = 0
          net.ipv6.conf.default.max_addresses = 1
          net.ipv6.conf.default.router_solicitations = 0
          net.ipv6.conf.default.use_tempaddr = 2
          net.netfilter.nf_conntrack_max = 2000000
          net.netfilter.nf_conntrack_tcp_loose = 0
          net.ipv6.conf.ens18.accept_ra_rtr_pref = 0
          vm.max_map_count = 1048575
          
    - path: /etc/zincati/config.d/55-updates-strategy.toml
      mode: 0644     
      contents:
        inline: |
          [updates]
          strategy = "periodic"

          [updates.periodic]
          time_zone = "Europe/Warsaw"

          [[updates.periodic.window]]
          days = [ "Sun" ]
          start_time = "03:30"
          length_minutes = 60

# geco-motd.service
systemd:
  units:
    - name: geco-motd.service
      enabled: true
      contents: |
        [Unit]
        Description=Geco-iT Motd
        Before=console-login-helper-messages-motdgen.service
        After=network-online.target

        [Service]
        Type=oneshot
        ExecStart=/usr/local/bin/geco-motd
        RemainAfterExit=yes

        [Install]
        WantedBy=multi-user.target
        
# docker.service
    - name: docker.service
      enabled: true

# geco-cloudinit: apply cloudinit settings on boot
    - name: geco-cloudinit.service
      enabled: true
      contents: |
        [Unit]
        Description=Geco-iT Cloudinit
        Wants=network-online.target
        After=network.target network-online.target
 
        [Service]
        Type=oneshot
        TimeoutStartSec=0
        ExecStart=/usr/local/bin/geco-cloudinit
        RemainAfterExit=yes
 
        [Install]
        WantedBy=multi-user.target

# qemu-guest-agent
    - name: setup-qemu-guest-agent.service
      enabled: true
      contents: |
        [Unit]
        Description=Setup Qemu Guest Agent
        After=network-online.target
        Require=network-online.target
        ConditionKernelCommandLine=ignition.platform.id=qemu
        ConditionPathExists=!/var/lib/qemu-guest-agent.stamp

        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/bin/rpm-ostree install qemu-guest-agent
        ExecStart=/bin/touch /var/lib/qemu-guest-agent.stamp
        ExecStart=/bin/systemctl --no-block reboot

        [Install]
        WantedBy=multi-user.target

# fstrim
    - name: fstrim.timer
      enabled: true
 
    - name: fstrim.service
      dropins:
        - name: override.conf
          contents: |
            [Service]
            ExecStart=
            ExecStart=/sbin/fstrim -av