Архив рубрики: Скрипты

Установка Nextcloud на CentOS 8 используя скрипт. Nginx.

Для автоматической установки Nextcloud на CentOS 8 необходимо создать скрипт

nano avto_nextcloud_v01.sh

1	nano avto_nextcloud_v01.sh

#!/bin/sh
# You MUST set the SERVERNAME here:
SERVERNAME=nextcloud.example.com

# These values are used to generate a ssl certificate.  You can/should replace with LetsEncrypt after the build
COUNTRY=RU
STATE=-
CITY=Kolomna
ORG="Test ORG"
ORG_UNIT=Nextcloud

# This is the name of the database that will get created for nextcloud
DBNAME=nextcloud
# This is the username that is needed for the nextcloud database.  NOTE: This is not a nextcloud user account
USER=nextclouduser
# This is the name of the nextcloud Admin user
ADMIN=administrator

# These values increase the limits for nextcloud:
# BODY sets the client_max_body_size in the nginx nextcloud.conf file
BODY=40960M
# FILESIZE sets the upload_max_filesize in /etc/php.ini
FILESIZE=102400M

# This generates a random password for the root account of mariadb.  You can change it if you wish
MARIADBPASSWORD=`date +%s | sha256sum | base64 | head -c 16`
sleep 1 # We need to sleep 1 to change the password, otherwise we end up with the same hash
# This generates a random password for the nextcloud user account in mariadb.  You can change it if you wish
APPPASSWORD=`date +%s | sha256sum | base64 | head -c 16`
sleep 1 # We need to sleep 1 to change the password, otherwise we end up with the same hash
# This generates a random password for the admin user account password:
ADMINPASS=`date +%s | sha256sum | base64 | head -c 16`

# This will save the values that are needed for setup and accessing mariadb in /root/mariadb.txt
echo -e "MariaDB root password is $MARIADBPASSWORD" >> /root/mariadb.txt
echo -e "App DB is $DBNAME, the Username is $USER and the password is $APPPASSWORD" >> /root/mariadb.txt
# This will save the admin username and password for nextcloud
echo -e "The admin username is $ADMIN and the password is $ADMINPASS" >> /root/nextcloud_admin.txt

##########################################################################
############## NO CHANGES FROM HERE DOWN SHOULD BE REQUIRED ##############
##########################################################################

sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
dnf -y install nginx mariadb-server mariadb php php-mysqlnd php-fpm php-opcache php-gd php-xml php-mbstring wget unzip php-common php-gd php-json php-curl php-zip php-xml php-mbstring php-bz2 php-intl php-process apcu-panel php-pecl-apcu
sed -i 's/user\ =\ apache/user\ =\ nginx/g' /etc/php-fpm.d/www.conf
sed -i 's/group\ =\ apache/group\ =\ nginx/g' /etc/php-fpm.d/www.conf
sed -i "s/upload_max_filesize = 2M/upload_max_filesize = $FILESIZE/g" /etc/php.ini
sed -i 's/opcache.max_accelerated_files=4000/opcache.max_accelerated_files=10000/g' /etc/php.d/10-opcache.ini
echo "opcache.revalidate_freq=1" >> /etc/php.d/10-opcache.ini
sed -i 's/memory_limit\ =\ 128M/memory_limit\ =\ 512M/g' /etc/php.ini

echo "env[PATH] = /usr/local/bin:/usr/bin:/bin" >> /etc/php-fpm.d/www.conf
systemctl enable nginx --now
systemctl enable mariadb --now
systemctl enable php-fpm --now
firewall-cmd --permanent --add-service=https
firewall-cmd --reload
chown nginx:nginx /usr/share/nginx/html -R
mkdir /etc/nginx/ssl
openssl req -x509 -nodes -days 36500 -newkey rsa:2048 -keyout /etc/nginx/ssl/nextcloud.key -out /etc/nginx/ssl/nextcloud.crt -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORG/OU=$ORG_UNIT/CN=$SERVERNAME"
cat << EOF >> /tmp/setup.sql
SET PASSWORD FOR 'root'@'localhost' = PASSWORD('$MARIADBPASSWORD');
DELETE FROM mysql.user WHERE User='';
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
DROP DATABASE IF EXISTS test;
DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
CREATE DATABASE $DBNAME DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER $USER@localhost IDENTIFIED BY '$APPPASSWORD';
GRANT ALL PRIVILEGES ON $DBNAME.* TO $USER@localhost;
FLUSH PRIVILEGES;
quit
EOF
mysql -u root < /tmp/setup.sql
wget https://download.nextcloud.com/server/releases/latest-18.zip
unzip latest-18.zip -d /usr/share/nginx/
chown nginx:nginx /usr/share/nginx/nextcloud/ -R
cat << EOF >> /etc/nginx/conf.d/nextcloud.conf
server {
    #listen 80;
    listen 443 ssl;

    server_name $SERVERNAME;
    ssl_certificate /etc/nginx/ssl/nextcloud.crt;
    ssl_certificate_key /etc/nginx/ssl/nextcloud.key;

    # Add headers to serve security related headers
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;
    add_header Referrer-Policy no-referrer;

    #I found this header is needed on Debian/Ubuntu/CentOS/RHEL, but not on Arch Linux.
    add_header X-Frame-Options "SAMEORIGIN";

    # Path to the root of your installation
    root /usr/share/nginx/nextcloud/;

    access_log /var/log/nginx/nextcloud.access;
    error_log /var/log/nginx/nextcloud.error;

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # The following 2 rules are only needed for the user_webfinger app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
    # last;

    location = /.well-known/carddav {
        return 301 \$scheme://\$host/remote.php/dav;
    }
    location = /.well-known/caldav {
       return 301 \$scheme://\$host/remote.php/dav;
    }

    location ~ /.well-known/acme-challenge {
      allow all;
    }

    # set max upload size
    client_max_body_size $BODY;
    fastcgi_buffers 64 4K;

    # Disable gzip to avoid the removal of the ETag header
    gzip off;

    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;

    error_page 403 /core/templates/403.php;
    error_page 404 /core/templates/404.php;

    location / {
       rewrite ^ /index.php\$uri;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
       deny all;
    }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
       deny all;
     }

    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
       include fastcgi_params;
       fastcgi_split_path_info ^(.+\.php)(/.*)$;
       fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
       fastcgi_param PATH_INFO \$fastcgi_path_info;
       #Avoid sending the security headers twice
       fastcgi_param modHeadersAvailable true;
       fastcgi_param front_controller_active true;
       fastcgi_pass unix:/run/php-fpm/www.sock;
       fastcgi_intercept_errors on;
       fastcgi_request_buffering off;
       fastcgi_send_timeout 3600;
       fastcgi_read_timeout 3600;
    }

    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
       try_files \$uri/ =404;
       index index.php;
    }

    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~* \.(?:css|js)$ {
        try_files \$uri /index.php\$uri\$is_args\$args;
        add_header Cache-Control "public, max-age=7200";
        # Add headers to serve security related headers (It is intended to
        # have those duplicated to the ones above)
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;
        # Optional: Don't log access to assets
        access_log off;
   }

   location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ {
        try_files \$uri /index.php\$uri\$is_args\$args;
        # Optional: Don't log access to other assets
        access_log off;
   }
}
EOF
systemctl reload nginx
setsebool -P httpd_execmem 1
systemctl reload php-fpm
chcon -t httpd_sys_rw_content_t /usr/share/nginx/nextcloud/ -R
setsebool -P httpd_can_network_connect 1
setfacl -R -m u:nginx:rwx /var/lib/php/opcache/
setfacl -R -m u:nginx:rwx /var/lib/php/session/
setfacl -R -m u:nginx:rwx /var/lib/php/wsdlcache/
mkdir /usr/share/nginx/nextcloud-data
chown nginx:nginx /usr/share/nginx/nextcloud-data -R
chcon -t httpd_sys_rw_content_t /usr/share/nginx/nextcloud-data/ -R
cd /usr/share/nginx/nextcloud/
sudo -u nginx php occ  maintenance:install --database "mysql" --database-name "$DBNAME"  --database-user "$USER" --database-pass "$APPPASSWORD" --admin-user "$ADMIN" --admin-pass "$ADMINPASS" --data-dir "/usr/share/nginx/nextcloud-data"
sed -i '$d' /usr/share/nginx/nextcloud/config/config.php
# I put three \\\ in the below echo file because \ needs to be escaped out.  The result is two \\
echo "  'memcache.local' => '\\\OC\\\Memcache\\\APCu'," >> /usr/share/nginx/nextcloud/config/config.php
echo ");" >> /usr/share/nginx/nextcloud/config/config.php
# For some reason, when you configure nextcloud from the command line, you need to modify trusted_domains
sed -i "s/0 => 'localhost/0 => '*/g" /usr/share/nginx/nextcloud/config/config.php
cat /root/nextcloud_admin.txt

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

#!/bin/sh

# You MUST set the SERVERNAME here:

SERVERNAME=nextcloud.example.com

# These values are used to generate a ssl certificate. You can/should replace with LetsEncrypt after the build

COUNTRY=RU

STATE=-

CITY=Kolomna

ORG="Test ORG"

ORG_UNIT=Nextcloud

# This is the name of the database that will get created for nextcloud

DBNAME=nextcloud

# This is the username that is needed for the nextcloud database. NOTE: This is not a nextcloud user account

USER=nextclouduser

# This is the name of the nextcloud Admin user

ADMIN=administrator

# These values increase the limits for nextcloud:

# BODY sets the client_max_body_size in the nginx nextcloud.conf file

BODY=40960M

# FILESIZE sets the upload_max_filesize in /etc/php.ini

FILESIZE=102400M

# This generates a random password for the root account of mariadb. You can change it if you wish

MARIADBPASSWORD=`date +%s | sha256sum | base64 | head -c 16`

sleep 1 # We need to sleep 1 to change the password, otherwise we end up with the same hash

# This generates a random password for the nextcloud user account in mariadb. You can change it if you wish

APPPASSWORD=`date +%s | sha256sum | base64 | head -c 16`

sleep 1 # We need to sleep 1 to change the password, otherwise we end up with the same hash

# This generates a random password for the admin user account password:

ADMINPASS=`date +%s | sha256sum | base64 | head -c 16`

# This will save the values that are needed for setup and accessing mariadb in /root/mariadb.txt

echo -e "MariaDB root password is $MARIADBPASSWORD" >> /root/mariadb.txt

echo -e "App DB is $DBNAME, the Username is $USER and the password is $APPPASSWORD" >> /root/mariadb.txt

# This will save the admin username and password for nextcloud

echo -e "The admin username is $ADMIN and the password is $ADMINPASS" >> /root/nextcloud_admin.txt

##########################################################################

############## NO CHANGES FROM HERE DOWN SHOULD BE REQUIRED ##############

##########################################################################

sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config

dnf -y install nginx mariadb-server mariadb php php-mysqlnd php-fpm php-opcache php-gd php-xml php-mbstring wget unzip php-common php-gd php-json php-curl php-zip php-xml php-mbstring php-bz2 php-intl php-process apcu-panel php-pecl-apcu

sed -i 's/user\ =\ apache/user\ =\ nginx/g' /etc/php-fpm.d/www.conf

sed -i 's/group\ =\ apache/group\ =\ nginx/g' /etc/php-fpm.d/www.conf

sed -i "s/upload_max_filesize = 2M/upload_max_filesize = $FILESIZE/g" /etc/php.ini

sed -i 's/opcache.max_accelerated_files=4000/opcache.max_accelerated_files=10000/g' /etc/php.d/10-opcache.ini

echo "opcache.revalidate_freq=1" >> /etc/php.d/10-opcache.ini

sed -i 's/memory_limit\ =\ 128M/memory_limit\ =\ 512M/g' /etc/php.ini

echo "env[PATH] = /usr/local/bin:/usr/bin:/bin" >> /etc/php-fpm.d/www.conf

systemctl enable nginx --now

systemctl enable mariadb --now

systemctl enable php-fpm --now

firewall-cmd --permanent --add-service=https

firewall-cmd --reload

chown nginx:nginx /usr/share/nginx/html -R

mkdir /etc/nginx/ssl

openssl req -x509 -nodes -days 36500 -newkey rsa:2048 -keyout /etc/nginx/ssl/nextcloud.key -out /etc/nginx/ssl/nextcloud.crt -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORG/OU=$ORG_UNIT/CN=$SERVERNAME"

cat << EOF >> /tmp/setup.sql

SET PASSWORD FOR 'root'@'localhost' = PASSWORD('$MARIADBPASSWORD');

DELETE FROM mysql.user WHERE User='';

DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');

DROP DATABASE IF EXISTS test;

DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';

CREATE DATABASE $DBNAME DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

CREATE USER $USER@localhost IDENTIFIED BY '$APPPASSWORD';

GRANT ALL PRIVILEGES ON $DBNAME.* TO $USER@localhost;

FLUSH PRIVILEGES;

quit

EOF

mysql -u root < /tmp/setup.sql

wget https://download.nextcloud.com/server/releases/latest-18.zip

unzip latest-18.zip -d /usr/share/nginx/

chown nginx:nginx /usr/share/nginx/nextcloud/ -R

cat << EOF >> /etc/nginx/conf.d/nextcloud.conf

server {

#listen 80;

listen 443 ssl;

server_name $SERVERNAME;

ssl_certificate /etc/nginx/ssl/nextcloud.crt;

ssl_certificate_key /etc/nginx/ssl/nextcloud.key;

# Add headers to serve security related headers

add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";

add_header X-Content-Type-Options nosniff;

add_header X-XSS-Protection "1; mode=block";

add_header X-Robots-Tag none;

add_header X-Download-Options noopen;

add_header X-Permitted-Cross-Domain-Policies none;

add_header Referrer-Policy no-referrer;

#I found this header is needed on Debian/Ubuntu/CentOS/RHEL, but not on Arch Linux.

add_header X-Frame-Options "SAMEORIGIN";

# Path to the root of your installation

root /usr/share/nginx/nextcloud/;

access_log /var/log/nginx/nextcloud.access;

error_log /var/log/nginx/nextcloud.error;

location = /robots.txt {

allow all;

log_not_found off;

access_log off;

}

# The following 2 rules are only needed for the user_webfinger app.

# Uncomment it if you're planning to use this app.

#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;

#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json

# last;

location = /.well-known/carddav {

return 301 \$scheme://\$host/remote.php/dav;

}

location = /.well-known/caldav {

return 301 \$scheme://\$host/remote.php/dav;

}

location ~ /.well-known/acme-challenge {

allow all;

}

# set max upload size

client_max_body_size $BODY;

fastcgi_buffers 64 4K;

# Disable gzip to avoid the removal of the ETag header

gzip off;

# Uncomment if your server is build with the ngx_pagespeed module

# This module is currently not supported.

#pagespeed off;

error_page 403 /core/templates/403.php;

error_page 404 /core/templates/404.php;

location / {

rewrite ^ /index.php\$uri;

}

location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {

deny all;

}

location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {

deny all;

}

location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {

include fastcgi_params;

fastcgi_split_path_info ^(.+\.php)(/.*)$;

fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;

fastcgi_param PATH_INFO \$fastcgi_path_info;

#Avoid sending the security headers twice

fastcgi_param modHeadersAvailable true;

fastcgi_param front_controller_active true;

fastcgi_pass unix:/run/php-fpm/www.sock;

fastcgi_intercept_errors on;

fastcgi_request_buffering off;

fastcgi_send_timeout 3600;

fastcgi_read_timeout 3600;

}

location ~ ^/(?:updater|ocs-provider)(?:$|/) {

try_files \$uri/ =404;

index index.php;

}

# Adding the cache control header for js and css files

# Make sure it is BELOW the PHP block

location ~* \.(?:css|js)$ {

try_files \$uri /index.php\$uri\$is_args\$args;

add_header Cache-Control "public, max-age=7200";

# Add headers to serve security related headers (It is intended to

# have those duplicated to the ones above)

add_header X-Content-Type-Options nosniff;

add_header X-XSS-Protection "1; mode=block";

add_header X-Robots-Tag none;

add_header X-Download-Options noopen;

add_header X-Permitted-Cross-Domain-Policies none;

# Optional: Don't log access to assets

access_log off;

}

location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ {

try_files \$uri /index.php\$uri\$is_args\$args;

# Optional: Don't log access to other assets

access_log off;

}

EOF

systemctl reload nginx

setsebool -P httpd_execmem 1

systemctl reload php-fpm

chcon -t httpd_sys_rw_content_t /usr/share/nginx/nextcloud/ -R

setsebool -P httpd_can_network_connect 1

setfacl -R -m u:nginx:rwx /var/lib/php/opcache/

setfacl -R -m u:nginx:rwx /var/lib/php/session/

setfacl -R -m u:nginx:rwx /var/lib/php/wsdlcache/

mkdir /usr/share/nginx/nextcloud-data

chown nginx:nginx /usr/share/nginx/nextcloud-data -R

chcon -t httpd_sys_rw_content_t /usr/share/nginx/nextcloud-data/ -R

cd /usr/share/nginx/nextcloud/

sudo -u nginx php occ maintenance:install --database "mysql" --database-name "$DBNAME" --database-user "$USER" --database-pass "$APPPASSWORD" --admin-user "$ADMIN" --admin-pass "$ADMINPASS" --data-dir "/usr/share/nginx/nextcloud-data"

sed -i '$d' /usr/share/nginx/nextcloud/config/config.php

# I put three \\\ in the below echo file because \ needs to be escaped out. The result is two \\

echo " 'memcache.local' => '\\\OC\\\Memcache\\\APCu'," >> /usr/share/nginx/nextcloud/config/config.php

echo ");" >> /usr/share/nginx/nextcloud/config/config.php

# For some reason, when you configure nextcloud from the command line, you need to modify trusted_domains

sed -i "s/0 => 'localhost/0 => '*/g" /usr/share/nginx/nextcloud/config/config.php

cat /root/nextcloud_admin.txt

и запустить скрипт командой

sh avto_nextcloud_v01.sh

1	sh avto_nextcloud_v01.sh

bash cкрипт резервного копирования на FTP

Итак, как работает этот скрипт: – архивирует и пакует необходимые папки и файлы в папку $BDIR, – делает дамп ваших баз данных (mysql) и пакует их в папку $BDIR; – все, что напаковал сжимает одним файлом ($BFILE) в $BDIR; – затем, с помощью curlftpfs монтирует ftp папку для бекапов в папку на компьютере и заливает… Читать далее »

Оптимизация настроек Mysql с помощью Mysqltuner

Mysqltuner — это perl-скрипт, который анализирует статистику работы Mysql и выдает свои рекомендации по оптимизации настроек Mysql сервера. Скачать скрипт можно следующим образом:

wget https://raw.githubusercontent.com/major/MySQLTuner-perl/master/mysqltuner.pl

1	wget https://raw.githubusercontent.com/major/MySQLTuner-perl/master/mysqltuner.pl

Если возникает ошибка вида:

ERROR: cannot verify raw.githubusercontent.com's certificate, issued by '/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA':
 Unable to locally verify the issuer's authority.
 To connect to raw.githubusercontent.com insecurely, use `--no-check-certificate'.

ERROR: cannot verify raw.githubusercontent.com's certificate, issued by '/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA':

Unable to locally verify the issuer's authority.

To connect to raw.githubusercontent.com insecurely, use `--no-check-certificate'.

Запускаем с ключом –no-check-certificate:

wget https://raw.githubusercontent.com/major/MySQLTuner-perl/master/mysqltuner.pl --no-check-certificate

1	wget https://raw.githubusercontent.com/major/MySQLTuner-perl/master/mysqltuner.pl --no-check-certificate

Также, можно произвести установку: Debian/Ubuntu:

apt-get -y install mysqltuner

1	apt-get -y install mysqltuner

CentOS:

yum -y install mysqltuner

1	yum -y install mysqltuner

Чтобы данные анализа и статистика были более корректными, сервер Mysql должен проработать некоторое… Читать далее »

Удаление файлов на FTP старше X дней

#!/usr/bin/php
<?
$host = "ftp.host.ru";
$dir = "backup/blabla";
$user = "ftp_user346";
$passwd = "p0sw0rd";
$interval = 3600*24*8; # 8 days
$passive = true; # my FTP server only works in PASV mode
$DEBUG = 1;

// Парсим параметры вызова скрипта
//var_dump($argv);
$my_path = trim($argv[1]);
$my_days = intval($argv[2]);
$my_confirm = @$argv[3];

if(strlen($my_path)==0) die("[CLEANUP_BACKUP][ERROR] Path can not be empty!\n");
elseif(!$my_days) die("[CLEANUP_BACKUP][ERROR] Days count error\n");

$interval =  $my_days * 3600 * 24;

print "=========================================================\n";
print date("c")."\n";
print "Parsing parametres.......................................\n";
print "Host: {$host}\n";
print "Login: {$user}\n";
print "Path: {$my_path}\n";
print "Max days old: $my_days ($interval seconds)\n";
print "=========================================================\n";

$ftp = ftp_connect($host) or die("[CLEANUP_BACKUP][ERROR] Couldn't connect to $host"); 
if (@ftp_login($ftp, $user , $passwd)) {
    echo "Connected as $user\n";
} else {
    echo "[CLEANUP_BACKUP][ERROR] Couldn't connect as $user\n";
}
ftp_pasv($ftp, $passive);
echo ftp_pwd($ftp);

// try to change the directory to somedir
if (ftp_chdir($ftp, $my_path)) {
    echo "Current directory is now: " . ftp_pwd($ftp) . "\n";
} else { 
    echo "[CLEANUP_BACKUP][ERROR] Couldn't change directory\n";
}



// Парсим список файлов и ищем старые файлы
$files = ftp_nlist($ftp, ".");
var_dump($file);
if(sizeof($files)==0)die("[CLEANUP_BACKUP][ERROR] Backup files list is empty!\n");
echo "[CLEANUP_BACKUP][INFO] Total files: ".sizeof($files)."\n";

$arDeleteFiles=array(); //Массив списка файлов на удаление
foreach($files as $file){
    $mdtm = ftp_mdtm($ftp, $file);
    if ($mdtm != -1) {
        //Проверяем, что время просрочилось
        $diff_time = time() - $mdtm;
        $percent = round($diff_time/$interval,5)*100;
        echo "[LOOP]  $diff_time/$interval \t ({$percent}%) $file : ";
        if($diff_time > $interval){
            echo "File is too old... delete plz...\n";
            if($my_confirm){
                //Добавляем файл в очередь на удаление
                $arDeleteFiles[]=$file;
            }
        }else{ 
            echo "Good\n";
        }
    }
    else
    {
        echo "[CLEANUP_BACKUP][ERROR] {$file} cant look up mod time\n";
    }
}

//Удаляем файл и проверяем, что удаляется не более 30% файлов
if(sizeof($arDeleteFiles)>0 ){
    if((sizeof($arDeleteFiles)/sizeof($files)) > 0.3 )die("[CLEANUP_BACKUP][ERROR] attemp to delete more then 30% of files!");
    foreach($arDeleteFiles as $DelFile){
        if(ftp_delete($ftp, $file))echo "{$DelFile} - deleted\n";
        else echo "{$DelFile} - error - can not delete file\n";
    }
}
ftp_close($ftp);

#!/usr/bin/php

$host = "ftp.host.ru";

$dir = "backup/blabla";

$user = "ftp_user346";

$passwd = "p0sw0rd";

$interval = 3600*24*8; # 8 days

$passive = true; # my FTP server only works in PASV mode

$DEBUG = 1;

// Парсим параметры вызова скрипта

//var_dump($argv);

$my_path = trim($argv[1]);

$my_days = intval($argv[2]);

$my_confirm = @$argv[3];

if(strlen($my_path)==0) die("[CLEANUP_BACKUP][ERROR] Path can not be empty!\n");

elseif(!$my_days) die("[CLEANUP_BACKUP][ERROR] Days count error\n");

$interval = $my_days * 3600 * 24;

print "=========================================================\n";

print date("c")."\n";

print "Parsing parametres.......................................\n";

print "Host: {$host}\n";

print "Login: {$user}\n";

print "Path: {$my_path}\n";

print "Max days old: $my_days ($interval seconds)\n";

print "=========================================================\n";

$ftp = ftp_connect($host) or die("[CLEANUP_BACKUP][ERROR] Couldn't connect to $host");

if (@ftp_login($ftp, $user , $passwd)) {

echo "Connected as $user\n";

} else {

echo "[CLEANUP_BACKUP][ERROR] Couldn't connect as $user\n";

}

ftp_pasv($ftp, $passive);

echo ftp_pwd($ftp);

// try to change the directory to somedir

if (ftp_chdir($ftp, $my_path)) {

echo "Current directory is now: " . ftp_pwd($ftp) . "\n";

} else {

echo "[CLEANUP_BACKUP][ERROR] Couldn't change directory\n";

}

// Парсим список файлов и ищем старые файлы

$files = ftp_nlist($ftp, ".");

var_dump($file);

if(sizeof($files)==0)die("[CLEANUP_BACKUP][ERROR] Backup files list is empty!\n");

echo "[CLEANUP_BACKUP][INFO] Total files: ".sizeof($files)."\n";

$arDeleteFiles=array(); //Массив списка файлов на удаление

foreach($files as $file){

$mdtm = ftp_mdtm($ftp, $file);

if ($mdtm != -1) {

//Проверяем, что время просрочилось

$diff_time = time() - $mdtm;

$percent = round($diff_time/$interval,5)*100;

echo "[LOOP] $diff_time/$interval \t ({$percent}%) $file : ";

if($diff_time > $interval){

echo "File is too old... delete plz...\n";

if($my_confirm){

//Добавляем файл в очередь на удаление

$arDeleteFiles[]=$file;

}

}else{

echo "Good\n";

}

else

{

echo "[CLEANUP_BACKUP][ERROR] {$file} cant look up mod time\n";

}

//Удаляем файл и проверяем, что удаляется не более 30% файлов

if(sizeof($arDeleteFiles)>0 ){

if((sizeof($arDeleteFiles)/sizeof($files)) > 0.3 )die("[CLEANUP_BACKUP][ERROR] attemp to delete more then 30% of files!");

foreach($arDeleteFiles as $DelFile){

if(ftp_delete($ftp, $file))echo "{$DelFile} - deleted\n";

else echo "{$DelFile} - error - can not delete file\n";

}

ftp_close($ftp);

Бэкап каталогов с конфигурационными файлами. bcp_data_01_v03.sh

Пример скрипта бэкапа каталогов с конфигурационными файлами:

nano bcp_data_01_v03.sh

1	nano bcp_data_01_v03.sh

#!/bin/bash
#Присваиваем текущую дату переменной date день.месяц.год.часы.минуты.секунды
date=`date '+%Y%m%d_%H.%M.%S'`
#Присваеваем переменную каталогу хранения бэкапов
bcp_dir='/bcp/everyday_data'
#Присваеваем переменные
ftp_user='ftp-test-user'
ftp_password='ftp-test-password'
ftp_host='ftp.test.ru'
ftp_dir='everyday_data/'
#Бэкап каталогов с конфигурационными файлами
tar -zcvpf $bcp_dir/bcp_data_01_v01-$date.tar.gz /etc /var/lib/asterisk
#Чистим, удаляя файлы из папки $bcp_dir старше 10-ти дней
/usr/bin/find $bcp_dir -type f -mtime +10 -exec rm -rf {} \;
#Отправляем бэкап на FTP сервер
/usr/bin/curl --upload-file "$bcp_dir/bcp_data_01_v01-$date.tar.gz" ftp://$ftp_user:$ftp_password@$ftp_host/$ftp_dir

#!/bin/bash

#Присваиваем текущую дату переменной date день.месяц.год.часы.минуты.секунды

date=`date '+%Y%m%d_%H.%M.%S'`

#Присваеваем переменную каталогу хранения бэкапов

bcp_dir='/bcp/everyday_data'

#Присваеваем переменные

ftp_user='ftp-test-user'

ftp_password='ftp-test-password'

ftp_host='ftp.test.ru'

ftp_dir='everyday_data/'

#Бэкап каталогов с конфигурационными файлами

tar -zcvpf $bcp_dir/bcp_data_01_v01-$date.tar.gz /etc /var/lib/asterisk

#Чистим, удаляя файлы из папки $bcp_dir старше 10-ти дней

/usr/bin/find $bcp_dir -type f -mtime +10 -exec rm -rf {} \;

#Отправляем бэкап на FTP сервер

/usr/bin/curl --upload-file "$bcp_dir/bcp_data_01_v01-$date.tar.gz" ftp://$ftp_user:$ftp_password@$ftp_host/$ftp_dir

Бэкап всей БД со всеми пользователями. bcp_bd_mysql_v03.sh

Пример скрипта бэкапа всей БД со всеми пользователями:

nano bcp_bd_mysql_v03.sh

1	nano bcp_bd_mysql_v03.sh

#!/bin/bash
#Присваиваем текущую дату переменной date день.месяц.год.часы.минуты.секунды
date=`date '+%Y%m%d_%H.%M.%S'`
#Присваиваем переменную каталогу хранения бэкапов
bcp_dir='/bcp/everyday_bd'
#Присваиваем переменные
db_user='db-test-user'
db_password='db-test-password'
ftp_user='ftp-test-user'
ftp_password='ftp-test-password'
ftp_host='ftp.test.ru'
ftp_dir='everyday_bd/'
#Создаем бэкап всей БД со всеми пользователями
mysqldump -u $db_user -p$db_password --all-databases > $bcp_dir/bcp_bd_mysql_v01_$date.sql
#Архивируем созданный бэкап
tar -zcvpf $bcp_dir/bcp_bd_mysql_v01-$date.tar.gz $bcp_dir/bcp_bd_mysql_v01_$date.sql
#Удаляем исходник бэкапа БД
rm $bcp_dir/bcp_bd_mysql_v01_$date.sql
#Чистим, удаляя файлы из папки $bcp_dir старше 10-ти дней
/usr/bin/find $bcp_dir -type f -mtime +10 -exec rm -rf {} \;
#Отправляем бэкап на FTP сервер
/usr/bin/curl --upload-file "$bcp_dir/bcp_bd_mysql_v01-$date.tar.gz" ftp://$ftp_user:$ftp_password@$ftp_host/$ftp_dir

#!/bin/bash

#Присваиваем текущую дату переменной date день.месяц.год.часы.минуты.секунды

date=`date '+%Y%m%d_%H.%M.%S'`

#Присваиваем переменную каталогу хранения бэкапов

bcp_dir='/bcp/everyday_bd'

#Присваиваем переменные

db_user='db-test-user'

db_password='db-test-password'

ftp_user='ftp-test-user'

ftp_password='ftp-test-password'

ftp_host='ftp.test.ru'

ftp_dir='everyday_bd/'

#Создаем бэкап всей БД со всеми пользователями

mysqldump -u $db_user -p$db_password --all-databases > $bcp_dir/bcp_bd_mysql_v01_$date.sql

#Архивируем созданный бэкап

tar -zcvpf $bcp_dir/bcp_bd_mysql_v01-$date.tar.gz $bcp_dir/bcp_bd_mysql_v01_$date.sql

#Удаляем исходник бэкапа БД

rm $bcp_dir/bcp_bd_mysql_v01_$date.sql

#Чистим, удаляя файлы из папки $bcp_dir старше 10-ти дней

/usr/bin/find $bcp_dir -type f -mtime +10 -exec rm -rf {} \;

#Отправляем бэкап на FTP сервер

/usr/bin/curl --upload-file "$bcp_dir/bcp_bd_mysql_v01-$date.tar.gz" ftp://$ftp_user:$ftp_password@$ftp_host/$ftp_dir

Мониторинг сайтов на коленке (bash script)

#/bin/bash
html=/var/www/servers_state.html
while true; do
	echo "<br><br><br>" > $html
	echo '<center><table width="40%" border="1" cellspacing="0" cellpadding="5" >' >> $html
	echo "<tr><td></td><td><b>HOST</b></td><td><b>State</b></td></tr>" >> $html
	i=1
	serverlist=(website1.com website2.com website3.com website4.com website4.com)
	for web in "${serverlist[@]}";do
		state=$(HEAD -t 8 $web |sed -n 1p)
		echo "<tr><td>$i</td><td>$ip</td><td>$state</td></tr>" >> $html
		if [ "$state" != "200 OK" ]
		then
						echo "Something is wrong with $ip" |mail -s "Invalid responce from $web" \ yourmail@domain.com
		fi
	let "i = $i +1"
done
echo "</table>" >> $html
echo "<br>" >> $html
echo "<p>Last updated at $(date +%H:%M:%S)</p>" >> $html
echo "</center>" >> $html
sleep 30
done

#/bin/bash

html=/var/www/servers_state.html

while true; do

echo " " > $html

echo '<center><table width="40%" border="1" cellspacing="0" cellpadding="5" >' >> $html

echo "<tr><td></td><td>HOST</td><td>State</td></tr>" >> $html

i=1

serverlist=(website1.com website2.com website3.com website4.com website4.com)

for web in "${serverlist[@]}";do

state=$(HEAD -t 8 $web |sed -n 1p)

echo "<tr><td>$i</td><td>$ip</td><td>$state</td></tr>" >> $html

if [ "$state" != "200 OK" ]

then

echo "Something is wrong with $ip" |mail -s "Invalid responce from $web" \ yourmail@domain.com

let "i = $i +1"

done

echo "</table>" >> $html

echo " " >> $html

echo "Last updated at $(date +%H:%M:%S)" >> $html

echo "</center>" >> $html

sleep 30

done

Backup mysql базы в docker контейнере

Для бэкапа mysql базы достаточно запустить mysqldump в контейнере и сохранить файл на хост. Делается это все одной командой:

docker exec container_name /usr/bin/mysqldump -u root --password=rootpass db_name > /mnt/backup/db_name.sql

1	docker exec container_name /usr/bin/mysqldump -u root --password=rootpass db_name > /mnt/backup/db_name.sql

Ну и сразу же простенький скрипт приведу по регулярному созданию бэкапов:

#!/bin/bash

DATA=`date +"%Y-%m-%d_%H-%M"`
PATHB=/mnt/backups

# Бэкапим дампом
docker exec container_name /usr/bin/mysqldump -u root --password=rootpass db_name > "$PATHB"/"$DATA"-db_name.sql
# Жмем
/bin/gzip "$PATHB"/"$DATA"-db_name.sql
# Чистим, удаляя файлы старше 10-ти дней
/usr/bin/find "$PATHB" -type f -mtime +10 -exec rm -rf {} \;

#!/bin/bash

DATA=`date +"%Y-%m-%d_%H-%M"`

PATHB=/mnt/backups

# Бэкапим дампом

docker exec container_name /usr/bin/mysqldump -u root --password=rootpass db_name > "$PATHB"/"$DATA"-db_name.sql

# Жмем

/bin/gzip "$PATHB"/"$DATA"-db_name.sql

# Чистим, удаляя файлы старше 10-ти дней

/usr/bin/find "$PATHB" -type f -mtime +10 -exec rm -rf {} \;

На сервере с бэкапами забираем эти файлы через rsync:

/usr/bin/rsync -av -e "ssh -p 17222 -i /root/.ssh/id_rsa" rsyncuser@10.0.0.101:/mnt/backups/* /backups/mysql

1	/usr/bin/rsync -av -e "ssh -p 17222 -i /root/.ssh/id_rsa" rsyncuser@10.0.0.101:/mnt/backups/* /backups/mysql

Я подключаюсь пользователем rsuncuser по ключу из файла /root/.ssh/id_rsa к серверу 10.0.0.101 с… Читать далее »

Защита web сервера от программ для ddos атак

Сразу сделаю оговорку по поводу слова ddos, которое тут не совсем уместно, но я не придумал, как еще популярно объяснить о чем идет речь. От полноценной ddos атаки вы не сможете защититься в рамках настройки веб сервера. У вас просто будет забит весь канал и сервер перестанет отвечать. Если мощности сервера не достаточно для обработки… Читать далее »

Загрузка файла по ftp через консоль в одну команду

/usr/bin/curl --upload-file "/mnt/backup/mysql_zabbix.sql.gz" ftp://backup:'password12345678'@ftp.server.com/backup/zabbix/

1	/usr/bin/curl --upload-file "/mnt/backup/mysql_zabbix.sql.gz" ftp://backup:'password12345678'@ftp.server.com/backup/zabbix/

backup имя пользователя ftp password12345678 пароль от ftp, который я поместил в одиночные кавычки, чтобы экранировать спецсимволы /backup/zabbix директория на удаленном ftp сервере ftp.server.com адрес ftp сервера Если загрузка не работает, можно добавить ключ -v к команде curl, будет подробный лог. Все это было затеяно для бэкапа сервера мониторинга zabbix. Покажу сразу и сам… Читать далее »