View | Details | Raw Unified | Return to bug 15540
Collapse All | Expand All

(-)a/C4/Auth_cas_servers.yaml.orig (-12 lines)
Lines 1-12 Link Here
1
# This file is used for authenticating against multiple CAS servers
2
# If the file Auth_cas_servers.yaml exists, then the casServerUrl syspref will be ignored
3
4
# If you have to authenticate against only one CAS server, which is usually the case,
5
# don't use this file, but the casServerUrl syspref instead
6
7
default: ServerName
8
---
9
  ServerName: "https://example.com/cas"
10
  OtherServerName: "https://example.org/cas"
11
  ThirdServerName: "https://example.edu/cas"
12
(-)a/debian/docs/koha-create.xml (+8 lines)
Lines 40-45 Link Here
40
      <arg><option>--enable-sru</option></arg>
40
      <arg><option>--enable-sru</option></arg>
41
      <arg><option>--sru-port</option> port</arg>
41
      <arg><option>--sru-port</option> port</arg>
42
      <arg><option>--upload-path</option> directory</arg>
42
      <arg><option>--upload-path</option> directory</arg>
43
      <arg><option>--tor</option></arg>
43
      <arg><option>--help</option>|<option>-h</option></arg>
44
      <arg><option>--help</option>|<option>-h</option></arg>
44
45
45
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
46
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
Lines 177-182 Link Here
177
    </varlistentry>
178
    </varlistentry>
178
179
179
    <varlistentry>
180
    <varlistentry>
181
      <term><option>--tor</option></term>
182
      <listitem>
183
        <para>Enable a Tor hidden service (.onion address) for the created instance.</para>
184
      </listitem>
185
    </varlistentry>
186
187
    <varlistentry>
180
      <term><option>--help</option>,<option>-h</option></term>
188
      <term><option>--help</option>,<option>-h</option></term>
181
      <listitem>
189
      <listitem>
182
        <para>Print usage information.</para>
190
        <para>Print usage information.</para>
(-)a/debian/scripts/koha-create (-2 / +174 lines)
Lines 71-76 Options: Link Here
71
                            conjunction with --defaultsql and --populate-db.
71
                            conjunction with --defaultsql and --populate-db.
72
  --upload-path dir         Set a user defined upload_path. It defaults to
72
  --upload-path dir         Set a user defined upload_path. It defaults to
73
                            /var/lib/koha/<instance>/uploads
73
                            /var/lib/koha/<instance>/uploads
74
  --tor                     Automatically set up a Tor hidden service for the OPAC
74
  --help,-h                 Show this help.
75
  --help,-h                 Show this help.
75
76
76
Note: the instance name cannot be longer that 11 chars.
77
Note: the instance name cannot be longer that 11 chars.
Lines 311-316 enable_sru_server() Link Here
311
    fi
312
    fi
312
}
313
}
313
314
315
tor_check_install()
316
{
317
    # Check if Tor is installed
318
319
    # Check if Tor is installed, otherwise do it now
320
    # Repeat for every instance. Do at the beginning so we can stop the installation if necessary.
321
    if [ $(dpkg-query -W -f='${Status}' tor 2>/dev/null | grep -c "ok installed") -eq 0 ]; then
322
        debrelease="$(lsb_release -c | sed 's|.*\W\(.*\)|\1|')"
323
        # Check if Tor repository for this version of GNU/Linux exists
324
        if [ $(curl -sI "http://deb.torproject.org/torproject.org/dists/$debrelease/" | grep -c "200 OK") -eq 0 ]; then
325
            die "Cannot find a Tor release for $debrelease in the official repository. Please install the 'tor' package manually to use the option --tor"
326
        else
327
            # Prompt before adding the official Tor repo and installing Tor
328
            read -r -p "Tor is not installed. Do you want Koha to automatically set up the Tor repository and install Tor? [y/N] " response
329
            if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]
330
            then
331
                TORINSTALLATION="yes"
332
            else
333
                die "You need to install Tor to use the --tor option. Either accept or run koha-create without the --tor option."
334
            fi
335
        fi
336
    else
337
        if [ -e "/etc/tor/torrc-koha" ]; then
338
            TORINSTALLATION="previous"
339
        else
340
            TORINSTALLATION="manual"
341
            # Prompt to overwrite previous Tor config, otherwise stop installation
342
            read -r -p "Tor seems to be installed manually. Previous configuration file /etc/tor/torrc will be deleted! Continue? [y/N] " response
343
            if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]
344
            then
345
                rm -f /etc/tor/torrc
346
            else
347
                die "Please move your old configuration file /etc/tor/torrc and run koha-create again."
348
            fi
349
        fi
350
    fi
351
352
    # Is a key already present in the folder?
353
    if [ $(tor_check_instance $name) -eq 1 ]; then
354
        # Prompt to re-use previous key
355
        toroldonion="$(tor_get_onion $name)"
356
        read -r -p "There is a previous .onion key in the hidden service folder for instance $name. Do you want to overwrite it? Choose no to re-use the address $toroldonion. [y/N] " response
357
        if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]; then
358
            rm -Rf /var/lib/tor/koha/$name/
359
            toruseoldconfig="no"
360
        else
361
            toruseoldconfig="yes"
362
        fi
363
364
    fi
365
}
366
367
tor_check_instance()
368
{
369
    # Check if previous Tor hidden service folder exists and promt for re-use or deletion
370
    # Takes a Koha instance name as an argument
371
    if [ -e "/var/lib/tor/koha/$1/hidden_service/private_key" ]; then
372
        echo "1";
373
    else
374
        echo "0"
375
    fi
376
}
377
378
tor_install()
379
{
380
    # Install Tor from the official repository.
381
    # Only done once… I guess.
382
383
    echo "Installing Tor…"
384
    debrelease="$(lsb_release -c | sed 's|.*\W\(.*\)|\1|')"
385
    # Check if Tor repository is already in /etc/apt/sources.list.*
386
    if [ $(grep -rl "^deb http://deb.torproject.org/torproject.org" "/etc/apt/sources.list" "/etc/apt/sources.list.d/") != "" ]; then
387
        echo "deb http://deb.torproject.org/torproject.org $debrelease main" | tee -a /etc/apt/sources.list.d/tor.list
388
        gpg --keyserver keys.gnupg.net --recv 886DDD89
389
        gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add -
390
        apt-get update
391
    fi
392
    apt-get install -y tor deb.torproject.org-keyring
393
    service tor stop
394
    # next: tor_config
395
}
396
397
tor_config()
398
{
399
    # Create Koha-specific Tor config, make backup of last config.
400
    # Called for every new instance
401
402
    # Check if /etc/tor/torrc-koha exists, if not create it now
403
    if [ ! -e "/etc/tor/torrc-koha" ]; then
404
        generate_config_file torrc.in \
405
            "/etc/tor/torrc-koha"
406
        rm -f /etc/tor/torrc # just in case
407
        ln -s /etc/tor/torrc-koha /etc/tor/torrc
408
        chown -R debian-tor:debian-tor /etc/tor/
409
    fi
410
    tor_instance
411
}
412
413
tor_instance() # FIXME there needs to be tor_remove in koha-remove to undo all this
414
{
415
    # Add config to Tor configuration file
416
    # Repeat for every instance.
417
    # FIXME should go to koha-tor or koha-functions?
418
419
    torconfig=`cat <<EOF
420
421
# begin instance koha-$name
422
HiddenServiceDir /var/lib/tor/koha/$name/hidden_service/
423
HiddenServicePort 80 127.0.0.1:80
424
# end instance koha-$name
425
426
EOF`
427
    echo "$torconfig" >> /etc/tor/torrc-koha
428
    # Create instance-specific Tor folder.
429
    # We put this in /var/lib/tor/koha/ to keep it out of Koha backups and safe from koha-remove.
430
    # FIXME Would it be better to have it in the backups?
431
    #
432
    # Re-use old .onion if desired
433
    if [ "$toruseoldconfig" != "yes" ]; then
434
        mkdir -p /var/lib/tor/koha/$name
435
    fi
436
    chown -R debian-tor:debian-tor /var/lib/tor/koha/
437
    # Start Tor with new settings
438
    service tor restart           # needs to be done after apache for this instance is started, or hostname won't be created
439
    # Get .onion address          # FIXME does this work instantly or should we wait a few seconds?
440
    onion="$(tor_get_onion $name)"
441
    torinfo=`cat <<EOF
442
Your .onion address is $onion.
443
If you already have another .onion address that you would like to re-use,
444
stop the tor service, copy the key to /var/lib/tor/koha/$name/hidden_service/private_key,
445
change the ServerAlias in /etc/apache2/sites/sites-available/$name.conf to your
446
old .onion address, restart Apache and restart Tor.
447
EOF` # FIXME Should this be done at the first check so we don't do all the installation?
448
    echo "$torinfo"
449
    # Write ServerAlias $onion to apache config and restart apache
450
    sed -i "s/__OPACTORHIDDENSERVICE__/$onion/g" "/etc/apache2/sites-available/$name.conf"
451
    sed -i "s:^\s*#\(.*\)#onion$: \1:" "/etc/apache2/sites-available/$name.conf"
452
    service apache2 reload
453
}
454
455
tor_get_onion()
456
{
457
    # Get .onion address of an instance
458
    # Repeat on demand.
459
    # FIXME should go to koha-tor or koha-functions?
460
461
    # This is useful for 'public' 'hidden' Koha OPACS. For security reasons, other
462
    # hidden services a library might run SHOULD NOT BE in /var/lib/tor/koha/
463
    local myonion="$(cat /var/lib/tor/koha/$1/hidden_service/hostname)"
464
    echo $myonion
465
}
466
314
# Set defaults and read config file, if it exists.
467
# Set defaults and read config file, if it exists.
315
DOMAIN=""
468
DOMAIN=""
316
OPACPORT="80"
469
OPACPORT="80"
Lines 354-359 END_BIBLIOS_RETRIEVAL_INFO="" Link Here
354
START_AUTHORITIES_RETRIEVAL_INFO=""
507
START_AUTHORITIES_RETRIEVAL_INFO=""
355
END_AUTHORITIES_RETRIEVAL_INFO=""
508
END_AUTHORITIES_RETRIEVAL_INFO=""
356
509
510
# Tor settings
511
ENABLE_TOR_HIDDEN_SERVICE="no"
512
TOR_INSTALLATION="no"
513
357
if [ -e /etc/koha/koha-sites.conf ]
514
if [ -e /etc/koha/koha-sites.conf ]
358
then
515
then
359
    . /etc/koha/koha-sites.conf
516
    . /etc/koha/koha-sites.conf
Lines 361-367 fi Link Here
361
518
362
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
519
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
363
520
364
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:, \
521
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,tor, \
365
     -n "$0" -- "$@"`
522
     -n "$0" -- "$@"`
366
523
367
# Note the quotes around `$TEMP': they are essential!
524
# Note the quotes around `$TEMP': they are essential!
Lines 419-424 while true ; do Link Here
419
            SRU_SERVER_PORT="$2" ; shift 2 ;;
576
            SRU_SERVER_PORT="$2" ; shift 2 ;;
420
        --upload-path)
577
        --upload-path)
421
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
578
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
579
        --tor)
580
            ENABLE_TOR_HIDDEN_SERVICE="yes" ; shift ;;
422
        -h|--help)
581
        -h|--help)
423
            usage ; exit 0 ;;
582
            usage ; exit 0 ;;
424
        --)
583
        --)
Lines 508-513 then Link Here
508
    die "This script must be run with root privileges."
667
    die "This script must be run with root privileges."
509
fi
668
fi
510
669
670
# If --tor is used, but package 'tor' not installed, prompt for installation
671
# If refused, we can stop cleanly here
672
if [ "$ENABLE_TOR_HIDDEN_SERVICE" = "yes" ]; then
673
    enable_tor_hidden_service
674
fi
675
511
# Check everything is ok with Apache, die otherwise
676
# Check everything is ok with Apache, die otherwise
512
check_apache_config
677
check_apache_config
513
678
Lines 710-721 then Link Here
710
    fi
875
    fi
711
fi
876
fi
712
877
713
714
if [ "$op" = request ]
878
if [ "$op" = request ]
715
then
879
then
716
    koha-disable "$name"
880
    koha-disable "$name"
717
fi
881
fi
718
882
883
if [ "$op" = create ] && [ "$TORINSTALLATION" = "yes" ]; then
884
    tor_install
885
fi
886
887
if [ "$op" = create ] && [ "$ENABLE_TOR_HIDDEN_SERVICE" = "yes" ]; then
888
    tor_config
889
fi
890
719
echo <<eoh
891
echo <<eoh
720
892
721
Email for this instance is disabled. When you're ready to enable it, use:
893
Email for this instance is disabled. When you're ready to enable it, use:
(-)a/debian/scripts/koha-remove (+5 lines)
Lines 105-110 eof Link Here
105
    getent passwd "$name-koha" > /dev/null && deluser --quiet "$name-koha"
105
    getent passwd "$name-koha" > /dev/null && deluser --quiet "$name-koha"
106
    # in case the site has already been disabled, we don't want to break the loop now.
106
    # in case the site has already been disabled, we don't want to break the loop now.
107
    a2dissite "$name" > /dev/null 2>&1 || a2dissite "${name}.conf" > /dev/null 2>&1 || /bin/true
107
    a2dissite "$name" > /dev/null 2>&1 || a2dissite "${name}.conf" > /dev/null 2>&1 || /bin/true
108
    # Remove Tor hidden service info from torrrc if present and restart Tor
109
    if [ $(grep -c "# Start instance koha-$name" "/etc/tor/torrc") -eq 1 ]; then
110
        sed -i '/# begin instance koha-$name/, +4 d' "/etc/tor/torrc"
111
        service tor restart
112
    fi
108
done
113
done
109
114
110
service apache2 restart
115
service apache2 restart
(-)a/debian/templates/apache-site-tor.conf.in (+21 lines)
Line 0 Link Here
1
# Koha instance __KOHASITE__ Apache config for Tor hidden service.
2
3
# OPAC
4
<VirtualHost 127.0.0.1:8080>
5
  <IfVersion >= 2.4>
6
   Define instance "__KOHASITE__"
7
  </IfVersion>
8
   Include /etc/koha/apache-shared.conf
9
#  Include /etc/koha/apache-shared-disable.conf
10
#  Include /etc/koha/apache-shared-opac-plack.conf
11
   Include /etc/koha/apache-shared-opac.conf
12
13
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
14
#   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
15
#   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
16
   AssignUserID __UNIXUSER__ __UNIXGROUP__
17
18
   ErrorLog    /var/log/koha/__KOHASITE__/opac-error.log
19
#  TransferLog /var/log/koha/__KOHASITE__/opac-access.log
20
#  RewriteLog  /var/log/koha/__KOHASITE__/opac-rewrite.log
21
</VirtualHost>
(-)a/debian/templates/apache-site.conf.in (+1 lines)
Lines 11-16 Link Here
11
   Include /etc/koha/apache-shared-opac.conf
11
   Include /etc/koha/apache-shared-opac.conf
12
12
13
   ServerName __OPACSERVER__
13
   ServerName __OPACSERVER__
14
#  ServerAlias __OPACTORHIDDENSERVICE__ #onion
14
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
15
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
15
   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
16
   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
16
   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
17
   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
(-)a/debian/templates/torrc.in (-1 / +31 lines)
Line 0 Link Here
0
- 
1
# Tor minimal config for Koha bundle
2
# For a list of options check the default file at /etc/tor/torrc-old
3
4
5
# General section.
6
7
SocksPort 0
8
SocksPolicy reject *
9
DataDirectory /var/lib/tor
10
11
12
# Relay section
13
# You should read the Tor manual before you set up a Tor relay!
14
15
#ORPort 9001                  # use a port that is not used by anything else
16
#Address                      # ip or domain, or tor will guess
17
#Nickname Koha ILS Tor Server # public name of the Tor server, use whatever you like
18
#RelayBandwidthRate 100 KB    # Throttle traffic to 100KB/s (800Kbps)
19
#RelayBandwidthBurst 200 KB   # But allow bursts up to 200KB/s (1600Kbps)
20
#ExitPolicy reject *:*        # no exits allowed
21
22
23
# General hidden service section
24
# If you want to a run Tor hidden service other than the Koha OPAC, put it here.
25
# DO NOT USE the /var/lib/tor/koha FOLDER FOR CUSTOM HIDDEN SERVICES!
26
27
28
29
# !!! DO NOT EDIT ANYTHING BELOW THIS LINE !!!
30
31
# Koha hidden service section. This is generated automatically. Do not touch!

Return to bug 15540