mirror of https://github.com/infosecn1nja/HELK.git
456 lines
12 KiB
Bash
Executable File
456 lines
12 KiB
Bash
Executable File
#!/bin/sh
|
||
set -e
|
||
|
||
# HELK script: helk_docker_edge_install.sh
|
||
# HELK script description: Installs Docker on your HELK server.
|
||
# HELK build Stage: Alpha
|
||
# Author: Docker
|
||
# Maintained by: Docker
|
||
# Default Channel: EDGE
|
||
# Download Date: 01/11/2018
|
||
|
||
# Using these scripts is not recommended for production environments, and you should understand the potential risks before you use them:
|
||
|
||
# The scripts require root or sudo privileges in order to run. Therefore, you should carefully examine and audit the scripts before running them.
|
||
# The scripts attempt to detect your Linux distribution and version and configure your package management system for you. In addition, the scripts do not allow you to customize any installation parameters. This may lead to an unsupported configuration, either from Docker’s point of view or from your own organization’s guidelines and standards.
|
||
# The scripts install all dependencies and recommendations of the package manager without asking for confirmation. This may install a large number of packages, depending on the current configuration of your host machine.
|
||
# The script does not provide options to specify which version of Docker to install, and will install the latest version that is released in the “edge” channel.
|
||
# Do not use the convenience script if Docker has already been installed on the host machine using another mechanism.
|
||
|
||
# This script is meant for quick & easy install via:
|
||
# $ curl -fsSL get.docker.com -o get-docker.sh
|
||
# $ sh get-docker.sh
|
||
#
|
||
# For test builds (ie. release candidates):
|
||
# $ curl -fsSL test.docker.com -o test-docker.sh
|
||
# $ sh test-docker.sh
|
||
#
|
||
# NOTE: Make sure to verify the contents of the script
|
||
# you downloaded matches the contents of install.sh
|
||
# located at https://github.com/docker/docker-install
|
||
# before executing.
|
||
#
|
||
# Git commit from https://github.com/docker/docker-install when
|
||
# the script was uploaded (Should only be modified by upload job):
|
||
SCRIPT_COMMIT_SHA=1d31602
|
||
|
||
|
||
# This value will automatically get changed for:
|
||
# * edge
|
||
# * test
|
||
# * experimental
|
||
DEFAULT_CHANNEL_VALUE="edge"
|
||
if [ -z "$CHANNEL" ]; then
|
||
CHANNEL=$DEFAULT_CHANNEL_VALUE
|
||
fi
|
||
|
||
DOWNLOAD_URL="https://download.docker.com"
|
||
|
||
SUPPORT_MAP="
|
||
x86_64-centos-7
|
||
x86_64-fedora-24
|
||
x86_64-fedora-25
|
||
x86_64-fedora-26
|
||
x86_64-fedora-27
|
||
x86_64-debian-wheezy
|
||
x86_64-debian-jessie
|
||
x86_64-debian-stretch
|
||
x86_64-debian-buster
|
||
x86_64-ubuntu-trusty
|
||
x86_64-ubuntu-xenial
|
||
x86_64-ubuntu-zesty
|
||
x86_64-ubuntu-artful
|
||
s390x-ubuntu-xenial
|
||
s390x-ubuntu-zesty
|
||
s390x-ubuntu-artful
|
||
ppc64le-ubuntu-xenial
|
||
ppc64le-ubuntu-zesty
|
||
ppc64le-ubuntu-artful
|
||
aarch64-ubuntu-xenial
|
||
aarch64-ubuntu-zesty
|
||
aarch64-debian-jessie
|
||
aarch64-debian-stretch
|
||
armv6l-raspbian-jessie
|
||
armv7l-raspbian-jessie
|
||
armv6l-raspbian-stretch
|
||
armv7l-raspbian-stretch
|
||
armv7l-debian-jessie
|
||
armv7l-debian-stretch
|
||
armv7l-debian-buster
|
||
armv7l-ubuntu-trusty
|
||
armv7l-ubuntu-xenial
|
||
armv7l-ubuntu-zesty
|
||
armv7l-ubuntu-artful
|
||
"
|
||
|
||
mirror=''
|
||
DRY_RUN=${DRY_RUN:-}
|
||
while [ $# -gt 0 ]; do
|
||
case "$1" in
|
||
--mirror)
|
||
mirror="$2"
|
||
shift
|
||
;;
|
||
--dry-run)
|
||
DRY_RUN=1
|
||
;;
|
||
--*)
|
||
echo "Illegal option $1"
|
||
;;
|
||
esac
|
||
shift $(( $# > 0 ? 1 : 0 ))
|
||
done
|
||
|
||
case "$mirror" in
|
||
Aliyun)
|
||
DOWNLOAD_URL="https://mirrors.aliyun.com/docker-ce"
|
||
;;
|
||
AzureChinaCloud)
|
||
DOWNLOAD_URL="https://mirror.azure.cn/docker-ce"
|
||
;;
|
||
esac
|
||
|
||
command_exists() {
|
||
command -v "$@" > /dev/null 2>&1
|
||
}
|
||
|
||
is_dry_run() {
|
||
if [ -z "$DRY_RUN" ]; then
|
||
return 1
|
||
else
|
||
return 0
|
||
fi
|
||
}
|
||
|
||
get_distribution() {
|
||
lsb_dist=""
|
||
# Every system that we officially support has /etc/os-release
|
||
if [ -r /etc/os-release ]; then
|
||
lsb_dist="$(. /etc/os-release && echo "$ID")"
|
||
fi
|
||
# Returning an empty string here should be alright since the
|
||
# case statements don't act unless you provide an actual value
|
||
echo "$lsb_dist"
|
||
}
|
||
|
||
add_debian_backport_repo() {
|
||
debian_version="$1"
|
||
backports="deb http://ftp.debian.org/debian $debian_version-backports main"
|
||
if ! grep -Fxq "$backports" /etc/apt/sources.list; then
|
||
(set -x; $sh_c "echo \"$backports\" >> /etc/apt/sources.list")
|
||
fi
|
||
}
|
||
|
||
echo_docker_as_nonroot() {
|
||
if is_dry_run; then
|
||
return
|
||
fi
|
||
if command_exists docker && [ -e /var/run/docker.sock ]; then
|
||
(
|
||
set -x
|
||
$sh_c 'docker version'
|
||
) || true
|
||
fi
|
||
your_user=your-user
|
||
[ "$user" != 'root' ] && your_user="$user"
|
||
# intentionally mixed spaces and tabs here -- tabs are stripped by "<<-EOF", spaces are kept in the output
|
||
echo "If you would like to use Docker as a non-root user, you should now consider"
|
||
echo "adding your user to the \"docker\" group with something like:"
|
||
echo
|
||
echo " sudo usermod -aG docker $your_user"
|
||
echo
|
||
echo "Remember that you will have to log out and back in for this to take effect!"
|
||
echo
|
||
echo "WARNING: Adding a user to the \"docker\" group will grant the ability to run"
|
||
echo " containers which can be used to obtain root privileges on the"
|
||
echo " docker host."
|
||
echo " Refer to https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface"
|
||
echo " for more information."
|
||
|
||
}
|
||
|
||
# Check if this is a forked Linux distro
|
||
check_forked() {
|
||
|
||
# Check for lsb_release command existence, it usually exists in forked distros
|
||
if command_exists lsb_release; then
|
||
# Check if the `-u` option is supported
|
||
set +e
|
||
lsb_release -a -u > /dev/null 2>&1
|
||
lsb_release_exit_code=$?
|
||
set -e
|
||
|
||
# Check if the command has exited successfully, it means we're in a forked distro
|
||
if [ "$lsb_release_exit_code" = "0" ]; then
|
||
# Print info about current distro
|
||
cat <<-EOF
|
||
You're using '$lsb_dist' version '$dist_version'.
|
||
EOF
|
||
|
||
# Get the upstream release info
|
||
lsb_dist=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'id' | cut -d ':' -f 2 | tr -d '[:space:]')
|
||
dist_version=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'codename' | cut -d ':' -f 2 | tr -d '[:space:]')
|
||
|
||
# Print info about upstream distro
|
||
cat <<-EOF
|
||
Upstream release is '$lsb_dist' version '$dist_version'.
|
||
EOF
|
||
else
|
||
if [ -r /etc/debian_version ] && [ "$lsb_dist" != "ubuntu" ] && [ "$lsb_dist" != "raspbian" ]; then
|
||
# We're Debian and don't even know it!
|
||
lsb_dist=debian
|
||
dist_version="$(sed 's/\/.*//' /etc/debian_version | sed 's/\..*//')"
|
||
case "$dist_version" in
|
||
9)
|
||
dist_version="stretch"
|
||
;;
|
||
8|'Kali Linux 2')
|
||
dist_version="jessie"
|
||
;;
|
||
7)
|
||
dist_version="wheezy"
|
||
;;
|
||
esac
|
||
fi
|
||
fi
|
||
fi
|
||
}
|
||
|
||
semverParse() {
|
||
major="${1%%.*}"
|
||
minor="${1#$major.}"
|
||
minor="${minor%%.*}"
|
||
patch="${1#$major.$minor.}"
|
||
patch="${patch%%[-.]*}"
|
||
}
|
||
|
||
ee_notice() {
|
||
echo
|
||
echo
|
||
echo " WARNING: $1 is now only supported by Docker EE"
|
||
echo " Check https://store.docker.com for information on Docker EE"
|
||
echo
|
||
echo
|
||
}
|
||
|
||
do_install() {
|
||
echo "# Executing docker install script, commit: $SCRIPT_COMMIT_SHA"
|
||
|
||
if command_exists docker; then
|
||
version="$(docker -v | cut -d ' ' -f3 | cut -d ',' -f1)"
|
||
MAJOR_W=1
|
||
MINOR_W=10
|
||
|
||
semverParse "$version"
|
||
|
||
shouldWarn=0
|
||
if [ "$major" -lt "$MAJOR_W" ]; then
|
||
shouldWarn=1
|
||
fi
|
||
|
||
if [ "$major" -le "$MAJOR_W" ] && [ "$minor" -lt "$MINOR_W" ]; then
|
||
shouldWarn=1
|
||
fi
|
||
|
||
cat >&2 <<-'EOF'
|
||
Warning: the "docker" command appears to already exist on this system.
|
||
|
||
If you already have Docker installed, this script can cause trouble, which is
|
||
why we're displaying this warning and provide the opportunity to cancel the
|
||
installation.
|
||
|
||
If you installed the current Docker package using this script and are using it
|
||
EOF
|
||
|
||
if [ $shouldWarn -eq 1 ]; then
|
||
cat >&2 <<-'EOF'
|
||
again to update Docker, we urge you to migrate your image store before upgrading
|
||
to v1.10+.
|
||
|
||
You can find instructions for this here:
|
||
https://github.com/docker/docker/wiki/Engine-v1.10.0-content-addressability-migration
|
||
EOF
|
||
else
|
||
cat >&2 <<-'EOF'
|
||
again to update Docker, you can safely ignore this message.
|
||
EOF
|
||
fi
|
||
|
||
cat >&2 <<-'EOF'
|
||
|
||
You may press Ctrl+C now to abort this script.
|
||
EOF
|
||
( set -x; sleep 20 )
|
||
fi
|
||
|
||
user="$(id -un 2>/dev/null || true)"
|
||
|
||
sh_c='sh -c'
|
||
if [ "$user" != 'root' ]; then
|
||
if command_exists sudo; then
|
||
sh_c='sudo -E sh -c'
|
||
elif command_exists su; then
|
||
sh_c='su -c'
|
||
else
|
||
cat >&2 <<-'EOF'
|
||
Error: this installer needs the ability to run commands as root.
|
||
We are unable to find either "sudo" or "su" available to make this happen.
|
||
EOF
|
||
exit 1
|
||
fi
|
||
fi
|
||
|
||
if is_dry_run; then
|
||
sh_c="echo"
|
||
fi
|
||
|
||
# perform some very rudimentary platform detection
|
||
lsb_dist=$( get_distribution )
|
||
lsb_dist="$(echo "$lsb_dist" | tr '[:upper:]' '[:lower:]')"
|
||
|
||
case "$lsb_dist" in
|
||
|
||
ubuntu)
|
||
if command_exists lsb_release; then
|
||
dist_version="$(lsb_release --codename | cut -f2)"
|
||
fi
|
||
if [ -z "$dist_version" ] && [ -r /etc/lsb-release ]; then
|
||
dist_version="$(. /etc/lsb-release && echo "$DISTRIB_CODENAME")"
|
||
fi
|
||
;;
|
||
|
||
debian|raspbian)
|
||
dist_version="$(sed 's/\/.*//' /etc/debian_version | sed 's/\..*//')"
|
||
case "$dist_version" in
|
||
9)
|
||
dist_version="stretch"
|
||
;;
|
||
8)
|
||
dist_version="jessie"
|
||
;;
|
||
7)
|
||
dist_version="wheezy"
|
||
;;
|
||
esac
|
||
;;
|
||
|
||
centos)
|
||
if [ -z "$dist_version" ] && [ -r /etc/os-release ]; then
|
||
dist_version="$(. /etc/os-release && echo "$VERSION_ID")"
|
||
fi
|
||
;;
|
||
|
||
rhel|ol|sles)
|
||
ee_notice "$lsb_dist"
|
||
exit 1
|
||
;;
|
||
|
||
*)
|
||
if command_exists lsb_release; then
|
||
dist_version="$(lsb_release --release | cut -f2)"
|
||
fi
|
||
if [ -z "$dist_version" ] && [ -r /etc/os-release ]; then
|
||
dist_version="$(. /etc/os-release && echo "$VERSION_ID")"
|
||
fi
|
||
;;
|
||
|
||
esac
|
||
|
||
# Check if this is a forked Linux distro
|
||
check_forked
|
||
|
||
# Check if we actually support this configuration
|
||
if ! echo "$SUPPORT_MAP" | grep "$(uname -m)-$lsb_dist-$dist_version" >/dev/null; then
|
||
cat >&2 <<-'EOF'
|
||
|
||
Either your platform is not easily detectable or is not supported by this
|
||
installer script.
|
||
Please visit the following URL for more detailed installation instructions:
|
||
|
||
https://docs.docker.com/engine/installation/
|
||
|
||
EOF
|
||
exit 1
|
||
fi
|
||
|
||
# Run setup for each distro accordingly
|
||
case "$lsb_dist" in
|
||
ubuntu|debian|raspbian)
|
||
pre_reqs="apt-transport-https ca-certificates curl"
|
||
if [ "$lsb_dist" = "debian" ]; then
|
||
if [ "$dist_version" = "wheezy" ]; then
|
||
add_debian_backport_repo "$dist_version"
|
||
fi
|
||
# libseccomp2 does not exist for debian jessie main repos for aarch64
|
||
if [ "$(uname -m)" = "aarch64" ] && [ "$dist_version" = "jessie" ]; then
|
||
add_debian_backport_repo "$dist_version"
|
||
fi
|
||
fi
|
||
if ! command -v gpg > /dev/null; then
|
||
pre_reqs="$pre_reqs gnupg"
|
||
fi
|
||
apt_repo="deb [arch=$(dpkg --print-architecture)] $DOWNLOAD_URL/linux/$lsb_dist $dist_version $CHANNEL"
|
||
(
|
||
if ! is_dry_run; then
|
||
set -x
|
||
fi
|
||
$sh_c 'apt-get update -qq >/dev/null'
|
||
$sh_c "apt-get install -y -qq $pre_reqs >/dev/null"
|
||
$sh_c "curl -fsSL \"$DOWNLOAD_URL/linux/$lsb_dist/gpg\" | apt-key add -qq - >/dev/null"
|
||
$sh_c "echo \"$apt_repo\" > /etc/apt/sources.list.d/docker.list"
|
||
if [ "$lsb_dist" = "debian" ] && [ "$dist_version" = "wheezy" ]; then
|
||
$sh_c 'sed -i "/deb-src.*download\.docker/d" /etc/apt/sources.list.d/docker.list'
|
||
fi
|
||
$sh_c 'apt-get update -qq >/dev/null'
|
||
$sh_c 'apt-get install -y -qq --no-install-recommends docker-ce >/dev/null'
|
||
)
|
||
echo_docker_as_nonroot
|
||
exit 0
|
||
;;
|
||
centos|fedora)
|
||
yum_repo="$DOWNLOAD_URL/linux/$lsb_dist/docker-ce.repo"
|
||
if [ "$lsb_dist" = "fedora" ]; then
|
||
if [ "$dist_version" = "24" ]; then
|
||
echo
|
||
echo "Warning: Fedora 24 has reached EOL"
|
||
echo " Support for Fedora 24 for this installation script will be removed on October 1, 2017"
|
||
echo
|
||
sleep 10
|
||
fi
|
||
if [ "$dist_version" -lt "24" ]; then
|
||
echo "Error: Only Fedora >=24 are supported"
|
||
exit 1
|
||
fi
|
||
pkg_manager="dnf"
|
||
config_manager="dnf config-manager"
|
||
enable_channel_flag="--set-enabled"
|
||
pre_reqs="dnf-plugins-core"
|
||
else
|
||
pkg_manager="yum"
|
||
config_manager="yum-config-manager"
|
||
enable_channel_flag="--enable"
|
||
pre_reqs="yum-utils"
|
||
fi
|
||
(
|
||
if ! is_dry_run; then
|
||
set -x
|
||
fi
|
||
$sh_c "$pkg_manager install -y -q $pre_reqs"
|
||
$sh_c "$config_manager --add-repo $yum_repo"
|
||
|
||
if [ "$CHANNEL" != "stable" ]; then
|
||
$sh_c "$config_manager $enable_channel_flag docker-ce-$CHANNEL"
|
||
fi
|
||
$sh_c "$pkg_manager makecache"
|
||
$sh_c "$pkg_manager install -y -q docker-ce"
|
||
)
|
||
echo_docker_as_nonroot
|
||
exit 0
|
||
;;
|
||
esac
|
||
exit 1
|
||
}
|
||
|
||
# wrapped up in a function so that we have some protection against only getting
|
||
# half the file during "curl | sh"
|
||
do_install |