26 lines
1.0 KiB
Bash
26 lines
1.0 KiB
Bash
systemctl disable --quiet le-lab-selinux-mode.service 2>/dev/null
|
|
rm -f /etc/systemd/system/le-lab-selinux-mode.service
|
|
systemctl daemon-reload
|
|
|
|
for s in nginx httpd; do systemctl disable --quiet --now "$s" 2>/dev/null; done
|
|
if command -v semanage >/dev/null; then
|
|
semanage fcontext -l -C 2>/dev/null | awk '$1 ~ /^\/srv\/web/ {print $1}' | sort -u |
|
|
while read -r spec; do semanage fcontext -d "$spec" 2>/dev/null; done
|
|
semanage port -d -t ssh_port_t -p tcp 2222 2>/dev/null
|
|
fi
|
|
rm -rf /srv/web
|
|
|
|
# sshd back to port 22 only.
|
|
changed=''
|
|
for f in /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf; do
|
|
[ -f "$f" ] && grep -Eq '^[[:space:]]*Port[[:space:]]+2222[[:space:]]*$' "$f" || continue
|
|
sed -i -E '/^[[:space:]]*Port[[:space:]]+2222[[:space:]]*$/d' "$f"
|
|
changed=1
|
|
done
|
|
if [ -n "$changed" ] && sshd -t; then systemctl restart sshd; fi
|
|
|
|
setsebool -P httpd_can_network_connect off 2>/dev/null
|
|
sed -i -E 's/^[[:space:]]*SELINUX=(permissive|disabled)[[:space:]]*$/SELINUX=enforcing/' /etc/selinux/config
|
|
setenforce 1 2>/dev/null
|
|
true
|