#!/bin/bash

# Source debconf library.
. /usr/share/debconf/confmodule

# Returns 0, if run on UCS
UCS_detect()
{
	[ -f '/usr/sbin/udm' ]
	echo $?
}



#Shows the MySQL / MariaDB admin userln -s /m23/vms/bin/restoreBTServer /etc/init.d/
update-rc.d -f restoreBTServer defaults





#Shows the mysql password (if needed (only on MySQL))
showDBAdmPassword()
{
	grep "^password" /etc/mysql/debian.cnf | tr -d '[:blank:]' | cut -d'=' -f2 | head -1
}





#Shows the MySQL / MariaDB password parameter (if needed (only on MySQL))
showDBAdmPasswordParameter()
{
	dbadmpass=`showDBAdmPassword`

	if [ $dbadmpass ]
	then
		echo -n "-p$dbadmpass"
	fi
}





#Shows the MySQL / MariaDB admin user
showDBAdmUser()
{
	grep "^user" /etc/mysql/debian.cnf | tr -d '[:blank:]' | cut -d'=' -f2 | head -1
}





#Remove bad SSH keys
if [ -f /tmp/badSSH/root.pub ]
then
	cat /tmp/badSSH/root.pub | while read badSSHKey
	do
		sed -i "s#$badSSHKey##g" /root/.ssh/authorized_keys
		rootbadkeyexists=`grep -c "$badSSHKey" /root/.ssh/id_dsa.pub`
		if [ ${rootbadkeyexists:-0} -gt 0 ]
		then
			rm /root/.ssh/id_dsa*
		fi
	done
fi





if [ -f /tmp/badSSH/backuppc.pub ]
then
	cat /tmp/badSSH/backuppc.pub | while read badSSHKey
	do
		sed -i "s#$badSSHKey##g" /m23/data+scripts/packages/baseSys/authorized_keys

		bpchome=`grep backuppc /etc/passwd | cut -d':' -f6`
		bpcbadkeyexists=`grep -c "$badSSHKey" $bpchome/.ssh/id_rsa.pub`
		if [ ${bpcbadkeyexists:-0} -gt 0 ]
		then
			rm $bpchome/.ssh/id_*
		fi
	done
fi





#name updateDB
#description Updates the MySQL DB from m23.sql.bz2.
updateDB()
{
	dbname="m23"
	dbserver="localhost"
	#get username and password of the debian MySQL system 
	dbadmin=`showDBAdmUser`
	dbadmpassParam=`showDBAdmPasswordParameter`
	dbadmpass=`showDBAdmPassword`

	#create database m23
	. /usr/share/wwwconfig-common/mysql-createdb.sh

	if [ -d /tmp/m23-install ]
	then
		#add the entries of the main database
		bunzip2 /tmp/m23-install/m23.sql.bz2
		echo "Entpacken: /tmp/m23-install/m23.sql.bz2"  >> /m23.log
		sqlfile="/tmp/m23-install/m23.sql"
		. /usr/share/wwwconfig-common/mysql-exec.sh >> /m23.log
		rm $sqlfile

		#create database m23captured
		dbname="m23captured"
		. /usr/share/wwwconfig-common/mysql-createdb.sh
		bunzip2  /tmp/m23-install/m23captured.sql.bz2	
		sqlfile="/tmp/m23-install/m23captured.sql"
		. /usr/share/wwwconfig-common/mysql-exec.sh >> /m23.log
		rm $sqlfile
		rm -r /tmp/m23-install
	fi

	#Make sure the i18n table is always empty
	mysql -u$dbadmin $dbadmpassParam m23 -e "delete from i18n"
	mysql -u$dbadmin $dbadmpassParam m23captured -e "delete from i18n"
}





#name updateSQLIfOlder
#description Updates SQL information or executes SQL statements, if the current version of this packages is older than a given version.
#parameter oldversionint: The version of this packages, that was previously installed.
#parameter olderThan: The first version number that already contains the SQL adjustment and so doesn't need to be adjusted.
#parameter sql: SQL statement to execute.
updateSQLIfOlder()
{
	oldversionint=$1
	olderThan=$2
	sql="$3"

	if [ -n "$oldversionint" ] && [ $oldversionint -lt $olderThan ]
	then
		dbadmin=`showDBAdmUser`
		dbadmpassParam=`showDBAdmPasswordParameter`

		echo "$sql" | mysql -u $dbadmin $dbadmpassParam m23
	fi
}





#Restarts the DHCP server
restartDHCPServer()
{
for daemon in dhcp dhcp3-server isc-dhcp-server
do
	if [ -e "/etc/init.d/$daemon" ]
	then
		/etc/init.d/$daemon restart
	fi
done
}




if [ `grep -c Debian /etc/issue` -eq 0 ] && [ `grep -c Raspbian /etc/issue` -eq 0 ] && [ `grep -c Univention /etc/issue` -eq 0 ]
then
	echo "The m23 packages are ment for installation on Debian ONLY!"
	exit 666
fi

ln -s /sbin/lilo /sbin/update-grub 2> /dev/null

DNS=`cat /etc/resolv.conf | head -n 1 | cut -d' ' -f2`
BROADINT=`cat /etc/network/interfaces | tr -d "\t" | tr -s " " | sed 's/^[ ]*//g' | grep ^broadcast | cut -d ' ' -f2 | head -1`
if [ -z $BROADINT ]
then
	BROADINT=`LC_ALL=C; ifconfig | grep broadcast | sed 's/.*broadcast //'`
fi
IPINT=`cat /etc/network/interfaces | tr -d "\t" | tr -s " " | sed 's/^[ ]*//g' | grep ^address | cut -d ' ' -f2 | head -1 | sed 's#/.*##'`
GATEINT=`cat /etc/network/interfaces | tr -d "\t" | tr -s " " | sed 's/^[ ]*//g' | grep ^gateway | cut -d ' ' -f2 | head -1`
dbadmin=`showDBAdmUser`
dbadmpassParam=`showDBAdmPasswordParameter`
dbadmpass=`showDBAdmPassword`





#name getIfconfigSetting
#description Gets network information from ifconfig.
#parameter If there is a non empty value, it will be given back
#parameter ifconfig query string, to find the line holding the information.
getIfconfigSetting()
{
	if [ -z "$1" ]
	then
		LC_ALL="C"
		ifconfig eth0 | sed 's/  /\n/g' | grep "^$2" | cut -d':' -f2
	else
		echo -n $1
	fi
}





#name getIpGateway
#description Gets gateway from ip.
#parameter If there is a non empty value, it will be given back
getIpGateway()
{
	if [ -z "$1" ]
	then
		LC_ALL="C"
		ip route show default | awk '/default/ {print $3}'
	else
		echo -n $1
	fi
}





#name getCSExternIP
#description Get the external IP of this server, if run in CloudStack.
#shows External IP or empty if not run under CloudStack.
#returns 0 when an external CloudStack IP could be get, 1 otherwise
getCSExternIP()
{
	wget -qq "http://$GATEINT/latest/public-ipv4" -O /tmp/csExternIp

	if [ $? -eq 0 ] && [ -f /tmp/csExternIp ] && [ $(grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' -c /tmp/csExternIp) -eq 1 ]
	then
		cat /tmp/csExternIp
		rm /tmp/csExternIp
		return 0
	else
		return 1
	fi
}





IPINT=$(getIfconfigSetting "$IPINT" 'inet addr')
BROADINT=$(getIfconfigSetting "$BROADINT" 'Bcast')
GATEINT=$(getIpGateway "$GATEINT")




#check if we are reconfiguring
if [ "$1" = "reconfigure" ] || [ "${DEBCONF_RECONFIGURE}" = "1" ]
then
	reconf=true
	echo "reconf=true" >> /m23.log
else
	reconf=false
	echo "reconf=false" >> /m23.log
fi

#Check if the version is set (in case of first time installation it is not)
if [ -z $2 ]
then
	oldversion=999999
else
	oldversion=$2
fi
echo "oldversion: $oldversion" >> /m23.log
oldversionint=`echo $2 | sed 's/[.-]//g'`
echo "oldversionint: $oldversionint" >> /m23.log


if [ -f /tmp/m23-install/mkMissingDirectories.sh ]
then
	sh /tmp/m23-install/mkMissingDirectories.sh
fi


#make sure there is a .htpasswd to secure the admin interface
if [ ! -f /m23/etc/.htpasswd ]
then
	cp -a /m23/etc/.htpasswd.orig /m23/etc/.htpasswd
fi

#Make sure that the password file for phpMyAdmin and phpLDAPAdmin exists
if [ ! -f /m23/etc/.phpMyLDAPAdminHtpasswd ]
then
	cp -a /m23/etc/.htpasswd /m23/etc/.phpMyLDAPAdminHtpasswd
fi

rm /m23/etc/.htpasswd.orig

db_get m23/configMySQL
if [ "$RET" = "true" ] || [ $(UCS_detect) -eq 0 ]
then
	# Make sure, innoDB is enabled
	sed -i 's/skip-innodb/#skip-innodb/' /etc/mysql/my.cnf
	
	# Make sure MariaDB uses latin1 and not 4-byte utf8 which would lead to an exceeding of the 1000 bytes limit for unique keys
	if [ -d /etc/mysql/mariadb.conf.d ]
	then
		sed -i 's/utf8mb4/latin1/g' /etc/mysql/mariadb.conf.d/*
	fi

	/etc/init.d/mysql restart

	dbname="m23"
	dbserver="localhost"
	#get username and password of the debian MySQL system 
	dbadmin=`showDBAdmUser`
	dbadmpassParam=`showDBAdmPasswordParameter`
	dbadmpass=`showDBAdmPassword`


	#create database m23
	. /usr/share/wwwconfig-common/mysql-createdb.sh

	updateDB

	echo  "GRANT SELECT , INSERT , UPDATE , DELETE , FILE ON * . * TO 'm23dbuser'@'localhost' IDENTIFIED BY 'm23secret' WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 ;" | mysql -u $dbadmin $dbadmpassParam m23

	echo "GRANT SELECT , INSERT , UPDATE , DELETE , CREATE , DROP , FILE , INDEX , ALTER , CREATE TEMPORARY TABLES , LOCK TABLES ON * . * TO 'm23dbroot'@'localhost' IDENTIFIED BY 'm23secretroot' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 ;" | mysql -u $dbadmin $dbadmpassParam m23

	#Delete all unused "defaut" groups (every configuration adds a new instance of the default group => if they don't get deleted there will be lots of unused default groups where no client is in. Only the first occurrance of the default group should have clients in it.)
	echo "DELETE FROM groups WHERE id NOT IN (SELECT id FROM (SELECT groups.id FROM clientgroups, groups WHERE clientgroups.groupid = groups.id) as temp)" | mysql -u $dbadmin $dbadmpassParam m23

	#Make the groupname unique
	echo "ALTER TABLE groups ADD UNIQUE (groupname); ALTER TABLE groups DROP INDEX groupname" | mysql -u $dbadmin $dbadmpassParam m23

	#Make sure that a default group exists
	echo "INSERT INTO groups (id , groupname) VALUES ('1', 'default')" | mysql -u $dbadmin $dbadmpassParam m23
fi


db_get m23/configDHCP
if [ "$RET" = "true" ] && [ $(UCS_detect) -ne 0 ]
then
	#Check if the file /etc/init.d/dhcp3-server does exist and DOESN'T contain the m23/dhcp value
	[ -f /etc/init.d/dhcp3-server ] && [ `grep m23/dhcp /etc/init.d/dhcp3-server -c` -eq 0 ]
	lennyConfigured=$?

	#this part could be executed more times
	if [ $lennyConfigured -eq 0 ] || [ ! -f /m23/dhcp/dhcpd.conf ] || [ `grep domain-name-servers /m23/dhcp/dhcpd.conf -c` -eq 0 ] || $reconf
	then

		#Create /m23/dhcp if it's missing, set permissions and owner
		if [ ! -d /m23/dhcp ]
		then
			mkdir -p /m23/dhcp
			chown root.www-data /m23/dhcp
			chmod 777 /m23/dhcp
		fi

		#/m23/dhcp/dhcpd.conf
		rm /m23/dhcp/dhcpd.conf 2> /dev/null

echo "option domain-name-servers $DNS; \

option broadcast-address $BROADINT;\

option root-path \"/\";\

default-lease-time            21600;\

max-lease-time                21600;\

option log-servers            $IPINT;\

next-server                    $IPINT;\

option routers                $GATEINT;

use-host-decl-names on;\

ddns-update-style none;\

"> /m23/dhcp/dhcpd.conf

	fi

	#this part may be executed only once
	if [ -f /etc/init.d/dhcp3-server ] && [ `grep m23/dhcp /etc/init.d/dhcp3-server -c` -eq 0 ]
	then
		sed 's/--exec \/usr\/sbin\/dhcpd3 -- -q $INTERFACES/--exec \/usr\/sbin\/dhcpd3 -- -q $INTERFACES -lf \/m23\/dhcp\/dhcpd.leases -cf \/m23\/dhcp\/dhcpd.conf/' /etc/init.d/dhcp3-server > /tmp/dhcp3-server
		mv /tmp/dhcp3-server /etc/init.d/
		chown root.root /etc/init.d/dhcp3-server
		chmod 755 /etc/init.d/dhcp3-server
	fi

	#Squeeze
	if [ -f /etc/default/isc-dhcp-server ]
	then
		netDevices=`grep ':' /proc/net/dev | cut -d':' -f1 | tr -d '[:blank:]' | awk -v ORS=' ' '{print}'`
		mv /etc/dhcp/dhcpd.conf /etc/dhcp/dhcpd.conf.beforem23
		ln -s /m23/dhcp/dhcpd.conf /etc/dhcp/dhcpd.conf
		sed -i "s/INTERFACES=.*/INTERFACES=\"$netDevices\"/g" /etc/default/isc-dhcp-server
		sed -i "s/INTERFACESv4=.*/INTERFACESv4=\"$netDevices\"/g" /etc/default/isc-dhcp-server
	fi
fi



db_get m23/configureSSH
if [ "$RET" = "true" ] || [ ! -f /m23/data+scripts/packages/baseSys/authorized_keys ]
then
#	if test -e /root/.ssh/id_dsa.pub
	if test -e /root/.ssh/id_rsa.pub
	then
		nop=x
	else
#		ssh-keygen -t dsa -N '' -P '' -f /root/.ssh/id_dsa
		ssh-keygen -t rsa -b 8192 -N '' -P '' -f /root/.ssh/id_rsa
		ssh-agent sh -c 'ssh-add < /dev/null'
	fi

	#copy the public key to the m23 directory
#	cp /root/.ssh/id_dsa.pub /m23/data+scripts/packages/baseSys/authorized_keys
	cp /root/.ssh/id_rsa.pub /m23/data+scripts/packages/baseSys/authorized_keys
	chown www-data.www-data /m23/data+scripts/packages/baseSys/authorized_keys
else
	if [ ! -f /m23/data+scripts/packages/baseSys/authorized_keys ]
	then
#		cp /root/.ssh/id_dsa.pub /m23/data+scripts/packages/baseSys/authorized_keys
		cp /root/.ssh/id_rsa.pub /m23/data+scripts/packages/baseSys/authorized_keys
		chown www-data.www-data /m23/data+scripts/packages/baseSys/authorized_keys
	fi
fi



db_get m23/configureSquid
if [ "$RET" = "true" ] && [ $(UCS_detect) -ne 0 ]
then

	if [ -d /etc/squid3 ]
	then
		squidName='squid3'
		squidConf="/etc/squid3/squid.conf"
	else
		squidName='squid'
		squidConf="/etc/squid/squid.conf"
	fi


	rm $squidConf 2> /dev/null

	hname=`cat /etc/hostname`

if [ $squidName = 'squid' ]
then
cat >> $squidConf << "EOFSQUID"
acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
acl purge method PURGE
acl CONNECT method CONNECT
acl SSL_ports port 443          # https
acl SSL_ports port 563          # snews
acl SSL_ports port 873          # rsync
acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network

http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access allow all
http_access deny CONNECT !SSL_ports

http_access allow localhost

http_access deny all

icp_access allow localnet
icp_access deny all

http_port 2323

hierarchy_stoplist cgi-bin ?

cache_dir ufs /var/spool/squid X_CACHESIZE_X 16 256

maximum_object_size 1024000 KB

access_log /var/log/squid/access.log squid

acl shoutcast rep_header X-HTTP09-First-Line ^ICY.[0-9]
upgrade_http0.9 deny shoutcast

acl apache rep_header Server ^Apache
broken_vary_encoding allow apache

extension_methods REPORT MERGE MKACTIVITY CHECKOUT

hosts_file /etc/hosts

coredump_dir /var/spool/squid

http_access allow all !localhost
acl NOCACHE url_regex -i 192.168.1.6
no_cache deny NOCACHE
visible_hostname m23iso
refresh_pattern Release$         0   41%    360
refresh_pattern Packages.bz2$   0   41%    360
refresh_pattern Packages.gz$    0   41%    360
refresh_pattern Packages$        0   41%    360

refresh_pattern Sources.gz$     0   41%    360
refresh_pattern Sources$         0   41%    360
refresh_pattern Sources.bz2$    0   41%    360


refresh_pattern deb$			129600 100% 129600
refresh_pattern udeb$			129600 100% 129600
refresh_pattern tar.gz$			129600 100% 129600
refresh_pattern tar.xz$			129600 100% 129600
refresh_pattern tar.bz2$		129600 100% 129600
refresh_pattern .orig.tar.gz$	129600 100% 129600
refresh_pattern .diff.gz$		129600 100% 129600
refresh_pattern .tar.7z$		129600 100% 129600
refresh_pattern .dsc$			129600 100% 129600
refresh_pattern .rpm$			129600 100% 129600


http_access deny purge !localhost
EOFSQUID
else
cat >> $squidConf << "EOFSQUID3"
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
acl m23server dstdomain 192.168.1.6

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow all

http_port 2323

cache_dir ufs /var/spool/squid3 X_CACHESIZE_X 16 256

maximum_object_size 1024000 KB

access_log /var/log/squid3/access.log squid

coredump_dir /var/spool/squid3

#acl NOCACHE url_regex -i 192.168.1.6
#no_cache deny NOCACHE
always_direct allow m23server

visible_hostname m23iso

refresh_pattern Release$         0   41%    360
refresh_pattern Packages.bz2$   0   41%    360
refresh_pattern Packages.gz$    0   41%    360
refresh_pattern Packages$        0   41%    360

refresh_pattern Sources.gz$     0   41%    360
refresh_pattern Sources$         0   41%    360
refresh_pattern Sources.bz2$    0   41%    360

refresh_pattern .orig.tar.gz$ 525600 0% 525600 override-lastmod ignore-reload reload-into-ims ignore-no-cache
refresh_pattern .diff.gz$     525600 0% 525600 override-lastmod ignore-reload reload-into-ims ignore-no-cache
refresh_pattern .deb$         525600 0% 525600 override-lastmod ignore-reload reload-into-ims ignore-no-cache
refresh_pattern .tar.7z$     525600 0% 525600 override-lastmod ignore-reload reload-into-ims ignore-no-cache
refresh_pattern .dsc$         525600 0% 525600 override-lastmod ignore-reload reload-into-ims ignore-no-cache
refresh_pattern .rpm$         525600 0% 525600 override-lastmod ignore-reload reload-into-ims ignore-no-cache
EOFSQUID3
fi

	#Get the free 1K blocks of /var in MB and divide by 2
	free=$[ $(df -P /var | awk 'NR==2 {print $4}') / 2048 ]

	#Adjust the config file
	sed -i "s#X_CACHESIZE_X#$free#g" $squidConf
	sed -i "s#acl NOCACHE url_regex -i .*#acl NOCACHE url_regex -i $IPINT#g" $squidConf
	sed -i "s#acl m23server dstdomain .*#acl m23server dstdomain $IPINT#g" $squidConf
	sed -i "s#visible_hostname .*#visible_hostname $hname#g" $squidConf

	chown root.root $squidConf
	chmod 644 $squidConf

	#restarting squid
	/etc/init.d/$squidName stop
	$squidName -z
	/etc/init.d/$squidName start
fi


db_get m23/configureSSL
if [ "$RET" = "true" ] && [ $(UCS_detect) -ne 0 ]
then
	if [ -c /dev/random ]
	then
		mv /dev/random /dev/random-blocks
		ln -s /dev/urandom /dev/random
	fi

	if test -f /etc/apache/m23/server.crt
	then
		#there is a m23 server certificate
		if $reconf
		then
			#generate only a new if reconfigure is selected
			/m23/bin/enable-ssl noAptGet `getCSExternIP`
		fi
	else
		#no m23 certificate found => create a new
		/m23/bin/enable-ssl noAptGet `getCSExternIP`
	fi

	if [ -h /dev/random ] && [ -c /dev/random-blocks ]
	then
		rm /dev/random
		mv /dev/random-blocks /dev/random
	fi
fi


# Make symlinks on UCS and copy SSL certificate
if [ $(UCS_detect) -eq 0 ]
then
	ln -s /m23/data+scripts/m23admin /var/www
	ln -s /m23/data+scripts/gfx /var/www
	ln -s /m23/data+scripts/cron.php /var/www
	ln -s /m23/data+scripts/debugScreen.php /var/www
	ln -s /m23/data+scripts/index.php /var/www
	ln -s /m23/data+scripts/migrate.php /var/www
	ln -s /m23/data+scripts/postMessage.php /var/www
	ln -s /m23/data+scripts/work.php /var/www
	ln -s /m23/data+scripts/devguide /var/www
	ln -s /m23/data+scripts/extraDebs /var/www
	ln -s /m23/data+scripts/iso /var/www
	ln -s /m23/data+scripts/jQuery-gfx /var/www
	ln -s /m23/data+scripts/java-vnc /var/www
	ln -s /m23/data+scripts/js /var/www
	ln -s /m23/data+scripts/packages /var/www
	ln -s /m23/data+scripts/ace /var/www
	ln -s /m23/data+scripts/distr /var/www/
	
	ucsSSLDir="/etc/univention/ssl/`hostname`"
	openssl x509 -in "$ucsSSLDir/cert.pem" -subject_hash_old -noout > /m23/data+scripts/packages/baseSys/ca.hash
	cp "$ucsSSLDir/cert.pem" /m23/data+scripts/packages/baseSys/ca.crt
	
	chown www-data.www-data /m23/data+scripts/packages/baseSys/ca.crt /m23/data+scripts/packages/baseSys/ca.hash
	chmod 644 /m23/data+scripts/packages/baseSys/ca.crt /m23/data+scripts/packages/baseSys/ca.hash

	# Convert to UTF-8 on UCS > 4.1
	if [ $(grep ' 4\.1-' /etc/issue -c) -ne 1 ]
	then
		# Convert the files to UTF-8
		find /m23 | grep php$ | xargs -n1 recode ISO-8859-1..utf-8
		find /m23/inc | grep inc$ | xargs -n1 recode ISO-8859-1..utf-8
		find /m23/inc | grep hlp$ | xargs -n1 recode ISO-8859-1..utf-8
		sed -i 's/ISO-8859-1/UTF-8/' /m23/data+scripts/index.php
	fi

	for phpFile in `find /etc/php?/apache* /etc/php/7.0 2> /dev/null | grep php.ini` `find /etc/php?/cli | grep php.ini`
	do
		#PHP settings
		sed -i -e 's/short_open_tag = Off/short_open_tag = On/g' $phpFile
	done

	/etc/init.d/apache2 restart
fi



db_get m23/configureApache
if [ "$RET" = "true" ] && [ $(UCS_detect) -ne 0 ]
then
	if ( [ -f /etc/default/apache2 ] && [ `grep "NO_START=1" /etc/default/apache2 -c` -eq 0 ] ) || ( [ -f /etc/apache2/ports.conf ] )
	then
		#Configuration for Apache 2.x

		rm /etc/apache2/sites-enabled/m23.conf /etc/apache2/sites-enabled/000-default.conf 2> /dev/null

		# Config snippets for Apache 2.2
		allowAll='
		Order allow,deny
		Allow from all
		'
		sslDirSettings=''
		phpCharSet=''


		# Check, if apache2ctl is present
		type apache2ctl &> /dev/null
		if [ $? -eq 0 ]
		then
			# Check, if Apache 2.4 is installed
			if [ $(apache2ctl -v | grep version | grep -c '/2\.4') -gt 0 ]
			then
				# Overwrite the Apache 2.2 snippets
				allowAll='Require all granted'
				sslDirSettings='
		<Directory /m23/data+scripts>
			Options Indexes Includes FollowSymLinks MultiViews
			AllowOverride AuthConfig
			Require all granted
		</Directory>
		'
				phpCharSet='
		php_value default_charset "ISO-8859-1"
		'
			fi
		fi

		for IP in 127.0.0.1 localhost $IPINT
		do
echo "<VirtualHost *:80>
	ServerName $IP
	DocumentRoot /m23/data+scripts
	<Directory /m23/data+scripts>
		Options Indexes Includes FollowSymLinks MultiViews
		AllowOverride AuthConfig
		$allowAll
	</Directory>
	$phpCharSet
</VirtualHost>
" >> /etc/apache2/sites-enabled/m23.conf
		done

		echo "<IfModule mod_ssl.c>" >> /etc/apache2/sites-enabled/m23.conf

		for IP in 127.0.0.1 localhost $IPINT
		do
echo "	<VirtualHost *:443>
		ServerName $IP
		DocumentRoot \"/m23/data+scripts/\"
		SSLEngine on
		SSLCertificateFile /etc/apache/m23/server.crt
		SSLCertificateKeyFile /etc/apache/m23/server.key
		SSLCertificateChainFile /etc/apache/m23/server.crt
		SSLVerifyClient none

		<Files ~ \"\.(cgi|shtml)$\">
			SSLOptions +StdEnvVars
		</Files>
		<Directory \"/usr/lib/cgi-bin\">
			SSLOptions +StdEnvVars
		</Directory>

		$sslDirSettings

		SetEnvIf User-Agent \".*MSIE.*\" nokeepalive ssl-unclean-shutdown
		$phpCharSet
	</VirtualHost>
" >> /etc/apache2/sites-enabled/m23.conf
		done

		echo "</IfModule>" >> /etc/apache2/sites-enabled/m23.conf
		chmod 644 /etc/apache2/sites-enabled/m23.conf

		#Delete symbolic link of old default vhost
		rm /etc/apache2/sites-enabled/000-default 2> /dev/null
		
		apacheV=2
	else
		sed 's/DocumentRoot \/var\/www/DocumentRoot \/m23\/data+scripts/' /etc/apache/httpd.conf | sed 's/<Directory \/var\/www\/>/<Directory \/m23\/data+scripts>/' | sed 's/  DirectoryIndex/  DirectoryIndex index.php/' | sed  's/#AddType application\/x-httpd-php .php/AddType application\/x-httpd-php .php/' | sed 's/# LoadModule php4_module \/usr\/lib\/apache\/1.3\/libphp4.so/LoadModule php4_module \/usr\/lib\/apache\/1.3\/libphp4.so/' | sed 's/AllowOverride None/AllowOverride AuthConfig/g' > /tmp/httpd.conf
		mv /tmp/httpd.conf /etc/apache/
		chown root.root /etc/apache/httpd.conf
		chmod 644 /etc/apache/httpd.conf

		apacheV=""
	fi
	
	#Get the absolute path to the PHP ini file(s)
	for phpFile in `find /etc/php?/apache* /etc/php/7.0 | grep php.ini` `find /etc/php?/cli | grep php.ini`
	do
		#PHP settings
		sed -i -e 's/register_globals = Off/register_globals = On/g' -e 's/memory_limit[ =0-9MG]*;/memory_limit = 32M;/g' -e 's/short_open_tag = Off/short_open_tag = On/g' -e 's/^session.gc_probability[ =0-9]*/session.gc_probability = 5/g' -e 's/^session.gc_divisor[ =0-9]*/session.gc_divisor = 100/g' $phpFile
		
		if [ -e /etc/php/7.0 ]
		then
			sed -i -e 's/^session.gc_probability[ =0-9]*/session.gc_probability = 0/g' $phpFile
		fi

		chown root.root $phpFile
		chmod 644 $phpFile
	
		#activate MySQL support in php.ini
		if test `grep -c "^extension=mysql.so" $phpFile` -eq 0
		then
			echo "extension=mysql.so" >> $phpFile
		fi
	done

	#Sets the phpver and phpini variables to the version of php that are installed.
	. /usr/share/wwwconfig-common/php.get
	server="apache$apacheV"

	#Verifies that the php module is loaded in the apache config file.
	. /usr/share/wwwconfig-common/apache-php.sh
	server="apache$apacheV-ssl"
	. /usr/share/wwwconfig-common/apache-php.sh

	/etc/init.d/apache$apacheV restart
	
	#Create a script that "knows" how to control the Apache 1.x/2.x process.
	echo "/etc/init.d/apache$apacheV \$1" > /tmp/apachectl
	chmod +x /tmp/apachectl

	# Make sure, the Apache user gets a shell. Needed for sudo by www-data otherwise the '-i' in SERVER_runInBackground need to be removed
	chsh -s /bin/sh www-data
fi

db_get m23/configureSudo
if [ "$RET" = "true" ] || [ $(UCS_detect) -eq 0 ]
then
	if test `grep -c "^www-data          ALL=NOPASSWD:ALL" /etc/sudoers` -eq 0
	then
		echo "www-data          ALL=NOPASSWD:ALL" >> /etc/sudoers
	fi
fi



db_get m23/configureBackupPC
if [ "$RET" = "true" ] && [ $(UCS_detect) -ne 0 ]
then
	bpchome=`grep backuppc /etc/passwd | cut -d':' -f6`
	
	#check if the BackupPC SSH key is missing
	if [ ! -f $bpchome/.ssh/id_rsa ]
	then
		#create a new SSH keypair for the backuppc user
		sudo -H -u backuppc sh -l -c "ssh-keygen -t dsa -N '' -P '' -f ~/.ssh/id_rsa; ssh-agent sh -c 'ssh-add < /dev/null'"
	fi

	#add the BackupPC key to the authorized_keys
	if [ `grep -c backuppc /m23/data+scripts/packages/baseSys/authorized_keys` -lt 1 ]
	then
		#add the key to the keys known by the clients
		keyPath="$bpchome/.ssh/id_rsa.pub"
		cat $keyPath >> /m23/data+scripts/packages/baseSys/authorized_keys
	fi

	#disable needed mutual exchange of SSH keys and strong verification of keys
	sed -i 's#sshPath -q -x -n -l root#sshPath -o VerifyHostKeyDNS=no -o PreferredAuthentications=publickey -o PasswordAuthentication=no -o CheckHostIP=no -o BatchMode=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -q -x -l root#g' /etc/backuppc/config.pl

	#Check for Apache 1.x
	if [ -f /etc/apache/httpd.conf ]
	then
		#Make sure the BackupPC Apache include file is included in httpd.conf.
		if [ `grep -c "Include /etc/backuppc/apache.conf" /etc/apache/httpd.conf` -lt 1 ]
		then
			echo "Include /etc/backuppc/apache.conf" >> /etc/apache/httpd.conf
		fi
	fi

	#Make BackupPC use the same password file than m23
	sed -i 's#/etc/backuppc/htpasswd#/m23/etc/.htpasswd#g' /etc/backuppc/apache.conf

	#Make sure all m23 admins are known to BackupPC.
	for admin in `cat /m23/etc/.htpasswd | cut -d':' -f1`
	do
		echo "Adding $admin to the list of BackupPC admins"
		php -r "include(\"/m23/inc/backup.php\");
		include(\"/m23/inc/server.php\");
		include(\"/m23/inc/edit.php\");
		include(\"/m23/inc/helper.php\");
		BACKUP_addAdmin(\"$admin\");"
	done

	#Make BackupPC usable by the apache user (and not only by user backuppc)
	chown backuppc.www-data /usr/share/backuppc/cgi-bin/index.cgi
	chmod u+s /usr/share/backuppc/cgi-bin/index.cgi

	#Restart the Apache 1.x/2.x
	/tmp/apachectl restart
fi





#Create a new cron secret file if it doesn't exist
if [ ! -e /m23/inc/cronSecret.php ]
then
	echo "<?
        define('CONF_CRON_SECRET','`pwgen -c -s 64`');
?>" > /m23/inc/cronSecret.php
	chmod 644 /m23/inc/cronSecret.php
fi





#Create the GPG key
if [ ! -e /home/grdmgpg/.gnupg/secring.gpg ]
then
	#Change random to non-blocking urandom
	if [ -c /dev/random ]
	then
		mv /dev/random /dev/random-blocks
		ln -s /dev/urandom /dev/random
	fi

	#Generate a random password for the GPG user
	pw=`pwgen -s -c 16`

	#Create the user
	if [ $(UCS_detect) -eq 0 ]
	then
		addgroup --gid 55001 grdmgpg
		useradd --uid 55001 --gid 55001 -m -p $pw grdmgpg
	else
		useradd -m -p $pw grdmgpg
	fi

	#Delete old GPG line
	sed -i '/NOPASSWD:GPG/d' /etc/sudoers

	#Delete localhost alias
	sed -i '/Host_Alias[ \t]*LOCALHOST/d' /etc/sudoers
	sed -i '/Host alias specification/d' /etc/sudoers
	
	grdmAmount=$(grep -c grdmgpg /etc/sudoers)
	if [ $grdmAmount -eq 0 ]
	then
		echo "# User privilege specification
www-data          ALL= (grdmgpg) NOPASSWD:/usr/bin/gpg

" >> /etc/sudoers
	fi
	

	#add access to sudo: the Apache user should be able to call gpg under the grdmgpg user
	echo "# Host alias specification
Host_Alias	LOCALHOST=127.0.0.1/255.255.255.0, `hostname`
" >> /etc/sudoers

	#Write a file with settings for the GPG key generation
	echo "
%echo Generating a standard key
Key-Type: DSA
Key-Length: 1024
Subkey-Type: ELG-E
Subkey-Length: 4096
Name-Real: backupsignkey
Name-Comment: No comment
Name-Email: backupsignkey@m23server
Expire-Date: 0
%commit
%echo done
" > /tmp/gpgSettings

	#let the GPG user create a new key
	su -c "gpg --batch --gen-key -a /tmp/gpgSettings" grdmgpg
	rm /tmp/gpgSettings

	#Change random back
	if [ -h /dev/random ] && [ -c /dev/random-blocks ]
	then
		rm /dev/random
		mv /dev/random-blocks /dev/random
	fi
fi


#For Debian Squeeze (where mkisofs doesn't exist)
if [ -f /usr/bin/genisoimage ] && [ ! -f /usr/bin/mkisofs ]
then
	ln -s /usr/bin/genisoimage /usr/bin/mkisofs
fi

#For Debian Squeeze (where cdrecord doesn't exist)
if [ -f /usr/bin/wodim ] && [ ! -f /usr/bin/cdrecord ]
then
	ln -s /usr/bin/wodim /usr/bin/cdrecord
fi





##################
# DB adjustments #
##################

#Add architecture option with i386 if it's missing
if [ -n "$oldversionint" ] && [ $oldversionint -lt 057100154 ]
then
php -r "
	include(\"/m23/inc/db.php\");
	include(\"/m23/inc/client.php\");
	include(\"/m23/inc/capture.php\");

	dbConnect();

	\$results = CLIENT_query(\"\",\"\",\"\",\"\");

	while(\$data = mysql_fetch_array(\$results))
	{
		\$opt=CLIENT_getAllOptions(\$data[client]);

		if (!isset(\$opt[arch]))
		{
			\$opt[arch]=\"i386\";
			CLIENT_setAllOptions(\$data[client],\$opt);
		}
	}
"
fi

#Add the server to the list of clients if it's missing
localhostCount=`echo "SELECT COUNT(*) FROM clients WHERE client='localhost'" | mysql -u $dbadmin $dbadmpassParam m23 | tail -1`
if [ $localhostCount -eq 0 ]
then
	#Add the server to the list of clients as "localhost"
	ts=`date +%s`

	#Get CPU type and speed
	cpu=`grep name /proc/cpuinfo | cut -d':' -f2`
	mhz=`grep MHz /proc/cpuinfo | cut -d':' -f2 | cut -d' ' -f2`

	echo "INSERT INTO clients (client,ip,installdate,lastmodify,status,cpu,MHz) VALUES ('localhost','$IPINT','$ts','$ts','2','$cpu','$mhz')" | mysql -u $dbadmin $dbadmpassParam m23
fi

#Increased the size of the fields "cpu" and "MHz" in the table "clients".
updateSQLIfOlder $oldversionint 057100145 "ALTER TABLE clients CHANGE cpu cpu LONGTEXT NOT NULL"
updateSQLIfOlder $oldversionint 057100145 "ALTER TABLE clients CHANGE MHz MHz LONGTEXT NOT NULL"

#Add table rows for virtualisation
updateSQLIfOlder $oldversionint 071100200 "ALTER TABLE clientjobs CHANGE normalPackage normalPackage LONGTEXT"
updateSQLIfOlder $oldversionint 071100200 "ALTER TABLE clients ADD vmRunOnHost INT( 9 ) NULL DEFAULT '-1'"
updateSQLIfOlder $oldversionint 071100200 "ALTER TABLE clients ADD vmSoftware INT NULL DEFAULT '0'"
updateSQLIfOlder $oldversionint 071100200 "ALTER TABLE clients ADD vmRole TINYINT( 1 ) NOT NULL DEFAULT '0'"
updateSQLIfOlder $oldversionint 071100200 "ALTER TABLE clients ADD vmVisualPassword VARCHAR( 40 ) NOT NULL"
updateSQLIfOlder $oldversionint 071100200 "ALTER TABLE clients ADD vmVisualURL VARCHAR( 255 ) NOT NULL"

#Add table a rows for storing debconf values
updateSQLIfOlder $oldversionint 101100351 "ALTER TABLE clientjobs CHANGE normalPackage normalPackage LONGTEXT"
updateSQLIfOlder $oldversionint 101100351 "CREATE TABLE m23.debconf ( id INT NOT NULL AUTO_INCREMENT , client VARCHAR( 40 ) NOT NULL , package VARCHAR( 255 ) NOT NULL , type varchar(255) NOT NULL, var VARCHAR( 255 ) NOT NULL , val LONGTEXT NOT NULL , PRIMARY KEY ( id ), UNIQUE KEY client (client,package,var) ) ENGINE = MYISAM"

#Add a table for storing status bar values
updateSQLIfOlder $oldversionint 113100356 "CREATE TABLE m23.statusbar ( id int(20) NOT NULL AUTO_INCREMENT , refreshtime int(11) NOT NULL default '5', type VARCHAR( 255 ) NOT NULL , cmd LONGTEXT NOT NULL, ts bigint(20) NOT NULL default '0', percent int(11) NOT NULL default '0', client varchar(255) NOT NULL , statustext longtext NOT NULL , name VARCHAR( 255 ) NOT NULL , PRIMARY KEY ( id ),  UNIQUE KEY client (client,name) ) ENGINE = MYISAM"

#Increased the size of the field "normalPackage" in the table "clientjobs".
updateSQLIfOlder $oldversionint 113100402 "ALTER TABLE clientjobs CHANGE normalPackage normalPackage LONGTEXT NOT NULL"

#Increased the size of the clientname to longtext.
updateSQLIfOlder $oldversionint 113100411 "ALTER TABLE clients CHANGE client client LONGTEXT NOT NULL"

#Increase the size of language
updateSQLIfOlder $oldversionint 113100485 "ALTER TABLE clients CHANGE language language VARCHAR( 5 ) NOT NULL"

#Add a table for storing locked IP ranges
updateSQLIfOlder $oldversionint 123100598 "CREATE TABLE m23.lockedIPRanges (id BIGINT NOT NULL AUTO_INCREMENT , firstIPInt bigint(20) NOT NULL , lastIPInt bigint(20) NOT NULL , PRIMARY KEY ( id )) ENGINE = MYISAM ;"

#Convert the old dhcpd.conf format to the new
if [ -f /m23/dhcp/dhcpd.conf ]
then
	dhcpdBackup=$(date +'/m23/dhcp/dhcpd.conf.%Y-%m-%d_%H-%M.bak')
	cp /m23/dhcp/dhcpd.conf $dhcpdBackup
	sed -i -e 's/^ subnet [0-9]*\.[0-9]*\.[0-9]*\.[0-9]* netmask [0-9]*\.[0-9]*\.[0-9]*\.0 { //g' -e 's/; } option/; option/g' -e 's/}}$/}/g' -e 's/^ host/host/g' /m23/dhcp/dhcpd.conf
fi

#Add new table for storing the PHP objects
updateSQLIfOlder $oldversionint 131100629 "CREATE TABLE m23.PHPObjectStorage ( id BIGINT NOT NULL AUTO_INCREMENT , ident VARCHAR( 255 ) NOT NULL , class VARCHAR( 255 ) NOT NULL , object LONGTEXT NOT NULL, last_modified int(10) NOT NULL, PRIMARY KEY ( id ), UNIQUE KEY client (ident,class) ) ENGINE = MYISAM ;"

#Add a new table for storing the admin credentials
updateSQLIfOlder $oldversionint 131100637 "CREATE TABLE m23Admins ( ID int(10) unsigned NOT NULL AUTO_INCREMENT, name varchar(40) NOT NULL, pwhash varchar(255) NOT NULL, options longtext NOT NULL, salt varchar(16) NOT NULL, PRIMARY KEY (ID) ) ENGINE=MyISAM COMMENT='List of all m23 admins with password hashes and options';"

#Increase the size of the normalPackage field to LONGTEXT
updateSQLIfOlder $oldversionint 131100669 "ALTER TABLE recommendpackages CHANGE normalPackage normalPackage LONGTEXT NOT NULL"

updateSQLIfOlder $oldversionint 143100752 "ALTER TABLE clients ADD CFDiskTemp LONGBLOB NOT NULL AFTER partitions"

# Add description field to the groups table
updateSQLIfOlder $oldversionint 162100899 "ALTER TABLE groups ADD description LONGTEXT; ALTER TABLE clients ADD keyValueStore LONGTEXT"

# Add new table for storing the autoUpdate schedule
updateSQLIfOlder $oldversionint 172100985 "CREATE TABLE autoUpdateSchedule ( id int(11) NOT NULL, startsEnds text NOT NULL, groups text NOT NULL, type varchar(1) NOT NULL, parallelUpdates int(11) NOT NULL, lastRun timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, active tinyint(1) NOT NULL ) ENGINE=InnoDB DEFAULT CHARSET=latin1;"

# Extend the client table by fields for storing autoUpdate values
updateSQLIfOlder $oldversionint 172100985 "ALTER TABLE clients ADD autoUpdate_lastAttempt int(10) DEFAULT NULL AFTER keyValueStore, ADD autoUpdate_gotJob BOOLEAN NOT NULL AFTER autoUpdate_lastAttempt, ADD autoUpdate_fails INT NOT NULL AFTER autoUpdate_gotJob;"



######################
# DB adjustments END #
######################


updateDB


#Adjust the ramdisk sizes of all PXE settings
kernelRamDisk=`grep kernelRamDisk /m23/inc/kernelRamDisk.inc | sed 's/[^0-9]//g'`
sed -i "s/ramdisk_size=[0-9]*/ramdisk_size=$kernelRamDisk/g" /m23/tftp/pxelinux.cfg/* /m23/tftp/grub/grub.cfg
restartDHCPServer


mkdir -p /m23/tmp /m23/log

/m23/bin/fix-permissions
if [ -e /m23/data+scripts/clientImages ]
then
	chown www-data /m23/data+scripts/clientImages
	chmod 755 /m23/data+scripts/clientImages
fi


chown www-data.www-data /m23/data+scripts/packages/userPackages /m23/log
mkdir -p /m23/var/cache/m23apt
chown www-data.www-data /m23/var/cache/m23apt /m23/tmp /m23/tftp/pxelinux.cfg
chmod 755 /m23/log


touch /m23/dhcp/dhcpd.leases

mkdir -p /m23/root-only
chmod 700 /m23/root-only

rm -r /tmp/m23-install 2> /dev/null

# Make sure the www-data user has a normal login (needed for sudo, e.g. package index creation)
usermod -s /bin/bash www-data
# Set a random password
usermod -p $(< /dev/urandom tr -dc A-Za-z0-9 | head -c${1:-64};echo;) www-data

#Make sure that there is no user test
userdel -r -f test 2> /dev/null

#Import the key for the signed m23 packages
wget -T1 -t1 -q http://m23.sourceforge.net/m23-Sign-Key.asc -O - | apt-key add -

#Create the extraDebs directory with empty indices if it doesn't exist.
if [ ! -f /m23/data+scripts/extraDebs/Packages.gz ]
then
	mkdir -p /m23/data+scripts/extraDebs/

	cd /m23/data+scripts/extraDebs/
	touch Packages
	gzip -c Packages > Packages.gz
	bzip2 -k Packages

	chmod 777 -R /m23/data+scripts/extraDebs
fi

#grep "`cat ~/.ssh/id_dsa.pub 2> /dev/null`" ~/.ssh/authorized_keys -c 2> /dev/null
grep "`cat ~/.ssh/id_rsa.pub 2> /dev/null`" ~/.ssh/authorized_keys -c 2> /dev/null
if [ $? -ne 0 ]
then
#	cat ~/.ssh/id_dsa.pub 2> /dev/null >> ~/.ssh/authorized_keys
	cat ~/.ssh/id_rsa.pub 2> /dev/null >> ~/.ssh/authorized_keys
fi


#Fix /etc/sudoers, if there are more than one entry for grdmgpg
grdmAmount=$(grep -c grdmgpg /etc/sudoers)
if [ $grdmAmount -gt 1 ]
then
	awk -vAM=$grdmAmount '
	BEGIN { cnt=1 }
	/grdmgpg/ {
		if (cnt < AM)
		{ cnt++; next}
	}
	{ print }
	' /etc/sudoers > /tmp/sudoers
	cat /tmp/sudoers > /etc/sudoers
fi

# Needed on Debian 8
/etc/init.d/mysql restart

postinstHook='/m23/bin/postinstHook.sh'
if [ -f $postinstHook ]
then
	bash $postinstHook
fi

db_stop