/scripts/alcasar-urpmi.sh |
---|
12,7 → 12,7 |
VERSION="4" |
ARCH="i586" |
# ****** Alcasar needed RPMS - paquetages nécessaires au fonctionnement d'Alcasar ****** |
PACKAGES="freeradius freeradius-mysql freeradius-ldap freeradius-web apache apache-mod_ssl apache-mod_php dansguardian postfix mariadb ntp bind-utils openssh-server php-xml php-ldap php-mysql php-mbstring php-sockets rng-utils dnsmasq rsync clamav perl-rrdtool perl-MailTools perl-Socket6 fail2ban gnupg ulogd man dkms-ipt_NETFLOW pm-fallback-policy ipset cronie-anacron" |
PACKAGES="freeradius freeradius-mysql freeradius-ldap freeradius-web apache apache-mod_ssl apache-mod_php dansguardian postfix mariadb ntp bind-utils openssh-server php-xml php-ldap php-mysql php-mbstring php-sockets rng-utils dnsmasq rsync clamav perl-rrdtool perl-MailTools perl-Socket6 fail2ban gnupg ulogd dkms-ipt_NETFLOW pm-fallback-policy ipset cronie-anacron" |
rpm_repository_sync () |
{ |
/scripts/sbin/alcasar-bl.sh |
---|
17,6 → 17,7 |
DIR_tmp="/tmp/blacklists" |
FILE_tmp="/tmp/filesfilter.txt" |
FILE_ip_tmp="/tmp/filesipfilter.txt" |
FILE_IP_WL="/usr/local/share/ossi_wl" |
DIR_DG="/etc/dansguardian/lists" |
DIR_DG_BL="$DIR_DG/blacklists" |
BL_CATEGORIES="$DIR_CONF/alcasar-bl-categories" # list of names of the BL categories |
30,7 → 31,8 |
DIR_DNS_BL_ENABLED="$DIR_SHARE/dnsmasq-bl-enabled" # symbolic link to the dnsmasq BL (only enabled categories) |
DIR_DNS_WL_ENABLED="$DIR_SHARE/dnsmasq-wl-enabled" # ' ' ' WL ' ' ' |
DIR_IP_BL_ENABLED="$DIR_SHARE/iptables-bl-enabled" # ' ' ip BL (only enabled categories) |
DNSMASQ_BL_CONF="/etc/dnsmasq-blackhole.conf" # conf file of dnsmasq-blackhole |
DNSMASQ_BL_CONF="/etc/dnsmasq-blacklist.conf" # conf file of dnsmasq-blacklist |
DNS1=`grep "DNS1" $CONF_FILE | cut -d '=' -f 2` # server DNS1 (for WL domain names) |
BL_SERVER="dsi.ut-capitole.fr" |
SED="/bin/sed -i" |
99,15 → 101,9 |
args=$1 |
if [ $nb_args -eq 0 ] |
then |
DNS_FILTERING=`grep DNS_FILTERING $CONF_FILE|cut -d"=" -f2` # DNS and URLs filter (on/off) |
DNS_FILTERING=${DNS_FILTERING:=off} |
echo "Set BlackList Filtering to $DNS_FILTERING" |
if [ $DNS_FILTERING = on ]; then |
cat_choice |
bl_enable |
else |
bl_disable |
fi |
echo "Set BlackList Filtering to ON" |
cat_choice |
bl_enable |
exit 0 |
fi |
case $args in |
143,9 → 139,17 |
;; |
# Adapt Toulouse BL to ALCASAR architecture (dnsmasq + DG + iptables) |
-adapt | --adapt) |
echo -n "Migration process of Toulouse BlackList. Please wait : " |
# Saving IP ossi category if exist else create it (ie : during the installaton process) |
[ -e $DIR_IP_BL/ossi ] && mv -f $DIR_IP_BL/ossi $DIR_tmp/ossi-ip |
echo -n "Toulouse BlackList migration process. Please wait : " |
# Saving whitelist ip |
if [ -e $FILE_IP_WL ] |
then |
cp $FILE_IP_WL $DIR_tmp |
else |
touch $FILE_IP_WL |
chown apache $FILE_IP_WL |
fi |
# Saving ossi category |
cp $DIR_IP_BL/ossi $DIR_tmp/ossi-ip |
if [ -f $DIR_tmp/blacklists.tar.gz ] |
then |
[ -d $DIR_DG_BL/ossi ] && mv -f $DIR_DG_BL/ossi $DIR_tmp |
201,25 → 205,31 |
# retrieve the ip addresses for iptables |
# create an set save for the selected category |
awk '/^([0-9]{1,3}\.){3}[0-9]{1,3}$/{print "add blacklist_ip_blocked " $0}' $PATH_FILE/domains > $FILE_ip_tmp |
# for dnsmask, remove IP addesses, accented characters and commented lines. |
egrep -v "^([0-9]{1,3}\.){3}[0-9]{1,3}$" $PATH_FILE/domains > $FILE_tmp |
$SED "/[äâëêïîöôüû]/d" $FILE_tmp |
$SED "/^#.*/d" $FILE_tmp |
# adapt to the dnsmasq syntax |
$SED "s?.*?address=/&/$PRIVATE_IP?g" $FILE_tmp |
if [ "$LIST" == "$BL_CATEGORIES" ] |
then |
# adapt to the dnsmasq syntax for the blacklist |
$SED "s?.*?address=/&/$PRIVATE_IP?g" $FILE_tmp |
mv $FILE_tmp $DIR_DNS_BL/$DOMAINE.conf |
mv $FILE_ip_tmp $DIR_IP_BL/$DOMAINE |
else |
# adapt to the dnsmasq syntax for the whitelist |
$SED "s?.*?server=/&/$DNS1?g" $FILE_tmp |
mv $FILE_tmp $DIR_DNS_WL/$DOMAINE.conf |
fi |
done |
done |
rm -f $FILE_tmp $FILE_ip_tmp |
# Restoring ossi-IP category |
[ -e $DIR_tmp/ossi-ip ] && mv $DIR_tmp/ossi-ip $DIR_IP_BL/ossi |
# Restoring ossi category |
mv $DIR_tmp/ossi-ip $DIR_IP_BL/ossi |
# Restoring whitelist ip |
if [ -e $DIR_tmp/ossi_wl ] |
then |
mv $DIR_tmpi/ossi_wl /usr/local/share/ |
fi |
rm -rf $DIR_tmp |
echo |
;; |
240,13 → 250,7 |
cp -f $DIR_DG_BL/ossi/domains $DIR_DNS_BL/ossi.conf |
$SED "s?.*?address=/&/$PRIVATE_IP?g" $DIR_DNS_BL/ossi.conf |
cp -f $DIR_DG_BL/ossi/domains_wl $DIR_DNS_WL/ossi.conf |
DNS_FILTERING=`grep DNS_FILTERING $CONF_FILE|cut -d"=" -f2` # DNS and URLs filter (on/off) |
DNS_FILTERING=${DNS_FILTERING:=off} |
if [ $DNS_FILTERING = on ]; then |
bl_enable |
else |
bl_disable |
fi |
bl_enable |
;; |
*) |
echo "Argument inconnu :$1"; |
/scripts/sbin/alcasar-uninstall.sh |
---|
78,7 → 78,7 |
sleep 1 |
#param_web_radius |
echo -en "\n- param_web_radius(3) : " |
echo -en "\n- param_web_radius(4) : " |
[ -e /etc/freeradius-web/admin.conf.default ] && mv /etc/freeradius-web/admin.conf.default /etc/freeradius-web/admin.conf && echo -n "1, " |
[ -e /etc/freeradius-web/naslist.conf ] && rm /etc/freeradius-web/naslist.conf && echo -n "2, " |
[ -e /etc/freeradius-web/user_edit.attrs.default ] && mv /etc/freeradius-web/user_edit.attrs.default /etc/freeradius-web/user_edit.attrs && echo -n "3, " |
128,18 → 128,27 |
sleep 1 |
#param_ulogd |
echo -en "\n- ulogd(2) : " |
echo -en "\n- ulogd(6) : " |
if [ -e /lib/systemd/system/ulogd-traceability.conf ] |
then |
rm -f /etc/ulogd-* && echo -n "1, " |
rm -f /lib/systemd/system/ulogd-* && echo -n "2" |
i=0 |
for log_type in traceability ssh ext-access |
do |
i=`expr $i + 1` |
rm -f /etc/ulogd-$log_type.conf && echo -n "$i, " |
i=`expr $i + 1` |
rm -f /lib/systemd/system/ulogd-$log_type && echo -n "$i" |
else echo -n "nothing to do" |
fi |
sleep 1 |
#nfsen |
echo -en "\n nfsen(0) :" |
echo "todo!!!" |
echo -en "\n- nfsen(2) : " |
[ `grep "^nfsen:" /etc/passwd | wc -l` == 1 ] && userdel -r nfsen && echo -n "1, " |
[ `grep "^www-data:" /etc/group | wc -l` == 1 ] && userdel -r www-data && groupdel www-data ; echo -n "2" |
# We keep netflow RRD DB for the moment |
#[ -d /var/log/netflow ] && rm -rf /var/log/netflow && echo -n "3" |
sleep 1 |
#DnsMasq |
182,14 → 191,17 |
rm -f /etc/cron.d/coova /etc/cron.d/alcasar-bl_download |
sleep 1 |
# network |
#network |
echo -en "\n- network(9) : " |
hostname localhost |
for i in /etc/sysconfig/network-scripts/default* |
EXTIF=`/sbin/ip route|grep default|cut -d" " -f5` |
INTIF=`/sbin/ip link|grep '^[[:digit:]]:'|grep -v "lo\|$EXTIF"|cut -d" " -f2|tr -d ":"` |
i=0 |
for nic in $EXTIF $INTIF |
do |
nic=`echo $i|cut -d"-" -f4` |
i=`expr $i + 1` |
/sbin/ifdown $nic |
mv -f $i /etc/sysconfig/network-scripts/ifcfg-$nic |
[ -e /etc/sysconfig/network-scripts/default-ifcfg-$nic ] && mv -f /etc/sysconfig/network-scripts/default-ifcfg-$nic /etc/sysconfig/network-scripts/ifcfg-$nic && echo -n "$i, " |
done |
[ -e /etc/sysconfig/network.default ] && mv /etc/sysconfig/network.default /etc/sysconfig/network && echo -n "3, " |
[ -e /etc/hosts.default ] && mv /etc/hosts.default /etc/hosts && echo -n "4, " |
200,7 → 212,7 |
[ -e /etc/modprobe.preload.default ] && mv /etc/modprobe.preload.default /etc/modprobe.preload && echo -n "9" |
echo |
/sbin/ifup eth0 |
/sbin/ifup $EXTIF |
sleep 1 |
#post_install |
232,5 → 244,5 |
done |
echo |
# suppression des exceptions de mises à jours ( coova-chilli et freeradius) |
#suppression des exceptions de mises à jours ( coova-chilli et freeradius) |
sed -i '/coova.*/d' /etc/urpmi/skip.list |