WebSVN – ALCASAR – Diff – /alcasar.sh



#!/bin/bash
#  $Id: alcasar.sh 1389 2014-06-15 14:55:15Z richard $ 
 
# alcasar.sh
 
# ALCASAR Install script -  CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...] 
# Ce programme est un logiciel libre ; This software is free and open source

#	init			: Installation of RPM and scripts
#	network			: Network parameters
#	ACC			: ALCASAR Control Center installation
#	CA			: Certification Authority initialization
#	init_db			: Initilization of radius database managed with MariaDB
#	radius			: FreeRadius initialisation
#	radius_web		: copy ans modifiy original "freeradius web" in ACC
#	chilli			: coovachilli initialisation (+authentication page)
#	dansguardian		: DansGuardian filtering HTTP proxy configuration
#	antivirus		: HAVP + libclamav configuration
#	ulogd			: log system in userland (match NFLOG target of iptables)
#	nfsen		:	: Configuration du grapheur nfsen pour apache 
#	dnsmasq			: Name server configuration
#	BL			: BlackList of Toulouse configuration : split into 3 BL (for Dnsmasq, for dansguardian and for Netfilter)
#	cron			: Logs export + watchdog + connexion statistics
#	fail2ban		: Fail2ban IDS installation and configuration
 
#	gammu_smsd		: Autoregister addon via SMS (gammu-smsd)
#	post_install		: Security, log rotation, etc.
 
DATE=`date '+%d %B %Y - %Hh%M'`
DATE_SHORT=`date '+%d/%m/%Y'`
Lang=`echo $LANG|cut -c 1-2`
mode="install"

	clear
	echo "-----------------------------------------------------------------------------"
	echo "                     ALCASAR V$VERSION Installation"
	echo "Application Libre pour le Contrôle d'Accès Sécurisé et Authentifié au Réseau"
	echo "-----------------------------------------------------------------------------"
 
}
 
##################################################################
##			Function "testing"			##
## - Test of Mageia version					##
## - Test of free space on /var  (>10G)				##

		fi
		exit 0
	fi
	rm -rf /tmp/con_ok.html
	echo ". : ok"
} # end of testing ()
 
##################################################################
##			Function "init"				##
## - Création du fichier "/root/ALCASAR_parametres.txt"		##
## - Installation et modification des scripts du portail	##

	ErrorDocument 404 https://$HOSTNAME.$DOMAIN/
</Directory>
EOF
# Launch after coova
$SED "s?^After=.*?After=network.target remote-fs.target nss-lookup.target chilli.service?g" /lib/systemd/system/httpd.service
} # End of ACC ()
 
##########################################################################################
##				Fonction "CA"						##
## - Création d'une Autorité de Certification et du certificat serveur pour apache 	##
##########################################################################################

	$SED "s?localhost.crt?alcasar.crt?g" $FIC_VIRTUAL_SSL
	$SED "s?localhost.key?alcasar.key?g" $FIC_VIRTUAL_SSL
	$SED "s?^#SSLCertificateChainFile.*?SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt?" $FIC_VIRTUAL_SSL
	chown -R root:apache /etc/pki
	chmod -R 750 /etc/pki
} # End of CA ()
 
##########################################################################################
##			Fonction "init_db"						##
## - Initialisation de la base Mysql							##
## - Affectation du mot de passe de l'administrateur (root)				##

# modify the start script in order to close accounting connexion when the system is comming down or up
	[ -e /lib/systemd/system/mysqld.service.default ] || cp /lib/systemd/system/mysqld.service /lib/systemd/system/mysqld.service.default
	$SED "/ExecStartPost=/a ExecStartPost=[ -e /usr/local/sbin/alcasar-mysql.sh ] && /usr/local/sbin/alcasar-mysql.sh -acct_stop" /lib/systemd/system/mysqld.service
	$SED "/ExecStartPost=/a ExecStop=[ -e /usr/local/sbin/alcasar-mysql.sh ] && /usr/local/sbin/alcasar-mysql.sh -acct_stop" /usr/lib/systemd/system/mysqld.service
	systemctl daemon-reload
} # End of init_db ()
 
##########################################################################
##			Fonction "radius"				##
## - Paramètrage des fichiers de configuration FreeRadius		##
## - Affectation du secret partagé entre coova-chilli et freeradius	##
## - Modification de fichier de conf pour l'accès à Mysql		##
##########################################################################
radius ()
{
	cp -f $DIR_CONF/radiusd-db-vierge.sql /etc/raddb/
	chown -R radius:radius /etc/raddb
	[ -e /etc/raddb/radiusd.conf.default ] || cp /etc/raddb/radiusd.conf /etc/raddb/radiusd.conf.default
# Set radius.conf parameters

	chown -R radius:radius /etc/raddb/sql/mysql/*
# make certain that mysql is up before radius start
	[ -e /lib/systemd/system/radiusd.service.default ] || cp /lib/systemd/system/radiusd.service /lib/systemd/system/radiusd.service.default
	$SED "s?^After=.*?After=syslog.target network.target mysqld.service?g" /lib/systemd/system/radiusd.service
	systemctl daemon-reload
} # End radius ()
 
##########################################################################
##			Function "radius_web"				##
## - Import, modification et paramètrage de l'interface "dialupadmin"	##
## - Création du lien vers la page de changement de mot de passe        ##
##########################################################################
radius_web ()
{
# copie de l'interface d'origine dans la structure Alcasar
	[ -d /usr/share/freeradius-web ] && cp -rf /usr/share/freeradius-web/* $DIR_ACC/manager/
	rm -f $DIR_ACC/manager/index.html $DIR_ACC/manager/readme 
	rm -f $DIR_ACC/manager/htdocs/about.html $DIR_ACC/manager/htdocs/index.html $DIR_ACC/manager/htdocs/content.html

	Allow from 127.0.0.1
	Allow from $PRIVATE_NETWORK_MASK
	ErrorDocument 404 https://$HOSTNAME.$DOMAIN
</Directory>
EOF
} # End of radius_web ()
 
##################################################################################
##			Fonction "chilli"					##
## - Création du fichier d'initialisation et de configuration de coova-chilli	##
## - Paramètrage de la page d'authentification (intercept.php)			##
##################################################################################
chilli ()
{
# chilli unit for systemd
cat << EOF > /lib/systemd/system/chilli.service
#  This file is part of systemd.
#

	then
	      userdel -r chilli 2>/dev/null
	fi
	groupadd -f chilli
	useradd -r -g chilli -s /bin/false -c "system user for coova-chilli" chilli
}  # End of chilli ()
 
##################################################################
##		Fonction "dansguardian"				##
## - Paramètrage du gestionnaire de contenu Dansguardian	##
##################################################################
dansguardian ()
{
	mkdir /var/dansguardian
	chown dansguardian /var/dansguardian
	$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dansguardian -c /etc/dansguardian/dansguardian.conf?g" /lib/systemd/system/dansguardian.service
	$SED "s?^After=.*?After=network.target chilli.target?g" /lib/systemd/system/dansguardian.service

	[ -e $DIR_DG/lists/exceptioniplist.default ] || mv $DIR_DG/lists/exceptioniplist $DIR_DG/lists/exceptioniplist.default
	touch $DIR_DG/lists/exceptioniplist
# Keep a copy of URL & domain filter configuration files
	[ -e $DIR_DG/lists/bannedsitelist.default ] || mv $DIR_DG/lists/bannedsitelist $DIR_DG/lists/bannedsitelist.default
	[ -e $DIR_DG/lists/bannedurllist.default ] || mv $DIR_DG/lists/bannedurllist $DIR_DG/lists/bannedurllist.default
} # End of dansguardian ()
 
##################################################################
##			Fonction "antivirus"			##
## - configuration of havp, libclamav and freshclam		##
##################################################################

	$SED "/^DatabaseMirror/i DatabaseMirror db.fr.clamav.net" /etc/freshclam.conf
	$SED "/^DatabaseMirror db.fr.clamav.net/i DatabaseMirror switch.clamav.net" /etc/freshclam.conf
	$SED "s?MaxAttempts.*?MaxAttempts 3?g" /etc/freshclam.conf
# update now
	/usr/bin/freshclam --no-warnings
} # End of antivirus ()
 
##################################################################################
##			function "ulogd"					##
## - Ulog config for multi-log files 						##
##################################################################################
ulogd ()
{
# Three instances of ulogd (three different logfiles)
	[ -d /var/log/firewall ] || mkdir -p /var/log/firewall
	nl=1
	for log_type in traceability ssh ext-access

		nl=`expr $nl + 1`
	done
	chown -R root:apache /var/log/firewall
	chmod 750 /var/log/firewall
	chmod 640 /var/log/firewall/*
}  # End of ulogd ()
 
 
##########################################################
##              Function "nfsen"			##
##########################################################
nfsen()
{
	tar xvzf ./conf/nfsen/nfsen-1.3.6p1.tar.gz -C /tmp/
# Create a specific user and group
	[ `grep "^www-data:" /etc/group | wc -l` == 1 ] || groupadd www-data
	[ `grep "^nfsen:" /etc/passwd | wc -l` == 1 ] || useradd -r -g nfsen -s /bin/false -c "system user for the grapher nfsen" nfsen

# expire delay for the profile "live"
	nfsen -m live -e 62d 2>/dev/null
# clear the installation
	cd $DirTmp
	rm -rf /tmp/nfsen-1.3.6p1/
} # End of nfsen ()
 
##########################################################
##		Function "dnsmasq"		##
##########################################################
dnsmasq ()
{
	[ -d /var/log/dnsmasq ] || mkdir /var/log/dnsmasq
	[ -e /etc/sysconfig/dnsmasq.default ] || cp /etc/sysconfig/dnsmasq /etc/sysconfig/dnsmasq.default
	$SED "s?^OPTION=.*?OPTION=-C /etc/dnsmasq.conf?g" /etc/sysconfig/dnsmasq # default conf file for the first dnsmasq instance
	[ -e /etc/dnsmasq.conf.default ] || cp /etc/dnsmasq.conf /etc/dnsmasq.conf.default

# Create dnsmasq-blacklist and dnsmasq-whitelist unit
	cp -f /lib/systemd/system/dnsmasq.service /lib/systemd/system/dnsmasq-blacklist.service
	cp -f /lib/systemd/system/dnsmasq.service /lib/systemd/system/dnsmasq-whitelist.service
	$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dnsmasq -C /etc/dnsmasq-blacklist.conf?g" /lib/systemd/system/dnsmasq-blacklist.service
	$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dnsmasq -C /etc/dnsmasq-whitelist.conf?g" /lib/systemd/system/dnsmasq-whitelist.service
<<<<<<< .mine
} # End of dnsmasq()
=======
	$SED "s?^PIDFile=.*?PIDFile=/var/run/dnsmasq-blacklist.pid?g" /lib/systemd/system/dnsmasq-blacklist.service
	$SED "s?^PIDFile=.*?PIDFile=/var/run/dnsmasq-whitelist.pid?g" /lib/systemd/system/dnsmasq-whitelist.service
} # End dnsmasq
>>>>>>> .r1387
 
##########################################################
##		Fonction "BL"				##
##########################################################
BL ()

	for i in havp 
	do
		/sbin/chkconfig --add $i
	done
# processes launched at boot time (Systemctl)
	for i in alcasar-load_balancing nfsen mysqld httpd ntpd iptables ulogd dnsmasq dnsmasq-blacklist dnsmasq-whitelist radiusd dansguardian freshclam ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban
	do
		systemctl -q enable $i.service
	done
# Apply French Security Agency (ANSSI) rules
# ignore ICMP broadcast (smurf attack)
	echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" > /etc/sysctl.d/alcasar.conf
# ignore ICMP errors bogus

			MAJ_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f1`
			MIN_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f2|cut -c1`
			UPD_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f3`
			mode="update"
		fi
		for func in init network ACC CA init_db radius radius_web chilli dansguardian antivirus ulogd nfsen dnsmasq BL cron fail2ban gammu_smsd post_install
		do
			$func
# echo "*** 'debug' : end of function $func ***"; read a
		done
		;;

Rev 1387	Rev 1389
Line 1...	Line 1...
1	`#!/bin/bash`	1	`#!/bin/bash`
2	`# $Id: alcasar.sh 1387 2014-06-13 16:57:56Z richard $`	2	`# $Id: alcasar.sh 1389 2014-06-15 14:55:15Z richard $`
3		3
4	`# alcasar.sh`	4	`# alcasar.sh`
5		5
6	`# ALCASAR Install script - CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...]`	6	`# ALCASAR Install script - CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...]`
7	`# Ce programme est un logiciel libre ; This software is free and open source`	7	`# Ce programme est un logiciel libre ; This software is free and open source`
Line 31...	Line 31...
31	`# init : Installation of RPM and scripts`	31	`# init : Installation of RPM and scripts`
32	`# network : Network parameters`	32	`# network : Network parameters`
33	`# ACC : ALCASAR Control Center installation`	33	`# ACC : ALCASAR Control Center installation`
34	`# CA : Certification Authority initialization`	34	`# CA : Certification Authority initialization`
35	`# init_db : Initilization of radius database managed with MariaDB`	35	`# init_db : Initilization of radius database managed with MariaDB`
36	`# param_radius : FreeRadius initialisation`	36	`# radius : FreeRadius initialisation`
37	`# param_web_radius : copy ans modifiy original "freeradius web" in ACC`	37	`# radius_web : copy ans modifiy original "freeradius web" in ACC`
38	`# param_chilli : coovachilli initialisation (+authentication page)`	38	`# chilli : coovachilli initialisation (+authentication page)`
39	`# param_dansguardian : DansGuardian filtering HTTP proxy configuration`	39	`# dansguardian : DansGuardian filtering HTTP proxy configuration`
40	`# antivirus : HAVP + libclamav configuration`	40	`# antivirus : HAVP + libclamav configuration`
-		41	`# ulogd : log system in userland (match NFLOG target of iptables)`
41	`# param_nfsen : Configuration du grapheur nfsen pour apache`	42	`# nfsen : : Configuration du grapheur nfsen pour apache`
42	`# dnsmasq : Name server configuration`	43	`# dnsmasq : Name server configuration`
43	`# BL : BlackList of Toulouse configuration : split into 3 BL (for Dnsmasq, for dansguardian and for Netfilter)`	44	`# BL : BlackList of Toulouse configuration : split into 3 BL (for Dnsmasq, for dansguardian and for Netfilter)`
44	`# cron : Logs export + watchdog + connexion statistics`	45	`# cron : Logs export + watchdog + connexion statistics`
45	`# fail2ban : Fail2ban installation and configuration`	46	`# fail2ban : Fail2ban IDS installation and configuration`
46	`# post_install : Security, log rotation, etc.`	-
47	`# gammu_smsd : Autoregister addon via SMS (gammu-smsd)`	47	`# gammu_smsd : Autoregister addon via SMS (gammu-smsd)`
-		48	`# post_install : Security, log rotation, etc.`
48		49
49	DATE=`date '+%d %B %Y - %Hh%M'`	50	DATE=`date '+%d %B %Y - %Hh%M'`
50	DATE_SHORT=`date '+%d/%m/%Y'`	51	DATE_SHORT=`date '+%d/%m/%Y'`
51	Lang=`echo $LANG\|cut -c 1-2`	52	Lang=`echo $LANG\|cut -c 1-2`
52	`mode="install"`	53	`mode="install"`
Line 96...	Line 97...
96	`clear`	97	`clear`
97	`echo "-----------------------------------------------------------------------------"`	98	`echo "-----------------------------------------------------------------------------"`
98	`echo " ALCASAR V$VERSION Installation"`	99	`echo " ALCASAR V$VERSION Installation"`
99	`echo "Application Libre pour le Contrôle d'Accès Sécurisé et Authentifié au Réseau"`	100	`echo "Application Libre pour le Contrôle d'Accès Sécurisé et Authentifié au Réseau"`
100	`echo "-----------------------------------------------------------------------------"`	101	`echo "-----------------------------------------------------------------------------"`
101	`} # End of header_install ()`	-
102		102	`}`
103		103
104	`##################################################################`	104	`##################################################################`
105	`## Function "testing" ##`	105	`## Function "testing" ##`
106	`## - Test of Mageia version ##`	106	`## - Test of Mageia version ##`
107	`## - Test of free space on /var (>10G) ##`	107	`## - Test of free space on /var (>10G) ##`
Line 306...	Line 306...
306	`fi`	306	`fi`
307	`exit 0`	307	`exit 0`
308	`fi`	308	`fi`
309	`rm -rf /tmp/con_ok.html`	309	`rm -rf /tmp/con_ok.html`
310	`echo ". : ok"`	310	`echo ". : ok"`
311	`} # end of testing`	311	`} # end of testing ()`
312		312
313	`##################################################################`	313	`##################################################################`
314	`## Function "init" ##`	314	`## Function "init" ##`
315	`## - Création du fichier "/root/ALCASAR_parametres.txt" ##`	315	`## - Création du fichier "/root/ALCASAR_parametres.txt" ##`
316	`## - Installation et modification des scripts du portail ##`	316	`## - Installation et modification des scripts du portail ##`
Line 751...	Line 751...
751	`ErrorDocument 404 https://$HOSTNAME.$DOMAIN/`	751	`ErrorDocument 404 https://$HOSTNAME.$DOMAIN/`
752	`</Directory>`	752	`</Directory>`
753	`EOF`	753	`EOF`
754	`# Launch after coova`	754	`# Launch after coova`
755	`$SED "s?^After=.*?After=network.target remote-fs.target nss-lookup.target chilli.service?g" /lib/systemd/system/httpd.service`	755	`$SED "s?^After=.*?After=network.target remote-fs.target nss-lookup.target chilli.service?g" /lib/systemd/system/httpd.service`
756	`} # End of ACC()`	756	`} # End of ACC ()`
757		757
758	`##########################################################################################`	758	`##########################################################################################`
759	`## Fonction "CA" ##`	759	`## Fonction "CA" ##`
760	`## - Création d'une Autorité de Certification et du certificat serveur pour apache ##`	760	`## - Création d'une Autorité de Certification et du certificat serveur pour apache ##`
761	`##########################################################################################`	761	`##########################################################################################`
Line 768...	Line 768...
768	`$SED "s?localhost.crt?alcasar.crt?g" $FIC_VIRTUAL_SSL`	768	`$SED "s?localhost.crt?alcasar.crt?g" $FIC_VIRTUAL_SSL`
769	`$SED "s?localhost.key?alcasar.key?g" $FIC_VIRTUAL_SSL`	769	`$SED "s?localhost.key?alcasar.key?g" $FIC_VIRTUAL_SSL`
770	`$SED "s?^#SSLCertificateChainFile.*?SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt?" $FIC_VIRTUAL_SSL`	770	`$SED "s?^#SSLCertificateChainFile.*?SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt?" $FIC_VIRTUAL_SSL`
771	`chown -R root:apache /etc/pki`	771	`chown -R root:apache /etc/pki`
772	`chmod -R 750 /etc/pki`	772	`chmod -R 750 /etc/pki`
773	`} # End CA ()`	773	`} # End of CA ()`
774		774
775	`##########################################################################################`	775	`##########################################################################################`
776	`## Fonction "init_db" ##`	776	`## Fonction "init_db" ##`
777	`## - Initialisation de la base Mysql ##`	777	`## - Initialisation de la base Mysql ##`
778	`## - Affectation du mot de passe de l'administrateur (root) ##`	778	`## - Affectation du mot de passe de l'administrateur (root) ##`
Line 802...	Line 802...
802	`# modify the start script in order to close accounting connexion when the system is comming down or up`	802	`# modify the start script in order to close accounting connexion when the system is comming down or up`
803	`[ -e /lib/systemd/system/mysqld.service.default ] \|\| cp /lib/systemd/system/mysqld.service /lib/systemd/system/mysqld.service.default`	803	`[ -e /lib/systemd/system/mysqld.service.default ] \|\| cp /lib/systemd/system/mysqld.service /lib/systemd/system/mysqld.service.default`
804	`$SED "/ExecStartPost=/a ExecStartPost=[ -e /usr/local/sbin/alcasar-mysql.sh ] && /usr/local/sbin/alcasar-mysql.sh -acct_stop" /lib/systemd/system/mysqld.service`	804	`$SED "/ExecStartPost=/a ExecStartPost=[ -e /usr/local/sbin/alcasar-mysql.sh ] && /usr/local/sbin/alcasar-mysql.sh -acct_stop" /lib/systemd/system/mysqld.service`
805	`$SED "/ExecStartPost=/a ExecStop=[ -e /usr/local/sbin/alcasar-mysql.sh ] && /usr/local/sbin/alcasar-mysql.sh -acct_stop" /usr/lib/systemd/system/mysqld.service`	805	`$SED "/ExecStartPost=/a ExecStop=[ -e /usr/local/sbin/alcasar-mysql.sh ] && /usr/local/sbin/alcasar-mysql.sh -acct_stop" /usr/lib/systemd/system/mysqld.service`
806	`systemctl daemon-reload`	806	`systemctl daemon-reload`
807	`} # End init_db ()`	807	`} # End of init_db ()`
808		808
809	`##########################################################################`	809	`##########################################################################`
810	`## Fonction "param_radius" ##`	810	`## Fonction "radius" ##`
811	`## - Paramètrage des fichiers de configuration FreeRadius ##`	811	`## - Paramètrage des fichiers de configuration FreeRadius ##`
812	`## - Affectation du secret partagé entre coova-chilli et freeradius ##`	812	`## - Affectation du secret partagé entre coova-chilli et freeradius ##`
813	`## - Modification de fichier de conf pour l'accès à Mysql ##`	813	`## - Modification de fichier de conf pour l'accès à Mysql ##`
814	`##########################################################################`	814	`##########################################################################`
815	`param_radius ()`	815	`radius ()`
816	`{`	816	`{`
817	`cp -f $DIR_CONF/radiusd-db-vierge.sql /etc/raddb/`	817	`cp -f $DIR_CONF/radiusd-db-vierge.sql /etc/raddb/`
818	`chown -R radius:radius /etc/raddb`	818	`chown -R radius:radius /etc/raddb`
819	`[ -e /etc/raddb/radiusd.conf.default ] \|\| cp /etc/raddb/radiusd.conf /etc/raddb/radiusd.conf.default`	819	`[ -e /etc/raddb/radiusd.conf.default ] \|\| cp /etc/raddb/radiusd.conf /etc/raddb/radiusd.conf.default`
820	`# Set radius.conf parameters`	820	`# Set radius.conf parameters`
Line 864...	Line 864...
864	`chown -R radius:radius /etc/raddb/sql/mysql/*`	864	`chown -R radius:radius /etc/raddb/sql/mysql/*`
865	`# make certain that mysql is up before radius start`	865	`# make certain that mysql is up before radius start`
866	`[ -e /lib/systemd/system/radiusd.service.default ] \|\| cp /lib/systemd/system/radiusd.service /lib/systemd/system/radiusd.service.default`	866	`[ -e /lib/systemd/system/radiusd.service.default ] \|\| cp /lib/systemd/system/radiusd.service /lib/systemd/system/radiusd.service.default`
867	`$SED "s?^After=.*?After=syslog.target network.target mysqld.service?g" /lib/systemd/system/radiusd.service`	867	`$SED "s?^After=.*?After=syslog.target network.target mysqld.service?g" /lib/systemd/system/radiusd.service`
868	`systemctl daemon-reload`	868	`systemctl daemon-reload`
869	`} # End param_radius ()`	869	`} # End radius ()`
870		870
871	`##########################################################################`	871	`##########################################################################`
872	`## Function "param_web_radius" ##`	872	`## Function "radius_web" ##`
873	`## - Import, modification et paramètrage de l'interface "dialupadmin" ##`	873	`## - Import, modification et paramètrage de l'interface "dialupadmin" ##`
874	`## - Création du lien vers la page de changement de mot de passe ##`	874	`## - Création du lien vers la page de changement de mot de passe ##`
875	`##########################################################################`	875	`##########################################################################`
876	`param_web_radius ()`	876	`radius_web ()`
877	`{`	877	`{`
878	`# copie de l'interface d'origine dans la structure Alcasar`	878	`# copie de l'interface d'origine dans la structure Alcasar`
879	`[ -d /usr/share/freeradius-web ] && cp -rf /usr/share/freeradius-web/* $DIR_ACC/manager/`	879	`[ -d /usr/share/freeradius-web ] && cp -rf /usr/share/freeradius-web/* $DIR_ACC/manager/`
880	`rm -f $DIR_ACC/manager/index.html $DIR_ACC/manager/readme`	880	`rm -f $DIR_ACC/manager/index.html $DIR_ACC/manager/readme`
881	`rm -f $DIR_ACC/manager/htdocs/about.html $DIR_ACC/manager/htdocs/index.html $DIR_ACC/manager/htdocs/content.html`	881	`rm -f $DIR_ACC/manager/htdocs/about.html $DIR_ACC/manager/htdocs/index.html $DIR_ACC/manager/htdocs/content.html`
Line 923...	Line 923...
923	`Allow from 127.0.0.1`	923	`Allow from 127.0.0.1`
924	`Allow from $PRIVATE_NETWORK_MASK`	924	`Allow from $PRIVATE_NETWORK_MASK`
925	`ErrorDocument 404 https://$HOSTNAME.$DOMAIN`	925	`ErrorDocument 404 https://$HOSTNAME.$DOMAIN`
926	`</Directory>`	926	`</Directory>`
927	`EOF`	927	`EOF`
928	`} # End of param_web_radius ()`	928	`} # End of radius_web ()`
929		929
930	`##################################################################################`	930	`##################################################################################`
931	`## Fonction "param_chilli" ##`	931	`## Fonction "chilli" ##`
932	`## - Création du fichier d'initialisation et de configuration de coova-chilli ##`	932	`## - Création du fichier d'initialisation et de configuration de coova-chilli ##`
933	`## - Paramètrage de la page d'authentification (intercept.php) ##`	933	`## - Paramètrage de la page d'authentification (intercept.php) ##`
934	`##################################################################################`	934	`##################################################################################`
935	`param_chilli ()`	935	`chilli ()`
936	`{`	936	`{`
937	`# chilli unit for systemd`	937	`# chilli unit for systemd`
938	`cat << EOF > /lib/systemd/system/chilli.service`	938	`cat << EOF > /lib/systemd/system/chilli.service`
939	`# This file is part of systemd.`	939	`# This file is part of systemd.`
940	`#`	940	`#`
Line 1094...	Line 1094...
1094	`then`	1094	`then`
1095	`userdel -r chilli 2>/dev/null`	1095	`userdel -r chilli 2>/dev/null`
1096	`fi`	1096	`fi`
1097	`groupadd -f chilli`	1097	`groupadd -f chilli`
1098	`useradd -r -g chilli -s /bin/false -c "system user for coova-chilli" chilli`	1098	`useradd -r -g chilli -s /bin/false -c "system user for coova-chilli" chilli`
1099	`} # End of param_chilli ()`	1099	`} # End of chilli ()`
1100		1100
1101	`##################################################################`	1101	`##################################################################`
1102	`## Fonction "param_dansguardian" ##`	1102	`## Fonction "dansguardian" ##`
1103	`## - Paramètrage du gestionnaire de contenu Dansguardian ##`	1103	`## - Paramètrage du gestionnaire de contenu Dansguardian ##`
1104	`##################################################################`	1104	`##################################################################`
1105	`param_dansguardian ()`	1105	`dansguardian ()`
1106	`{`	1106	`{`
1107	`mkdir /var/dansguardian`	1107	`mkdir /var/dansguardian`
1108	`chown dansguardian /var/dansguardian`	1108	`chown dansguardian /var/dansguardian`
1109	`$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dansguardian -c /etc/dansguardian/dansguardian.conf?g" /lib/systemd/system/dansguardian.service`	1109	`$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dansguardian -c /etc/dansguardian/dansguardian.conf?g" /lib/systemd/system/dansguardian.service`
1110	`$SED "s?^After=.*?After=network.target chilli.target?g" /lib/systemd/system/dansguardian.service`	1110	`$SED "s?^After=.*?After=network.target chilli.target?g" /lib/systemd/system/dansguardian.service`
Line 1144...	Line 1144...
1144	`[ -e $DIR_DG/lists/exceptioniplist.default ] \|\| mv $DIR_DG/lists/exceptioniplist $DIR_DG/lists/exceptioniplist.default`	1144	`[ -e $DIR_DG/lists/exceptioniplist.default ] \|\| mv $DIR_DG/lists/exceptioniplist $DIR_DG/lists/exceptioniplist.default`
1145	`touch $DIR_DG/lists/exceptioniplist`	1145	`touch $DIR_DG/lists/exceptioniplist`
1146	`# Keep a copy of URL & domain filter configuration files`	1146	`# Keep a copy of URL & domain filter configuration files`
1147	`[ -e $DIR_DG/lists/bannedsitelist.default ] \|\| mv $DIR_DG/lists/bannedsitelist $DIR_DG/lists/bannedsitelist.default`	1147	`[ -e $DIR_DG/lists/bannedsitelist.default ] \|\| mv $DIR_DG/lists/bannedsitelist $DIR_DG/lists/bannedsitelist.default`
1148	`[ -e $DIR_DG/lists/bannedurllist.default ] \|\| mv $DIR_DG/lists/bannedurllist $DIR_DG/lists/bannedurllist.default`	1148	`[ -e $DIR_DG/lists/bannedurllist.default ] \|\| mv $DIR_DG/lists/bannedurllist $DIR_DG/lists/bannedurllist.default`
1149	`} # End of param_dansguardian ()`	1149	`} # End of dansguardian ()`
1150		1150
1151	`##################################################################`	1151	`##################################################################`
1152	`## Fonction "antivirus" ##`	1152	`## Fonction "antivirus" ##`
1153	`## - configuration of havp, libclamav and freshclam ##`	1153	`## - configuration of havp, libclamav and freshclam ##`
1154	`##################################################################`	1154	`##################################################################`
Line 1192...	Line 1192...
1192	`$SED "/^DatabaseMirror/i DatabaseMirror db.fr.clamav.net" /etc/freshclam.conf`	1192	`$SED "/^DatabaseMirror/i DatabaseMirror db.fr.clamav.net" /etc/freshclam.conf`
1193	`$SED "/^DatabaseMirror db.fr.clamav.net/i DatabaseMirror switch.clamav.net" /etc/freshclam.conf`	1193	`$SED "/^DatabaseMirror db.fr.clamav.net/i DatabaseMirror switch.clamav.net" /etc/freshclam.conf`
1194	`$SED "s?MaxAttempts.*?MaxAttempts 3?g" /etc/freshclam.conf`	1194	`$SED "s?MaxAttempts.*?MaxAttempts 3?g" /etc/freshclam.conf`
1195	`# update now`	1195	`# update now`
1196	`/usr/bin/freshclam --no-warnings`	1196	`/usr/bin/freshclam --no-warnings`
1197	`}`	1197	`} # End of antivirus ()`
1198		1198
1199	`##################################################################################`	1199	`##################################################################################`
1200	`## function "param_ulogd" ##`	1200	`## function "ulogd" ##`
1201	`## - Ulog config for multi-log files ##`	1201	`## - Ulog config for multi-log files ##`
1202	`##################################################################################`	1202	`##################################################################################`
1203	`param_ulogd ()`	1203	`ulogd ()`
1204	`{`	1204	`{`
1205	`# Three instances of ulogd (three different logfiles)`	1205	`# Three instances of ulogd (three different logfiles)`
1206	`[ -d /var/log/firewall ] \|\| mkdir -p /var/log/firewall`	1206	`[ -d /var/log/firewall ] \|\| mkdir -p /var/log/firewall`
1207	`nl=1`	1207	`nl=1`
1208	`for log_type in traceability ssh ext-access`	1208	`for log_type in traceability ssh ext-access`
Line 1220...	Line 1220...
1220	nl=`expr $nl + 1`	1220	nl=`expr $nl + 1`
1221	`done`	1221	`done`
1222	`chown -R root:apache /var/log/firewall`	1222	`chown -R root:apache /var/log/firewall`
1223	`chmod 750 /var/log/firewall`	1223	`chmod 750 /var/log/firewall`
1224	`chmod 640 /var/log/firewall/*`	1224	`chmod 640 /var/log/firewall/*`
1225	`} # End of param_ulogd ()`	1225	`} # End of ulogd ()`
1226		1226
1227		1227
1228	`##########################################################`	1228	`##########################################################`
1229	`## Function "param_nfsen" ##`	1229	`## Function "nfsen" ##`
1230	`##########################################################`	1230	`##########################################################`
1231	`param_nfsen()`	1231	`nfsen()`
1232	`{`	1232	`{`
1233	`tar xvzf ./conf/nfsen/nfsen-1.3.6p1.tar.gz -C /tmp/`	1233	`tar xvzf ./conf/nfsen/nfsen-1.3.6p1.tar.gz -C /tmp/`
1234	`# Create a specific user and group`	1234	`# Create a specific user and group`
1235	[ `grep "^www-data:" /etc/group \| wc -l` == 1 ] \|\| groupadd www-data	1235	[ `grep "^www-data:" /etc/group \| wc -l` == 1 ] \|\| groupadd www-data
1236	[ `grep "^nfsen:" /etc/passwd \| wc -l` == 1 ] \|\| useradd -r -g nfsen -s /bin/false -c "system user for the grapher nfsen" nfsen	1236	[ `grep "^nfsen:" /etc/passwd \| wc -l` == 1 ] \|\| useradd -r -g nfsen -s /bin/false -c "system user for the grapher nfsen" nfsen
Line 1298...	Line 1298...
1298	`# expire delay for the profile "live"`	1298	`# expire delay for the profile "live"`
1299	`nfsen -m live -e 62d 2>/dev/null`	1299	`nfsen -m live -e 62d 2>/dev/null`
1300	`# clear the installation`	1300	`# clear the installation`
1301	`cd $DirTmp`	1301	`cd $DirTmp`
1302	`rm -rf /tmp/nfsen-1.3.6p1/`	1302	`rm -rf /tmp/nfsen-1.3.6p1/`
1303	`} # End of param_nfsen`	1303	`} # End of nfsen ()`
1304		1304
1305	`##########################################################`	1305	`##########################################################`
1306	`## Function "param_dnsmasq" ##`	1306	`## Function "dnsmasq" ##`
1307	`##########################################################`	1307	`##########################################################`
1308	`param_dnsmasq ()`	1308	`dnsmasq ()`
1309	`{`	1309	`{`
1310	`[ -d /var/log/dnsmasq ] \|\| mkdir /var/log/dnsmasq`	1310	`[ -d /var/log/dnsmasq ] \|\| mkdir /var/log/dnsmasq`
1311	`[ -e /etc/sysconfig/dnsmasq.default ] \|\| cp /etc/sysconfig/dnsmasq /etc/sysconfig/dnsmasq.default`	1311	`[ -e /etc/sysconfig/dnsmasq.default ] \|\| cp /etc/sysconfig/dnsmasq /etc/sysconfig/dnsmasq.default`
1312	`$SED "s?^OPTION=.*?OPTION=-C /etc/dnsmasq.conf?g" /etc/sysconfig/dnsmasq # default conf file for the first dnsmasq instance`	1312	`$SED "s?^OPTION=.*?OPTION=-C /etc/dnsmasq.conf?g" /etc/sysconfig/dnsmasq # default conf file for the first dnsmasq instance`
1313	`[ -e /etc/dnsmasq.conf.default ] \|\| cp /etc/dnsmasq.conf /etc/dnsmasq.conf.default`	1313	`[ -e /etc/dnsmasq.conf.default ] \|\| cp /etc/dnsmasq.conf /etc/dnsmasq.conf.default`
Line 1381...	Line 1381...
1381	`# Create dnsmasq-blacklist and dnsmasq-whitelist unit`	1381	`# Create dnsmasq-blacklist and dnsmasq-whitelist unit`
1382	`cp -f /lib/systemd/system/dnsmasq.service /lib/systemd/system/dnsmasq-blacklist.service`	1382	`cp -f /lib/systemd/system/dnsmasq.service /lib/systemd/system/dnsmasq-blacklist.service`
1383	`cp -f /lib/systemd/system/dnsmasq.service /lib/systemd/system/dnsmasq-whitelist.service`	1383	`cp -f /lib/systemd/system/dnsmasq.service /lib/systemd/system/dnsmasq-whitelist.service`
1384	`$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dnsmasq -C /etc/dnsmasq-blacklist.conf?g" /lib/systemd/system/dnsmasq-blacklist.service`	1384	`$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dnsmasq -C /etc/dnsmasq-blacklist.conf?g" /lib/systemd/system/dnsmasq-blacklist.service`
1385	`$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dnsmasq -C /etc/dnsmasq-whitelist.conf?g" /lib/systemd/system/dnsmasq-whitelist.service`	1385	`$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dnsmasq -C /etc/dnsmasq-whitelist.conf?g" /lib/systemd/system/dnsmasq-whitelist.service`
-		1386	`<<<<<<< .mine`
-		1387	`} # End of dnsmasq()`
-		1388	`=======`
1386	`$SED "s?^PIDFile=.*?PIDFile=/var/run/dnsmasq-blacklist.pid?g" /lib/systemd/system/dnsmasq-blacklist.service`	1389	`$SED "s?^PIDFile=.*?PIDFile=/var/run/dnsmasq-blacklist.pid?g" /lib/systemd/system/dnsmasq-blacklist.service`
1387	`$SED "s?^PIDFile=.*?PIDFile=/var/run/dnsmasq-whitelist.pid?g" /lib/systemd/system/dnsmasq-whitelist.service`	1390	`$SED "s?^PIDFile=.*?PIDFile=/var/run/dnsmasq-whitelist.pid?g" /lib/systemd/system/dnsmasq-whitelist.service`
1388	`} # End dnsmasq`	1391	`} # End dnsmasq`
-		1392	`>>>>>>> .r1387`
1389		1393
1390	`##########################################################`	1394	`##########################################################`
1391	`## Fonction "BL" ##`	1395	`## Fonction "BL" ##`
1392	`##########################################################`	1396	`##########################################################`
1393	`BL ()`	1397	`BL ()`
Line 1689...	Line 1693...
1689	`for i in havp`	1693	`for i in havp`
1690	`do`	1694	`do`
1691	`/sbin/chkconfig --add $i`	1695	`/sbin/chkconfig --add $i`
1692	`done`	1696	`done`
1693	`# processes launched at boot time (Systemctl)`	1697	`# processes launched at boot time (Systemctl)`
1694	`for i in alcasar-load_balancing nfsen mysqld httpd ntpd iptables ulogd dnsmasq dnsmasq-blacklist dnsmasq-whitelist radiusd dansguardian freshclam ulogd-ssh ulogd-traceability ulogd-ext-access chilli`	1698	`for i in alcasar-load_balancing nfsen mysqld httpd ntpd iptables ulogd dnsmasq dnsmasq-blacklist dnsmasq-whitelist radiusd dansguardian freshclam ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban`
1695	`do`	1699	`do`
1696	`systemctl -q enable $i`	1700	`systemctl -q enable $i.service`
1697	`done`	1701	`done`
1698	`# Apply French Security Agency (ANSSI) rules`	1702	`# Apply French Security Agency (ANSSI) rules`
1699	`# ignore ICMP broadcast (smurf attack)`	1703	`# ignore ICMP broadcast (smurf attack)`
1700	`echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" > /etc/sysctl.d/alcasar.conf`	1704	`echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" > /etc/sysctl.d/alcasar.conf`
1701	`# ignore ICMP errors bogus`	1705	`# ignore ICMP errors bogus`
Line 1902...	Line 1906...
1902	MAJ_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION\|cut -d"." -f1`	1906	MAJ_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION\|cut -d"." -f1`
1903	MIN_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION\|cut -d"." -f2\|cut -c1`	1907	MIN_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION\|cut -d"." -f2\|cut -c1`
1904	UPD_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION\|cut -d"." -f3`	1908	UPD_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION\|cut -d"." -f3`
1905	`mode="update"`	1909	`mode="update"`
1906	`fi`	1910	`fi`
1907	`for func in init network ACC CA init_db param_radius param_web_radius param_chilli param_dansguardian antivirus param_ulogd param_nfsen param_dnsmasq BL cron fail2ban gammu_smsd post_install`	1911	`for func in init network ACC CA init_db radius radius_web chilli dansguardian antivirus ulogd nfsen dnsmasq BL cron fail2ban gammu_smsd post_install`
1908	`do`	1912	`do`
1909	`$func`	1913	`$func`
1910	`# echo "* 'debug' : end of function $func *"; read a`	1914	`# echo "* 'debug' : end of function $func *"; read a`
1911	`done`	1915	`done`
1912	`;;`	1916	`;;`

Subversion Repositories ALCASAR

(root)/alcasar.sh @ 1387 – Rev 1387 → 1389