Subversion Repositories ALCASAR

Rev

Rev 497 | Rev 499 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 497 Rev 498
Line 1... Line 1...
1 
#!/bin/sh
 1 
#!/bin/sh
2 
#  $Id: alcasar.sh 497 2011-02-17 21:36:20Z richard $
2 
#  $Id: alcasar.sh 498 2011-02-24 20:56:27Z richard $
3 
 
 3 
 
4 
# alcasar.sh
 4 
# alcasar.sh
5 
# by Franck BOUIJOUX, Pascal LEVANT and Richard REY
 5 
# by Franck BOUIJOUX, Pascal LEVANT and Richard REY
6 
# This script is distributed under the Gnu General Public License (GPL)
 6 
# This script is distributed under the Gnu General Public License (GPL)
7 
 
 7 
 
Line 211... Line 211...
211 
	urpmi --auto $PACKAGES
211 
	urpmi --auto $PACKAGES
212 
# On supprime les paquetages, les services et les utilisateurs inutiles
 212 
# On supprime les paquetages, les services et les utilisateurs inutiles
213 
	for rm_rpm in shorewall dhcp-server c-icap-server cyrus-sasl distcache-server avahi mandi radeontool
 213 
	for rm_rpm in shorewall dhcp-server c-icap-server cyrus-sasl distcache-server avahi mandi radeontool
214 
	do
 214 
	do
215 
		/usr/sbin/urpme --auto $rm_rpm --auto-orphans 2>/dev/null
 215 
		/usr/sbin/urpme --auto $rm_rpm --auto-orphans 2>/dev/null
- 
 
 216 
		echo -n "."
216 
	done
 217 
	done
217 
	for svc in alsa sound dm atd netfs bootlogd stop-bootlogd
 218 
	for svc in alsa sound dm atd netfs bootlogd stop-bootlogd
218 
	do
 219 
	do
219 
		/sbin/chkconfig --del $svc
 220 
		/sbin/chkconfig --del $svc
220 
	done
 221 
	done
Line 472... Line 473...
472 
	$SED "s?99/99/9999?$DATE_SHORT?g" $DIR_ACC/menu.php
 473 
	$SED "s?99/99/9999?$DATE_SHORT?g" $DIR_ACC/menu.php
473 
	$SED "s?\$DB_RADIUS = .*?\$DB_RADIUS = \"$DB_RADIUS\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
 474 
	$SED "s?\$DB_RADIUS = .*?\$DB_RADIUS = \"$DB_RADIUS\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
474 
	$SED "s?\$DB_USER = .*?\$DB_USER = \"$DB_USER\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
 475 
	$SED "s?\$DB_USER = .*?\$DB_USER = \"$DB_USER\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
475 
	$SED "s?\$radiuspwd = .*?\$radiuspwd = \"$radiuspwd\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
 476 
	$SED "s?\$radiuspwd = .*?\$radiuspwd = \"$radiuspwd\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
476 
	$SED "s?^\$private_ip =.*?\$private_ip = \"$PRIVATE_IP\";?g" $DIR_WEB/index.php
 477 
	$SED "s?^\$private_ip =.*?\$private_ip = \"$PRIVATE_IP\";?g" $DIR_WEB/index.php
- 
 
 478 
	$SED "s?\$hostname =.*?\$hostname = \"$HOSTNAME\";?g" $DIR_WEB/index.php
477 
	chmod 640 $DIR_ACC/phpsysinfo/includes/xml/portail.php
 479 
	chmod 640 $DIR_ACC/phpsysinfo/includes/xml/portail.php
478 
	chown -R apache:apache $DIR_WEB/*
 480 
	chown -R apache:apache $DIR_WEB/*
479 
	for i in ISO base logs/firewall logs/httpd logs/squid ;
 481 
	for i in ISO base logs/firewall logs/httpd logs/squid ;
480 
	do
 482 
	do
481 
		[ -d $DIR_SAVE/$i ] || mkdir -p $DIR_SAVE/$i
 483 
		[ -d $DIR_SAVE/$i ] || mkdir -p $DIR_SAVE/$i
Line 539... Line 541...
539 
	AllowOverride None
 541 
	AllowOverride None
540 
	Order deny,allow
 542 
	Order deny,allow
541 
	Deny from all
 543 
	Deny from all
542 
	Allow from 127.0.0.1
 544 
	Allow from 127.0.0.1
543 
	Allow from $PRIVATE_NETWORK_MASK
 545 
	Allow from $PRIVATE_NETWORK_MASK
544 
#	Allow from $SRC_ADMIN
 546 
#	Allow from $SRC_ADMIN
545 
	require valid-user
 547 
	require valid-user
546 
	AuthType digest
 548 
	AuthType digest
547 
	AuthName $HOSTNAME
 549 
	AuthName $HOSTNAME
548 
	BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
 550 
	BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
549 
	AuthUserFile $DIR_DEST_ETC/digest/key_all
 551 
	AuthUserFile $DIR_DEST_ETC/digest/key_all
Line 905... Line 907...
905 
	[ -e $DIR_DG/lists/bannedextensionlist.default ] || mv $DIR_DG/lists/bannedextensionlist $DIR_DG/lists/bannedextensionlist.default
 907 
	[ -e $DIR_DG/lists/bannedextensionlist.default ] || mv $DIR_DG/lists/bannedextensionlist $DIR_DG/lists/bannedextensionlist.default
906 
	[ -e $DIR_DG/lists/bannedmimetypelist.default ] || mv $DIR_DG/lists/bannedmimetypelist $DIR_DG/lists/bannedmimetypelist.default
 908 
	[ -e $DIR_DG/lists/bannedmimetypelist.default ] || mv $DIR_DG/lists/bannedmimetypelist $DIR_DG/lists/bannedmimetypelist.default
907 
	touch $DIR_DG/lists/bannedextensionlist
 909 
	touch $DIR_DG/lists/bannedextensionlist
908 
	touch $DIR_DG/lists/bannedmimetypelist
 910 
	touch $DIR_DG/lists/bannedmimetypelist
909 
# 'Safesearch' regex actualisation
 911 
# 'Safesearch' regex actualisation
910 
	$SED "s?images?search?g" /etc/
 912 
	$SED "s?images?search?g" $DIR_DG/lists/urlregexplist
911 
# empty LAN IP list that won't be WEB filtered
 913 
# empty LAN IP list that won't be WEB filtered
912 
	[ -e $DIR_DG/lists/exceptioniplist.default ] || mv $DIR_DG/lists/exceptioniplist $DIR_DG/lists/exceptioniplist.default
 914 
	[ -e $DIR_DG/lists/exceptioniplist.default ] || mv $DIR_DG/lists/exceptioniplist $DIR_DG/lists/exceptioniplist.default
913 
	touch $DIR_DG/lists/exceptioniplist
 915 
	touch $DIR_DG/lists/exceptioniplist
914 
# Keep a copy of URL & domain filter configuration files
 916 
# Keep a copy of URL & domain filter configuration files
915 
	[ -e $DIR_DG/lists/bannedsitelist.default ] || mv $DIR_DG/lists/bannedsitelist $DIR_DG/lists/bannedsitelist.default
 917 
	[ -e $DIR_DG/lists/bannedsitelist.default ] || mv $DIR_DG/lists/bannedsitelist $DIR_DG/lists/bannedsitelist.default
Line 962... Line 964...
962 
{
 964 
{
963 
	$SED "s?^EXTIF=.*?EXTIF=\"$EXTIF\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
 965 
	$SED "s?^EXTIF=.*?EXTIF=\"$EXTIF\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
964 
	$SED "s?^INTIF=.*?INTIF=\"$INTIF\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
 966 
	$SED "s?^INTIF=.*?INTIF=\"$INTIF\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
965 
	$SED "s?^PRIVATE_NETWORK_MASK=.*?PRIVATE_NETWORK_MASK=\"$PRIVATE_NETWORK_MASK\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
 967 
	$SED "s?^PRIVATE_NETWORK_MASK=.*?PRIVATE_NETWORK_MASK=\"$PRIVATE_NETWORK_MASK\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
966 
	$SED "s?^PRIVATE_IP=.*?PRIVATE_IP=\"$PRIVATE_IP\"?g" $DIR_DEST_BIN/alcasar-iptables.sh $DIR_DEST_BIN/alcasar-iptables-bypass.sh
 968 
	$SED "s?^PRIVATE_IP=.*?PRIVATE_IP=\"$PRIVATE_IP\"?g" $DIR_DEST_BIN/alcasar-iptables.sh $DIR_DEST_BIN/alcasar-iptables-bypass.sh
967 
	$SED "s?^DNSSERVERS=.*?PRIVATE_IP=\"$DNS1,$DNS2\"?g" $DIR_DEST_BIN/alcasar-iptables.sh
 969 
	$SED "s?^DNSSERVERS=.*?DNSSERVERS=\"$DNS1,$DNS2\"?g" $DIR_DEST_BIN/alcasar-iptables.sh
968 
	chmod o+r $DIR_DEST_BIN/alcasar-iptables.sh #lecture possible pour apache (interface php du filtrage réseau)
 970 
	chmod o+r $DIR_DEST_BIN/alcasar-iptables.sh #lecture possible pour apache (interface php du filtrage réseau)
969 
# création du fichier d'exception au filtrage
 971 
# création du fichier d'exception au filtrage
970 
	touch /usr/local/etc/alcasar-filter-exceptions
 972 
	touch /usr/local/etc/alcasar-filter-exceptions
971 
# le script $DIR_DEST_BIN/alcasar-iptables.sh est lancé à la fin (pour ne pas perturber une mise à jour via ssh)
 973 
# le script $DIR_DEST_BIN/alcasar-iptables.sh est lancé à la fin (pour ne pas perturber une mise à jour via ssh)
972 
}  # End of firewall ()
 974 
}  # End of firewall ()
Line 1046... Line 1048...
1046 
param_dnsmasq ()
 1048 
param_dnsmasq ()
1047 
{
 1049 
{
1048 
	[ -d /etc/dnsmasq.d ] || mkdir /etc/dnsmasq.d
 1050 
	[ -d /etc/dnsmasq.d ] || mkdir /etc/dnsmasq.d
1049 
	[ -d /var/log/dnsmasq ] || mkdir /var/log/dnsmasq
 1051 
	[ -d /var/log/dnsmasq ] || mkdir /var/log/dnsmasq
1050 
	[ -e /etc/dnsmasq.conf ] && cp /etc/dnsmasq.conf /etc/dnsmasq.conf.default
 1052 
	[ -e /etc/dnsmasq.conf ] && cp /etc/dnsmasq.conf /etc/dnsmasq.conf.default
1051 
	$SED "s?^[^#]?#&?g" /etc/dnsmasq.conf 					# (on commente ce qui ne l'est pas)
 1053 
	$SED "s?^[^#]?#&?g" /etc/dnsmasq.conf 					# on commente ce qui ne l'est pas
1052 
	$SED "s?^#conf-dir=.*?conf-dir=/etc/dnsmasq.d?g" /etc/dnsmasq.conf	# les fichiers de config se trouvent dans /etc/dnsmasq.d/*
 1054 
	$SED "s?^#conf-dir=.*?conf-dir=/etc/dnsmasq.d?g" /etc/dnsmasq.conf	# les fichiers de config se trouvent dans /etc/dnsmasq.d/*
1053 
	$SED "s?^DHCP_LEASE=.*?DHCP_LEASE=/var/log/dnsmasq/lease.log?g" /etc/sysconfig/dnsmasq # fichier contenant les baux
 1055 
	$SED "s?^DHCP_LEASE=.*?DHCP_LEASE=/var/log/dnsmasq/lease.log?g" /etc/sysconfig/dnsmasq # fichier contenant les baux
1054 
# on crée le fichier de conf spécifique pour Alcasar
 1056 
# 1st configuration file for "dnsmasq + blackhole" (listen on udp 52)
1055 
	cat << EOF > /etc/dnsmasq.d/alcasar-dnsmasq.conf
1057 
	cat << EOF > /etc/dnsmasq.d/alcasar-dnsmasq.conf
- 
 
 1058 
# Configuration file for "dnsmasq + blackhole"
1056 
# Inclusion de la blacklist <domains> de Toulouse dans la configuration
 1059 
# Inclusion de la blacklist <domains> de Toulouse dans la configuration
1057 
conf-dir=/usr/local/etc/alcasar-dnsfilter-enabled
 1060 
conf-dir=/usr/local/etc/alcasar-dnsfilter-enabled
1058 
conf-file=/usr/local/etc/alcasar-dns-name	# zone de definition de noms DNS locaux si besoin
 1061 
conf-file=/usr/local/etc/alcasar-dns-name	# zone de definition de noms DNS locaux
1059 
 
 1062 
 
1060 
listen-address=$PRIVATE_IP
 1063 
listen-address=$PRIVATE_IP
1061 
listen-address=127.0.0.1
 1064 
listen-address=127.0.0.1
1062 
no-dhcp-interface=$INTIF
 1065 
no-dhcp-interface=$INTIF
1063 
bind-interfaces
 1066 
bind-interfaces
Line 1069... Line 1072...
1069 
bogus-priv
 1072 
bogus-priv
1070 
filterwin2k
 1073 
filterwin2k
1071 
server=$DNS1
 1074 
server=$DNS1
1072 
server=$DNS2
 1075 
server=$DNS2
1073 
 
 1076 
 
- 
 
 1077 
# le servive DHCP est configuré mais n'est exploité que pour le "bypass"
1074 
dhcp-range=$ORGANISME,$PRIVATE_DYN_FIRST_IP,$PRIVATE_DYN_LAST_IP,$PRIVATE_MASK,12h
 1078 
dhcp-range=$ORGANISME,$PRIVATE_DYN_FIRST_IP,$PRIVATE_DYN_LAST_IP,$PRIVATE_MASK,12h
1075 
#dhcp-option=3,1.2.3.4
 1079 
#dhcp-option=3,1.2.3.4
1076 
#dhcp-option=option:router,1.2.3.4
 1080 
#dhcp-option=option:router,1.2.3.4
1077 
#dhcp-option=42,0.0.0.0
 1081 
#dhcp-option=42,0.0.0.0
1078 
#dhcp-option=option:ntp-server,192.168.0.4,10.10.0.5
 1082 
#dhcp-option=option:ntp-server,192.168.0.4,10.10.0.5
1079 
 
 1083 
 
1080 
# Exemple de configuration statique : <@MAC>,<name>,<@IP>,<MASK>,<ttl bail>
 1084 
# Exemple de configuration statique : <@MAC>,<name>,<@IP>,<MASK>,<ttl bail>
1081 
#dhcp-host=11:22:33:44:55:66,ssic-test,192.168.182.20,255.255.255.0,45m
 1085 
#dhcp-host=11:22:33:44:55:66,ssic-test,192.168.182.20,255.255.255.0,45m
1082 
EOF
 1086 
EOF
- 
 
 1087 
# 2nd dnsmasq configuration file for filter exception user (listen on udp 54)
- 
 
 1088 
	cat << EOF > /etc/dnsmasq-forward.conf
- 
 
 1089 
# Dnsmasq configuration for exception filter users (no blackhole)
- 
 
 1090 
conf-file=/usr/local/etc/alcasar-dns-name	# zone de definition de noms DNS locaux
- 
 
 1091 
 
- 
 
 1092 
listen-address=$PRIVATE_IP
- 
 
 1093 
listen-address=127.0.0.1
- 
 
 1094 
port=54
- 
 
 1095 
no-dhcp-interface=$INTIF
- 
 
 1096 
bind-interfaces
- 
 
 1097 
 
- 
 
 1098 
cache-size=256
- 
 
 1099 
domain=$DOMAIN
- 
 
 1100 
domain-needed
- 
 
 1101 
expand-hosts
- 
 
 1102 
bogus-priv
- 
 
 1103 
filterwin2k
- 
 
 1104 
server=$DNS1
- 
 
 1105 
server=$DNS2
- 
 
 1106 
EOF
- 
 
 1107 
# On crée le fichier de résolution locale
1083 
touch /usr/local/etc/alcasar-dns-name
 1108 
touch /usr/local/etc/alcasar-dns-name
- 
 
 1109 
# On modifie le fichier d'initialisattion (lancement dune deuxième instance)
- 
 
 1110 
[ -e /etc/init.d/dnsmasq ] && cp /etc/init.d/dnsmasq /etc/init.d/dnsmasq.default
- 
 
 1111 
$SED "s?^DOMAIN_SUFFIX=.*?DOMAIN_SUFFIX=''?g" /etc/init.d/dnsmasq
- 
 
 1112 
$SED "/daemon \$dnsmasq/a daemon \$dnsmasq -C /etc/dnsmasq-forward.conf" /etc/init.d/dnsmasq
- 
 
 1113 
$SED "/killproc \$iDAEMON_NAME/a killall \$DAEMON_NAME" /etc/init.d/dnsmasq
1084 
} # End dnsmasq
 1114 
} # End dnsmasq
1085 
 
 1115 
 
1086 
##########################################################
 1116 
##########################################################
1087 
##		Fonction BL (BlackList)			##
 1117 
##		Fonction BL (BlackList)			##
1088 
##########################################################
 1118 
##########################################################
Line 1397... Line 1427...
1397 
			read response
 1427 
			read response
1398 
		done
 1428 
		done
1399 
		if [ "$reponse" = "o" ] || [ "$reponse" = "O" ]
 1429 
		if [ "$reponse" = "o" ] || [ "$reponse" = "O" ]
1400 
		then
 1430 
		then
1401 
			$DIR_SCRIPT/alcasar-conf.sh --create
 1431 
			$DIR_SCRIPT/alcasar-conf.sh --create
- 
 
 1432 
		else
- 
 
 1433 
			rm -f /tmp/alcasar-conf*
1402 
		fi
 1434 
		fi
1403 
# On désinstalle la version actuelle
 1435 
# On désinstalle la version actuelle
1404 
		$DIR_SCRIPTS/sbin/alcasar-uninstall.sh
 1436 
		$DIR_SCRIPTS/sbin/alcasar-uninstall.sh
1405 
		;;
 1437 
		;;
1406 
	*)
 1438 
	*)