Subversion Repositories ALCASAR

Rev

Rev 2688 | Rev 2770 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 2688 Rev 2769
Line 1... Line 1...
1
#!/bin/bash
1
#!/bin/bash
2
 
2
 
3
# $Id: alcasar-bl.sh 2688 2019-01-18 23:15:49Z lucas.echard $
3
# $Id: alcasar-bl.sh 2769 2019-11-24 22:31:36Z rexy $
4
 
4
 
5
# alcasar-bl.sh
5
# alcasar-bl.sh
6
# by Franck BOUIJOUX and Richard REY
6
# by Franck BOUIJOUX and Richard REY
7
# This script is distributed under the Gnu General Public License (GPL)
7
# This script is distributed under the Gnu General Public License (GPL)
8
 
8
 
9
# Gestion de la BL pour le filtrage de domaine (via unbound) et d'URL (via E2guardian)
9
# Gestion de la BL pour le filtrage de domaine (via unbound) et d'URL (via E2guardian)
10
# Manage the BL for DnsBlackHole (unbound) and URL filtering (E2guardian)
10
# Manage the BL for domain filtering (with unbound) and URL filtering (with E2guardian)
11
 
11
 
12
DIR_CONF="/usr/local/etc"
12
DIR_CONF="/usr/local/etc"
13
CONF_FILE="$DIR_CONF/alcasar.conf"
13
CONF_FILE="$DIR_CONF/alcasar.conf"
14
private_ip_mask=`grep ^PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
14
private_ip_mask=`grep ^PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
15
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
15
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
Line 31... Line 31...
31
DIR_DNS_BL_ENABLED="$DIR_SHARE/unbound-bl-enabled"			# symbolic link to the domains BL (only enabled categories)
31
DIR_DNS_BL_ENABLED="$DIR_SHARE/unbound-bl-enabled"			# symbolic link to the domains BL (only enabled categories)
32
DIR_DNS_WL_ENABLED="$DIR_SHARE/unbound-wl-enabled"			#	'	'	'	WL	'	'
32
DIR_DNS_WL_ENABLED="$DIR_SHARE/unbound-wl-enabled"			#	'	'	'	WL	'	'
33
DIR_IP_BL_ENABLED="$DIR_SHARE/iptables-bl-enabled"			#	'	'	ip BL (only enabled categories)
33
DIR_IP_BL_ENABLED="$DIR_SHARE/iptables-bl-enabled"			#	'	'	ip BL (only enabled categories)
34
DIR_IP_WL_ENABLED="$DIR_SHARE/iptables-wl-enabled"			#	'	'	ip WL (ossi and ossi-* imported from ACC)
34
DIR_IP_WL_ENABLED="$DIR_SHARE/iptables-wl-enabled"			#	'	'	ip WL (ossi and ossi-* imported from ACC)
35
REHABILITATED_DNS_FILE="/etc/unbound/conf.d/blacklist/rehabilitated.conf"
35
REHABILITATED_DNS_FILE="/etc/unbound/conf.d/blacklist/rehabilitated.conf"
-
 
36
CNC_BL_NAME="ossi-bl-candc"
36
BL_SERVER="dsi.ut-capitole.fr"
37
BL_SERVER="dsi.ut-capitole.fr"
37
SED="/bin/sed -i"
38
SED="/bin/sed -i"
38
 
39
 
39
# enable/disable the BL & WL categories
40
# enable/disable the BL & WL categories
40
function cat_choice (){
41
function cat_choice (){
Line 107... Line 108...
107
	#	MAX_TLD=18
108
	#	MAX_TLD=18
108
	#fi
109
	#fi
109
	# search for correction	egrep "([a-zA-Z0-9_-.]+\.){1,2}[a-zA-Z]{2,$MAX_TLD}" $ossi_custom_dir/domains > $FILE_tmp
110
	# search for correction	egrep "([a-zA-Z0-9_-.]+\.){1,2}[a-zA-Z]{2,$MAX_TLD}" $ossi_custom_dir/domains > $FILE_tmp
110
}
111
}
111
 
112
 
112
usage="Usage: alcasar-bl.sh { -cat_choice or --cat_choice } | { -download or --download } | { -adapt or --adapt } | { -reload or --reload } | { -update_cat or --update_cat }"
113
usage="Usage: alcasar-bl.sh { -cat_choice or --cat_choice } | { -download or --download } | { -adapt or --adapt } | { -reload or --reload } | { -install_ossi_candc or --install_ossi_candc }"
113
nb_args=$#
114
nb_args=$#
114
args=$1
115
args=$1
115
if [ $nb_args -eq 0 ]
116
if [ $nb_args -eq 0 ]
116
then
117
then
117
	args="-h"
118
	args="-h"
Line 182... Line 183...
182
SOURCE: ALCASAR Team
183
SOURCE: ALCASAR Team
183
DESC FR: Adresses IP des noeuds (routeurs) d'entrée du réseau TOR
184
DESC FR: Adresses IP des noeuds (routeurs) d'entrée du réseau TOR
184
DESC EN: IP addresses of input TOR nodes (routers)
185
DESC EN: IP addresses of input TOR nodes (routers)
185
NAME FR: Noeuds TOR
186
NAME FR: Noeuds TOR
186
NAME EN: TOR nodes
187
NAME EN: TOR nodes
-
 
188
 
-
 
189
NAME: ossi-bl-ultrasurf
-
 
190
DEFAULT_TYPE: black
-
 
191
SOURCE: ALCASAR Team
-
 
192
DESC FR: Adresses IP des point de sortie ULTRASURF
-
 
193
DESC EN: IP addresses of output points of ULTRASURF
-
 
194
NAME FR: Points de sortie ULTRASURF
-
 
195
NAME EN: ULTRASURF output points
-
 
196
 
-
 
197
NAME: ossi-bl-candc
-
 
198
DEFAULT_TYPE: black
-
 
199
SOURCE: Bambenek Consulting: https://osint.bambenekconsulting.com
-
 
200
DESC FR: liste des URLs et IPs des serveurs command & control
-
 
201
DESC EN: list of URLs and IPs of command & control servers
-
 
202
NAME FR: Serveurs Command & Control
-
 
203
NAME EN: Command & Control Server
-
 
204
 
187
EOF
205
EOF
188
			# Retrieve custom files (ossi)
206
# Retrieve custom files (ossi)
189
			for x in $(ls -1 $DIR_tmp | grep "^ossi-*")
207
			for x in $(ls -1 $DIR_tmp | grep "^ossi-*")
190
			do
208
			do
191
				mv $DIR_tmp/$x $DIR_DG_BL
209
				mv $DIR_tmp/$x $DIR_DG_BL
192
			done
210
			done
193
		fi
211
		fi
Line 262... Line 280...
262
		chmod 770 $DIR_DNS_BL $DIR_DNS_WL $DIR_IP_BL $DIR_IP_WL
280
		chmod 770 $DIR_DNS_BL $DIR_DNS_WL $DIR_IP_BL $DIR_IP_WL
263
		chmod -f 660 $BL_CATEGORIES $WL_CATEGORIES $BL_CATEGORIES_ENABLED $WL_CATEGORIES_ENABLED $DIR_DNS_BL/* $DIR_DNS_WL/* $DIR_IP_BL/* $DIR_IP_WL/*
281
		chmod -f 660 $BL_CATEGORIES $WL_CATEGORIES $BL_CATEGORIES_ENABLED $WL_CATEGORIES_ENABLED $DIR_DNS_BL/* $DIR_DNS_WL/* $DIR_IP_BL/* $DIR_IP_WL/*
264
		rm -f $FILE_tmp $FILE_ip_tmp
282
		rm -f $FILE_tmp $FILE_ip_tmp
265
		rm -rf $DIR_tmp
283
		rm -rf $DIR_tmp
266
		;;
284
		;;
267
	# Rsync the categories which are listed in "/usr/local/etc/update_cat.conf". Cron run this function every 12h
-
 
268
	-update_cat | --update_cat)
285
    # install C&C-Server Blacklist.
269
		if [ $(cat /usr/local/etc/update_cat.conf | wc -l) -ne 0 ]
-
 
270
		then
-
 
271
			echo -n "Updating categories in /usr/local/etc/update_cat.conf ..."
-
 
272
			cat /usr/local/etc/update_cat.conf | while read LIGNE_RSYNC
-
 
273
			do
-
 
274
				CATEGORIE=$(echo $LIGNE_RSYNC | cut -d' ' -f1)
-
 
275
				URL=$(echo $LIGNE_RSYNC | cut -d' ' -f2)
-
 
276
				PATH_FILE=$(find $DIR_DG_BL/ -type d -name $CATEGORIE) # retrieve directory name of the category
-
 
277
				rsync -rv $URL $(dirname $PATH_FILE ) #rsync inside of the blacklist directory
-
 
278
				# Creation of unbound and Iptables BL and WL
286
    -install_ossi_candc | --install_ossi_candc)
279
				DOMAIN=$(basename $PATH_FILE)
-
 
280
				cp $PATH_FILE/domains $FILE_tmp
-
 
281
				clean_split  # clean ossi custom files & split them for unbound and for iptables
-
 
282
				black=`grep black $PATH_FILE/usage |wc -l`
-
 
283
				if [ $black == "1" ]
287
        ## download
284
				then
-
 
285
					# adapt to the unbound syntax for the blacklist
288
        /usr/local/bin/alcasar-bl-autoupdate.sh --update_ossi-bl-candc
286
					$SED "s?.*?local-zone: & typetransparent\nlocal-zone-tag: & blacklist?g" $FILE_tmp
289
        ## enable blacklist by default by creating symlinks
287
					mv $FILE_tmp $DIR_DNS_BL/$DOMAIN.conf
290
        if [ -e ${DIR_DNS_BL_ENABLED}/${CNC_BL_NAME} ]; then
288
					mv $FILE_ip_tmp $DIR_IP_BL/$DOMAIN
291
		    rm ${DIR_DNS_BL_ENABLED}/${CNC_BL_NAME}
289
				else
292
	    fi
290
					# adapt to the unbound syntax for the whitelist
-
 
291
					$SED "s?.*?local-zone: & transparent?g" $FILE_tmp
-
 
292
					mv $FILE_tmp $DIR_DNS_WL/$DOMAIN.conf
293
	    if [ -e ${DIR_IP_BL_ENABLED}/${CNC_BL_NAME} ]; then
293
					mv $FILE_ip_tmp $DIR_IP_WL/$DOMAIN
294
		    rm ${DIR_IP_BL_ENABLED}/${CNC_BL_NAME}
294
				fi
295
	    fi
295
				rm -f $FILE_tmp $FILE_ip_tmp
-
 
296
			done
-
 
297
			/usr/bin/systemctl restart unbound-whitelist
-
 
298
			/usr/bin/systemctl restart dnsmasq-whitelist
-
 
299
			/usr/bin/systemctl restart unbound-blacklist
296
 		echo "Creating symlinks to enable blacklist"
300
			/usr/bin/systemctl restart e2guardian
297
        ln -s ${DIR_DNS_BL}/${CNC_BL_NAME}.conf ${DIR_DNS_BL_ENABLED}/${CNC_BL_NAME}
301
			/usr/local/bin/alcasar-iptables.sh
-
 
302
		else
-
 
303
			echo -n "/usr/local/etc/update_cat.conf is empty ..."
298
        ln -s ${DIR_IP_BL}/${CNC_BL_NAME} ${DIR_IP_BL_ENABLED}/${CNC_BL_NAME}
304
		fi
-
 
305
		echo
299
		exit 0
306
		;;
300
		;;
307
	# reload when selected categories are changed or when ossi change his custom files
301
	# reload when selected categories are changed or when ossi change his custom files
308
	-reload | --reload)
302
	-reload | --reload)
309
		# for DG
303
		# for E2Gardian
310
		cat_choice
304
		cat_choice
311
		#  for unbound (rehabilitated domain names)
305
		#  for unbound (rehabilitated domain names)
312
		rm -f $REHABILITATED_DNS_FILE
306
		rm -f $REHABILITATED_DNS_FILE
313
		if [ "$(wc -w $DIR_DG/exceptionsitelist | cut -d " " -f1)" != "0" ]
307
		if [ "$(wc -w $DIR_DG/exceptionsitelist | cut -d " " -f1)" != "0" ]
314
		then
308
		then