Subversion Repositories ALCASAR

Rev

Rev 497 | Rev 499 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log

Rev 497 Rev 498
Line 1... Line 1...
1 
#!/bin/sh
 1 
#!/bin/sh
2 
#  $Id: alcasar.sh 497 2011-02-17 21:36:20Z richard $
2 
#  $Id: alcasar.sh 498 2011-02-24 20:56:27Z richard $
3 
 
 3 
 
4 
# alcasar.sh
 4 
# alcasar.sh
5 
# by Franck BOUIJOUX, Pascal LEVANT and Richard REY
 5 
# by Franck BOUIJOUX, Pascal LEVANT and Richard REY
6 
# This script is distributed under the Gnu General Public License (GPL)
 6 
# This script is distributed under the Gnu General Public License (GPL)
7 
 
 7 
 
Line 211... Line 211...
211 
	urpmi --auto $PACKAGES
211 
	urpmi --auto $PACKAGES
212 
# On supprime les paquetages, les services et les utilisateurs inutiles
 212 
# On supprime les paquetages, les services et les utilisateurs inutiles
213 
	for rm_rpm in shorewall dhcp-server c-icap-server cyrus-sasl distcache-server avahi mandi radeontool
 213 
	for rm_rpm in shorewall dhcp-server c-icap-server cyrus-sasl distcache-server avahi mandi radeontool
214 
	do
 214 
	do
215 
		/usr/sbin/urpme --auto $rm_rpm --auto-orphans 2>/dev/null
 215 
		/usr/sbin/urpme --auto $rm_rpm --auto-orphans 2>/dev/null
- 
 
 216 
		echo -n "."
216 
	done
 217 
	done
217 
	for svc in alsa sound dm atd netfs bootlogd stop-bootlogd
 218 
	for svc in alsa sound dm atd netfs bootlogd stop-bootlogd
218 
	do
 219 
	do
219 
		/sbin/chkconfig --del $svc
 220 
		/sbin/chkconfig --del $svc
220 
	done
 221 
	done
Line 472... Line 473...
472 
	$SED "s?99/99/9999?$DATE_SHORT?g" $DIR_ACC/menu.php
 473 
	$SED "s?99/99/9999?$DATE_SHORT?g" $DIR_ACC/menu.php
473 
	$SED "s?\$DB_RADIUS = .*?\$DB_RADIUS = \"$DB_RADIUS\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
 474 
	$SED "s?\$DB_RADIUS = .*?\$DB_RADIUS = \"$DB_RADIUS\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
474 
	$SED "s?\$DB_USER = .*?\$DB_USER = \"$DB_USER\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
 475 
	$SED "s?\$DB_USER = .*?\$DB_USER = \"$DB_USER\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
475 
	$SED "s?\$radiuspwd = .*?\$radiuspwd = \"$radiuspwd\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
 476 
	$SED "s?\$radiuspwd = .*?\$radiuspwd = \"$radiuspwd\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
476 
	$SED "s?^\$private_ip =.*?\$private_ip = \"$PRIVATE_IP\";?g" $DIR_WEB/index.php
 477 
	$SED "s?^\$private_ip =.*?\$private_ip = \"$PRIVATE_IP\";?g" $DIR_WEB/index.php
- 
 
 478 
	$SED "s?\$hostname =.*?\$hostname = \"$HOSTNAME\";?g" $DIR_WEB/index.php
477 
	chmod 640 $DIR_ACC/phpsysinfo/includes/xml/portail.php
 479 
	chmod 640 $DIR_ACC/phpsysinfo/includes/xml/portail.php
478 
	chown -R apache:apache $DIR_WEB/*
 480 
	chown -R apache:apache $DIR_WEB/*
479 
	for i in ISO base logs/firewall logs/httpd logs/squid ;
 481 
	for i in ISO base logs/firewall logs/httpd logs/squid ;
480 
	do
 482 
	do
481 
		[ -d $DIR_SAVE/$i ] || mkdir -p $DIR_SAVE/$i
 483 
		[ -d $DIR_SAVE/$i ] || mkdir -p $DIR_SAVE/$i
Line 905... Line 907...
905 
	[ -e $DIR_DG/lists/bannedextensionlist.default ] || mv $DIR_DG/lists/bannedextensionlist $DIR_DG/lists/bannedextensionlist.default
 907 
	[ -e $DIR_DG/lists/bannedextensionlist.default ] || mv $DIR_DG/lists/bannedextensionlist $DIR_DG/lists/bannedextensionlist.default
906 
	[ -e $DIR_DG/lists/bannedmimetypelist.default ] || mv $DIR_DG/lists/bannedmimetypelist $DIR_DG/lists/bannedmimetypelist.default
 908 
	[ -e $DIR_DG/lists/bannedmimetypelist.default ] || mv $DIR_DG/lists/bannedmimetypelist $DIR_DG/lists/bannedmimetypelist.default
907 
	touch $DIR_DG/lists/bannedextensionlist
 909 
	touch $DIR_DG/lists/bannedextensionlist
908 
	touch $DIR_DG/lists/bannedmimetypelist
 910 
	touch $DIR_DG/lists/bannedmimetypelist
909 
# 'Safesearch' regex actualisation
 911 
# 'Safesearch' regex actualisation
910 
	$SED "s?images?search?g" /etc/
 912 
	$SED "s?images?search?g" $DIR_DG/lists/urlregexplist
911 
# empty LAN IP list that won't be WEB filtered
 913 
# empty LAN IP list that won't be WEB filtered
912 
	[ -e $DIR_DG/lists/exceptioniplist.default ] || mv $DIR_DG/lists/exceptioniplist $DIR_DG/lists/exceptioniplist.default
 914 
	[ -e $DIR_DG/lists/exceptioniplist.default ] || mv $DIR_DG/lists/exceptioniplist $DIR_DG/lists/exceptioniplist.default
913 
	touch $DIR_DG/lists/exceptioniplist
 915 
	touch $DIR_DG/lists/exceptioniplist
914 
# Keep a copy of URL & domain filter configuration files
 916 
# Keep a copy of URL & domain filter configuration files
915 
	[ -e $DIR_DG/lists/bannedsitelist.default ] || mv $DIR_DG/lists/bannedsitelist $DIR_DG/lists/bannedsitelist.default
 917 
	[ -e $DIR_DG/lists/bannedsitelist.default ] || mv $DIR_DG/lists/bannedsitelist $DIR_DG/lists/bannedsitelist.default
Line 962... Line 964...
962 
{
 964 
{
963 
	$SED "s?^EXTIF=.*?EXTIF=\"$EXTIF\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
 965 
	$SED "s?^EXTIF=.*?EXTIF=\"$EXTIF\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
964 
	$SED "s?^INTIF=.*?INTIF=\"$INTIF\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
 966 
	$SED "s?^INTIF=.*?INTIF=\"$INTIF\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
965 
	$SED "s?^PRIVATE_NETWORK_MASK=.*?PRIVATE_NETWORK_MASK=\"$PRIVATE_NETWORK_MASK\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
 967 
	$SED "s?^PRIVATE_NETWORK_MASK=.*?PRIVATE_NETWORK_MASK=\"$PRIVATE_NETWORK_MASK\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
966 
	$SED "s?^PRIVATE_IP=.*?PRIVATE_IP=\"$PRIVATE_IP\"?g" $DIR_DEST_BIN/alcasar-iptables.sh $DIR_DEST_BIN/alcasar-iptables-bypass.sh
 968 
	$SED "s?^PRIVATE_IP=.*?PRIVATE_IP=\"$PRIVATE_IP\"?g" $DIR_DEST_BIN/alcasar-iptables.sh $DIR_DEST_BIN/alcasar-iptables-bypass.sh
967 
	$SED "s?^DNSSERVERS=.*?PRIVATE_IP=\"$DNS1,$DNS2\"?g" $DIR_DEST_BIN/alcasar-iptables.sh
 969 
	$SED "s?^DNSSERVERS=.*?DNSSERVERS=\"$DNS1,$DNS2\"?g" $DIR_DEST_BIN/alcasar-iptables.sh
968 
	chmod o+r $DIR_DEST_BIN/alcasar-iptables.sh #lecture possible pour apache (interface php du filtrage réseau)
 970 
	chmod o+r $DIR_DEST_BIN/alcasar-iptables.sh #lecture possible pour apache (interface php du filtrage réseau)
969 
# création du fichier d'exception au filtrage
 971 
# création du fichier d'exception au filtrage
970 
	touch /usr/local/etc/alcasar-filter-exceptions
 972 
	touch /usr/local/etc/alcasar-filter-exceptions
971 
# le script $DIR_DEST_BIN/alcasar-iptables.sh est lancé à la fin (pour ne pas perturber une mise à jour via ssh)
 973 
# le script $DIR_DEST_BIN/alcasar-iptables.sh est lancé à la fin (pour ne pas perturber une mise à jour via ssh)
972 
}  # End of firewall ()
 974 
}  # End of firewall ()
Line 1046... Line 1048...
1046 
param_dnsmasq ()
 1048 
param_dnsmasq ()
1047 
{
 1049 
{
1048 
	[ -d /etc/dnsmasq.d ] || mkdir /etc/dnsmasq.d
 1050 
	[ -d /etc/dnsmasq.d ] || mkdir /etc/dnsmasq.d
1049 
	[ -d /var/log/dnsmasq ] || mkdir /var/log/dnsmasq
 1051 
	[ -d /var/log/dnsmasq ] || mkdir /var/log/dnsmasq
1050 
	[ -e /etc/dnsmasq.conf ] && cp /etc/dnsmasq.conf /etc/dnsmasq.conf.default
 1052 
	[ -e /etc/dnsmasq.conf ] && cp /etc/dnsmasq.conf /etc/dnsmasq.conf.default
1051 
	$SED "s?^[^#]?#&?g" /etc/dnsmasq.conf 					# (on commente ce qui ne l'est pas)
 1053 
	$SED "s?^[^#]?#&?g" /etc/dnsmasq.conf 					# on commente ce qui ne l'est pas
1052 
	$SED "s?^#conf-dir=.*?conf-dir=/etc/dnsmasq.d?g" /etc/dnsmasq.conf	# les fichiers de config se trouvent dans /etc/dnsmasq.d/*
 1054 
	$SED "s?^#conf-dir=.*?conf-dir=/etc/dnsmasq.d?g" /etc/dnsmasq.conf	# les fichiers de config se trouvent dans /etc/dnsmasq.d/*
1053 
	$SED "s?^DHCP_LEASE=.*?DHCP_LEASE=/var/log/dnsmasq/lease.log?g" /etc/sysconfig/dnsmasq # fichier contenant les baux
 1055 
	$SED "s?^DHCP_LEASE=.*?DHCP_LEASE=/var/log/dnsmasq/lease.log?g" /etc/sysconfig/dnsmasq # fichier contenant les baux
1054 
# on crée le fichier de conf spécifique pour Alcasar
 1056 
# 1st configuration file for "dnsmasq + blackhole" (listen on udp 52)
1055 
	cat << EOF > /etc/dnsmasq.d/alcasar-dnsmasq.conf
1057 
	cat << EOF > /etc/dnsmasq.d/alcasar-dnsmasq.conf
- 
 
 1058 
# Configuration file for "dnsmasq + blackhole"
1056 
# Inclusion de la blacklist <domains> de Toulouse dans la configuration
 1059 
# Inclusion de la blacklist <domains> de Toulouse dans la configuration
1057 
conf-dir=/usr/local/etc/alcasar-dnsfilter-enabled
 1060 
conf-dir=/usr/local/etc/alcasar-dnsfilter-enabled
1058 
conf-file=/usr/local/etc/alcasar-dns-name	# zone de definition de noms DNS locaux si besoin
 1061 
conf-file=/usr/local/etc/alcasar-dns-name	# zone de definition de noms DNS locaux
1059 
 
 1062 
 
1060 
listen-address=$PRIVATE_IP
 1063 
listen-address=$PRIVATE_IP
1061 
listen-address=127.0.0.1
 1064 
listen-address=127.0.0.1
1062 
no-dhcp-interface=$INTIF
 1065 
no-dhcp-interface=$INTIF
1063 
bind-interfaces
 1066 
bind-interfaces
Line 1069... Line 1072...
1069 
bogus-priv
 1072 
bogus-priv
1070 
filterwin2k
 1073 
filterwin2k
1071 
server=$DNS1
 1074 
server=$DNS1
1072 
server=$DNS2
 1075 
server=$DNS2
1073 
 
 1076 
 
- 
 
 1077 
# le servive DHCP est configuré mais n'est exploité que pour le "bypass"
1074 
dhcp-range=$ORGANISME,$PRIVATE_DYN_FIRST_IP,$PRIVATE_DYN_LAST_IP,$PRIVATE_MASK,12h
 1078 
dhcp-range=$ORGANISME,$PRIVATE_DYN_FIRST_IP,$PRIVATE_DYN_LAST_IP,$PRIVATE_MASK,12h
1075 
#dhcp-option=3,1.2.3.4
 1079 
#dhcp-option=3,1.2.3.4
1076 
#dhcp-option=option:router,1.2.3.4
 1080 
#dhcp-option=option:router,1.2.3.4
1077 
#dhcp-option=42,0.0.0.0
 1081 
#dhcp-option=42,0.0.0.0
1078 
#dhcp-option=option:ntp-server,192.168.0.4,10.10.0.5
 1082 
#dhcp-option=option:ntp-server,192.168.0.4,10.10.0.5
1079 
 
 1083 
 
1080 
# Exemple de configuration statique : <@MAC>,<name>,<@IP>,<MASK>,<ttl bail>
 1084 
# Exemple de configuration statique : <@MAC>,<name>,<@IP>,<MASK>,<ttl bail>
1081 
#dhcp-host=11:22:33:44:55:66,ssic-test,192.168.182.20,255.255.255.0,45m
 1085 
#dhcp-host=11:22:33:44:55:66,ssic-test,192.168.182.20,255.255.255.0,45m
1082 
EOF
 1086 
EOF
- 
 
 1087 
# 2nd dnsmasq configuration file for filter exception user (listen on udp 54)
- 
 
 1088 
	cat << EOF > /etc/dnsmasq-forward.conf
- 
 
 1089 
# Dnsmasq configuration for exception filter users (no blackhole)
- 
 
 1090 
conf-file=/usr/local/etc/alcasar-dns-name	# zone de definition de noms DNS locaux
- 
 
 1091 
 
- 
 
 1092 
listen-address=$PRIVATE_IP
- 
 
 1093 
listen-address=127.0.0.1
- 
 
 1094 
port=54
- 
 
 1095 
no-dhcp-interface=$INTIF
- 
 
 1096 
bind-interfaces
- 
 
 1097 
 
- 
 
 1098 
cache-size=256
- 
 
 1099 
domain=$DOMAIN
- 
 
 1100 
domain-needed
- 
 
 1101 
expand-hosts
- 
 
 1102 
bogus-priv
- 
 
 1103 
filterwin2k
- 
 
 1104 
server=$DNS1
- 
 
 1105 
server=$DNS2
- 
 
 1106 
EOF
- 
 
 1107 
# On crée le fichier de résolution locale
1083 
touch /usr/local/etc/alcasar-dns-name
 1108 
touch /usr/local/etc/alcasar-dns-name
- 
 
 1109 
# On modifie le fichier d'initialisattion (lancement dune deuxième instance)
- 
 
 1110 
[ -e /etc/init.d/dnsmasq ] && cp /etc/init.d/dnsmasq /etc/init.d/dnsmasq.default
- 
 
 1111 
$SED "s?^DOMAIN_SUFFIX=.*?DOMAIN_SUFFIX=''?g" /etc/init.d/dnsmasq
- 
 
 1112 
$SED "/daemon \$dnsmasq/a daemon \$dnsmasq -C /etc/dnsmasq-forward.conf" /etc/init.d/dnsmasq
- 
 
 1113 
$SED "/killproc \$iDAEMON_NAME/a killall \$DAEMON_NAME" /etc/init.d/dnsmasq
1084 
} # End dnsmasq
 1114 
} # End dnsmasq
1085 
 
 1115 
 
1086 
##########################################################
 1116 
##########################################################
1087 
##		Fonction BL (BlackList)			##
 1117 
##		Fonction BL (BlackList)			##
1088 
##########################################################
 1118 
##########################################################
Line 1397... Line 1427...
1397 
			read response
 1427 
			read response
1398 
		done
 1428 
		done
1399 
		if [ "$reponse" = "o" ] || [ "$reponse" = "O" ]
 1429 
		if [ "$reponse" = "o" ] || [ "$reponse" = "O" ]
1400 
		then
 1430 
		then
1401 
			$DIR_SCRIPT/alcasar-conf.sh --create
 1431 
			$DIR_SCRIPT/alcasar-conf.sh --create
- 
 
 1432 
		else
- 
 
 1433 
			rm -f /tmp/alcasar-conf*
1402 
		fi
 1434 
		fi
1403 
# On désinstalle la version actuelle
 1435 
# On désinstalle la version actuelle
1404 
		$DIR_SCRIPTS/sbin/alcasar-uninstall.sh
 1436 
		$DIR_SCRIPTS/sbin/alcasar-uninstall.sh
1405 
		;;
 1437 
		;;
1406 
	*)
 1438 
	*)