Subversion Repositories ALCASAR

Rev

Rev 1361 | Rev 1363 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 1361 Rev 1362
Line 1... Line 1...
1
 
1
 
2
#!/bin/bash
2
#!/bin/bash
3
#  $Id: alcasar.sh 1361 2014-05-25 22:08:44Z richard $ 
3
#  $Id: alcasar.sh 1362 2014-05-26 17:12:54Z richard $ 
4
 
4
 
5
# alcasar.sh
5
# alcasar.sh
6
 
6
 
7
# ALCASAR Install script -  CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...] 
7
# ALCASAR Install script -  CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...] 
8
# Ce programme est un logiciel libre ; This software is free and open source
8
# Ce programme est un logiciel libre ; This software is free and open source
Line 48... Line 48...
48
#	gammu_smsd			: Autoregister addon (gammu-smsd)
48
#	gammu_smsd			: Autoregister addon (gammu-smsd)
49
 
49
 
50
DATE=`date '+%d %B %Y - %Hh%M'`
50
DATE=`date '+%d %B %Y - %Hh%M'`
51
DATE_SHORT=`date '+%d/%m/%Y'`
51
DATE_SHORT=`date '+%d/%m/%Y'`
52
Lang=`echo $LANG|cut -c 1-2`
52
Lang=`echo $LANG|cut -c 1-2`
-
 
53
mode="install"
53
# ******* Files parameters - paramètres fichiers *********
54
# ******* Files parameters - paramètres fichiers *********
54
DIR_INSTALL=`pwd`				# current directory 
55
DIR_INSTALL=`pwd`				# current directory 
55
DIR_CONF="$DIR_INSTALL/conf"			# install directory (with conf files)
56
DIR_CONF="$DIR_INSTALL/conf"			# install directory (with conf files)
56
DIR_SCRIPTS="$DIR_INSTALL/scripts"		# install directory (with script files)
57
DIR_SCRIPTS="$DIR_INSTALL/scripts"		# install directory (with script files)
57
DIR_SAVE="/var/Save"				# backup directory (system_backup, user_db_backup, logs)
58
DIR_SAVE="/var/Save"				# backup directory (system_backup, user_db_backup, logs)
Line 106... Line 107...
106
## - Test of free space on /var  (>10G)				##
107
## - Test of free space on /var  (>10G)				##
107
## - Test of Internet access					##
108
## - Test of Internet access					##
108
##################################################################
109
##################################################################
109
testing ()
110
testing ()
110
{
111
{
111
	free_space=`df -BG --output=avail /var|tail -1|tr -d [:space:]G`
112
# Test if ALCASAR is already installed
112
	if [ $free_space -lt 10 ]
113
	if [ -e $CONF_FILE ]
113
		then
114
	then
-
 
115
		current_version=`cat $CONF_FILE | grep VERSION | cut -d"=" -f2`
114
		if [ $Lang == "fr" ]
116
		if [ $Lang == "fr" ]
115
			then echo "place disponible sur /var insufisante ($free_space Go au lieu de 10 Go au minimum)"
117
			then echo -n "La version "; echo -n $current_version ; echo " d'ALCASAR est déjà installée";
116
			else echo "not enough free space on /var ($free_space GB instead of at least 10 GB)"
118
			else echo -n "ALCASAR Version "; echo -n $current_version ; echo " is already installed";
-
 
119
		fi
-
 
120
		response=0
-
 
121
		PTN='^[oOnNyY]$'
-
 
122
		until [[ $(expr $response : $PTN) -gt 0 ]]
-
 
123
		do
-
 
124
			if [ $Lang == "fr" ]
-
 
125
				then echo -n "Voulez-vous effectuer une mise à jour (O/n)? ";
-
 
126
				else echo -n "Do you want to update (Y/n)?";
-
 
127
			 fi
-
 
128
			read response
-
 
129
		done
-
 
130
		if [ "$response" = "n" ] || [ "$response" = "N" ] 
-
 
131
		then
-
 
132
			rm -f /tmp/alcasar-conf*
-
 
133
		else
-
 
134
# Create a backup of running version importants files
-
 
135
			$DIR_SCRIPTS/alcasar-conf.sh --create
-
 
136
			mode="update"
117
		fi
137
		fi
-
 
138
	else
-
 
139
		free_space=`df -BG --output=avail /var|tail -1|tr -d [:space:]G`
-
 
140
		if [ $free_space -lt 10 ]
-
 
141
		then
-
 
142
			if [ $Lang == "fr" ]
-
 
143
				then echo "place disponible sur /var insufisante ($free_space Go au lieu de 10 Go au minimum)"
-
 
144
				else echo "not enough free space on /var ($free_space GB instead of at least 10 GB)"
-
 
145
			fi
118
		exit 0
146
		exit 0
-
 
147
		fi
119
	fi
148
	fi
120
if [ $Lang == "fr" ]
149
if [ $Lang == "fr" ]
121
		then echo -n "Tests des paramètres réseau : "
150
		then echo -n "Tests des paramètres réseau : "
122
		else echo -n "Network parameters tests : "
151
		else echo -n "Network parameters tests : "
123
	fi
152
	fi
124
# We test gw
-
 
125
	if [ "$EXTIF" == "" ]
-
 
126
		then
-
 
127
		if [ $Lang == "fr" ]
-
 
128
			then
-
 
129
			echo "L'adresse du routeur n'est pas configuré"
-
 
130
		else
-
 
131
			echo "The gateway address isn't set"
-
 
132
		fi
-
 
133
		exit 0
-
 
134
	fi
-
 
135
# We test EXTIF config files
153
# We test EXTIF config files
136
	PUBLIC_IP=`grep IPADDR /etc/sysconfig/network-scripts/ifcfg-$EXTIF|cut -d"=" -f2`
154
	PUBLIC_IP=`grep IPADDR /etc/sysconfig/network-scripts/ifcfg-$EXTIF|cut -d"=" -f2`
137
	PUBLIC_GATEWAY=`grep GATEWAY /etc/sysconfig/network-scripts/ifcfg-$EXTIF|cut -d"=" -f2`
155
	PUBLIC_GATEWAY=`grep GATEWAY /etc/sysconfig/network-scripts/ifcfg-$EXTIF|cut -d"=" -f2`
138
	if [ `echo $PUBLIC_IP|wc -c` -lt 7 ] || [ `echo $PUBLIC_GATEWAY|wc -c` -lt 7 ]
156
	if [ "$EXTIF" == "" ] || [ `echo $PUBLIC_IP|wc -c` -lt 7 ] || [ `echo $PUBLIC_GATEWAY|wc -c` -lt 7 ]
139
		then
157
		then
140
		if [ $Lang == "fr" ]
158
		if [ $Lang == "fr" ]
141
		then 
159
		then 
142
			echo "Échec"
160
			echo "Échec"
143
			echo "La carte réseau connectée à Internet ($EXTIF) n'est pas correctement configurée."
161
			echo "La carte réseau connectée à Internet ($EXTIF) n'est pas correctement configurée."
144
			echo "Renseignez les champs suivants dans le fichier '/etc/sysconfig/network-scripts/ifcfg-$EXTIF' :"
162
			echo "Renseignez les champs suivants dans le fichier '/etc/sysconfig/network-scripts/ifcfg-$EXTIF' :"
145
			echo "Appliquez les changements : 'service network restart'"
163
			echo "Appliquez les changements : 'systemctl restart network'"
146
		else
164
		else
147
			echo "Failed"
165
			echo "Failed"
148
			echo "The Internet connected network card ($EXTIF) isn't well configured."
166
			echo "The Internet connected network card ($EXTIF) isn't well configured."
149
			echo "The folowing parametres must be set in the file '/etc/sysconfig/network-scripts/ifcfg-$EXTIF' :"
167
			echo "The folowing parametres must be set in the file '/etc/sysconfig/network-scripts/ifcfg-$EXTIF' :"
150
			echo "Apply the new configuration 'service network restart'"
168
			echo "Apply the new configuration 'systemctl restart network'"
151
		fi
169
		fi
152
		echo "DEVICE=$EXTIF"
170
		echo "DEVICE=$EXTIF"
153
		echo "IPADDR="
171
		echo "IPADDR="
154
		echo "NETMASK="
172
		echo "NETMASK="
155
		echo "GATEWAY="
173
		echo "GATEWAY="
Line 1524... Line 1542...
1524
 
1542
 
1525
	do
1543
	do
1526
		systemctl -q enable $i
1544
		systemctl -q enable $i
1527
	done
1545
	done
1528
# Apply French Security Agency (ANSSI) rules
1546
# Apply French Security Agency (ANSSI) rules
1529
# ignorer les broadcast ICMP. (attaque smurf) 
1547
# ignore ICMP broadcast (smurf attack)
1530
	sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
1548
	echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" > /etc/sysctl.d/alcasar.conf
1531
# ignorer les erreurs ICMP bogus
1549
# ignore ICMP errors bogus
1532
	sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
1550
	echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" >> /etc/sysctl.d/alcasar.conf
1533
# désactiver l'envoi et la réponse aux ICMP redirects
-
 
1534
	sysctl -w net.ipv4.conf.all.accept_redirects=0
-
 
1535
	accept_redirect=`grep accept_redirect /etc/sysctl.conf|wc -l`
-
 
1536
	if [ "$accept_redirect" == "0" ]
1551
# remove ICMP redirects responces
1537
	then
-
 
1538
		echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.d/alcasar.conf
1552
	echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.d/alcasar.conf
1539
	else
-
 
1540
		$SED "s?accept_redirects.*?accept_redirects = 0?g" /etc/sysctl.conf
-
 
1541
	fi
-
 
1542
	sysctl -w net.ipv4.conf.all.send_redirects=0
-
 
1543
	send_redirect=`grep send_redirect /etc/sysctl.conf|wc -l`
-
 
1544
	if [ "$send_redirect" == "0" ]
-
 
1545
	then
-
 
1546
		echo "net.ipv4.conf.all.send_redirects = 0" >> /etc/sysctl.conf
1553
	echo "net.ipv4.conf.all.send_redirects = 0" >> /etc/sysctl.d/alcasar.conf
1547
	else
-
 
1548
		$SED "s?send_redirects.*?send_redirects = 0?g" /etc/sysctl.conf
-
 
1549
	fi
-
 
1550
# activer les SYN Cookies (attaque syn flood)
1554
# enable SYN Cookies (Syn flood attacks)
1551
	sysctl -w net.ipv4.tcp_syncookies=1
-
 
1552
	tcp_syncookies=`grep tcp_syncookies /etc/sysctl.conf|wc -l`
-
 
1553
	if [ "$tcp_syncookies" == "0" ]
-
 
1554
	then
-
 
1555
		echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf
1555
	echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.d/alcasar.conf
1556
	else
-
 
1557
		$SED "s?tcp_syncookies.*?tcp_syncookies = 1?g" /etc/sysctl.conf
-
 
1558
	fi
-
 
1559
# activer l'antispoofing niveau Noyau
1556
# enable kernel antispoofing
1560
	sysctl -w net.ipv4.conf.all.rp_filter=1
1557
	echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.d/alcasar.conf
1561
# ignorer le source routing
1558
# ignore source routing
1562
	sysctl -w net.ipv4.conf.all.accept_source_route=0
-
 
1563
	 accept_source_route=`grep accept_source_route /etc/sysctl.conf|wc -l`
-
 
1564
	if [ "$accept_source_route" == "0" ]
-
 
1565
	then
-
 
1566
		echo "net.ipv4.conf.all.accept_source_route = 0" >> /etc/sysctl.conf
1559
	echo "net.ipv4.conf.all.accept_source_route = 0" >> /etc/sysctl.d/alcasar.conf
1567
	else
-
 
1568
		$SED "s?accept_source_route.*?accept_source_route = 0?g" /etc/sysctl.conf
-
 
1569
	fi
-
 
1570
# réglage du timer de maintien de suivi de session à 1h (3600s) au lieu de 5 semaines
1560
# set conntrack timer to 1h (3600s) instead of 5 weeks
1571
	sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=3600
-
 
1572
	timeout_established=`grep timeout_established /etc/sysctl.conf|wc -l`
-
 
1573
	if [ "$timeout_established" == "0" ]
-
 
1574
	then
-
 
1575
		echo "net.netfilter.nf_conntrack_tcp_timeout_established = 3600" >> /etc/sysctl.conf
1561
	echo "net.netfilter.nf_conntrack_tcp_timeout_established = 3600" >> /etc/sysctl.d/alcasar.conf
1576
	else
-
 
1577
		$SED "s?timeout_established.*?timeout_established = 3600?g" /etc/sysctl.conf
-
 
1578
	fi
-
 
1579
# disable log_martians (ALCASAR is often installed between two private network addresses) 
1562
# disable log_martians (ALCASAR is often installed between two private network addresses) 
1580
	sysctl -w net.ipv4.conf.all.log_martians=0
1563
	echo "net.ipv4.conf.all.log_martians = 0" >> etc/sysctl.d/alcasar.conf
1581
# On supprime la gestion du <CTRL>+<ALT>+<SUPPR> et des Magic SysReq Keys
1564
# remove Magic SysReq Keys
1582
# ???	$SED "s?^ALLOW_REBOOT=.*?ALLOW_REBOOT=no?g" /etc/security/msec/level.fileserver
1565
	[ -e /etc/sysctl.d/51-alt-sysrq.conf ] && rm /etc/sysctl.d/51-alt-sysrq.con
1583
# switch to multi-users runlevel (instead of x11)
1566
# switch to multi-users runlevel (instead of x11)
1584
	ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
1567
	ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
1585
#	GRUB modifications
1568
#	GRUB modifications
1586
# limit wait time to 3s
1569
# limit wait time to 3s
1587
# create an alcasar entry instead of linux-nonfb
1570
# create an alcasar entry instead of linux-nonfb
Line 1591... Line 1574...
1591
	$SED "/^kernel/s/splash quiet //" /boot/grub/menu.lst
1574
	$SED "/^kernel/s/splash quiet //" /boot/grub/menu.lst
1592
	$SED "/^kernel/s/vga=.*/vga=791 nomodeset/" /boot/grub/menu.lst
1575
	$SED "/^kernel/s/vga=.*/vga=791 nomodeset/" /boot/grub/menu.lst
1593
	$SED "/^kernel/s/BOOT_IMAGE=linux /BOOT_IMAGE=linux-nonfb /" /boot/grub/menu.lst
1576
	$SED "/^kernel/s/BOOT_IMAGE=linux /BOOT_IMAGE=linux-nonfb /" /boot/grub/menu.lst
1594
	$SED "/^gfxmenu/d" /boot/grub/menu.lst
1577
	$SED "/^gfxmenu/d" /boot/grub/menu.lst
1595
# Remove unused services and users
1578
# Remove unused services and users
1596
	for old_svc in alsa sound dm
-
 
1597
	do
-
 
1598
		/sbin/chkconfig --del $old_svc
-
 
1599
	done
-
 
1600
	for svc in snmpd.service sshd.service
1579
	for svc in sshd.service
1601
	do
1580
	do
1602
		/bin/systemctl disable $svc
1581
		/bin/systemctl -q disable $svc
1603
	done
1582
	done
1604
	for rm_users in avahi-autoipd avahi icapd
1583
	for rm_users in sysqdin
1605
	do
1584
	do
1606
		user=`cat /etc/passwd|grep $rm_users|cut -d":" -f1`
1585
		user=`cat /etc/passwd|grep $rm_users|cut -d":" -f1`
1607
		if [ "$user" == "$rm_users" ]
1586
		if [ "$user" == "$rm_users" ]
1608
		then
1587
		then
1609
			/usr/sbin/userdel -f $rm_users
1588
			/usr/sbin/userdel -f $rm_users
Line 1789... Line 1768...
1789
		;;
1768
		;;
1790
	-i | --install)
1769
	-i | --install)
1791
		license
1770
		license
1792
		header_install
1771
		header_install
1793
		testing
1772
		testing
1794
# Test if ALCASAR is already installed
-
 
1795
		if [ -e $CONF_FILE ]
-
 
1796
		then
-
 
1797
			current_version=`cat $CONF_FILE | grep VERSION | cut -d"=" -f2`
-
 
1798
			if [ $Lang == "fr" ]
-
 
1799
				then echo -n "La version "; echo -n $current_version ; echo " d'ALCASAR est déjà installée";
-
 
1800
				else echo -n "ALCASAR Version "; echo -n $current_version ; echo " is already installed";
-
 
1801
			fi
-
 
1802
			response=0
-
 
1803
			PTN='^[oOnNyY]$'
-
 
1804
			until [[ $(expr $response : $PTN) -gt 0 ]]
-
 
1805
			do
-
 
1806
				if [ $Lang == "fr" ]
-
 
1807
					then echo -n "Voulez-vous effectuer une mise à jour (O/n)? ";
-
 
1808
					else echo -n "Do you want to update (Y/n)?";
-
 
1809
				 fi
-
 
1810
				read response
-
 
1811
			done
-
 
1812
			if [ "$response" = "n" ] || [ "$response" = "N" ] 
-
 
1813
			then
-
 
1814
				rm -f /tmp/alcasar-conf*
-
 
1815
			else
-
 
1816
# Create a backup of running version importants files
-
 
1817
				$DIR_SCRIPTS/alcasar-conf.sh --create
-
 
1818
				mode="update"
-
 
1819
			fi
-
 
1820
		fi
-
 
1821
# RPMs install
1773
# RPMs install
1822
		$DIR_SCRIPTS/alcasar-urpmi.sh
1774
		$DIR_SCRIPTS/alcasar-urpmi.sh
1823
		if [ "$?" != "0" ]
1775
		if [ "$?" != "0" ]
1824
		then
1776
		then
1825
			exit 0
1777
			exit 0
Line 1828... Line 1780...
1828
		then
1780
		then
1829
# Uninstall the running version
1781
# Uninstall the running version
1830
			$DIR_SCRIPTS/sbin/alcasar-uninstall.sh
1782
			$DIR_SCRIPTS/sbin/alcasar-uninstall.sh
1831
		fi
1783
		fi
1832
# Test if manual update	
1784
# Test if manual update	
1833
		if [ -e /tmp/alcasar-conf*.tar.gz ] && [ "$mode" != "update" ]
1785
		if [ -e /tmp/alcasar-conf*.tar.gz ] && [ "$mode" == "install" ]
1834
		then
1786
		then
1835
			header_install
1787
			header_install
1836
			if [ $Lang == "fr" ]
1788
			if [ $Lang == "fr" ]
1837
				then echo "Le fichier de configuration d'une ancienne version a été trouvé";
1789
				then echo "Le fichier de configuration d'une ancienne version a été trouvé";
1838
				else echo "The configuration file of an old version has been found";
1790
				else echo "The configuration file of an old version has been found";
Line 1864... Line 1816...
1864
			PREVIOUS_VERSION=`grep VERSION conf/etc/alcasar.conf|cut -d"=" -f2`
1816
			PREVIOUS_VERSION=`grep VERSION conf/etc/alcasar.conf|cut -d"=" -f2`
1865
			MAJ_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f1`
1817
			MAJ_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f1`
1866
			MIN_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f2|cut -c1`
1818
			MIN_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f2|cut -c1`
1867
			UPD_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f3`
1819
			UPD_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f3`
1868
			mode="update"
1820
			mode="update"
1869
		else
-
 
1870
			mode="install"
-
 
1871
		fi
1821
		fi
1872
		for func in init network ACC CA init_db param_radius param_web_radius param_chilli param_dansguardian antivirus param_ulogd param_nfsen param_dnsmasq BL cron fail2ban post_install
1822
		for func in init network ACC CA init_db param_radius param_web_radius param_chilli param_dansguardian antivirus param_ulogd param_nfsen param_dnsmasq BL cron fail2ban post_install
1873
		do
1823
		do
1874
			$func
1824
			$func
1875
echo "*** 'debug' : end of function $func ***"; read a
1825
# echo "*** 'debug' : end of function $func ***"; read a
1876
		done
1826
		done
1877
		;;
1827
		;;
1878
	-u | --uninstall)
1828
	-u | --uninstall)
1879
		if [ ! -e $DIR_DEST_SBIN/alcasar-uninstall.sh ]
1829
		if [ ! -e $DIR_DEST_SBIN/alcasar-uninstall.sh ]
1880
		then
1830
		then