| Line 1... |
Line 1... |
| 1 |
#!/bin/bash
|
1 |
#!/bin/bash
|
| 2 |
# $Id: alcasar.sh 2770 2020-02-11 23:06:07Z rexy $
|
2 |
# $Id: alcasar.sh 2771 2020-02-22 09:50:24Z rexy $
|
| 3 |
|
3 |
|
| 4 |
# alcasar.sh
|
4 |
# alcasar.sh
|
| 5 |
# ALCASAR is a Free and open source NAC created by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy)
|
5 |
# ALCASAR is a Free and open source NAC created by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy)
|
| 6 |
# This script is distributed under the Gnu General Public License (GPL)
|
6 |
# This script is distributed under the Gnu General Public License (GPL)
|
| 7 |
# team@alcasar.net
|
7 |
# team@alcasar.net
|
| Line 222... |
Line 222... |
| 222 |
$DIR_SCRIPTS/alcasar-conf.sh --create
|
222 |
$DIR_SCRIPTS/alcasar-conf.sh --create
|
| 223 |
mode="update"
|
223 |
mode="update"
|
| 224 |
fi
|
224 |
fi
|
| 225 |
fi
|
225 |
fi
|
| 226 |
# Test free space on /var
|
226 |
# Test free space on /var
|
| - |
|
227 |
free_space=`df -BG --output=avail /var|tail -1|tr -d '[:space:]G'`
|
| 227 |
if [ ! -d /var/log/netflow/porttracker ]
|
228 |
if [ $free_space -lt 10 ]
|
| 228 |
then
|
229 |
then
|
| 229 |
free_space=`df -BG --output=avail /var|tail -1|tr -d '[:space:]G'`
|
- |
|
| 230 |
if [ $free_space -lt 10 ]
|
- |
|
| 231 |
then
|
- |
|
| 232 |
if [ $Lang == "fr" ]
|
230 |
if [ $Lang == "fr" ]
|
| 233 |
then echo "place disponible sur /var insufisante ($free_space Go au lieu de 10 Go au minimum)"
|
231 |
then echo "place disponible sur /var insufisante ($free_space Go au lieu de 10 Go au minimum)"
|
| 234 |
else echo "not enough free space on /var ($free_space GB instead of at least 10 GB)"
|
232 |
else echo "not enough free space on /var ($free_space GB instead of at least 10 GB)"
|
| 235 |
fi
|
- |
|
| 236 |
exit 0
|
- |
|
| 237 |
fi
|
233 |
fi
|
| - |
|
234 |
exit 0
|
| 238 |
fi
|
235 |
fi
|
| 239 |
|
236 |
|
| 240 |
# Detect external/internal interfaces
|
237 |
# Detect external/internal interfaces
|
| 241 |
if [ -z "$EXTIF" ]; then
|
238 |
if [ -z "$EXTIF" ]; then
|
| 242 |
EXTIF=$(/usr/sbin/ip route list | awk '/^default / {print $5}')
|
239 |
EXTIF=$(/usr/sbin/ip route list | awk '/^default / {print $5}')
|
| 243 |
if [ -z "$EXTIF" ]; then
|
240 |
if [ -z "$EXTIF" ]; then
|
| 244 |
if [ "$Lang" == 'fr' ]
|
241 |
if [ "$Lang" == 'fr' ]
|
| 245 |
then echo -n "Aucune passerelle par défaut configurée"
|
242 |
then echo "Aucune passerelle par défaut configurée"
|
| 246 |
else echo -n "No default gateway configured"
|
243 |
else echo "No default gateway configured"
|
| 247 |
fi
|
244 |
fi
|
| 248 |
exit 1
|
245 |
exit 1
|
| 249 |
fi
|
246 |
fi
|
| 250 |
fi
|
247 |
fi
|
| 251 |
if [ "$Lang" == 'fr' ]
|
248 |
if [ "$Lang" == 'fr' ]
|
| Line 1073... |
Line 1070... |
| 1073 |
#
|
1070 |
#
|
| 1074 |
# systemd is free software; you can redistribute it and/or modify it
|
1071 |
# systemd is free software; you can redistribute it and/or modify it
|
| 1075 |
# under the terms of the GNU General Public License as published by
|
1072 |
# under the terms of the GNU General Public License as published by
|
| 1076 |
# the Free Software Foundation; either version 2 of the License, or
|
1073 |
# the Free Software Foundation; either version 2 of the License, or
|
| 1077 |
# (at your option) any later version.
|
1074 |
# (at your option) any later version.
|
| - |
|
1075 |
|
| - |
|
1076 |
# This unit launches coova-chilli a captive portal
|
| 1078 |
[Unit]
|
1077 |
[Unit]
|
| 1079 |
Description=chilli is a captive portal daemon
|
1078 |
Description=chilli is a captive portal daemon
|
| 1080 |
After=network.target
|
1079 |
After=network.target
|
| 1081 |
|
1080 |
|
| 1082 |
[Service]
|
1081 |
[Service]
|
| Line 1484... |
Line 1483... |
| 1484 |
chmod 640 /var/log/firewall/*
|
1483 |
chmod 640 /var/log/firewall/*
|
| 1485 |
} # End of ulogd()
|
1484 |
} # End of ulogd()
|
| 1486 |
|
1485 |
|
| 1487 |
##########################################################
|
1486 |
##########################################################
|
| 1488 |
## Function "nfsen" ##
|
1487 |
## Function "nfsen" ##
|
| 1489 |
## - install the nfsen grapher ##
|
1488 |
## - configure NetFlow collector (nfcapd) ##
|
| 1490 |
## - install the two plugins porttracker & surfmap ##
|
1489 |
## - configure NetFlow grapher (nfsen-ng) ##
|
| 1491 |
##########################################################
|
1490 |
##########################################################
|
| 1492 |
nfsen()
|
1491 |
nfsen()
|
| 1493 |
{
|
1492 |
{
|
| 1494 |
tar xzf ./conf/nfsen/nfsen-*.tar.gz -C /tmp/
|
- |
|
| 1495 |
# Add PortTracker plugin
|
1493 |
groupadd -f nfcapd
|
| 1496 |
for i in /var/www/html/acc/manager/nfsen/plugins /var/log/netflow/porttracker /usr/share/nfsen/plugins
|
- |
|
| 1497 |
do
|
- |
|
| 1498 |
[ ! -d $i ] && mkdir -p $i && chown -R apache:apache $i
|
- |
|
| 1499 |
done
|
- |
|
| 1500 |
$SED "s?^my \$PORTSDBDIR =.*?my \$PORTSDBDIR = \"/var/log/netflow/porttracker\";?g" /tmp/nfsen-*/contrib/PortTracker/PortTracker.pm
|
- |
|
| 1501 |
# use of our conf file and init unit
|
- |
|
| 1502 |
cp $DIR_CONF/nfsen/nfsen.conf /tmp/nfsen-*/etc/
|
- |
|
| 1503 |
# Installation of nfsen (we change a little 'install.pl in order not to ask the user for the perl version)
|
- |
|
| 1504 |
DirTmp=$(pwd)
|
- |
|
| 1505 |
cd /tmp/nfsen-*/ || { echo "Unable to find nfsen directory"; exit 1; }
|
- |
|
| 1506 |
/usr/bin/perl install.pl /tmp/nfsen-*/etc/nfsen.conf
|
1494 |
useradd -r -g nfcapd -s /bin/false -c "system user for nfcapd" nfcapd
|
| 1507 |
/usr/bin/perl install.pl /tmp/nfsen-*/etc/nfsen.conf # to avoid a Perl mistake "Semaphore introuvable"
|
- |
|
| 1508 |
# Create RRD DB for porttracker (only in it still doesn't exist)
|
- |
|
| 1509 |
cp contrib/PortTracker/PortTracker.pm /usr/share/nfsen/plugins/
|
- |
|
| 1510 |
cp contrib/PortTracker/PortTracker.php /var/www/html/acc/manager/nfsen/plugins/
|
- |
|
| 1511 |
if [ "$(ls -A "/var/log/netflow/porttracker" 2>&1)" = "" ]; then sudo -u apache nftrack -I -d /var/log/netflow/porttracker; else echo "RRD DB already exists"; fi
|
- |
|
| 1512 |
chmod -R 770 /var/log/netflow/porttracker
|
- |
|
| 1513 |
# nfsen unit for systemd
|
1495 |
# nfcapd unit for systemd
|
| 1514 |
cat << EOF > /lib/systemd/system/nfsen.service
|
1496 |
cat << EOF > /lib/systemd/system/nfcapd.service
|
| 1515 |
# This file is part of systemd.
|
1497 |
# This file is part of systemd.
|
| 1516 |
#
|
1498 |
#
|
| 1517 |
# systemd is free software; you can redistribute it and/or modify it
|
1499 |
# systemd is free software; you can redistribute it and/or modify it
|
| 1518 |
# under the terms of the GNU General Public License as published by
|
1500 |
# under the terms of the GNU General Public License as published by
|
| 1519 |
# the Free Software Foundation; either version 2 of the License, or
|
1501 |
# the Free Software Foundation; either version 2 of the License, or
|
| 1520 |
# (at your option) any later version.
|
1502 |
# (at your option) any later version.
|
| 1521 |
|
1503 |
|
| 1522 |
# This unit launches nfsen (a Netflow grapher).
|
1504 |
# This unit launches nfcapd (a Netflow collector).
|
| 1523 |
[Unit]
|
1505 |
[Unit]
|
| 1524 |
Description= NfSen init script
|
1506 |
Description=Netflow Capture Daemon
|
| 1525 |
After=network.target iptables.service
|
1507 |
After=network-online.target iptables.service
|
| 1526 |
|
1508 |
|
| 1527 |
[Service]
|
1509 |
[Service]
|
| 1528 |
Type=oneshot
|
1510 |
Type=exec
|
| 1529 |
RemainAfterExit=yes
|
- |
|
| 1530 |
PIDFile=/var/run/nfsen/nfsen.pid
|
1511 |
PIDFile=/run/nfcapd/nfcapd.pid
|
| 1531 |
ExecStartPre=/bin/mkdir -p /var/run/nfsen
|
- |
|
| 1532 |
ExecStartPre=/bin/chown apache:apache /var/run/nfsen
|
1512 |
ExecStart=/usr/bin/nfcapd -w -D -b 127.0.0.1 -p 2055 -u nfcapd -g nfcapd -B 200000 -t 300 -S 7 -z -P /var/run/nfcapd/nfcapd.pid -I alcasar_netflow -l /var/log/nfsen/profile-data/live/alcasar_netflow
|
| 1533 |
ExecStart=/usr/bin/nfsen start
|
- |
|
| 1534 |
ExecStop=/usr/bin/nfsen stop
|
- |
|
| 1535 |
ExecReload=/usr/bin/nfsen restart
|
1513 |
ExecReload=/bin/kill -HUP $MAINPID
|
| 1536 |
TimeoutSec=0
|
- |
|
| 1537 |
|
1514 |
|
| 1538 |
[Install]
|
1515 |
[Install]
|
| 1539 |
WantedBy=multi-user.target
|
1516 |
WantedBy=multi-user.target
|
| 1540 |
EOF
|
1517 |
EOF
|
| 1541 |
# Add the listen port to collect netflow packet (nfcapd)
|
- |
|
| 1542 |
$SED 's?$ziparg $extensions.*?$ziparg $extensions -b 127.0.0.1";?g' /usr/libexec/NfSenRC.pm
|
1518 |
[ -e /var/log/nfsen/profile-data/live/alcasar_netflow ] || mkdir -p /var/log/nfsen/profile-data/live/alcasar_netflow
|
| 1543 |
# expire delay for the profile "live"
|
- |
|
| 1544 |
/usr/bin/systemctl start nfsen
|
- |
|
| 1545 |
/bin/nfsen -m live -e 62d 2>/dev/null
|
- |
|
| 1546 |
# add SURFmap plugin (waiting for new technical solution)
|
1519 |
[ -e /var/run/nfcapd ] || mkdir -p /var/run/nfcapd
|
| 1547 |
# see https://adullact.net/forum/forum.php?thread_id=319545&forum_id=1601&group_id=450
|
- |
|
| 1548 |
# cp $DIR_CONF/nfsen/SURFmap_*.tar.gz /tmp/
|
- |
|
| 1549 |
# cp $DIR_CONF/nfsen/GeoLiteCity* /tmp/
|
- |
|
| 1550 |
# tar xzf /tmp/SURFmap_*.tar.gz -C /tmp/
|
- |
|
| 1551 |
# cd /tmp/
|
- |
|
| 1552 |
# /usr/bin/sh SURFmap/install.sh (no more used since Google sells the access to googleMap API)
|
1520 |
chown -R nfcapd:nfcapd /var/log/nfsen/profile-data/live/alcasar_netflow /var/run/nfcapd
|
| 1553 |
# clear the installation
|
- |
|
| 1554 |
# rm -rf /tmp/SURFmap*
|
- |
|
| 1555 |
rm -rf /tmp/nfsen-*
|
- |
|
| 1556 |
cd $DirTmp || { echo "Unable to find $DirTmp directory"; exit 1; }
|
- |
|
| 1557 |
chown -R apache:apache /var/www/html/acc/manager/nfsen /usr/share/nfsen /var/log/nfsen
|
1521 |
# chown -R apache:apache /var/www/html/acc/manager/nfsen-ng
|
| 1558 |
} # End of nfsen()
|
1522 |
} # End of nfsen()
|
| 1559 |
|
1523 |
|
| 1560 |
###########################################################
|
1524 |
###########################################################
|
| 1561 |
## Function "vnstat" ##
|
1525 |
## Function "vnstat" ##
|
| 1562 |
## - Initialization of Vnstat and vnstat phpFrontEnd ##
|
1526 |
## - Initialization of Vnstat and vnstat phpFrontEnd ##
|
| Line 1935... |
Line 1899... |
| 1935 |
EOF
|
1899 |
EOF
|
| 1936 |
cat <<EOF > /etc/cron.d/alcasar-letsencrypt
|
1900 |
cat <<EOF > /etc/cron.d/alcasar-letsencrypt
|
| 1937 |
# Automatic renew the Let's Encrypt certificate (daily --> see "cron.daily")
|
1901 |
# Automatic renew the Let's Encrypt certificate (daily --> see "cron.daily")
|
| 1938 |
@daily root $DIR_DEST_BIN/alcasar-letsencrypt.sh --cron > /dev/null 2>&1
|
1902 |
@daily root $DIR_DEST_BIN/alcasar-letsencrypt.sh --cron > /dev/null 2>&1
|
| 1939 |
EOF
|
1903 |
EOF
|
| - |
|
1904 |
cat <<EOF > /etc/cron.d/alcasar-nfcapd-expire
|
| - |
|
1905 |
# Remove netflow files older than one year
|
| - |
|
1906 |
@daily root /usr/bin/nfexpire -e /var/log/nfsen/profile-data/live/alcasar_netflow -t 365d
|
| 1940 |
|
1907 |
EOF
|
| 1941 |
# removing the users crons
|
1908 |
# removing the users crons
|
| 1942 |
rm -f /var/spool/cron/*
|
1909 |
rm -f /var/spool/cron/*
|
| 1943 |
} # End of cron()
|
1910 |
} # End of cron()
|
| 1944 |
|
1911 |
|
| 1945 |
######################################################################
|
1912 |
######################################################################
|
| Line 2232... |
Line 2199... |
| 2232 |
[Install]
|
2199 |
[Install]
|
| 2233 |
WantedBy=multi-user.target
|
2200 |
WantedBy=multi-user.target
|
| 2234 |
EOF
|
2201 |
EOF
|
| 2235 |
/usr/bin/systemctl daemon-reload
|
2202 |
/usr/bin/systemctl daemon-reload
|
| 2236 |
# processes launched at boot time (Systemctl)
|
2203 |
# processes launched at boot time (Systemctl)
|
| 2237 |
for i in alcasar-load_balancing mysqld lighttpd php-fpm ntpd iptables unbound unbound-blacklist unbound-whitelist dnsmasq-whitelist unbound-blackhole radiusd nfsen e2guardian clamav-freshclam ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban havp tinyproxy vnstat sshd
|
2204 |
for i in alcasar-load_balancing mysqld lighttpd php-fpm ntpd iptables unbound unbound-blacklist unbound-whitelist dnsmasq-whitelist unbound-blackhole radiusd nfcapd e2guardian clamav-freshclam ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban havp tinyproxy vnstat sshd
|
| 2238 |
do
|
2205 |
do
|
| 2239 |
/usr/bin/systemctl -q enable $i.service
|
2206 |
/usr/bin/systemctl -q enable $i.service
|
| 2240 |
done
|
2207 |
done
|
| 2241 |
|
2208 |
|
| 2242 |
# disable processes at boot time (Systemctl)
|
2209 |
# disable processes at boot time (Systemctl)
|