| Line 1... |
Line 1... |
| 1 |
#!/bin/bash
|
1 |
#!/bin/bash
|
| 2 |
# $Id: alcasar.sh 2412 2017-09-17 12:11:23Z tom.houdayer $
|
2 |
# $Id: alcasar.sh 2416 2017-09-17 21:01:15Z richard $
|
| 3 |
|
3 |
|
| 4 |
# alcasar.sh
|
4 |
# alcasar.sh
|
| 5 |
|
5 |
|
| 6 |
# ALCASAR Install script - CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...]
|
6 |
# ALCASAR Install script - CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...]
|
| 7 |
# Ce programme est un logiciel libre ; This software is free and open source
|
7 |
# Ce programme est un logiciel libre ; This software is free and open source
|
| Line 187... |
Line 187... |
| 187 |
# Create the current conf file
|
187 |
# Create the current conf file
|
| 188 |
$DIR_SCRIPTS/alcasar-conf.sh --create
|
188 |
$DIR_SCRIPTS/alcasar-conf.sh --create
|
| 189 |
mode="update"
|
189 |
mode="update"
|
| 190 |
fi
|
190 |
fi
|
| 191 |
fi
|
191 |
fi
|
| 192 |
if [[ ( $unknown_os != 3 ) || ("$DISTRIBUTION" != "Mageia" ) || ( "$CURRENT_VERSION" != "5" ) ]]
|
192 |
if [[ ( $unknown_os != 3 ) || ("$DISTRIBUTION" != "Mageia" ) || ( "$CURRENT_VERSION" != "6" ) ]]
|
| 193 |
then
|
193 |
then
|
| 194 |
if [ -e /tmp/alcasar-conf.tar.gz ] # update
|
194 |
if [ -e /tmp/alcasar-conf.tar.gz ] # update
|
| 195 |
then
|
195 |
then
|
| 196 |
echo
|
196 |
echo
|
| 197 |
if [ $Lang == "fr" ]
|
197 |
if [ $Lang == "fr" ]
|
| 198 |
then
|
198 |
then
|
| 199 |
echo "La mise à jour automatique d'ALCASAR ne peut pas être réalisée."
|
199 |
echo "La mise à jour automatique d'ALCASAR ne peut pas être réalisée."
|
| 200 |
echo "1 - Effectuez une sauvegarde des fichiers de traçabilité et de la base des usagers via l'ACC"
|
200 |
echo "1 - Effectuez une sauvegarde des fichiers de traçabilité et de la base des usagers via l'ACC"
|
| 201 |
echo "2 - Installez Linux-Mageia 5.1-64bits et ALCASAR (cf. doc d'installation)"
|
201 |
echo "2 - Installez Linux-Mageia 6.0 (64bits) et ALCASAR (cf. doc d'installation)"
|
| 202 |
echo "3 - Importez votre base des usagers"
|
202 |
echo "3 - Importez votre base des usagers"
|
| 203 |
else
|
203 |
else
|
| 204 |
echo "The automatic update of ALCASAR can't be performed."
|
204 |
echo "The automatic update of ALCASAR can't be performed."
|
| 205 |
echo "1 - Save your traceability files and the user database"
|
205 |
echo "1 - Save your traceability files and the user database"
|
| 206 |
echo "2 - Install Linux-Mageia 5.1-64bits & ALCASAR (cf. installation doc)"
|
206 |
echo "2 - Install Linux-Mageia 6 (64bits) & ALCASAR (cf. installation doc)"
|
| 207 |
echo "3 - Import your users database"
|
207 |
echo "3 - Import your users database"
|
| 208 |
fi
|
208 |
fi
|
| 209 |
else
|
209 |
else
|
| 210 |
if [ $Lang == "fr" ]
|
210 |
if [ $Lang == "fr" ]
|
| 211 |
then
|
211 |
then
|
| Line 215... |
Line 215... |
| 215 |
fi
|
215 |
fi
|
| 216 |
fi
|
216 |
fi
|
| 217 |
echo
|
217 |
echo
|
| 218 |
if [ $Lang == "fr" ]
|
218 |
if [ $Lang == "fr" ]
|
| 219 |
then
|
219 |
then
|
| 220 |
echo "Le système d'exploitation doit être remplacé (Mageia5.1-64bits)"
|
220 |
echo "Le système d'exploitation doit être remplacé (Mageia6-64bits)"
|
| 221 |
else
|
221 |
else
|
| 222 |
echo "The OS must be replaced (Mageia5.1-64bits)"
|
222 |
echo "The OS must be replaced (Mageia6-64bits)"
|
| 223 |
fi
|
223 |
fi
|
| 224 |
exit 0
|
224 |
exit 0
|
| 225 |
fi
|
225 |
fi
|
| 226 |
if [ ! -d /var/log/netflow/porttracker ]
|
226 |
if [ ! -d /var/log/netflow/porttracker ]
|
| 227 |
then
|
227 |
then
|
| Line 383... |
Line 383... |
| 383 |
fi
|
383 |
fi
|
| 384 |
done
|
384 |
done
|
| 385 |
fi
|
385 |
fi
|
| 386 |
# On crée aléatoirement les mots de passe et les secrets partagés
|
386 |
# On crée aléatoirement les mots de passe et les secrets partagés
|
| 387 |
rm -f $PASSWD_FILE
|
387 |
rm -f $PASSWD_FILE
|
| 388 |
grubpwd=`cat /dev/urandom | tr -dc [:alnum:] | head -c16`
|
- |
|
| 389 |
echo "# Password to protect the GRUB boot menu (/!\\ qwerty keyboard):" > $PASSWD_FILE
|
- |
|
| 390 |
echo "grub=$grubpwd" >> $PASSWD_FILE
|
- |
|
| 391 |
md5_grubpwd=`/usr/bin/openssl passwd -1 $grubpwd`
|
- |
|
| 392 |
$SED "/^password.*/d" /boot/grub/menu.lst
|
- |
|
| 393 |
$SED "1ipassword --md5 $md5_grubpwd" /boot/grub/menu.lst
|
- |
|
| 394 |
mysqlpwd=`cat /dev/urandom | tr -dc [:alnum:] | head -c16`
|
388 |
mysqlpwd=`cat /dev/urandom | tr -dc [:alnum:] | head -c16`
|
| 395 |
echo "# Password of MariaDB administrator:" >> $PASSWD_FILE
|
389 |
echo "# Password of MariaDB administrator:" >> $PASSWD_FILE
|
| 396 |
echo "db_root=$mysqlpwd" >> $PASSWD_FILE
|
390 |
echo "db_root=$mysqlpwd" >> $PASSWD_FILE
|
| 397 |
radiuspwd=`cat /dev/urandom | tr -dc [:alnum:] | head -c16`
|
391 |
radiuspwd=`cat /dev/urandom | tr -dc [:alnum:] | head -c16`
|
| 398 |
echo "# Name and password of MariaDB user:" >> $PASSWD_FILE
|
392 |
echo "# Name and password of MariaDB user:" >> $PASSWD_FILE
|
| Line 1015... |
Line 1009... |
| 1015 |
if [ `systemctl is-active mysqld` == "active" ]
|
1009 |
if [ `systemctl is-active mysqld` == "active" ]
|
| 1016 |
then
|
1010 |
then
|
| 1017 |
systemctl stop mysqld
|
1011 |
systemctl stop mysqld
|
| 1018 |
fi
|
1012 |
fi
|
| 1019 |
rm -rf /var/lib/mysql # to be sure that there is no former installation
|
1013 |
rm -rf /var/lib/mysql # to be sure that there is no former installation
|
| 1020 |
/usr/sbin/mysqld-prepare-db-dir > /dev/null 2>&1
|
- |
|
| 1021 |
[ -e /etc/my.cnf.default ] || cp /etc/my.cnf /etc/my.cnf.default
|
1014 |
[ -e /etc/my.cnf.default ] || cp /etc/my.cnf /etc/my.cnf.default
|
| 1022 |
$SED "s?^tmpdir.*?tmpdir=/tmp?g" /etc/my.cnf
|
1015 |
$SED "s?^tmpdir.*?tmpdir=/tmp?g" /etc/my.cnf
|
| 1023 |
$SED "s?^port.*?#&?g" /etc/my.cnf # we use unix socket only
|
1016 |
$SED "s?^port.*?#&?g" /etc/my.cnf # we use unix socket only
|
| 1024 |
$SED "s?^;collation_server =.*?collation_server = utf8_unicode_ci?g" /etc/my.cnf
|
1017 |
$SED "s?^;collation_server =.*?collation_server = utf8_unicode_ci?g" /etc/my.cnf
|
| 1025 |
$SED "s?^;character_set_server =.*?character_set_server = utf8?g" /etc/my.cnf # accentuated user names are allowed
|
1018 |
$SED "s?^;character_set_server =.*?character_set_server = utf8?g" /etc/my.cnf # accentuated user names are allowed
|
| 1026 |
$SED "s?^plugin-load.*?#&?g" /etc/my.cnf.d/feedback.cnf # remove the feedback plugin (ALCASAR doesn't report anything !)
|
1019 |
$SED "s?^plugin-load.*?#&?g" /etc/my.cnf.d/feedback.cnf # remove the feedback plugin (ALCASAR doesn't report anything !)
|
| - |
|
1020 |
/usr/sbin/mysqld-prepare-db-dir > /dev/null 2>&1
|
| - |
|
1021 |
/usr/bin/systemctl set-environment MYSQLD_OPTS="--skip-grant-tables --skip-networking"
|
| 1027 |
/usr/bin/systemctl start mysqld.service
|
1022 |
/usr/bin/systemctl start mysqld
|
| 1028 |
nb_round=1
|
1023 |
nb_round=1
|
| 1029 |
while [ ! -S /var/lib/mysql/mysql.sock ] && [ $nb_round -lt 10 ] # we wait until mariadb is on
|
1024 |
while [ ! -S /var/lib/mysql/mysql.sock ] && [ $nb_round -lt 10 ] # we wait until mariadb is on
|
| 1030 |
do
|
1025 |
do
|
| 1031 |
nb_round=`expr $nb_round + 1`
|
1026 |
nb_round=`expr $nb_round + 1`
|
| 1032 |
sleep 2
|
1027 |
sleep 2
|
| Line 1034... |
Line 1029... |
| 1034 |
if [ ! -S /var/lib/mysql/mysql.sock ]
|
1029 |
if [ ! -S /var/lib/mysql/mysql.sock ]
|
| 1035 |
then
|
1030 |
then
|
| 1036 |
echo "Problème : la base données 'MariaDB' ne s'est pas lancée !"
|
1031 |
echo "Problème : la base données 'MariaDB' ne s'est pas lancée !"
|
| 1037 |
exit
|
1032 |
exit
|
| 1038 |
fi
|
1033 |
fi
|
| 1039 |
mysqladmin -u root password $mysqlpwd
|
- |
|
| 1040 |
MYSQL="/usr/bin/mysql -uroot -p$mysqlpwd --exec"
|
1034 |
MYSQL="/usr/bin/mysql --execute"
|
| 1041 |
# Secure the server
|
1035 |
# Secure the server
|
| - |
|
1036 |
$MYSQL="GRANT ALL PRIVILEGES ON *.* TO root@'localhost' IDENTIFIED BY '$mysqlpwd';"
|
| - |
|
1037 |
MYSQL="/usr/bin/mysql -uroot -p$mysqlpwd --execute"
|
| 1042 |
$MYSQL="DROP DATABASE IF EXISTS test;DROP DATABASE IF EXISTS tmp;"
|
1038 |
$MYSQL="DROP DATABASE IF EXISTS test;DROP DATABASE IF EXISTS tmp;"
|
| 1043 |
$MYSQL="CONNECT mysql;DELETE from user where User='';DELETE FROM user WHERE User='root' AND Host NOT IN ('localhost','127.0.0.1','::1');FLUSH PRIVILEGES;"
|
1039 |
$MYSQL="CONNECT mysql;DELETE from user where User='';DELETE FROM user WHERE User='root' AND Host NOT IN ('localhost','127.0.0.1','::1');FLUSH PRIVILEGES;"
|
| 1044 |
# Create 'radius' database
|
1040 |
# Create 'radius' database
|
| 1045 |
$MYSQL="CREATE DATABASE IF NOT EXISTS $DB_RADIUS;GRANT ALL ON $DB_RADIUS.* TO $DB_USER@localhost IDENTIFIED BY '$radiuspwd';FLUSH PRIVILEGES;"
|
1041 |
$MYSQL="CREATE DATABASE IF NOT EXISTS $DB_RADIUS;GRANT ALL ON $DB_RADIUS.* TO $DB_USER@localhost IDENTIFIED BY '$radiuspwd';FLUSH PRIVILEGES;"
|
| 1046 |
# Add an empty radius database structure
|
1042 |
# Add an empty radius database structure
|
| 1047 |
mysql -u$DB_USER -p$radiuspwd $DB_RADIUS < $DIR_CONF/empty-radiusd-db.sql
|
1043 |
mysql -u$DB_USER -p$radiuspwd $DB_RADIUS < $DIR_CONF/empty-radiusd-db.sql
|
| 1048 |
# modify the start script in order to close accounting connexion when the system is comming down or up
|
1044 |
# modify the start script in order to close accounting connexion when the system is comming down or up
|
| 1049 |
[ -e /lib/systemd/system/mysqld.service.default ] || cp /lib/systemd/system/mysqld.service /lib/systemd/system/mysqld.service.default
|
1045 |
[ -e /lib/systemd/system/mysqld.service.default ] || cp /lib/systemd/system/mysqld.service /lib/systemd/system/mysqld.service.default
|
| 1050 |
$SED "/ExecStartPost=/a ExecStop=$DIR_DEST_BIN/alcasar-mysql.sh -acct_stop" /usr/lib/systemd/system/mysqld.service
|
1046 |
$SED "/^ExecStart=/a ExecStop=$DIR_DEST_BIN/alcasar-mysql.sh -acct_stop" /usr/lib/systemd/system/mysqld.service
|
| 1051 |
$SED "/ExecStartPost=/a ExecStartPost=$DIR_DEST_BIN/alcasar-mysql.sh -acct_stop" /lib/systemd/system/mysqld.service
|
1047 |
$SED "/^ExecStop=/a ExecStartPost=$DIR_DEST_BIN/alcasar-mysql.sh -acct_stop" /lib/systemd/system/mysqld.service
|
| - |
|
1048 |
/usr/bin/systemctl unset-environment MYSQLD_OPTS
|
| 1052 |
/usr/bin/systemctl daemon-reload
|
1049 |
/usr/bin/systemctl daemon-reload
|
| 1053 |
} # End of init_db ()
|
1050 |
} # End of init_db ()
|
| 1054 |
|
1051 |
|
| 1055 |
##########################################################################
|
1052 |
##########################################################################
|
| 1056 |
## Fonction "radius" ##
|
1053 |
## Fonction "radius" ##
|
| Line 2128... |
Line 2125... |
| 2128 |
do
|
2125 |
do
|
| 2129 |
/usr/bin/systemctl -q enable $i.service
|
2126 |
/usr/bin/systemctl -q enable $i.service
|
| 2130 |
done
|
2127 |
done
|
| 2131 |
|
2128 |
|
| 2132 |
# disable processes at boot time (Systemctl)
|
2129 |
# disable processes at boot time (Systemctl)
|
| 2133 |
for i in ulogd
|
2130 |
for i in ulogd gpm
|
| 2134 |
do
|
2131 |
do
|
| 2135 |
/usr/bin/systemctl -q disable $i.service
|
2132 |
/usr/bin/systemctl -q disable $i.service
|
| 2136 |
done
|
2133 |
done
|
| 2137 |
|
2134 |
|
| 2138 |
# Apply French Security Agency (ANSSI) rules
|
2135 |
# Apply French Security Agency (ANSSI) rules
|