Subversion Repositories ALCASAR

Rev

Rev 786 | Rev 793 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 786 Rev 790
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/bash
2 
#  $Id: alcasar.sh 786 2012-01-02 22:50:31Z richard $
2 
#  $Id: alcasar.sh 790 2012-01-12 23:23:59Z richard $
3 
 
 3 
 
4 
# alcasar.sh
 4 
# alcasar.sh
5 
# by Franck BOUIJOUX, Pascal LEVANT and Richard REY
 5 
# by Franck BOUIJOUX, Pascal LEVANT and Richard REY
6 
# This script is distributed under the Gnu General Public License (GPL)
 6 
# This script is distributed under the Gnu General Public License (GPL)
7 
 
 7 
 
Line 442... Line 442...
442 
	[ -e /etc/host.deny.default ]  || cp /etc/hosts.deny /etc/hosts.deny.default
 442 
	[ -e /etc/host.deny.default ]  || cp /etc/hosts.deny /etc/hosts.deny.default
443 
	cat <<EOF > /etc/hosts.deny
 443 
	cat <<EOF > /etc/hosts.deny
444 
ALL: ALL: spawn ( /bin/echo "service %d demandé par %c" | /bin/mail -s "Tentative d'accès au service %d par %c REFUSE !!!" security ) &
 444 
ALL: ALL: spawn ( /bin/echo "service %d demandé par %c" | /bin/mail -s "Tentative d'accès au service %d par %c REFUSE !!!" security ) &
445 
EOF
 445 
EOF
446 
# Firewall config
 446 
# Firewall config
447 
$SED "s?^EXTIF=.*?EXTIF=\"$EXTIF\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
 447 
	$SED "s?^EXTIF=.*?EXTIF=\"$EXTIF\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
448 
$SED "s?^INTIF=.*?INTIF=\"$INTIF\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
 448 
	$SED "s?^INTIF=.*?INTIF=\"$INTIF\"?g" $DIR_DEST_BIN/alcasar-iptables.sh  $DIR_DEST_BIN/alcasar-iptables-bypass.sh
449 
chmod o+r $DIR_DEST_BIN/alcasar-iptables.sh #lecture possible pour apache (interface php du filtrage réseau)
 449 
	chmod o+r $DIR_DEST_BIN/alcasar-iptables.sh #lecture possible pour apache (interface php du filtrage réseau)
450 
# création du fichier d'exception au filtrage
 450 
# create the filter exxeption file
451 
touch $DIR_DEST_ETC/alcasar-filter-exceptions
 451 
	touch $DIR_DEST_ETC/alcasar-filter-exceptions
- 
 
 452 
# load conntrack ftp module
- 
 
 453 
	[ -e /etc/modprobe.preload.default ] || cp /etc/modprobe.preload /etc/modprobe.preload.default
- 
 
 454 
	echo "ip_conntrack_ftp" >>  /etc/modprobe.preload
452 
# le script $DIR_DEST_BIN/alcasar-iptables.sh est lancé à la fin (pour ne pas perturber une mise à jour via ssh)
 455 
# le script $DIR_DEST_BIN/alcasar-iptables.sh est lancé à la fin (pour ne pas perturber une mise à jour via ssh)
453 
} # End of network ()
 456 
} # End of network ()
454 
 
 457 
 
455 
##################################################################
 458 
##################################################################
456 
##			Fonction gestion			##
 459 
##			Fonction gestion			##
Line 459... Line 462...
459 
## - définition du 1er comptes de gestion 			##
 462 
## - définition du 1er comptes de gestion 			##
460 
## - sécurisation des accès					##
 463 
## - sécurisation des accès					##
461 
##################################################################
 464 
##################################################################
462 
gestion()
 465 
gestion()
463 
{
 466 
{
464 
# Suppression des CGI et des pages WEB installés par défaut
 - 
 
465 
	rm -rf /var/www/cgi-bin/*
 - 
 
466 
	[ -d $DIR_WEB ] && rm -rf $DIR_WEB
 467 
	[ -d $DIR_WEB ] && rm -rf $DIR_WEB
467 
	mkdir $DIR_WEB
 468 
	mkdir $DIR_WEB
468 
# Copie et configuration des fichiers du centre de gestion
 469 
# Copie et configuration des fichiers du centre de gestion
469 
	cp -rf $DIR_INSTALL/web/* $DIR_WEB/
 470 
	cp -rf $DIR_INSTALL/web/* $DIR_WEB/
470 
	echo "$VERSION du $DATE" > $DIR_WEB/VERSION
 471 
	echo "$VERSION du $DATE" > $DIR_WEB/VERSION
Line 487... Line 488...
487 
	$SED "s?^upload_max_filesize.*?upload_max_filesize = 100M?g" /etc/php.ini
 488 
	$SED "s?^upload_max_filesize.*?upload_max_filesize = 100M?g" /etc/php.ini
488 
	$SED "s?^post_max_size.*?post_max_size = 100M?g" /etc/php.ini
 489 
	$SED "s?^post_max_size.*?post_max_size = 100M?g" /etc/php.ini
489 
	$SED "s?^html_errors.*?html_errors = Off?g" /etc/php.ini
 490 
	$SED "s?^html_errors.*?html_errors = Off?g" /etc/php.ini
490 
	$SED "s?^expose_php.*?expose_php = Off?g" /etc/php.ini
 491 
	$SED "s?^expose_php.*?expose_php = Off?g" /etc/php.ini
491 
# Configuration et sécurisation Apache
 492 
# Configuration et sécurisation Apache
- 
 
 493 
	rm -rf /var/www/cgi-bin/* /var/www/perl/* /var/www/icons/README* /var/www/error/README*
492 
	[ -e /etc/httpd/conf/httpd.conf.default ] || cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.default
 494 
	[ -e /etc/httpd/conf/httpd.conf.default ] || cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.default
493 
	$SED "s?^#ServerName.*?ServerName $HOSTNAME?g" /etc/httpd/conf/httpd.conf
 495 
	$SED "s?^#ServerName.*?ServerName $HOSTNAME?g" /etc/httpd/conf/httpd.conf
494 
	$SED "s?^Listen.*?Listen $PRIVATE_IP:80?g" /etc/httpd/conf/httpd.conf
 496 
	$SED "s?^Listen.*?Listen $PRIVATE_IP:80?g" /etc/httpd/conf/httpd.conf
495 
	$SED "s?^ServerTokens.*?ServerTokens Prod?g" /etc/httpd/conf/httpd.conf
 497 
	$SED "s?^ServerTokens.*?ServerTokens Prod?g" /etc/httpd/conf/httpd.conf
496 
	$SED "s?^ServerSignature.*?ServerSignature Off?g" /etc/httpd/conf/httpd.conf
 498 
	$SED "s?^ServerSignature.*?ServerSignature Off?g" /etc/httpd/conf/httpd.conf
497 
	$SED "s?^#ErrorDocument 404 /missing.html.*?ErrorDocument 404 /index.html?g" /etc/httpd/conf/httpd.conf
 499 
	$SED "s?^#ErrorDocument 404 /missing.html.*?ErrorDocument 404 /index.html?g" /etc/httpd/conf/httpd.conf
- 
 
 500 
	$SED "s?^LoadModule authn_anon_module.*?#LoadModule authn_anon_module modules/mod_authn_anon.so?g" /etc/httpd/conf/httpd.conf
- 
 
 501 
	$SED "s?^LoadModule status_module.*?#LoadModule status_module modules/mod_status.so?g" /etc/httpd/conf/httpd.conf
- 
 
 502 
	$SED "s?^LoadModule autoindex_module.*?#LoadModule autoindex_module modules/mod_autoindex.so?g" /etc/httpd/conf/httpd.conf
- 
 
 503 
	$SED "s?^LoadModule info_module.*?#LoadModule info_module modules/mod_info.so?g" /etc/httpd/conf/httpd.conf
- 
 
 504 
	$SED "s?^LoadModule cgi_module.*?#LoadModule cgi_module modules/mod_cgi.so?g" /etc/httpd/conf/httpd.conf
- 
 
 505 
	$SED "s?^LoadModule imagemap_module.*?#LoadModule imagemap_module modules/mod_imagemap.so?g" /etc/httpd/conf/httpd.conf
- 
 
 506 
	$SED "s?^LoadModule rewrite_module.*?#LoadModule rewrite_module modules/mod_rewrite.so?g" /etc/httpd/conf/httpd.conf
498 
	FIC_MOD_SSL=`find /etc/httpd/modules.d/ -type f -name *mod_ssl.conf`
 507 
	FIC_MOD_SSL=`find /etc/httpd/modules.d/ -type f -name *mod_ssl.conf`
499 
	$SED "s?^Listen.*?Listen $PRIVATE_IP:443?g" $FIC_MOD_SSL # On écoute en SSL que sur INTIF
 508 
	$SED "s?^Listen.*?Listen $PRIVATE_IP:443?g" $FIC_MOD_SSL # On écoute en SSL que sur INTIF
500 
	$SED "s?background-color.*?background-color: #EFEFEF; }?g" /var/www/error/include/top.html
 509 
	$SED "s?background-color.*?background-color: #EFEFEF; }?g" /var/www/error/include/top.html
501 
	[ -e /var/www/error/include/bottom.html.default ] || mv /var/www/error/include/bottom.html /var/www/error/include/bottom.html.default
 510 
	[ -e /var/www/error/include/bottom.html.default ] || mv /var/www/error/include/bottom.html /var/www/error/include/bottom.html.default
502 
	cat <<EOF > /var/www/error/include/bottom.html
 511 
	cat <<EOF > /var/www/error/include/bottom.html
Line 622... Line 631...
622 
	AuthName $HOSTNAME
 631 
	AuthName $HOSTNAME
623 
	BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
 632 
	BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
624 
	AuthUserFile $DIR_DEST_ETC/digest/key_backup
 633 
	AuthUserFile $DIR_DEST_ETC/digest/key_backup
625 
	ErrorDocument 404 https://$HOSTNAME/
 634 
	ErrorDocument 404 https://$HOSTNAME/
626 
</Directory>
 635 
</Directory>
627 
Alias /save/ "$DIR_SAVE/"
 - 
 
628 
<Directory $DIR_SAVE>
 - 
 
629 
	SSLRequireSSL
 - 
 
630 
	Options Indexes
 - 
 
631 
	Order deny,allow
 - 
 
632 
	Deny from all
 - 
 
633 
	Allow from 127.0.0.1
 - 
 
634 
	Allow from $PRIVATE_NETWORK_MASK
 - 
 
635 
	require valid-user
 - 
 
636 
	AuthType digest
 - 
 
637 
	AuthName $HOSTNAME
 - 
 
638 
	AuthUserFile $DIR_DEST_ETC/digest/key_backup
 - 
 
639 
	ErrorDocument 404 https://$HOSTNAME/
 - 
 
640 
	ReadmeName	/readmeSave.html
 - 
 
641 
</Directory>
 - 
 
642 
EOF
 636 
EOF
643 
} # End of gestion ()
 637 
} # End of gestion ()
644 
 
 638 
 
645 
##########################################################################################
 639 
##########################################################################################
646 
##				Fonction AC()						##
 640 
##				Fonction AC()						##
Line 1303... Line 1297...
1303 
	$SED "s?^Banner.*?Banner /etc/ssh/alcasar-banner-ssh?g" /etc/ssh/sshd_config
 1297 
	$SED "s?^Banner.*?Banner /etc/ssh/alcasar-banner-ssh?g" /etc/ssh/sshd_config
1304 
	$SED "s?^#Banner.*?Banner /etc/ssh/alcasar-banner-ssh?g" /etc/ssh/sshd_config
 1298 
	$SED "s?^#Banner.*?Banner /etc/ssh/alcasar-banner-ssh?g" /etc/ssh/sshd_config
1305 
# sshd écoute côté LAN et WAN
 1299 
# sshd écoute côté LAN et WAN
1306 
	$SED "s?^#ListenAddress 0\.0\.0\.0?ListenAddress $PRIVATE_IP?g" /etc/ssh/sshd_config
 1300 
	$SED "s?^#ListenAddress 0\.0\.0\.0?ListenAddress $PRIVATE_IP?g" /etc/ssh/sshd_config
1307 
	$SED "/^ListenAddress $PRIVATE_IP/a\ListenAddress $PUBLIC_IP" /etc/ssh/sshd_config
1301 
	$SED "/^ListenAddress $PRIVATE_IP/a\ListenAddress $PUBLIC_IP" /etc/ssh/sshd_config
1308 
# Put the default value in conf file (sshd, QOS, protocols filter and dns filter are off)(web antivirus is on)
 1302 
	# Put the default value in conf file (sshd, QOS and protocols/dns/ext_LAN filtering are off)(web antivirus is on)
1309 
	/sbin/chkconfig --del sshd
 1303 
	/sbin/chkconfig --del sshd
1310 
	echo "SSH=off" >> $CONF_FILE
 1304 
	echo "SSH=off" >> $CONF_FILE
1311 
	echo 'Admin_from_IP="0.0.0.0/0.0.0.0"' >> $CONF_FILE
 1305 
	echo 'Admin_from_IP="0.0.0.0/0.0.0.0"' >> $CONF_FILE
1312 
	echo "QOS=off" >> $CONF_FILE
 1306 
	echo "QOS=off" >> $CONF_FILE
1313 
	echo "LDAP=off" >> $CONF_FILE
 1307 
	echo "LDAP=off" >> $CONF_FILE
1314 
	echo "LDAP_IP=0.0.0.0/0.0.0.0" >> $CONF_FILE
 1308 
	echo "LDAP_IP=0.0.0.0/0.0.0.0" >> $CONF_FILE
1315 
	echo "PROTOCOLS_FILTERING=off" >> $CONF_FILE
 1309 
	echo "PROTOCOLS_FILTERING=off" >> $CONF_FILE
- 
 
 1310 
	echo "EXT_LAN_FILTERING=off" >> $CONF_FILE
1316 
	echo "DNS_FILTERING=off" >> $CONF_FILE
 1311 
	echo "DNS_FILTERING=off" >> $CONF_FILE
1317 
	echo "WEB_ANTIVIRUS=on" >> $CONF_FILE
 1312 
	echo "WEB_ANTIVIRUS=on" >> $CONF_FILE
1318 
# Coloration des prompts
 1313 
# Coloration des prompts
1319 
	[ -e /etc/bashrc.default ]  || cp /etc/bashrc /etc/bashrc.default
 1314 
	[ -e /etc/bashrc.default ]  || cp /etc/bashrc /etc/bashrc.default
1320 
	cp -f $DIR_CONF/bashrc /etc/. ; chmod 644 /etc/bashrc ; chown root:root /etc/bashrc
 1315 
	cp -f $DIR_CONF/bashrc /etc/. ; chmod 644 /etc/bashrc ; chown root:root /etc/bashrc