672 |
richard |
1 |
#/bin/bash
|
63 |
franck |
2 |
# $Id: alcasar-bl.sh 854 2012-04-09 19:31:46Z richard $
|
|
|
3 |
|
672 |
richard |
4 |
# alcasar-bl.sh
|
|
|
5 |
# by Franck BOUIJOUX and Richard REY
|
|
|
6 |
# This script is distributed under the Gnu General Public License (GPL)
|
1 |
root |
7 |
|
672 |
richard |
8 |
# Gestion de la BL pour le filtrage de domaine (via dnsmasq) et d'URL (via Dansguardian)
|
|
|
9 |
# Manage the BL for DnsBlackHole (dnsmasq) and URL filtering (Dansguardian)
|
|
|
10 |
|
612 |
richard |
11 |
CONF_FILE="/usr/local/etc/alcasar.conf"
|
854 |
richard |
12 |
private_ip_mask=`grep PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
|
|
|
13 |
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
|
|
|
14 |
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1` # ALCASAR LAN IP address
|
308 |
richard |
15 |
DIR_tmp="/tmp/blacklists"
|
|
|
16 |
FILE_tmp="/tmp/fileFilter.txt"
|
316 |
richard |
17 |
DIR_DG="/etc/dansguardian/lists"
|
|
|
18 |
DIR_DG_BL="$DIR_DG/blacklists"
|
313 |
richard |
19 |
BL_CATEGORIES="/usr/local/etc/alcasar-bl-categories"
|
|
|
20 |
BL_CATEGORIES_ENABLED="/usr/local/etc/alcasar-bl-categories-enabled"
|
308 |
richard |
21 |
DIR_DNS_FILTER_AVAILABLE="/usr/local/etc/alcasar-dnsfilter-available"
|
309 |
richard |
22 |
DIR_DNS_FILTER_ENABLED="/usr/local/etc/alcasar-dnsfilter-enabled"
|
1 |
root |
23 |
BL_SERVER="cri.univ-tlse1.fr"
|
|
|
24 |
SED="/bin/sed -i"
|
637 |
richard |
25 |
|
308 |
richard |
26 |
# Récupération de l'archive de la BL Toulouse
|
1 |
root |
27 |
function transfert () {
|
|
|
28 |
mkdir -p $DIR_tmp
|
|
|
29 |
cd $DIR_tmp
|
|
|
30 |
wget http://$BL_SERVER/blacklists/download/blacklists.tar.gz
|
|
|
31 |
}
|
308 |
richard |
32 |
# Décompression de la BL (en conservant la WL)
|
1 |
root |
33 |
function install () {
|
316 |
richard |
34 |
[ -d $DIR_DG ] || mkdir -p $DIR_DG
|
|
|
35 |
[ -d $DIR_DG_BL/ossi ] && mv -f $DIR_DG_BL/ossi $DIR_tmp
|
648 |
richard |
36 |
[ -d $DIR_DG_BL/ip ] && mv -f $DIR_DG_BL/ip $DIR_tmp
|
316 |
richard |
37 |
tar zxf $DIR_tmp/blacklists.tar.gz --directory=$DIR_DG/
|
|
|
38 |
[ -d $DIR_tmp/ossi ] && mv -f $DIR_tmp/ossi $DIR_DG_BL/
|
648 |
richard |
39 |
[ -d $DIR_tmp/ip ] && mv -f $DIR_tmp/ip $DIR_DG_BL/
|
1 |
root |
40 |
cd /root
|
|
|
41 |
rm -rf $DIR_tmp
|
|
|
42 |
}
|
308 |
richard |
43 |
# Permet d'activer/désactiver les catégories de la BL
|
|
|
44 |
function cat_choice (){
|
311 |
richard |
45 |
# un peu de ménage
|
|
|
46 |
rm -rf $DIR_DNS_FILTER_ENABLED/*
|
316 |
richard |
47 |
$SED "/\.Include/d" $DIR_DG/bannedsitelist $DIR_DG/bannedurllist
|
313 |
richard |
48 |
# on adapte le fichier $BL_CATEGORIES au choix de catégorie
|
|
|
49 |
$SED "s?^[^#]?#&?g" $BL_CATEGORIES # on commente ce qui ne l'est pas
|
648 |
richard |
50 |
for ENABLE_CATEGORIE in `cat $BL_CATEGORIES_ENABLED` # on affecte les catégories à dansguardian et dnsmasq
|
313 |
richard |
51 |
do
|
314 |
richard |
52 |
$SED "/\/$ENABLE_CATEGORIE$/d" $BL_CATEGORIES
|
|
|
53 |
$SED "1i\/etc\/dansguardian\/lists\/blacklists\/$ENABLE_CATEGORIE" $BL_CATEGORIES
|
648 |
richard |
54 |
ln -s $DIR_DNS_FILTER_AVAILABLE/$ENABLE_CATEGORIE.conf $DIR_DNS_FILTER_ENABLED/$ENABLE_CATEGORIE
|
854 |
richard |
55 |
echo ".Include<$DIR_DG_BL/$ENABLE_CATEGORIE/domains>" >> $DIR_DG/bannedsitelist # dansguardian s'occupe du contournement par proxy http ;-)
|
648 |
richard |
56 |
echo ".Include<$DIR_DG_BL/$ENABLE_CATEGORIE/urls>" >> $DIR_DG/bannedurllist
|
313 |
richard |
57 |
done
|
314 |
richard |
58 |
sort -k2n $BL_CATEGORIES > $FILE_tmp
|
313 |
richard |
59 |
mv $FILE_tmp $BL_CATEGORIES
|
308 |
richard |
60 |
}
|
615 |
richard |
61 |
function bl_enable (){
|
|
|
62 |
$SED "s/^reportinglevel =.*/reportinglevel = 3/g" /etc/dansguardian/dansguardian.conf
|
|
|
63 |
$SED "s?^#\"?\"?g" $DIR_DG/urlregexplist # Enable 'safesearch'
|
|
|
64 |
if [ "$PARENT_SCRIPT" != "/usr/local/bin/alcasar-conf.sh" ] # don't launch on install stage
|
|
|
65 |
then
|
|
|
66 |
service dansguardian restart
|
|
|
67 |
service dnsmasq restart
|
|
|
68 |
/usr/local/bin/alcasar-iptables.sh
|
|
|
69 |
fi
|
|
|
70 |
}
|
|
|
71 |
function bl_disable (){
|
|
|
72 |
rm -rf $DIR_DNS_FILTER_ENABLED/*
|
|
|
73 |
$SED "s/^reportinglevel =.*/reportinglevel = -1/g" /etc/dansguardian/dansguardian.conf
|
|
|
74 |
$SED "s?^[^#]?#&?g" $DIR_DG/urlregexplist # Disable 'safesearch'
|
|
|
75 |
if [ "$PARENT_SCRIPT" != "/usr/local/bin/alcasar-conf.sh" ] # don't launch on install stage
|
|
|
76 |
then
|
|
|
77 |
service dansguardian restart
|
634 |
richard |
78 |
service dnsmasq restart
|
615 |
richard |
79 |
/usr/local/bin/alcasar-iptables.sh
|
|
|
80 |
fi
|
|
|
81 |
}
|
634 |
richard |
82 |
usage="Usage: alcasar-bl.sh {-on or --on} | { -off or --off } | { -download or --download } | { -reload or --reload }"
|
1 |
root |
83 |
nb_args=$#
|
|
|
84 |
args=$1
|
|
|
85 |
if [ $nb_args -eq 0 ]
|
|
|
86 |
then
|
634 |
richard |
87 |
DNS_FILTERING=`grep DNS_FILTERING $CONF_FILE|cut -d"=" -f2` # DNS and URLs filter (on/off)
|
|
|
88 |
DNS_FILTERING=${DNS_FILTERING:=off}
|
|
|
89 |
echo "Set BlackList Filtering to $DNS_FILTERING"
|
|
|
90 |
if [ $DNS_FILTERING = on ]; then
|
|
|
91 |
cat_choice
|
|
|
92 |
bl_enable
|
|
|
93 |
else
|
|
|
94 |
bl_disable
|
|
|
95 |
fi
|
|
|
96 |
exit 0
|
1 |
root |
97 |
fi
|
|
|
98 |
case $args in
|
|
|
99 |
-\? | -h* | --h*)
|
|
|
100 |
echo "$usage"
|
|
|
101 |
exit 0
|
|
|
102 |
;;
|
308 |
richard |
103 |
# activation du filtrage
|
386 |
franck |
104 |
-on | --on)
|
311 |
richard |
105 |
cat_choice
|
612 |
richard |
106 |
$SED "s?^DNS_FILTERING.*?DNS_FILTERING=on?g" $CONF_FILE
|
615 |
richard |
107 |
bl_enable
|
1 |
root |
108 |
;;
|
308 |
richard |
109 |
# désactivation du filtrage
|
412 |
richard |
110 |
-off | --off)
|
612 |
richard |
111 |
$SED "s?^DNS_FILTERING.*?DNS_FILTERING=off?g" $CONF_FILE
|
615 |
richard |
112 |
bl_disable
|
|
|
113 |
;;
|
854 |
richard |
114 |
# Mise a jour de la blacklist 'Toulouse' (attente validation md5 avant adaptation à notre structure)
|
386 |
franck |
115 |
-download | --download)
|
1 |
root |
116 |
rm -rf /tmp/con_ok.html
|
|
|
117 |
`/usr/bin/curl $BL_SERVER -# -o /tmp/con_ok.html`
|
|
|
118 |
if [ ! -e /tmp/con_ok.html ]
|
|
|
119 |
then
|
|
|
120 |
echo "Erreur : le serveur de blacklist ($BL_SERVER) n'est pas joignable"
|
|
|
121 |
else
|
|
|
122 |
transfert
|
|
|
123 |
install
|
316 |
richard |
124 |
chown -R dansguardian:apache $DIR_DG
|
|
|
125 |
chmod -R g+w $DIR_DG
|
685 |
richard |
126 |
rm -rf /tmp/con_ok.html
|
|
|
127 |
fi
|
654 |
richard |
128 |
;;
|
854 |
richard |
129 |
# Adaptation de la BL à notre structure (dnsmasq + DG)
|
654 |
richard |
130 |
-adapt | --adapt)
|
854 |
richard |
131 |
find $DIR_DG_BL/ -type f -name domains > $BL_CATEGORIES # On récupère le nom des répertoire (catégories)
|
|
|
132 |
$SED "s?\/domains??g" $BL_CATEGORIES # On supprime le suffice "/domains"
|
|
|
133 |
rm -f $DIR_DNS_FILTER_AVAILABLE/*
|
|
|
134 |
echo -n "Toulouse BlackList migration process. Please wait : "
|
|
|
135 |
for PATH_FILE in `cat $BL_CATEGORIES` # pour chaque catégorie
|
|
|
136 |
do
|
|
|
137 |
echo -n "."
|
|
|
138 |
if [ ! -f $PATH_FILE/urls ] # on crée le fichier 'urls' s'il n'existe pas
|
|
|
139 |
then
|
|
|
140 |
touch $PATH_FILE/urls
|
|
|
141 |
chown dansguardian:apache $PATH_FILE/urls
|
|
|
142 |
fi
|
|
|
143 |
# suppression des @IP, de caractères acccentués et des lignes commentées
|
|
|
144 |
egrep -v "([0-9]{1,3}\.){3}[0-9]{1,3}" $PATH_FILE/domains > /tmp/dnsmasq-bl.tmp
|
|
|
145 |
$SED "/[äâëêïîöôüû]/d" /tmp/dnsmasq-bl.tmp
|
|
|
146 |
$SED "/^#.*/d" /tmp/dnsmasq-bl.tmp
|
|
|
147 |
$SED "s?.*?address=/&/$PRIVATE_IP?g" /tmp/dnsmasq-bl.tmp # Mise en forme dnsmasq
|
|
|
148 |
DOMAINE=`basename $PATH_FILE`
|
|
|
149 |
mv /tmp/dnsmasq-bl.tmp $DIR_DNS_FILTER_AVAILABLE/$DOMAINE.conf
|
|
|
150 |
done
|
|
|
151 |
echo
|
654 |
richard |
152 |
;;
|
854 |
richard |
153 |
# regénération suite à modification de la BL secondaire ou du choix des catégories
|
386 |
franck |
154 |
-reload | --reload)
|
308 |
richard |
155 |
# pour Dansguardian
|
316 |
richard |
156 |
chown -R dansguardian:apache $DIR_DG_BL/ossi
|
|
|
157 |
chmod -R g+w $DIR_DG_BL/ossi
|
311 |
richard |
158 |
cat_choice
|
|
|
159 |
# pour dnsmasq (noms de domaine réhabilités)
|
316 |
richard |
160 |
if [ `wc -w $DIR_DG/exceptionsitelist|cut -d " " -f1` != "0" ]
|
311 |
richard |
161 |
then
|
316 |
richard |
162 |
for i in `cat $DIR_DG/exceptionsitelist`
|
311 |
richard |
163 |
do
|
313 |
richard |
164 |
$SED "/$i/d" $DIR_DNS_FILTER_AVAILABLE/*
|
311 |
richard |
165 |
done
|
|
|
166 |
fi
|
316 |
richard |
167 |
cp -f $DIR_DG_BL/ossi/domains $DIR_DNS_FILTER_AVAILABLE/ossi.conf
|
854 |
richard |
168 |
$SED "s?.*?address=/&/$PRIVATE_IP?g" $DIR_DNS_FILTER_AVAILABLE/ossi.conf
|
648 |
richard |
169 |
IP_PURE=`grep '^ip' $BL_CATEGORIES_ENABLED|wc -l`
|
|
|
170 |
if [ $IP_PURE -eq "1" ]; then # filtrage des url sans nom de domaine
|
|
|
171 |
$SED "s/^\#\*ip$/*ip/g" $DIR_DG/bannedsitelist
|
|
|
172 |
else
|
|
|
173 |
$SED "s/^\*ip$/#*ip/g" $DIR_DG/bannedsitelist
|
|
|
174 |
fi
|
634 |
richard |
175 |
DNS_FILTERING=`grep DNS_FILTERING $CONF_FILE|cut -d"=" -f2` # DNS and URLs filter (on/off)
|
|
|
176 |
DNS_FILTERING=${DNS_FILTERING:=off}
|
|
|
177 |
if [ $DNS_FILTERING = on ]; then
|
|
|
178 |
bl_enable
|
|
|
179 |
else
|
|
|
180 |
bl_disable
|
|
|
181 |
fi
|
503 |
richard |
182 |
;;
|
1 |
root |
183 |
*)
|
|
|
184 |
echo "Argument inconnu :$1";
|
|
|
185 |
echo "$usage"
|
|
|
186 |
exit 1
|
|
|
187 |
;;
|
|
|
188 |
esac
|
|
|
189 |
|