| 2,7 → 2,7 |
|---|
| # $Id$ |
| |
| # ALCASAR is a Free and open source NAC (Network Access Controler) created by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy) |
| # ALCASAR is based on a stripped Mageia (LSB) with the following open source softwares Coovachilli, freeradius, mariaDB, lighttpd, php, netfilter, e2guardian, ntpd, openssl, unbound, gammu, Ulog, fail2ban, vnstat, wkhtml2pdf, ipt_NETFLOW, NFsen and NFdump |
| # ALCASAR is based on a stripped Mageia (LSB) with the following open source softwares Coovachilli, freeradius, mariaDB, apache, php, netfilter, e2guardian, ntpd, openssl, unbound, gammu, Ulog, fail2ban, vnstat, wkhtml2pdf, ipt_NETFLOW, NFsen and NFdump |
| # contact : info@alcasar.net |
| |
| # Install script for ALCASAR (a secured and authenticated Internet access control captive portal) |
| 48,7 → 48,7 |
|---|
| DIR_SCRIPTS="$DIR_INSTALL/scripts" # install directory (with script files) |
| DIR_BLACKLIST="$DIR_INSTALL/blacklist" # install directory (with blacklist files) |
| DIR_SAVE="/var/Save" # backup directory (traceability_log, user_db, security_log) |
| DIR_WEB="/var/www/html" # directory of Lighttpd |
| DIR_WEB="/var/www/html" # directory of Apache |
| DIR_E2G="/etc/e2guardian" # directory of E2Guardian |
| DIR_ACC="$DIR_WEB/acc" # directory of the 'ALCASAR Control Center' |
| DIR_DEST_BIN="/usr/local/bin" # directory of ALCASAR scripts |
| 776,7 → 776,7 |
|---|
| |
| ################################################################## |
| ## "CA" ## |
| ## - Creating the CA and the server certificate (lighttpd) ## |
| ## - Creating the CA and the server certificate (httpd) ## |
| ################################################################## |
| CA() |
| { |
| 794,7 → 794,7 |
|---|
| ###################################################### |
| ## "ACC" ## |
| ## - copy ALCASAR Control Center (ACC) files ## |
| ## - configuration of the web server (Lighttpd) ## |
| ## - configuration of the web server (Apache) ## |
| ## - creation of the first ACC admin account ## |
| ## - secure the ACC access ## |
| ###################################################### |
| 846,42 → 846,157 |
|---|
| $SED "s?^html_errors.*?html_errors = Off?g" /etc/php.ini |
| $SED "s?^expose_php.*?expose_php = Off?g" /etc/php.ini |
| $SED "s?^allow_url_fopen.*?allow_url_fopen = Off?" /etc/php.ini |
| # Configuring & securing Lighttpd |
| # Configuring & securing Apache |
| rm -rf /var/www/cgi-bin/* /var/www/perl/* /var/www/icons/README* /var/www/error/README* |
| [ -e /etc/lighttpd/lighttpd.conf.default ] || cp /etc/lighttpd/lighttpd.conf /etc/lighttpd/lighttpd.conf.default |
| $SED "s?^#server\.bind.*?server\.bind = \"$PRIVATE_IP\"?g" /etc/lighttpd/lighttpd.conf |
| $SED "s?^server\.bind.*?server\.bind = \"$PRIVATE_IP\"?g" /etc/lighttpd/lighttpd.conf |
| $SED "s?^#server\.tag.*?server\.tag = \"\"?g" /etc/lighttpd/lighttpd.conf |
| echo "include \"vhosts.d/alcasar.conf\"" >> /etc/lighttpd/lighttpd.conf |
| |
| [ -e /etc/lighttpd/modules.conf.default ] || cp /etc/lighttpd/modules.conf /etc/lighttpd/modules.conf.default |
| $SED "s?^#[ ]*\"mod_auth\",.*?\"mod_auth\",?g" /etc/lighttpd/modules.conf |
| $SED "s?^#[ ]*\"mod_authn_file\",.*?\"mod_authn_file\",?g" /etc/lighttpd/modules.conf |
| $SED "s?^#[ ]*\"mod_alias\",.*?\"mod_alias\",?g" /etc/lighttpd/modules.conf |
| $SED "s?^#[ ]*\"mod_redirect\",.*?\"mod_redirect\",?g" /etc/lighttpd/modules.conf |
| $SED "/^[ ]*\"mod_redirect\",/a\"mod_openssl\"," /etc/lighttpd/modules.conf |
| $SED "s?^#include conf_dir + \"/conf.d/fastcgi.conf\".*?include conf_dir + \"/conf.d/fastcgi.conf\"?g" /etc/lighttpd/modules.conf |
| |
| [ -e /etc/lighttpd/conf.d/fastcgi.conf.default ] || cp /etc/lighttpd/conf.d/fastcgi.conf /etc/lighttpd/conf.d/fastcgi.conf.default |
| cp $DIR_CONF/lighttpd/conf.d/fastcgi.conf /etc/lighttpd/conf.d/fastcgi.conf |
| |
| [ -e /etc/php-fpm.conf.default ] || cp /etc/php-fpm.conf /etc/php-fpm.conf.default |
| $SED "s?^;listen\.owner.*?listen\.owner = apache?g" /etc/php-fpm.conf |
| $SED "s?^;listen\.group.*?listen\.group = apache?g" /etc/php-fpm.conf |
| $SED "s?^;listen\.mode.*?listen\.mode = 0660?g" /etc/php-fpm.conf |
| |
| [ -d /etc/lighttpd/vhosts.d ] || mkdir /etc/lighttpd/vhosts.d |
| cp $DIR_CONF/lighttpd/vhosts.d/* /etc/lighttpd/vhosts.d/ |
| $SED 's/^$SERVER\["socket"\] == ".*:443.*/$SERVER\["socket"\] == "'"$PRIVATE_IP"':443" {/g' /etc/lighttpd/vhosts.d/alcasar-with-ssl.conf /etc/lighttpd/vhosts.d/alcasar-without-ssl.conf |
| $SED "s/^\([\t ]*\)var.server_name.*/\1var.server_name = \"$PRIVATE_IP\"/g" /etc/lighttpd/vhosts.d/alcasar-with-ssl.conf /etc/lighttpd/vhosts.d/alcasar-without-ssl.conf |
| ln -s /etc/lighttpd/vhosts.d/alcasar-without-ssl.conf /etc/lighttpd/vhosts.d/alcasar.conf |
| |
| [ -d /var/log/lighttpd ] || mkdir /var/log/lighttpd |
| [ -e /var/log/lighttpd/access.log ] || touch /var/log/lighttpd/access.log |
| [ -e /var/log/lighttpd/error.log ] || touch /var/log/lighttpd/error.log |
| |
| chown -R apache:apache /var/log/lighttpd |
| |
| [ -e /etc/httpd/conf/httpd.conf.default ] || cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.default |
| $SED "s?^#ServerName.*?ServerName $HOSTNAME.$DOMAIN?g" /etc/httpd/conf/httpd.conf |
| $SED "s?^Listen.*?Listen $PRIVATE_IP:80?g" /etc/httpd/conf/httpd.conf |
| $SED "s?Options Indexes.*?Options -Indexes?g" /etc/httpd/conf/httpd.conf |
| echo "ServerTokens Prod" >> /etc/httpd/conf/httpd.conf |
| echo "ServerSignature Off" >> /etc/httpd/conf/httpd.conf |
| [ -e /etc/httpd/conf/modules.d/00_base.conf.default ] || cp /etc/httpd/conf/modules.d/00_base.conf /etc/httpd/conf/modules.d/00_base.conf.default |
| $SED "s?^LoadModule authn_anon_module.*?#LoadModule authn_anon_module modules/mod_authn_anon.so?g" /etc/httpd/conf/modules.d/00_base.conf |
| $SED "s?^LoadModule status_module.*?#LoadModule status_module modules/mod_status.so?g" /etc/httpd/conf/modules.d/00_base.conf |
| $SED "s?^LoadModule info_module.*?#LoadModule info_module modules/mod_info.so?g" /etc/httpd/conf/modules.d/00_base.conf |
| $SED "s?^LoadModule imagemap_module.*?#LoadModule imagemap_module modules/mod_imagemap.so?g" /etc/httpd/conf/modules.d/00_base.conf |
| $SED "s?^LoadModule rewrite_module.*?#LoadModule rewrite_module modules/mod_rewrite.so?g" /etc/httpd/conf/modules.d/00_base.conf |
| $SED "s?^LoadModule speling_module.*?#LoadModule speling_module modules/mod_speling.so?g" /etc/httpd/conf/modules.d/00_base.conf |
| [ -e /etc/httpd/conf/conf.d/ssl.conf.default ] || cp /etc/httpd/conf/conf.d/ssl.conf /etc/httpd/conf/conf.d/ssl.conf.default |
| echo "Listen $PRIVATE_IP:443" > /etc/httpd/conf/conf.d/ssl.conf # Listen only on INTIF |
| echo "SSLProtocol all -SSLv2 -SSLv3" >> /etc/httpd/conf/conf.d/ssl.conf # exclude vulnerable protocols |
| echo "SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS" >> /etc/httpd/conf/conf.d/ssl.conf # Define the cipher suite |
| echo "SSLHonorCipherOrder on" >> /etc/httpd/conf/conf.d/ssl.conf # The Browser must respect the order of the cipher suite |
| echo "SSLPassPhraseDialog builtin" >> /etc/httpd/conf/conf.d/ssl.conf # in case of passphrase the dialog will be perform on stdin |
| echo "SSLSessionCache \"shmcb:/run/httpd/ssl_scache(512000)\"" >> /etc/httpd/conf/conf.d/ssl.conf # default cache size |
| echo "SSLSessionCacheTimeout 300" >> /etc/httpd/conf/conf.d/ssl.conf # default cache time in seconds |
| # Error page management |
| [ -e /etc/httpd/conf/conf.d/multilang-errordoc.conf.default ] || cp /etc/httpd/conf/conf.d/multilang-errordoc.conf /etc/httpd/conf/conf.d/multilang-errordoc.conf.default |
| cat <<EOF > /etc/httpd/conf/conf.d/multilang-errordoc.conf |
| Alias /error/ "/var/www/html/" |
| <Directory "/usr/share/httpd/error"> |
| AllowOverride None |
| Options IncludesNoExec |
| AddOutputFilter Includes html |
| AddHandler type-map var |
| Require all granted |
| LanguagePriority en cs de es fr it ja ko nl pl pt-br ro sv tr |
| ForceLanguagePriority Prefer Fallback |
| </Directory> |
| ErrorDocument 400 /error/error.php?error=400 |
| ErrorDocument 401 /error/error.php?error=401 |
| ErrorDocument 403 /error/error.php?error=403 |
| ErrorDocument 404 /error/index.php |
| ErrorDocument 405 /error/error.php?error=405 |
| ErrorDocument 408 /error/error.php?error=408 |
| ErrorDocument 410 /error/error.php?error=410 |
| ErrorDocument 411 /error/error.php?error=411 |
| ErrorDocument 412 /error/error.php?error=412 |
| ErrorDocument 413 /error/error.php?error=413 |
| ErrorDocument 414 /error/error.php?error=414 |
| ErrorDocument 415 /error/error.php?error=415 |
| ErrorDocument 500 /error/error.php?error=500 |
| ErrorDocument 501 /error/error.php?error=501 |
| ErrorDocument 502 /error/error.php?error=502 |
| ErrorDocument 503 /error/error.php?error=503 |
| ErrorDocument 506 /error/error.php?error=506 |
| EOF |
| [ -e /usr/share/httpd/error/include/top.html.default ] || cp /usr/share/httpd/error/include/top.html /usr/share/httpd/error/include/top.html.default |
| $SED "s?background-color.*?background-color: #EFEFEF; }?g" /usr/share/httpd/error/include/top.html |
| [ -e /usr/share/httpd/error/include/bottom.html.default ] || cp /usr/share/httpd/error/include/bottom.html /usr/share/httpd/error/include/bottom.html.default |
| cat <<EOF > /usr/share/httpd/error/include/bottom.html |
| </body> |
| </html> |
| EOF |
| # ACC partitioning |
| rm -f /etc/httpd/conf/vhosts.d/alcasar* |
| cat <<EOF > /etc/httpd/conf/vhosts.d/alcasar.conf |
| <Directory $DIR_WEB> |
| AllowOverride None |
| Order deny,allow |
| Deny from all |
| Allow from 127.0.0.1 |
| Allow from $PRIVATE_NETWORK_MASK |
| ErrorDocument 404 https://$HOSTNAME.$DOMAIN/ |
| </Directory> |
| <Directory $DIR_WEB/certs> |
| AddType application/x-x509-ca-cert crt |
| </Directory> |
| <Directory $DIR_ACC> |
| SSLRequireSSL |
| AllowOverride None |
| Order deny,allow |
| Deny from all |
| Allow from 127.0.0.1 |
| Allow from $PRIVATE_NETWORK_MASK |
| require valid-user |
| AuthType digest |
| AuthName "ALCASAR Control Center (ACC)" |
| AuthDigestDomain $HOSTNAME.$DOMAIN |
| BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On |
| AuthUserFile $DIR_DEST_ETC/digest/key_all |
| ErrorDocument 404 https://$HOSTNAME.$DOMAIN/ |
| </Directory> |
| <Directory $DIR_ACC/admin> |
| SSLRequireSSL |
| AllowOverride None |
| Order deny,allow |
| Deny from all |
| Allow from 127.0.0.1 |
| Allow from $PRIVATE_NETWORK_MASK |
| require valid-user |
| AuthType digest |
| AuthName "ALCASAR Control Center (ACC)" |
| AuthDigestDomain $HOSTNAME.$DOMAIN |
| BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On |
| AuthUserFile $DIR_DEST_ETC/digest/key_admin |
| ErrorDocument 404 https://$HOSTNAME.$DOMAIN/ |
| </Directory> |
| <Directory $DIR_ACC/manager> |
| SSLRequireSSL |
| AllowOverride None |
| Order deny,allow |
| Deny from all |
| Allow from 127.0.0.1 |
| Allow from $PRIVATE_NETWORK_MASK |
| require valid-user |
| AuthType digest |
| AuthName "ALCASAR Control Center (ACC)" |
| AuthDigestDomain $HOSTNAME.$DOMAIN |
| BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On |
| AuthUserFile $DIR_DEST_ETC/digest/key_manager |
| ErrorDocument 404 https://$HOSTNAME.$DOMAIN/ |
| </Directory> |
| <Directory $DIR_ACC/backup> |
| SSLRequireSSL |
| AllowOverride None |
| Order deny,allow |
| Deny from all |
| Allow from 127.0.0.1 |
| Allow from $PRIVATE_NETWORK_MASK |
| require valid-user |
| AuthType digest |
| AuthName "ALCASAR Control Center (ACC)" |
| AuthDigestDomain $HOSTNAME.$DOMAIN |
| BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On |
| AuthUserFile $DIR_DEST_ETC/digest/key_backup |
| ErrorDocument 404 https://$HOSTNAME.$DOMAIN/ |
| </Directory> |
| Alias /save/ "$DIR_SAVE/" |
| <Directory $DIR_SAVE> |
| SSLRequireSSL |
| Options Indexes |
| Order deny,allow |
| Deny from all |
| Allow from 127.0.0.1 |
| Allow from $PRIVATE_NETWORK_MASK |
| require valid-user |
| AuthType digest |
| AuthName "ALCASAR Control Center (ACC)" |
| AuthDigestDomain $HOSTNAME.$DOMAIN |
| AuthUserFile $DIR_DEST_ETC/digest/key_backup |
| ErrorDocument 404 https://$HOSTNAME.$DOMAIN/ |
| </Directory> |
| EOF |
| # Creation of the first account (in 'admin' profile) |
| if [ "$mode" = "install" ] |
| then |
| 902,9 → 1017,9 |
|---|
| # Creation of ACC certs links |
| [ -d /var/www/html/certs ] || mkdir /var/www/html/certs |
| ln -s /etc/pki/CA/alcasar-ca.crt /var/www/html/certs/certificat_alcasar_ca.crt |
| # Run lighttpd after coova (in order waiting tun0 to be up) |
| cp /lib/systemd/system/lighttpd.service /etc/systemd/system/lighttpd.service |
| $SED "s?^After=.*?After=network.target remote-fs.target nss-lookup.target chilli.service?g" /etc/systemd/system/lighttpd.service |
| # Run Apache after coova (in order waiting tun0 to be up) |
| cp /lib/systemd/system/httpd.service /etc/systemd/system/httpd.service |
| $SED "s?^After=.*?After=network.target remote-fs.target nss-lookup.target chilli.service?g" /etc/systemd/system/httpd.service |
| # Log file for ACC access imputability |
| [ -e $DIR_SAVE/security/acc_access.log ] || touch $DIR_SAVE/security/acc_access.log |
| chown root:apache $DIR_SAVE/security/acc_access.log |
| 1805,14 → 1920,14 |
|---|
| EOF |
| |
| ## lighttpd-auth : Ban after 3 failed attempts on ACC. This "jail" uses the default "lighttpd-auth" f2b filter. |
| cat << EOF > /etc/fail2ban/jail.d/02-alcasar_lighttpd-auth.conf |
| [lighttpd-auth] |
| enabled = true |
| # cat << EOF > /etc/fail2ban/jail.d/02-alcasar_lighttpd-auth.conf |
| #[lighttpd-auth] |
| #enabled = true |
| #enabled = false |
| maxretry = 3 |
| bantime = 3m |
| findtime = 3m |
| EOF |
| #maxretry = 3 |
| #bantime = 3m |
| #findtime = 3m |
| #EOF |
| |
| ## mod-evasive : Ban after 3 failed retrieve page attempts (ie : unknown page) |
| cat << EOF > /etc/fail2ban/jail.d/03-alcasar_mod-evasive.conf |
| 1822,7 → 1937,7 |
|---|
| backend = auto |
| filter = alcasar_mod-evasive |
| action = iptables-allports[name=alcasar_mod-evasive] |
| logpath = /var/log/lighttpd/access.log |
| logpath = /var/log/httpd/access.log |
| maxretry = 3 |
| bantime = 3m |
| findtime = 3m |
| 1841,7 → 1956,7 |
|---|
| backend = auto |
| filter = alcasar_intercept |
| action = iptables-allports[name=alcasar_intercept] |
| logpath = /var/log/lighttpd/access.log |
| logpath = /var/log/httpd/access.log |
| maxretry = 5 |
| bantime = 3m |
| findtime = 3m |
| 1860,7 → 1975,7 |
|---|
| backend = auto |
| filter = alcasar_change-pwd |
| action = iptables-allports[name=alcasar_change-pwd] |
| logpath = /var/log/lighttpd/access.log |
| logpath = /var/log/httpd/access.log |
| maxretry = 5 |
| bantime = 3m |
| findtime = 3m |
| 1881,7 → 1996,7 |
|---|
| cp /lib/systemd/system/fail2ban.service /etc/systemd/system/fail2ban.service |
| $SED '/ExecStart=/a\ExecStop=/usr/bin/fail2ban-client stop' /etc/systemd/system/fail2ban.service |
| $SED '/Type=/a\PIDFile=/run/fail2ban/fail2ban.pid' /etc/systemd/system/fail2ban.service |
| $SED '/After=*/c After=syslog.target network.target lighttpd.service' /etc/systemd/system/fail2ban.service |
| $SED '/After=*/c After=syslog.target network.target httpd.service' /etc/systemd/system/fail2ban.service |
| } # End of fail2ban() |
| |
| ######################################################## |
| 2152,13 → 2267,13 |
|---|
| # Log compression |
| $SED "s?^delaycompress.*?#&?g" /etc/logrotate.conf |
| # actualisation des fichiers logs compressés |
| for dir in firewall e2guardian lighttpd |
| for dir in firewall e2guardian httpd |
| do |
| find /var/log/$dir -type f -name "*.log-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]" -exec gzip {} \; |
| done |
| /usr/bin/systemctl daemon-reload |
| # processes started at boot time (Systemctl) |
| for i in alcasar-network mysqld lighttpd php-fpm ntpd iptables unbound unbound-blacklist unbound-whitelist unbound-blackhole radiusd nfcapd e2guardian ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban vnstat sshd |
| for i in alcasar-network mysqld httpd ntpd iptables unbound unbound-blacklist unbound-whitelist unbound-blackhole radiusd nfcapd e2guardian ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban vnstat sshd |
| do |
| /usr/bin/systemctl -q enable $i.service |
| done |