| Line 1... |
Line 1... |
| 1 |
#!/bin/bash
|
1 |
#!/bin/bash
|
| 2 |
# $Id: alcasar.sh 1114 2013-06-16 09:13:06Z richard $
|
2 |
# $Id: alcasar.sh 1118 2013-06-20 12:00:56Z franck $
|
| 3 |
|
3 |
|
| 4 |
# alcasar.sh
|
4 |
# alcasar.sh
|
| 5 |
|
5 |
|
| 6 |
# ALCASAR Install script - CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...]
|
6 |
# ALCASAR Install script - CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...]
|
| 7 |
# Ce programme est un logiciel libre ; This software is free and open source
|
7 |
# Ce programme est un logiciel libre ; This software is free and open source
|
| Line 67... |
Line 67... |
| 67 |
DB_USER="radius" # nom de l'utilisateur de la base de données
|
67 |
DB_USER="radius" # nom de l'utilisateur de la base de données
|
| 68 |
# ******* Network parameters - paramètres réseau *******
|
68 |
# ******* Network parameters - paramètres réseau *******
|
| 69 |
HOSTNAME="alcasar" #
|
69 |
HOSTNAME="alcasar" #
|
| 70 |
DOMAIN="localdomain" # domaine local
|
70 |
DOMAIN="localdomain" # domaine local
|
| 71 |
EXTIF="eth0" # ETH0 est l'interface connectée à Internet (Box FAI)
|
71 |
EXTIF="eth0" # ETH0 est l'interface connectée à Internet (Box FAI)
|
| 72 |
MTU="1500"
|
72 |
MTU="1492"
|
| 73 |
ETHTOOL_OPTS="speed 100 duplex full"
|
73 |
ETHTOOL_OPTS="autoneg off speed 100 duplex full"
|
| 74 |
INTIF="eth1" # ETH1 est l'interface connectée au réseau local de consultation
|
74 |
INTIF="eth1" # ETH1 est l'interface connectée au réseau local de consultation
|
| 75 |
DEFAULT_PRIVATE_IP_MASK="192.168.182.1/24" # adresse d'ALCASAR (+masque) proposée par défaut sur le réseau de consultation
|
75 |
DEFAULT_PRIVATE_IP_MASK="192.168.182.1/24" # adresse d'ALCASAR (+masque) proposée par défaut sur le réseau de consultation
|
| 76 |
# ****** Paths - chemin des commandes *******
|
76 |
# ****** Paths - chemin des commandes *******
|
| 77 |
SED="/bin/sed -i"
|
77 |
SED="/bin/sed -i"
|
| 78 |
# ****************** End of global parameters *********************
|
78 |
# ****************** End of global parameters *********************
|
| Line 989... |
Line 989... |
| 989 |
uamsecret $secretuam
|
989 |
uamsecret $secretuam
|
| 990 |
uamallowed alcasar
|
990 |
uamallowed alcasar
|
| 991 |
coaport 3799
|
991 |
coaport 3799
|
| 992 |
include $DIR_DEST_ETC/alcasar-uamallowed
|
992 |
include $DIR_DEST_ETC/alcasar-uamallowed
|
| 993 |
include $DIR_DEST_ETC/alcasar-uamdomain
|
993 |
include $DIR_DEST_ETC/alcasar-uamdomain
|
| 994 |
#dhcpgateway\t
|
994 |
#dhcpgateway
|
| 995 |
#dhcprelayagent\t
|
995 |
#dhcprelayagent
|
| 996 |
#dhcpgatewayport\t
|
996 |
#dhcpgatewayport
|
| 997 |
EOF
|
997 |
EOF
|
| 998 |
# create file for DHCP static ip. Reserve the second IP address for eth1 (the first one is for tun0)
|
998 |
# create file for DHCP static ip. Reserve the second IP address for eth1 (the first one is for tun0)
|
| 999 |
echo "$PRIVATE_MAC $PRIVATE_SECOND_IP" > $DIR_DEST_ETC/alcasar-ethers
|
999 |
echo "$PRIVATE_MAC $PRIVATE_SECOND_IP" > $DIR_DEST_ETC/alcasar-ethers
|
| 1000 |
# create files for trusted domains and urls
|
1000 |
# create files for trusted domains and urls
|
| - |
|
1001 |
cp -f $DIR_CONF/alcasar-uam* $DIR_DEST_ETC/.
|
| 1001 |
touch $DIR_DEST_ETC/alcasar-uamallowed $DIR_DEST_ETC/alcasar-uamdomain
|
1002 |
# touch $DIR_DEST_ETC/alcasar-uamallowed $DIR_DEST_ETC/alcasar-uamdomain
|
| 1002 |
chown root:apache $DIR_DEST_ETC/alcasar-*
|
1003 |
chown root:apache $DIR_DEST_ETC/alcasar-*
|
| 1003 |
chmod 660 $DIR_DEST_ETC/alcasar-*
|
1004 |
chmod 660 $DIR_DEST_ETC/alcasar-*
|
| 1004 |
# Configuration des fichier WEB d'interception (secret partagé avec coova-chilli)
|
1005 |
# Configuration des fichier WEB d'interception (secret partagé avec coova-chilli)
|
| 1005 |
$SED "s?^\$uamsecret =.*?\$uamsecret = \"$secretuam\";?g" $DIR_WEB/intercept.php
|
1006 |
$SED "s?^\$uamsecret =.*?\$uamsecret = \"$secretuam\";?g" $DIR_WEB/intercept.php
|
| 1006 |
$SED "s?^\$userpassword=1.*?\$userpassword=1;?g" $DIR_WEB/intercept.php
|
1007 |
$SED "s?^\$userpassword=1.*?\$userpassword=1;?g" $DIR_WEB/intercept.php
|
| Line 1515... |
Line 1516... |
| 1515 |
for i in ntpd iptables ulogd dnsmasq squid chilli httpd radiusd netfs mysqld dansguardian havp freshclam
|
1516 |
for i in ntpd iptables ulogd dnsmasq squid chilli httpd radiusd netfs mysqld dansguardian havp freshclam
|
| 1516 |
do
|
1517 |
do
|
| 1517 |
/sbin/chkconfig --add $i
|
1518 |
/sbin/chkconfig --add $i
|
| 1518 |
done
|
1519 |
done
|
| 1519 |
|
1520 |
|
| - |
|
1521 |
cat << EOF > /etc/rc.local
|
| 1520 |
echo "/usr/local/sbin/alcasar-load_balancing.sh start &" >> /etc/rc.local
|
1522 |
/usr/local/sbin/alcasar-load_balancing.sh start &
|
| - |
|
1523 |
sleep 3
|
| - |
|
1524 |
service radiusd restart
|
| - |
|
1525 |
EOF
|
| 1521 |
|
1526 |
|
| 1522 |
# On applique les préconisations ANSSI
|
1527 |
# On applique les préconisations ANSSI
|
| 1523 |
# Apply French Security Agency rules
|
1528 |
# Apply French Security Agency rules
|
| 1524 |
# ignorer les broadcast ICMP. (attaque smurf)
|
1529 |
# ignorer les broadcast ICMP. (attaque smurf)
|
| 1525 |
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
|
1530 |
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
|