| Line 1... |
Line 1... |
| 1 |
#!/bin/bash
|
1 |
#!/bin/bash
|
| 2 |
# $Id: alcasar.sh 1214 2013-09-18 16:01:28Z crox53 $
|
2 |
# $Id: alcasar.sh 1215 2013-09-18 22:08:14Z richard $
|
| 3 |
|
3 |
|
| 4 |
# alcasar.sh
|
4 |
# alcasar.sh
|
| 5 |
|
5 |
|
| 6 |
# ALCASAR Install script - CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...]
|
6 |
# ALCASAR Install script - CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...]
|
| 7 |
# Ce programme est un logiciel libre ; This software is free and open source
|
7 |
# Ce programme est un logiciel libre ; This software is free and open source
|
| Line 1189... |
Line 1189... |
| 1189 |
## Fonction param_nfsen ##
|
1189 |
## Fonction param_nfsen ##
|
| 1190 |
##########################################################
|
1190 |
##########################################################
|
| 1191 |
param_nfsen()
|
1191 |
param_nfsen()
|
| 1192 |
{
|
1192 |
{
|
| 1193 |
#Decompression tarball
|
1193 |
#Decompression tarball
|
| 1194 |
tar xvzf ./conf/nfsen/nfsen-1.3.6p1.tar.gz -C /tmp/
|
1194 |
tar xvzf ./conf/nfsen/nfsen-1.3.6p1.tar.gz -C /tmp/
|
| 1195 |
#Création groupe et utilisteur
|
1195 |
#Création groupe et utilisteur
|
| 1196 |
if grep "^www-data:" /etc/group > /dev/null; then
|
1196 |
if grep "^www-data:" /etc/group > /dev/null; then
|
| 1197 |
echo "Group already exists !"
|
1197 |
echo "Group already exists !"
|
| 1198 |
else
|
1198 |
else
|
| 1199 |
groupadd www-data
|
1199 |
groupadd www-data
|
| 1200 |
echo "Group 'www-data' created !"
|
1200 |
echo "Group 'www-data' created !"
|
| 1201 |
fi
|
1201 |
fi
|
| 1202 |
if grep "^nfsen:" /etc/passwd > /dev/null; then
|
1202 |
if grep "^nfsen:" /etc/passwd > /dev/null; then
|
| 1203 |
echo "User already exists !"
|
1203 |
echo "User already exists !"
|
| 1204 |
else
|
1204 |
else
|
| 1205 |
useradd -m nfsen
|
1205 |
useradd -m nfsen
|
| 1206 |
echo "User 'nfsen' created !"
|
1206 |
echo "User 'nfsen' created !"
|
| 1207 |
fi
|
1207 |
fi
|
| 1208 |
usermod -G www-data nfsen
|
1208 |
usermod -G www-data nfsen
|
| 1209 |
#Ajout du plugin nfsen : PortTracker
|
1209 |
#Ajout du plugin nfsen : PortTracker
|
| 1210 |
mkdir -p /var/www/nfsen/plugins
|
1210 |
mkdir -p /var/www/nfsen/plugins
|
| 1211 |
chown -R nfsen:www-data /var/www/nfsen
|
1211 |
chown -R nfsen:www-data /var/www/nfsen
|
| 1212 |
#Ajout du plugin PortTracker
|
1212 |
#Ajout du plugin PortTracker
|
| 1213 |
mkdir -p /var/log/netflow/porttracker
|
1213 |
mkdir -p /var/log/netflow/porttracker /usr/share/nfsen/plugins
|
| 1214 |
mkdir -p /usr/share/nfsen/plugins
|
- |
|
| 1215 |
chown -R apache:apache /usr/share/nfsen
|
1214 |
chown -R apache:apache /var/log/netflow/porttracker /usr/share/nfsen
|
| 1216 |
cp -f $DIR_CONF/nfsen/PortTracker.pm /tmp/nfsen-1.3.6p1/contrib/PortTracker/
|
1215 |
cp -f $DIR_CONF/nfsen/PortTracker.pm /tmp/nfsen-1.3.6p1/contrib/PortTracker/
|
| 1217 |
chown apache /var/log/netflow/porttracker
|
- |
|
| 1218 |
#Copie du fichier de conf modifié de nfsen
|
1216 |
#Copie du fichier de conf modifié de nfsen
|
| 1219 |
cp $DIR_CONF/nfsen/nfsen.conf /tmp/nfsen-1.3.6p1/etc/
|
1217 |
cp $DIR_CONF/nfsen/nfsen.conf /tmp/nfsen-1.3.6p1/etc/
|
| 1220 |
#Copie du script d'initialisation de nfsen
|
1218 |
#Copie du script d'initialisation de nfsen
|
| 1221 |
cp $DIR_CONF/nfsen/nfsen.service /lib/systemd/system/
|
1219 |
cp $DIR_CONF/nfsen/nfsen.service /lib/systemd/system/
|
| 1222 |
systemctl enable nfsen.service
|
- |
|
| 1223 |
#Installation de nfsen via le scrip Perl
|
1220 |
#Installation de nfsen via le scrip Perl
|
| 1224 |
DirTmp=$(pwd)
|
1221 |
DirTmp=$(pwd)
|
| 1225 |
cd /tmp/nfsen-1.3.6p1/
|
1222 |
cd /tmp/nfsen-1.3.6p1/
|
| 1226 |
/usr/bin/perl5 install.pl etc/nfsen.conf #script lancé deux fois pour corriger,
|
1223 |
/usr/bin/perl5 install.pl etc/nfsen.conf #script lancé deux fois pour corriger,
|
| 1227 |
/usr/bin/perl5 install.pl etc/nfsen.conf #un problème Perl : "Semaphore introuvable"
|
1224 |
/usr/bin/perl5 install.pl etc/nfsen.conf #un problème Perl : "Semaphore introuvable"
|
| 1228 |
#Création de la DB pour rrdtool
|
1225 |
#Création de la DB pour rrdtool
|
| 1229 |
cp /tmp/nfsen-1.3.6p1/contrib/PortTracker/PortTracker.pm /usr/share/nfsen/plugins/
|
1226 |
cp /tmp/nfsen-1.3.6p1/contrib/PortTracker/PortTracker.pm /usr/share/nfsen/plugins/
|
| 1230 |
cp /tmp/nfsen-1.3.6p1/contrib/PortTracker/PortTracker.php /var/www/nfsen/plugins/
|
1227 |
cp /tmp/nfsen-1.3.6p1/contrib/PortTracker/PortTracker.php /var/www/nfsen/plugins/
|
| 1231 |
sudo -u apache nftrack -I -d /var/log/netflow/porttracker
|
1228 |
sudo -u apache nftrack -I -d /var/log/netflow/porttracker
|
| 1232 |
chown -R apache:www-data /var/log/netflow/porttracker/
|
1229 |
chown -R apache:www-data /var/log/netflow/porttracker/
|
| 1233 |
chmod -R 775 /var/log/netflow/porttracker
|
1230 |
chmod -R 775 /var/log/netflow/porttracker
|
| 1234 |
#Configuration du fichier de conf d'apache
|
1231 |
#Configuration du fichier de conf d'apache
|
| 1235 |
if [ -f /etc/httpd/conf.d/nfsen.conf ];then
|
1232 |
if [ -f /etc/httpd/conf.d/nfsen.conf ];then
|
| 1236 |
rm -f /etc/httpd/conf.d/nfsen.conf
|
1233 |
rm -f /etc/httpd/conf.d/nfsen.conf
|
| 1237 |
fi
|
1234 |
fi
|
| 1238 |
cat <<EOF >> /etc/httpd/conf.d/nfsen.conf
|
1235 |
cat <<EOF >> /etc/httpd/conf.d/nfsen.conf
|
| 1239 |
Alias /nfsen /var/www/nfsen
|
1236 |
Alias /nfsen /var/www/nfsen
|
| 1240 |
<Directory /var/www/nfsen/>
|
1237 |
<Directory /var/www/nfsen/>
|
| 1241 |
DirectoryIndex nfsen.php
|
1238 |
DirectoryIndex nfsen.php
|
| 1242 |
Options -Indexes
|
1239 |
Options -Indexes
|
| 1243 |
AllowOverride all
|
1240 |
AllowOverride all
|
| Line 1247... |
Line 1244... |
| 1247 |
php_flag magic_quotes_gpc on
|
1244 |
php_flag magic_quotes_gpc on
|
| 1248 |
php_flag track_vars on
|
1245 |
php_flag track_vars on
|
| 1249 |
</Directory>
|
1246 |
</Directory>
|
| 1250 |
EOF
|
1247 |
EOF
|
| 1251 |
#Configuration du délais d'expiration des captures du profile "live"
|
1248 |
#Configuration du délais d'expiration des captures du profile "live"
|
| 1252 |
nfsen -m live -e 62d
|
1249 |
nfsen -m live -e 62d
|
| 1253 |
#Suppression des sources de nfsen
|
1250 |
#Suppression des sources de nfsen
|
| 1254 |
cd $DirTmp
|
1251 |
cd $DirTmp
|
| 1255 |
rm -rf /tmp/nfsen-1.3.6p1/
|
1252 |
rm -rf /tmp/nfsen-1.3.6p1/
|
| 1256 |
} # End of param_nfsen
|
1253 |
} # End of param_nfsen
|
| 1257 |
|
1254 |
|
| 1258 |
##########################################################
|
1255 |
##########################################################
|
| 1259 |
## Fonction param_dnsmasq ##
|
1256 |
## Fonction param_dnsmasq ##
|
| 1260 |
##########################################################
|
1257 |
##########################################################
|
| Line 1306... |
Line 1303... |
| 1306 |
server=$DNS1
|
1303 |
server=$DNS1
|
| 1307 |
server=$DNS2
|
1304 |
server=$DNS2
|
| 1308 |
EOF
|
1305 |
EOF
|
| 1309 |
|
1306 |
|
| 1310 |
# Init file modification
|
1307 |
# Init file modification
|
| 1311 |
[ -e /etc/init.d/dnsmasq.default ] || cp /etc/init.d/dnsmasq /etc/init.d/dnsmasq.default
|
1308 |
[ -e /etc/init.d/dnsmasq.default ] || cp /etc/init.d/dnsmasq /etc/init.d/dnsmasq.default
|
| 1312 |
# Start and stop a 2nd process for the "DNS blackhole"
|
1309 |
# Start and stop a 2nd process for the "DNS blackhole"
|
| 1313 |
cp -f $DIR_CONF/dnsmasq /etc/init.d/dnsmasq
|
1310 |
cp -f $DIR_CONF/dnsmasq /etc/init.d/dnsmasq
|
| 1314 |
# Start after chilli (65) which create tun0
|
1311 |
# Start after chilli (65) which create tun0
|
| 1315 |
$SED "s?^# chkconfig:.*?# chkconfig: 2345 99 40?g" /etc/init.d/dnsmasq
|
1312 |
$SED "s?^# chkconfig:.*?# chkconfig: 2345 99 40?g" /etc/init.d/dnsmasq
|
| 1316 |
# Optionnellement on pré-active les logs DNS des clients
|
1313 |
# Optionnellement on pré-active les logs DNS des clients
|
| 1317 |
[ -e /etc/sysconfig/dnsmasq.default ] || cp /etc/sysconfig/dnsmasq /etc/sysconfig/dnsmasq.default
|
1314 |
[ -e /etc/sysconfig/dnsmasq.default ] || cp /etc/sysconfig/dnsmasq /etc/sysconfig/dnsmasq.default
|
| 1318 |
$SED "s?log-facility?#OPTIONS=\"-q --log-facility=/var/log/dnsmasq/queries.log\"?g" /etc/sysconfig/dnsmasq
|
1315 |
$SED "s?log-facility?#OPTIONS=\"-q --log-facility=/var/log/dnsmasq/queries.log\"?g" /etc/sysconfig/dnsmasq
|
| 1319 |
# Optionnellement, exemple de paramètre supplémentaire pour le cache memoire
|
1316 |
# Optionnellement, exemple de paramètre supplémentaire pour le cache memoire
|
| 1320 |
echo '#OPTIONS="$OPTIONS --cache-size=250"' >> /etc/sysconfig/dnsmasq
|
1317 |
echo '#OPTIONS="$OPTIONS --cache-size=250"' >> /etc/sysconfig/dnsmasq
|
| 1321 |
# Optionnellement, exemple de configuration avec un A.D.
|
1318 |
# Optionnellement, exemple de configuration avec un A.D.
|
| 1322 |
echo '#OPTIONS="$OPTIONS --server=/your.domain/192.168.182.3"' >> /etc/sysconfig/dnsmasq
|
1319 |
echo '#OPTIONS="$OPTIONS --server=/your.domain/192.168.182.3"' >> /etc/sysconfig/dnsmasq
|
| 1323 |
} # End dnsmasq
|
1320 |
} # End dnsmasq
|
| 1324 |
|
1321 |
|
| 1325 |
##########################################################
|
1322 |
##########################################################
|
| 1326 |
## Fonction BL (BlackList) ##
|
1323 |
## Fonction BL (BlackList) ##
|
| 1327 |
##########################################################
|
1324 |
##########################################################
|
| Line 1534... |
Line 1531... |
| 1534 |
do
|
1531 |
do
|
| 1535 |
find /var/log/$dir -type f -name *.log-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9] -exec gzip {} \;
|
1532 |
find /var/log/$dir -type f -name *.log-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9] -exec gzip {} \;
|
| 1536 |
done
|
1533 |
done
|
| 1537 |
# export des logs en 'retard' dans /var/Save/logs
|
1534 |
# export des logs en 'retard' dans /var/Save/logs
|
| 1538 |
/usr/local/bin/alcasar-log.sh --export
|
1535 |
/usr/local/bin/alcasar-log.sh --export
|
| 1539 |
# processus lancés par défaut au démarrage
|
1536 |
# creation of the unit of alcasar-load_balancing
|
| 1540 |
for i in ntpd iptables ulogd dnsmasq squid chilli httpd radiusd netfs mysqld dansguardian havp freshclam nfsen
|
- |
|
| 1541 |
do
|
- |
|
| 1542 |
/sbin/chkconfig --add $i
|
- |
|
| 1543 |
done
|
- |
|
| 1544 |
|
- |
|
| 1545 |
cat << EOF > /lib/systemd/system/alcasar-load_balancing.service
|
1537 |
cat << EOF > /lib/systemd/system/alcasar-load_balancing.service
|
| 1546 |
# This file is part of systemd.
|
1538 |
# This file is part of systemd.
|
| 1547 |
#
|
1539 |
#
|
| 1548 |
# systemd is free software; you can redistribute it and/or modify it
|
1540 |
# systemd is free software; you can redistribute it and/or modify it
|
| 1549 |
# under the terms of the GNU General Public License as published by
|
1541 |
# under the terms of the GNU General Public License as published by
|
| 1550 |
# the Free Software Foundation; either version 2 of the License, or
|
1542 |
# the Free Software Foundation; either version 2 of the License, or
|
| Line 1564... |
Line 1556... |
| 1564 |
SysVStartPriority=99
|
1556 |
SysVStartPriority=99
|
| 1565 |
|
1557 |
|
| 1566 |
[Install]
|
1558 |
[Install]
|
| 1567 |
WantedBy=multi-user.target
|
1559 |
WantedBy=multi-user.target
|
| 1568 |
EOF
|
1560 |
EOF
|
| - |
|
1561 |
|
| - |
|
1562 |
# process launch at boot time
|
| - |
|
1563 |
for service in ntpd iptables ulogd dnsmasq squid chilli httpd radiusd netfs mysqld dansguardian havp freshclam
|
| - |
|
1564 |
do
|
| - |
|
1565 |
/sbin/chkconfig --add $service
|
| - |
|
1566 |
done
|
| 1569 |
systemctl enable alcasar-load_balancing.service
|
1567 |
for service in alcasar-load_balancing.service nfsen.service
|
| - |
|
1568 |
|
| - |
|
1569 |
do
|
| - |
|
1570 |
/bin/systemctl enable $service
|
| - |
|
1571 |
done
|
| 1570 |
|
1572 |
|
| 1571 |
# On applique les préconisations ANSSI
|
1573 |
# On applique les préconisations ANSSI
|
| 1572 |
# Apply French Security Agency rules
|
1574 |
# Apply French Security Agency rules
|
| 1573 |
# ignorer les broadcast ICMP. (attaque smurf)
|
1575 |
# ignorer les broadcast ICMP. (attaque smurf)
|
| 1574 |
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
|
1576 |
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
|
| 1575 |
# ignorer les erreurs ICMP bogus
|
1577 |
# ignorer les erreurs ICMP bogus
|
| 1576 |
sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
|
1578 |
sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
|
| 1577 |
# désactiver l'envoi et la réponse aux ICMP redirects
|
1579 |
# désactiver l'envoi et la réponse aux ICMP redirects
|
| 1578 |
sysctl -w net.ipv4.conf.all.accept_redirects=0
|
1580 |
sysctl -w net.ipv4.conf.all.accept_redirects=0
|
| 1579 |
accept_redirect=`grep accept_redirect /etc/sysctl.conf|wc -l`
|
1581 |
accept_redirect=`grep accept_redirect /etc/sysctl.conf|wc -l`
|
| 1580 |
if [ "$accept_redirect" == "0" ]
|
1582 |
if [ "$accept_redirect" == "0" ]
|
| 1581 |
then
|
1583 |
then
|
| 1582 |
echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.conf
|
1584 |
echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.conf
|
| 1583 |
else
|
1585 |
else
|
| 1584 |
$SED "s?accept_redirects.*?accept_redirects = 0?g" /etc/sysctl.conf
|
1586 |
$SED "s?accept_redirects.*?accept_redirects = 0?g" /etc/sysctl.conf
|