Subversion Repositories ALCASAR

Rev

Rev 1361 | Rev 1363 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 1361 Rev 1362
Line 1... Line 1...
1 
 
 1 
 
2 
#!/bin/bash
 2 
#!/bin/bash
3 
#  $Id: alcasar.sh 1361 2014-05-25 22:08:44Z richard $
3 
#  $Id: alcasar.sh 1362 2014-05-26 17:12:54Z richard $
4 
 
 4 
 
5 
# alcasar.sh
 5 
# alcasar.sh
6 
 
 6 
 
7 
# ALCASAR Install script -  CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...]
7 
# ALCASAR Install script -  CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...]
8 
# Ce programme est un logiciel libre ; This software is free and open source
 8 
# Ce programme est un logiciel libre ; This software is free and open source
Line 48... Line 48...
48 
#	gammu_smsd			: Autoregister addon (gammu-smsd)
 48 
#	gammu_smsd			: Autoregister addon (gammu-smsd)
49 
 
 49 
 
50 
DATE=`date '+%d %B %Y - %Hh%M'`
 50 
DATE=`date '+%d %B %Y - %Hh%M'`
51 
DATE_SHORT=`date '+%d/%m/%Y'`
 51 
DATE_SHORT=`date '+%d/%m/%Y'`
52 
Lang=`echo $LANG|cut -c 1-2`
 52 
Lang=`echo $LANG|cut -c 1-2`
- 
 
 53 
mode="install"
53 
# ******* Files parameters - paramètres fichiers *********
 54 
# ******* Files parameters - paramètres fichiers *********
54 
DIR_INSTALL=`pwd`				# current directory
55 
DIR_INSTALL=`pwd`				# current directory
55 
DIR_CONF="$DIR_INSTALL/conf"			# install directory (with conf files)
 56 
DIR_CONF="$DIR_INSTALL/conf"			# install directory (with conf files)
56 
DIR_SCRIPTS="$DIR_INSTALL/scripts"		# install directory (with script files)
 57 
DIR_SCRIPTS="$DIR_INSTALL/scripts"		# install directory (with script files)
57 
DIR_SAVE="/var/Save"				# backup directory (system_backup, user_db_backup, logs)
 58 
DIR_SAVE="/var/Save"				# backup directory (system_backup, user_db_backup, logs)
Line 106... Line 107...
106 
## - Test of free space on /var  (>10G)				##
 107 
## - Test of free space on /var  (>10G)				##
107 
## - Test of Internet access					##
 108 
## - Test of Internet access					##
108 
##################################################################
 109 
##################################################################
109 
testing ()
 110 
testing ()
110 
{
 111 
{
111 
	free_space=`df -BG --output=avail /var|tail -1|tr -d [:space:]G`
 112 
# Test if ALCASAR is already installed
112 
	if [ $free_space -lt 10 ]
 113 
	if [ -e $CONF_FILE ]
113 
		then
 114 
	then
- 
 
 115 
		current_version=`cat $CONF_FILE | grep VERSION | cut -d"=" -f2`
114 
		if [ $Lang == "fr" ]
 116 
		if [ $Lang == "fr" ]
115 
			then echo "place disponible sur /var insufisante ($free_space Go au lieu de 10 Go au minimum)"
 117 
			then echo -n "La version "; echo -n $current_version ; echo " d'ALCASAR est déjà installée";
116 
			else echo "not enough free space on /var ($free_space GB instead of at least 10 GB)"
 118 
			else echo -n "ALCASAR Version "; echo -n $current_version ; echo " is already installed";
- 
 
 119 
		fi
- 
 
 120 
		response=0
- 
 
 121 
		PTN='^[oOnNyY]$'
- 
 
 122 
		until [[ $(expr $response : $PTN) -gt 0 ]]
- 
 
 123 
		do
- 
 
 124 
			if [ $Lang == "fr" ]
- 
 
 125 
				then echo -n "Voulez-vous effectuer une mise à jour (O/n)? ";
- 
 
 126 
				else echo -n "Do you want to update (Y/n)?";
- 
 
 127 
			 fi
- 
 
 128 
			read response
- 
 
 129 
		done
- 
 
 130 
		if [ "$response" = "n" ] || [ "$response" = "N" ]
- 
 
 131 
		then
- 
 
 132 
			rm -f /tmp/alcasar-conf*
- 
 
 133 
		else
- 
 
 134 
# Create a backup of running version importants files
- 
 
 135 
			$DIR_SCRIPTS/alcasar-conf.sh --create
- 
 
 136 
			mode="update"
117 
		fi
 137 
		fi
- 
 
 138 
	else
- 
 
 139 
		free_space=`df -BG --output=avail /var|tail -1|tr -d [:space:]G`
- 
 
 140 
		if [ $free_space -lt 10 ]
- 
 
 141 
		then
- 
 
 142 
			if [ $Lang == "fr" ]
- 
 
 143 
				then echo "place disponible sur /var insufisante ($free_space Go au lieu de 10 Go au minimum)"
- 
 
 144 
				else echo "not enough free space on /var ($free_space GB instead of at least 10 GB)"
- 
 
 145 
			fi
118 
		exit 0
 146 
		exit 0
- 
 
 147 
		fi
119 
	fi
 148 
	fi
120 
if [ $Lang == "fr" ]
 149 
if [ $Lang == "fr" ]
121 
		then echo -n "Tests des paramètres réseau : "
 150 
		then echo -n "Tests des paramètres réseau : "
122 
		else echo -n "Network parameters tests : "
 151 
		else echo -n "Network parameters tests : "
123 
	fi
 152 
	fi
124 
# We test gw
 - 
 
125 
	if [ "$EXTIF" == "" ]
 - 
 
126 
		then
 - 
 
127 
		if [ $Lang == "fr" ]
 - 
 
128 
			then
 - 
 
129 
			echo "L'adresse du routeur n'est pas configuré"
 - 
 
130 
		else
 - 
 
131 
			echo "The gateway address isn't set"
 - 
 
132 
		fi
 - 
 
133 
		exit 0
 - 
 
134 
	fi
 - 
 
135 
# We test EXTIF config files
 153 
# We test EXTIF config files
136 
	PUBLIC_IP=`grep IPADDR /etc/sysconfig/network-scripts/ifcfg-$EXTIF|cut -d"=" -f2`
 154 
	PUBLIC_IP=`grep IPADDR /etc/sysconfig/network-scripts/ifcfg-$EXTIF|cut -d"=" -f2`
137 
	PUBLIC_GATEWAY=`grep GATEWAY /etc/sysconfig/network-scripts/ifcfg-$EXTIF|cut -d"=" -f2`
 155 
	PUBLIC_GATEWAY=`grep GATEWAY /etc/sysconfig/network-scripts/ifcfg-$EXTIF|cut -d"=" -f2`
138 
	if [ `echo $PUBLIC_IP|wc -c` -lt 7 ] || [ `echo $PUBLIC_GATEWAY|wc -c` -lt 7 ]
 156 
	if [ "$EXTIF" == "" ] || [ `echo $PUBLIC_IP|wc -c` -lt 7 ] || [ `echo $PUBLIC_GATEWAY|wc -c` -lt 7 ]
139 
		then
 157 
		then
140 
		if [ $Lang == "fr" ]
 158 
		if [ $Lang == "fr" ]
141 
		then
159 
		then
142 
			echo "Échec"
 160 
			echo "Échec"
143 
			echo "La carte réseau connectée à Internet ($EXTIF) n'est pas correctement configurée."
 161 
			echo "La carte réseau connectée à Internet ($EXTIF) n'est pas correctement configurée."
144 
			echo "Renseignez les champs suivants dans le fichier '/etc/sysconfig/network-scripts/ifcfg-$EXTIF' :"
 162 
			echo "Renseignez les champs suivants dans le fichier '/etc/sysconfig/network-scripts/ifcfg-$EXTIF' :"
145 
			echo "Appliquez les changements : 'service network restart'"
 163 
			echo "Appliquez les changements : 'systemctl restart network'"
146 
		else
 164 
		else
147 
			echo "Failed"
 165 
			echo "Failed"
148 
			echo "The Internet connected network card ($EXTIF) isn't well configured."
 166 
			echo "The Internet connected network card ($EXTIF) isn't well configured."
149 
			echo "The folowing parametres must be set in the file '/etc/sysconfig/network-scripts/ifcfg-$EXTIF' :"
 167 
			echo "The folowing parametres must be set in the file '/etc/sysconfig/network-scripts/ifcfg-$EXTIF' :"
150 
			echo "Apply the new configuration 'service network restart'"
 168 
			echo "Apply the new configuration 'systemctl restart network'"
151 
		fi
 169 
		fi
152 
		echo "DEVICE=$EXTIF"
 170 
		echo "DEVICE=$EXTIF"
153 
		echo "IPADDR="
 171 
		echo "IPADDR="
154 
		echo "NETMASK="
 172 
		echo "NETMASK="
155 
		echo "GATEWAY="
 173 
		echo "GATEWAY="
Line 1524... Line 1542...
1524 
 
 1542 
 
1525 
	do
 1543 
	do
1526 
		systemctl -q enable $i
 1544 
		systemctl -q enable $i
1527 
	done
 1545 
	done
1528 
# Apply French Security Agency (ANSSI) rules
 1546 
# Apply French Security Agency (ANSSI) rules
1529 
# ignorer les broadcast ICMP. (attaque smurf)
1547 
# ignore ICMP broadcast (smurf attack)
1530 
	sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
 1548 
	echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" > /etc/sysctl.d/alcasar.conf
1531 
# ignorer les erreurs ICMP bogus
 1549 
# ignore ICMP errors bogus
1532 
	sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
 1550 
	echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" >> /etc/sysctl.d/alcasar.conf
1533 
# désactiver l'envoi et la réponse aux ICMP redirects
 - 
 
1534 
	sysctl -w net.ipv4.conf.all.accept_redirects=0
 - 
 
1535 
	accept_redirect=`grep accept_redirect /etc/sysctl.conf|wc -l`
 - 
 
1536 
	if [ "$accept_redirect" == "0" ]
 1551 
# remove ICMP redirects responces
1537 
	then
 - 
 
1538 
		echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.d/alcasar.conf
 1552 
	echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.d/alcasar.conf
1539 
	else
 - 
 
1540 
		$SED "s?accept_redirects.*?accept_redirects = 0?g" /etc/sysctl.conf
 - 
 
1541 
	fi
 - 
 
1542 
	sysctl -w net.ipv4.conf.all.send_redirects=0
 - 
 
1543 
	send_redirect=`grep send_redirect /etc/sysctl.conf|wc -l`
 - 
 
1544 
	if [ "$send_redirect" == "0" ]
 - 
 
1545 
	then
 - 
 
1546 
		echo "net.ipv4.conf.all.send_redirects = 0" >> /etc/sysctl.conf
 1553 
	echo "net.ipv4.conf.all.send_redirects = 0" >> /etc/sysctl.d/alcasar.conf
1547 
	else
 - 
 
1548 
		$SED "s?send_redirects.*?send_redirects = 0?g" /etc/sysctl.conf
 - 
 
1549 
	fi
 - 
 
1550 
# activer les SYN Cookies (attaque syn flood)
 1554 
# enable SYN Cookies (Syn flood attacks)
1551 
	sysctl -w net.ipv4.tcp_syncookies=1
 - 
 
1552 
	tcp_syncookies=`grep tcp_syncookies /etc/sysctl.conf|wc -l`
 - 
 
1553 
	if [ "$tcp_syncookies" == "0" ]
 - 
 
1554 
	then
 - 
 
1555 
		echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf
 1555 
	echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.d/alcasar.conf
1556 
	else
 - 
 
1557 
		$SED "s?tcp_syncookies.*?tcp_syncookies = 1?g" /etc/sysctl.conf
 - 
 
1558 
	fi
 - 
 
1559 
# activer l'antispoofing niveau Noyau
 1556 
# enable kernel antispoofing
1560 
	sysctl -w net.ipv4.conf.all.rp_filter=1
 1557 
	echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.d/alcasar.conf
1561 
# ignorer le source routing
 1558 
# ignore source routing
1562 
	sysctl -w net.ipv4.conf.all.accept_source_route=0
 - 
 
1563 
	 accept_source_route=`grep accept_source_route /etc/sysctl.conf|wc -l`
 - 
 
1564 
	if [ "$accept_source_route" == "0" ]
 - 
 
1565 
	then
 - 
 
1566 
		echo "net.ipv4.conf.all.accept_source_route = 0" >> /etc/sysctl.conf
 1559 
	echo "net.ipv4.conf.all.accept_source_route = 0" >> /etc/sysctl.d/alcasar.conf
1567 
	else
 - 
 
1568 
		$SED "s?accept_source_route.*?accept_source_route = 0?g" /etc/sysctl.conf
 - 
 
1569 
	fi
 - 
 
1570 
# réglage du timer de maintien de suivi de session à 1h (3600s) au lieu de 5 semaines
 1560 
# set conntrack timer to 1h (3600s) instead of 5 weeks
1571 
	sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=3600
 - 
 
1572 
	timeout_established=`grep timeout_established /etc/sysctl.conf|wc -l`
 - 
 
1573 
	if [ "$timeout_established" == "0" ]
 - 
 
1574 
	then
 - 
 
1575 
		echo "net.netfilter.nf_conntrack_tcp_timeout_established = 3600" >> /etc/sysctl.conf
 1561 
	echo "net.netfilter.nf_conntrack_tcp_timeout_established = 3600" >> /etc/sysctl.d/alcasar.conf
1576 
	else
 - 
 
1577 
		$SED "s?timeout_established.*?timeout_established = 3600?g" /etc/sysctl.conf
 - 
 
1578 
	fi
 - 
 
1579 
# disable log_martians (ALCASAR is often installed between two private network addresses)
1562 
# disable log_martians (ALCASAR is often installed between two private network addresses)
1580 
	sysctl -w net.ipv4.conf.all.log_martians=0
 1563 
	echo "net.ipv4.conf.all.log_martians = 0" >> etc/sysctl.d/alcasar.conf
1581 
# On supprime la gestion du <CTRL>+<ALT>+<SUPPR> et des Magic SysReq Keys
 1564 
# remove Magic SysReq Keys
1582 
# ???	$SED "s?^ALLOW_REBOOT=.*?ALLOW_REBOOT=no?g" /etc/security/msec/level.fileserver
 1565 
	[ -e /etc/sysctl.d/51-alt-sysrq.conf ] && rm /etc/sysctl.d/51-alt-sysrq.con
1583 
# switch to multi-users runlevel (instead of x11)
 1566 
# switch to multi-users runlevel (instead of x11)
1584 
	ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
 1567 
	ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
1585 
#	GRUB modifications
 1568 
#	GRUB modifications
1586 
# limit wait time to 3s
 1569 
# limit wait time to 3s
1587 
# create an alcasar entry instead of linux-nonfb
 1570 
# create an alcasar entry instead of linux-nonfb
Line 1591... Line 1574...
1591 
	$SED "/^kernel/s/splash quiet //" /boot/grub/menu.lst
 1574 
	$SED "/^kernel/s/splash quiet //" /boot/grub/menu.lst
1592 
	$SED "/^kernel/s/vga=.*/vga=791 nomodeset/" /boot/grub/menu.lst
 1575 
	$SED "/^kernel/s/vga=.*/vga=791 nomodeset/" /boot/grub/menu.lst
1593 
	$SED "/^kernel/s/BOOT_IMAGE=linux /BOOT_IMAGE=linux-nonfb /" /boot/grub/menu.lst
 1576 
	$SED "/^kernel/s/BOOT_IMAGE=linux /BOOT_IMAGE=linux-nonfb /" /boot/grub/menu.lst
1594 
	$SED "/^gfxmenu/d" /boot/grub/menu.lst
 1577 
	$SED "/^gfxmenu/d" /boot/grub/menu.lst
1595 
# Remove unused services and users
 1578 
# Remove unused services and users
1596 
	for old_svc in alsa sound dm
 - 
 
1597 
	do
 - 
 
1598 
		/sbin/chkconfig --del $old_svc
 - 
 
1599 
	done
 - 
 
1600 
	for svc in snmpd.service sshd.service
 1579 
	for svc in sshd.service
1601 
	do
 1580 
	do
1602 
		/bin/systemctl disable $svc
 1581 
		/bin/systemctl -q disable $svc
1603 
	done
 1582 
	done
1604 
	for rm_users in avahi-autoipd avahi icapd
 1583 
	for rm_users in sysqdin
1605 
	do
 1584 
	do
1606 
		user=`cat /etc/passwd|grep $rm_users|cut -d":" -f1`
 1585 
		user=`cat /etc/passwd|grep $rm_users|cut -d":" -f1`
1607 
		if [ "$user" == "$rm_users" ]
 1586 
		if [ "$user" == "$rm_users" ]
1608 
		then
 1587 
		then
1609 
			/usr/sbin/userdel -f $rm_users
 1588 
			/usr/sbin/userdel -f $rm_users
Line 1789... Line 1768...
1789 
		;;
 1768 
		;;
1790 
	-i | --install)
 1769 
	-i | --install)
1791 
		license
 1770 
		license
1792 
		header_install
 1771 
		header_install
1793 
		testing
 1772 
		testing
1794 
# Test if ALCASAR is already installed
 - 
 
1795 
		if [ -e $CONF_FILE ]
 - 
 
1796 
		then
 - 
 
1797 
			current_version=`cat $CONF_FILE | grep VERSION | cut -d"=" -f2`
 - 
 
1798 
			if [ $Lang == "fr" ]
 - 
 
1799 
				then echo -n "La version "; echo -n $current_version ; echo " d'ALCASAR est déjà installée";
 - 
 
1800 
				else echo -n "ALCASAR Version "; echo -n $current_version ; echo " is already installed";
 - 
 
1801 
			fi
 - 
 
1802 
			response=0
 - 
 
1803 
			PTN='^[oOnNyY]$'
 - 
 
1804 
			until [[ $(expr $response : $PTN) -gt 0 ]]
 - 
 
1805 
			do
 - 
 
1806 
				if [ $Lang == "fr" ]
 - 
 
1807 
					then echo -n "Voulez-vous effectuer une mise à jour (O/n)? ";
 - 
 
1808 
					else echo -n "Do you want to update (Y/n)?";
 - 
 
1809 
				 fi
 - 
 
1810 
				read response
 - 
 
1811 
			done
 - 
 
1812 
			if [ "$response" = "n" ] || [ "$response" = "N" ]
- 
 
1813 
			then
 - 
 
1814 
				rm -f /tmp/alcasar-conf*
 - 
 
1815 
			else
 - 
 
1816 
# Create a backup of running version importants files
 - 
 
1817 
				$DIR_SCRIPTS/alcasar-conf.sh --create
 - 
 
1818 
				mode="update"
 - 
 
1819 
			fi
 - 
 
1820 
		fi
 - 
 
1821 
# RPMs install
 1773 
# RPMs install
1822 
		$DIR_SCRIPTS/alcasar-urpmi.sh
 1774 
		$DIR_SCRIPTS/alcasar-urpmi.sh
1823 
		if [ "$?" != "0" ]
 1775 
		if [ "$?" != "0" ]
1824 
		then
 1776 
		then
1825 
			exit 0
 1777 
			exit 0
Line 1828... Line 1780...
1828 
		then
 1780 
		then
1829 
# Uninstall the running version
 1781 
# Uninstall the running version
1830 
			$DIR_SCRIPTS/sbin/alcasar-uninstall.sh
 1782 
			$DIR_SCRIPTS/sbin/alcasar-uninstall.sh
1831 
		fi
 1783 
		fi
1832 
# Test if manual update
1784 
# Test if manual update
1833 
		if [ -e /tmp/alcasar-conf*.tar.gz ] && [ "$mode" != "update" ]
 1785 
		if [ -e /tmp/alcasar-conf*.tar.gz ] && [ "$mode" == "install" ]
1834 
		then
 1786 
		then
1835 
			header_install
 1787 
			header_install
1836 
			if [ $Lang == "fr" ]
 1788 
			if [ $Lang == "fr" ]
1837 
				then echo "Le fichier de configuration d'une ancienne version a été trouvé";
 1789 
				then echo "Le fichier de configuration d'une ancienne version a été trouvé";
1838 
				else echo "The configuration file of an old version has been found";
 1790 
				else echo "The configuration file of an old version has been found";
Line 1864... Line 1816...
1864 
			PREVIOUS_VERSION=`grep VERSION conf/etc/alcasar.conf|cut -d"=" -f2`
 1816 
			PREVIOUS_VERSION=`grep VERSION conf/etc/alcasar.conf|cut -d"=" -f2`
1865 
			MAJ_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f1`
 1817 
			MAJ_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f1`
1866 
			MIN_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f2|cut -c1`
 1818 
			MIN_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f2|cut -c1`
1867 
			UPD_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f3`
 1819 
			UPD_PREVIOUS_VERSION=`echo $PREVIOUS_VERSION|cut -d"." -f3`
1868 
			mode="update"
 1820 
			mode="update"
1869 
		else
 - 
 
1870 
			mode="install"
 - 
 
1871 
		fi
 1821 
		fi
1872 
		for func in init network ACC CA init_db param_radius param_web_radius param_chilli param_dansguardian antivirus param_ulogd param_nfsen param_dnsmasq BL cron fail2ban post_install
 1822 
		for func in init network ACC CA init_db param_radius param_web_radius param_chilli param_dansguardian antivirus param_ulogd param_nfsen param_dnsmasq BL cron fail2ban post_install
1873 
		do
 1823 
		do
1874 
			$func
 1824 
			$func
1875 
echo "*** 'debug' : end of function $func ***"; read a
 1825 
# echo "*** 'debug' : end of function $func ***"; read a
1876 
		done
 1826 
		done
1877 
		;;
 1827 
		;;
1878 
	-u | --uninstall)
 1828 
	-u | --uninstall)
1879 
		if [ ! -e $DIR_DEST_SBIN/alcasar-uninstall.sh ]
 1829 
		if [ ! -e $DIR_DEST_SBIN/alcasar-uninstall.sh ]
1880 
		then
 1830 
		then