Subversion Repositories ALCASAR

Rev

Rev 1471 | Rev 1474 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 1471 Rev 1472
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/bash
2 
#  $Id: alcasar.sh 1471 2014-10-31 17:46:11Z richard $
2 
#  $Id: alcasar.sh 1472 2014-11-03 17:56:00Z richard $
3 
 
 3 
 
4 
# alcasar.sh
 4 
# alcasar.sh
5 
 
 5 
 
6 
# ALCASAR Install script -  CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...]
6 
# ALCASAR Install script -  CopyLeft ALCASAR Team [Rexy + 3abtux + Steweb + Crox + ...]
7 
# Ce programme est un logiciel libre ; This software is free and open source
 7 
# Ce programme est un logiciel libre ; This software is free and open source
Line 1400... Line 1400...
1400 
{
 1400 
{
1401 
	[ -d /var/log/dnsmasq ] || mkdir /var/log/dnsmasq
 1401 
	[ -d /var/log/dnsmasq ] || mkdir /var/log/dnsmasq
1402 
	[ -e /etc/sysconfig/dnsmasq.default ] || cp /etc/sysconfig/dnsmasq /etc/sysconfig/dnsmasq.default
 1402 
	[ -e /etc/sysconfig/dnsmasq.default ] || cp /etc/sysconfig/dnsmasq /etc/sysconfig/dnsmasq.default
1403 
	$SED "s?^OPTION=.*?OPTION=-C /etc/dnsmasq.conf?g" /etc/sysconfig/dnsmasq # default conf file for the first dnsmasq instance
 1403 
	$SED "s?^OPTION=.*?OPTION=-C /etc/dnsmasq.conf?g" /etc/sysconfig/dnsmasq # default conf file for the first dnsmasq instance
1404 
	[ -e /etc/dnsmasq.conf.default ] || cp /etc/dnsmasq.conf /etc/dnsmasq.conf.default
 1404 
	[ -e /etc/dnsmasq.conf.default ] || cp /etc/dnsmasq.conf /etc/dnsmasq.conf.default
1405 
# 1st dnsmasq listen on udp 53 ("dnsmasq - forward"). It's used as dhcp server only if bypass is on.
 1405 
# 1st dnsmasq listen on udp 53 ("dnsmasq - forward"). It's used as dhcp server only if "alcasar-bypass" is on.
1406 
	cat << EOF > /etc/dnsmasq.conf
1406 
	cat << EOF > /etc/dnsmasq.conf
1407 
# Configuration file for "dnsmasq in forward mode"
 1407 
# Configuration file for "dnsmasq in forward mode"
1408 
conf-file=$DIR_DEST_ETC/alcasar-dns-name	# local DNS resolutions
 1408 
conf-file=$DIR_DEST_ETC/alcasar-dns-name	# local DNS resolutions
1409 
listen-address=$PRIVATE_IP
 1409 
listen-address=$PRIVATE_IP
1410 
pid-file=/var/run/dnsmasq.pid
 1410 
pid-file=/var/run/dnsmasq.pid
Line 1431... Line 1431...
1431 
EOF
 1431 
EOF
1432 
# 2nd dnsmasq listen on udp 54 ("dnsmasq with blacklist")
 1432 
# 2nd dnsmasq listen on udp 54 ("dnsmasq with blacklist")
1433 
	cat << EOF > /etc/dnsmasq-blacklist.conf
1433 
	cat << EOF > /etc/dnsmasq-blacklist.conf
1434 
# Configuration file for "dnsmasq with blacklist"
 1434 
# Configuration file for "dnsmasq with blacklist"
1435 
# Add Toulouse blacklist domains
 1435 
# Add Toulouse blacklist domains
1436 
conf-dir=$DIR_DEST_SHARE/dnsmasq-bl-enabled
 - 
 
1437 
conf-file=$DIR_DEST_ETC/alcasar-dns-name	# local DNS resolutions
 1436 
conf-file=$DIR_DEST_ETC/alcasar-dns-name	# local DNS resolutions
- 
 
 1437 
conf-dir=$DIR_DEST_SHARE/dnsmasq-bl-enabled
1438 
pid-file=/var/run/dnsmasq-blacklist.pid
 1438 
pid-file=/var/run/dnsmasq-blacklist.pid
1439 
listen-address=$PRIVATE_IP
 1439 
listen-address=$PRIVATE_IP
1440 
port=54
 1440 
port=54
1441 
no-dhcp-interface=$INTIF
 1441 
no-dhcp-interface=$INTIF
1442 
no-dhcp-interface=tun0
 1442 
no-dhcp-interface=tun0
- 
 
 1443 
no-dhcp-interface=lo
1443 
bind-interfaces
 1444 
bind-interfaces
1444 
cache-size=256
 1445 
cache-size=256
1445 
domain=$DOMAIN
 1446 
domain=$DOMAIN
1446 
domain-needed
 1447 
domain-needed
1447 
expand-hosts
 1448 
expand-hosts
Line 1452... Line 1453...
1452 
EOF
 1453 
EOF
1453 
# 3rd dnsmasq listen on udp 55 ("dnsmasq with whitelist")
 1454 
# 3rd dnsmasq listen on udp 55 ("dnsmasq with whitelist")
1454 
	cat << EOF > /etc/dnsmasq-whitelist.conf
1455 
	cat << EOF > /etc/dnsmasq-whitelist.conf
1455 
# Configuration file for "dnsmasq with whitelist"
 1456 
# Configuration file for "dnsmasq with whitelist"
1456 
# Inclusion de la whitelist <domains> de Toulouse dans la configuration
 1457 
# Inclusion de la whitelist <domains> de Toulouse dans la configuration
- 
 
 1458 
conf-file=$DIR_DEST_ETC/alcasar-dns-name	# local DNS resolutions
1457 
conf-dir=$DIR_DEST_SHARE/dnsmasq-wl-enabled
 1459 
conf-dir=$DIR_DEST_SHARE/dnsmasq-wl-enabled
1458 
conf-file=$DIR_DEST_ETC/alcasar-dns-name	# zone de definition de noms DNS locaux
 - 
 
1459 
listen-address=$PRIVATE_IP
 - 
 
1460 
pid-file=/var/run/dnsmasq-whitelist.pid
 1460 
pid-file=/var/run/dnsmasq-whitelist.pid
- 
 
 1461 
listen-address=$PRIVATE_IP
1461 
port=55
 1462 
port=55
1462 
no-dhcp-interface=$INTIF
 1463 
no-dhcp-interface=$INTIF
1463 
no-dhcp-interface=tun0
 1464 
no-dhcp-interface=tun0
- 
 
 1465 
no-dhcp-interface=lo
1464 
bind-interfaces
 1466 
bind-interfaces
1465 
cache-size=256
 1467 
cache-size=256
1466 
domain=$DOMAIN
 1468 
domain=$DOMAIN
1467 
domain-needed
 1469 
domain-needed
1468 
expand-hosts
 1470 
expand-hosts
1469 
bogus-priv
 1471 
bogus-priv
1470 
filterwin2k
 1472 
filterwin2k
1471 
address=/#/$PRIVATE_IP
 1473 
address=/#/$PRIVATE_IP				# for Domain name without local resolution (WL)
1472 
ipset=/#/whitelist_ip_allowed
 1474 
ipset=/#/whitelist_ip_allowed			# dynamicly add the resolv IP address in the Firewall rules
1473 
EOF
 1475 
EOF
- 
 
 1476 
# 4th dnsmasq listen on udp 56 ("blackhole")
- 
 
 1477 
	cat << EOF > /etc/dnsmasq-blackhole.conf
- 
 
 1478 
# Configuration file for "dnsmasq as a blackhole"
- 
 
 1479 
conf-file=$DIR_DEST_ETC/alcasar-dns-name	# local DNS resolutions
- 
 
 1480 
address=/#/$PRIVATE_IP				# redirect all on ALCASAR IP address
- 
 
 1481 
pid-file=/var/run/dnsmasq-blackhole.pid
- 
 
 1482 
listen-address=$PRIVATE_IP
- 
 
 1483 
port=56
- 
 
 1484 
no-dhcp-interface=$INTIF
- 
 
 1485 
no-dhcp-interface=tun0
- 
 
 1486 
no-dhcp-interface=lo
- 
 
 1487 
bind-interfaces
- 
 
 1488 
cache-size=256
- 
 
 1489 
domain=$DOMAIN
- 
 
 1490 
domain-needed
- 
 
 1491 
expand-hosts
- 
 
 1492 
bogus-priv
- 
 
 1493 
filterwin2k
- 
 
 1494 
EOF
- 
 
 1495 
 
1474 
# Start after chilli (which create tun0)
 1496 
# Start after chilli (which create tun0)
1475 
	$SED "s?^After=.*?After=syslog.target network.target chilli.service?g" /lib/systemd/system/dnsmasq.service
 1497 
	$SED "s?^After=.*?After=syslog.target network.target chilli.service?g" /lib/systemd/system/dnsmasq.service
1476 
# Create dnsmasq-blacklist and dnsmasq-whitelist unit
 1498 
# Create dnsmasq-blacklist and dnsmasq-whitelist unit
1477 
	cp -f /lib/systemd/system/dnsmasq.service /lib/systemd/system/dnsmasq-blacklist.service
 - 
 
1478 
	cp -f /lib/systemd/system/dnsmasq.service /lib/systemd/system/dnsmasq-whitelist.service
 1499 
	cp -f /lib/systemd/system/dnsmasq.service /lib/systemd/system/dnsmasq-blacklist.service /lib/systemd/system/dnsmasq-whitelist.service /lib/systemd/system/dnsmasq-blackhole.service
1479 
	$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dnsmasq -C /etc/dnsmasq-blacklist.conf?g" /lib/systemd/system/dnsmasq-blacklist.service
 1500 
	$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dnsmasq -C /etc/dnsmasq-blacklist.conf?g" /lib/systemd/system/dnsmasq-blacklist.service
1480 
	$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dnsmasq -C /etc/dnsmasq-whitelist.conf?g" /lib/systemd/system/dnsmasq-whitelist.service
 1501 
	$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dnsmasq -C /etc/dnsmasq-whitelist.conf?g" /lib/systemd/system/dnsmasq-whitelist.service
- 
 
 1502 
	$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/dnsmasq -C /etc/dnsmasq-blackhole.conf?g" /lib/systemd/system/dnsmasq-blackhole.service
1481 
	$SED "s?^PIDFile=.*?PIDFile=/var/run/dnsmasq-blacklist.pid?g" /lib/systemd/system/dnsmasq-blacklist.service
 1503 
	$SED "s?^PIDFile=.*?PIDFile=/var/run/dnsmasq-blacklist.pid?g" /lib/systemd/system/dnsmasq-blacklist.service
1482 
	$SED "s?^PIDFile=.*?PIDFile=/var/run/dnsmasq-whitelist.pid?g" /lib/systemd/system/dnsmasq-whitelist.service
 1504 
	$SED "s?^PIDFile=.*?PIDFile=/var/run/dnsmasq-whitelist.pid?g" /lib/systemd/system/dnsmasq-whitelist.service
- 
 
 1505 
	$SED "s?^PIDFile=.*?PIDFile=/var/run/dnsmasq-blackhole.pid?g" /lib/systemd/system/dnsmasq-blackhole.service
1483 
} # End dnsmasq
 1506 
} # End dnsmasq
1484 
 
 1507 
 
1485 
##########################################################
 1508 
##########################################################
1486 
##		Fonction "BL"				##
 1509 
##		Fonction "BL"				##
1487 
##########################################################
 1510 
##########################################################
Line 1790... Line 1813...
1790 
	for i in havp
1813 
	for i in havp
1791 
	do
 1814 
	do
1792 
		/sbin/chkconfig --add $i
 1815 
		/sbin/chkconfig --add $i
1793 
	done
 1816 
	done
1794 
# processes launched at boot time (Systemctl)
 1817 
# processes launched at boot time (Systemctl)
1795 
	for i in alcasar-load_balancing mysqld httpd ntpd iptables dnsmasq dnsmasq-blacklist dnsmasq-whitelist radiusd nfsen dansguardian freshclam ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban
 1818 
	for i in alcasar-load_balancing mysqld httpd ntpd iptables dnsmasq dnsmasq-blacklist dnsmasq-whitelist dnsmasq-blackhole radiusd nfsen dansguardian freshclam ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban
1796 
	do
 1819 
	do
1797 
		systemctl -q enable $i.service
 1820 
		systemctl -q enable $i.service
1798 
	done
 1821 
	done
1799
1822
1800 
# disable processes at boot time (Systemctl)
 1823 
# disable processes at boot time (Systemctl)
Line 1838... Line 1861...
1838 
# Remove unused services and users
 1861 
# Remove unused services and users
1839 
	for svc in sshd.service
 1862 
	for svc in sshd.service
1840 
	do
 1863 
	do
1841 
		/bin/systemctl -q disable $svc
 1864 
		/bin/systemctl -q disable $svc
1842 
	done
 1865 
	done
1843 
#	for rm_users in games
 - 
 
1844 
#	do
 - 
 
1845 
#		user=`cat /etc/passwd|grep $rm_users|cut -d":" -f1`
 - 
 
1846 
#		if [ "$user" == "$rm_users" ]
 - 
 
1847 
#		then
 - 
 
1848 
#			/usr/sbin/userdel -r $rm_users
 - 
 
1849 
#		fi
 - 
 
1850 
#	done
 - 
 
1851 
# Load and apply the previous conf file
 1866 
# Load and apply the previous conf file
1852 
	if [ "$mode" = "update" ]
 1867 
	if [ "$mode" = "update" ]
1853 
	then
 1868 
	then
1854 
		$DIR_DEST_BIN/alcasar-archive.sh --now # exports current logs in /var/Save/logs
 1869 
		$DIR_DEST_BIN/alcasar-archive.sh --now # exports current logs in /var/Save/logs
1855 
		$DIR_DEST_BIN/alcasar-conf.sh --load
 1870 
		$DIR_DEST_BIN/alcasar-conf.sh --load