| Line 1... |
Line 1... |
| 1 |
#!/bin/bash
|
1 |
#!/bin/bash
|
| 2 |
# $Id: alcasar.sh 3247 2025-02-02 23:22:02Z rexy $
|
2 |
# $Id: alcasar.sh 3248 2025-02-08 14:09:43Z rexy $
|
| 3 |
|
3 |
|
| 4 |
# ALCASAR is a Free and open source NAC (Network Access Controler) created by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy)
|
4 |
# ALCASAR is a Free and open source NAC (Network Access Controler) created by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy)
|
| 5 |
# ALCASAR is based on a stripped Mageia (LSB) with the following open source softwares Coovachilli, freeradius, mariaDB, apache, php, netfilter, e2guardian, ntpd, openssl, unbound, gammu, Ulog, fail2ban, vnstat, wkhtml2pdf, ipt_NETFLOW, NFsen and NFdump
|
5 |
# ALCASAR is based on a stripped Mageia (LSB) with the following open source softwares Coovachilli, freeradius, mariaDB, apache, php, netfilter, e2guardian, ntpd, openssl, unbound, gammu, Ulog, fail2ban, vnstat, wkhtml2pdf, ipt_NETFLOW, NFsen and NFdump
|
| 6 |
# contact : info@alcasar.net
|
6 |
# contact : info@alcasar.net
|
| 7 |
|
7 |
|
| Line 22... |
Line 22... |
| 22 |
# init_db : Initilization of radius database managed with MariaDB
|
22 |
# init_db : Initilization of radius database managed with MariaDB
|
| 23 |
# freeradius : FreeRadius initialisation
|
23 |
# freeradius : FreeRadius initialisation
|
| 24 |
# chilli : Coovachilli initialisation (+authentication page)
|
24 |
# chilli : Coovachilli initialisation (+authentication page)
|
| 25 |
# e2guardian : E2Guardian filtering HTTP proxy configuration
|
25 |
# e2guardian : E2Guardian filtering HTTP proxy configuration
|
| 26 |
# ulogd : Log system in userland (match NFLOG target of iptables)
|
26 |
# ulogd : Log system in userland (match NFLOG target of iptables)
|
| 27 |
# nfsen : Configuration of Netflow grapher (nfsen) & netflow collector (nfcapd)
|
27 |
# nfsen : Configuration of netflow collector (nfcapd) and Netflow grapher (nfsen-ng)
|
| 28 |
# unbound : Name server configuration
|
28 |
# unbound : Name server configuration
|
| 29 |
# vnstat : Little network stat daemon
|
29 |
# vnstat : Little network stat daemon
|
| 30 |
# BL : Adaptation of Toulouse University BlackList : split into 3 BL (for unbound, for e2guardian and for Netfilter)
|
30 |
# BL : Adaptation of Toulouse University BlackList : split into 3 BL (for unbound, for e2guardian and for Netfilter)
|
| 31 |
# cron : Logs export + watchdog + connexion statistics
|
31 |
# cron : Logs export + watchdog + connexion statistics
|
| 32 |
# fail2ban : Fail2ban IDS installation and configuration
|
32 |
# fail2ban : Fail2ban IDS installation and configuration
|
| Line 1567... |
Line 1567... |
| 1567 |
EOF
|
1567 |
EOF
|
| 1568 |
[ -d /var/log/nfsen/profiles-data/live/alcasar_netflow ] || mkdir -p /var/log/nfsen/profiles-data/live/alcasar_netflow
|
1568 |
[ -d /var/log/nfsen/profiles-data/live/alcasar_netflow ] || mkdir -p /var/log/nfsen/profiles-data/live/alcasar_netflow
|
| 1569 |
touch /var/log/nfsen/profiles-data/live/alcasar_netflow/.nfstat
|
1569 |
touch /var/log/nfsen/profiles-data/live/alcasar_netflow/.nfstat
|
| 1570 |
chown -R nfcapd:nfcapd /var/log/nfsen
|
1570 |
chown -R nfcapd:nfcapd /var/log/nfsen
|
| 1571 |
# nfsen-ng
|
1571 |
# nfsen-ng
|
| - |
|
1572 |
# initializing and populating the RRD database (see if it should be usefull)
|
| 1572 |
php /var/www/html/acc/manager/nfsen/backend/cli.php -f -p -ps import # initializing and populating the RDD database
|
1573 |
#su - apache --shell=/bin/bash -c '/var/www/html/acc/manager/nfsen/backend/cli.php -f -p -ps import'
|
| - |
|
1574 |
# nfsen-ng unit for systemd
|
| - |
|
1575 |
cat << EOF > /etc/systemd/system/nfsen-ng.service
|
| - |
|
1576 |
# This file is part of systemd.
|
| - |
|
1577 |
#
|
| - |
|
1578 |
# systemd is free software; you can redistribute it and/or modify it
|
| - |
|
1579 |
# under the terms of the GNU General Public License as published by
|
| - |
|
1580 |
# the Free Software Foundation; either version 2 of the License, or
|
| - |
|
1581 |
# (at your option) any later version.
|
| - |
|
1582 |
|
| - |
|
1583 |
# This unit launches nfsen-ng (a Netflow grapher).
|
| - |
|
1584 |
[Unit]
|
| - |
|
1585 |
Description=nfsen-ng daemon (netflow grapher)
|
| - |
|
1586 |
After=network-online.target
|
| - |
|
1587 |
|
| - |
|
1588 |
[Service]
|
| - |
|
1589 |
Type=simple
|
| - |
|
1590 |
User=apache
|
| - |
|
1591 |
Group=apache
|
| - |
|
1592 |
PIDFile=/var/www/html/acc/manager/nfsen/backend/nfsen-ng.pid
|
| - |
|
1593 |
WorkingDirectory=/var/www/html/acc/manager/nfsen/backend/
|
| - |
|
1594 |
ExecStart=/usr/bin/php /var/www/html/acc/manager/nfsen/backend/listen.php
|
| - |
|
1595 |
|
| - |
|
1596 |
[Install]
|
| - |
|
1597 |
WantedBy=multi-user.target
|
| - |
|
1598 |
EOF
|
| 1573 |
|
1599 |
|
| 1574 |
} # End of nfsen()
|
1600 |
} # End of nfsen()
|
| 1575 |
|
1601 |
|
| 1576 |
###########################################################
|
1602 |
###########################################################
|
| 1577 |
## "vnstat" ##
|
1603 |
## "vnstat" ##
|
| Line 2291... |
Line 2317... |
| 2291 |
do
|
2317 |
do
|
| 2292 |
find /var/log/$dir -type f -name "*.log-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]" -exec gzip {} \;
|
2318 |
find /var/log/$dir -type f -name "*.log-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]" -exec gzip {} \;
|
| 2293 |
done
|
2319 |
done
|
| 2294 |
/usr/bin/systemctl daemon-reload
|
2320 |
/usr/bin/systemctl daemon-reload
|
| 2295 |
# processes started at boot time (Systemctl)
|
2321 |
# processes started at boot time (Systemctl)
|
| 2296 |
for i in alcasar-network mysqld httpd ntpd iptables unbound unbound-blacklist unbound-whitelist unbound-blackhole radiusd nfcapd e2guardian ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban vnstat sshd
|
2322 |
for i in alcasar-network mysqld httpd ntpd iptables unbound unbound-blacklist unbound-whitelist unbound-blackhole radiusd nfcapd nfsen-ng e2guardian ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban vnstat sshd
|
| 2297 |
do
|
2323 |
do
|
| 2298 |
/usr/bin/systemctl -q enable $i.service
|
2324 |
/usr/bin/systemctl -q enable $i.service
|
| 2299 |
done
|
2325 |
done
|
| 2300 |
|
2326 |
|
| 2301 |
# disable processes at boot time (Systemctl)
|
2327 |
# disable processes at boot time (Systemctl)
|