WebSVN – ALCASAR – Diff – /alcasar.sh

 #!/bin/sh
-#  $Id: alcasar.sh 618 2011-05-26 21:35:31Z richard $
+#  $Id: alcasar.sh 628 2011-06-08 20:08:32Z richard $
 # alcasar.sh
 # by Franck BOUIJOUX, Pascal LEVANT and Richard REY
 # This script is distributed under the Gnu General Public License (GPL)
 DIR_WEB="/var/www/html"				# répertoire racine APACHE
 DIR_ACC="$DIR_WEB/acc"				# répertoire du centre de gestion 'ALCASAR Control Center'
 DIR_DEST_BIN="/usr/local/bin"			# répertoire des scripts
 DIR_DEST_SBIN="/usr/local/sbin"			# répertoire des scripts d'admin
 DIR_DEST_ETC="/usr/local/etc"			# répertoire des fichiers de conf
-FIC_CONF="$DIR_DEST_ETC/alcasar.conf"		# fichier de conf d'alcasar
+CONF_FILE="$DIR_DEST_ETC/alcasar.conf"		# fichier de conf d'alcasar
-FIC_PARAM="/root/ALCASAR-parameters.txt"	# fichier texte résumant les paramètres d'installation
-FIC_PASSWD="/root/ALCASAR-passwords.txt"	# fichier texte contenant les mots de passe et secrets partagés
+PASSWD_FILE="/root/ALCASAR-passwords.txt"	# fichier texte contenant les mots de passe et secrets partagés
 # ******* DBMS parameters - paramètres SGBD ********
 DB_RADIUS="radius"				# nom de la base de données utilisée par le serveur FreeRadius
 DB_USER="radius"				# nom de l'utilisateur de la base de données
 # ******* Network parameters - paramètres réseau *******
 HOSTNAME="alcasar"				#
 				ORGANISME=!
 			fi
 		done
 	fi
 # On crée aléatoirement les mots de passe et les secrets partagés
-	rm -f $FIC_PASSWD
+	rm -f $PASSWD_FILE
 	grubpwd=`cat /dev/urandom | tr -dc [:alnum:] | head -c8`	# mot de passe de protection du menu Grub
-	echo -n "Password to protect the boot menu (GRUB) : " > $FIC_PASSWD
+	echo -n "Password to protect the boot menu (GRUB) : " > $PASSWD_FILE
-	echo "$grubpwd" >> $FIC_PASSWD
+	echo "$grubpwd" >> $PASSWD_FILE
 	md5_grubpwd=`/usr/bin/md5pass $grubpwd`
 	$SED "/^password.*/d" /boot/grub/menu.lst
 	$SED "1ipassword --md5 $md5_grubpwd" /boot/grub/menu.lst
 	mysqlpwd=`cat /dev/urandom | tr -dc [:alnum:] | head -c8`	# mot de passe de l'administrateur Mysqld
-	echo -n "Name and password of MYSQL administrator : " >> $FIC_PASSWD
+	echo -n "Name and password of MYSQL administrator : " >> $PASSWD_FILE
-	echo "root / $mysqlpwd" >> $FIC_PASSWD
+	echo "root / $mysqlpwd" >> $PASSWD_FILE
 	radiuspwd=`cat /dev/urandom | tr -dc [:alnum:] | head -c8`	# mot de passe de l'utilisateur Mysqld (utilisé par freeradius)
-	echo -n "Name and password of MYSQL user : " >> $FIC_PASSWD
+	echo -n "Name and password of MYSQL user : " >> $PASSWD_FILE
-	echo "$DB_USER / $radiuspwd" >> $FIC_PASSWD
+	echo "$DB_USER / $radiuspwd" >> $PASSWD_FILE
 	secretuam=`cat /dev/urandom | tr -dc [:alnum:] | head -c8`	# secret partagé entre intercept.php et coova-chilli
-	echo -n "Shared secret between the script 'intercept.php' and coova-chilli : " >> $FIC_PASSWD
+	echo -n "Shared secret between the script 'intercept.php' and coova-chilli : " >> $PASSWD_FILE
-	echo "$secretuam" >> $FIC_PASSWD
+	echo "$secretuam" >> $PASSWD_FILE
 	secretradius=`cat /dev/urandom | tr -dc [:alnum:] | head -c8`	# secret partagé entre coova-chilli et FreeRadius
-	echo -n "Shared secret between coova-chilli and FreeRadius : " >> $FIC_PASSWD
+	echo -n "Shared secret between coova-chilli and FreeRadius : " >> $PASSWD_FILE
-	echo "$secretradius" >> $FIC_PASSWD
+	echo "$secretradius" >> $PASSWD_FILE
-	chmod 640 $FIC_PASSWD
+	chmod 640 $PASSWD_FILE
 # On installe les scripts et fichiers de configuration d'ALCASAR
 #  - dans /usr/local/bin :  alcasar-{CA.sh,conf.sh,import-clean.sh,iptables-bypass.sh,iptables.sh,log-clean.sh,log-export.sh,mondo.sh,watchdog.sh}
 	cp -f $DIR_SCRIPTS/alcasar* $DIR_DEST_BIN/. ; chown root:root $DIR_DEST_BIN/alcasar* ; chmod 740 $DIR_DEST_BIN/alcasar*
 #  - dans /usr/local/sbin :  alcasar-{bl.sh,bypass.sh,dateLog.sh,havp.sh,logout.sh,mysql.sh,nf.sh,profil.sh,uninstall.sh,version-list.sh,load-balancing.sh}
 	cp -f $DIR_SCRIPTS/sbin/alcasar* $DIR_DEST_SBIN/. ; chown root:root $DIR_DEST_SBIN/alcasar* ; chmod 740 $DIR_DEST_SBIN/alcasar*
 	cp -f $DIR_SCRIPTS/etc/alcasar* $DIR_DEST_ETC/. ; chown root:apache $DIR_DEST_ETC/alcasar* ; chmod 660 $DIR_DEST_ETC/alcasar*
 	$SED "s?^radiussecret.*?radiussecret=\"$secretradius\"?g" $DIR_DEST_SBIN/alcasar-logout.sh
 	$SED "s?^DB_RADIUS=.*?DB_RADIUS=\"$DB_RADIUS\"?g" $DIR_DEST_SBIN/alcasar-mysql.sh
 	$SED "s?^DB_USER=.*?DB_USER=\"$DB_USER\"?g" $DIR_DEST_SBIN/alcasar-mysql.sh $DIR_DEST_BIN/alcasar-conf.sh
 	$SED "s?^radiuspwd=.*?radiuspwd=\"$radiuspwd\"?g" $DIR_DEST_SBIN/alcasar-mysql.sh $DIR_DEST_BIN/alcasar-conf.sh
-# generate FIC_PARAM and FIC_CONF
+# generate central conf file
-	cat <<EOF > $FIC_PARAM
-##########################################
-##                                      ##
-##          ALCASAR Parameters          ##
-##                                      ##
-##########################################
-- Install date : $DATE
-- Version : $VERSION
-- Organism : $ORGANISME
-EOF
-	cat <<EOF > $FIC_CONF
+	cat <<EOF > $CONF_FILE
 ##########################################
 ##                                      ##
 ##          ALCASAR Parameters          ##
 ##                                      ##
 ##########################################
 INSTALL_DATE=$DATE
 VERSION=$VERSION
 ORGANISM=$ORGANISME
 EOF
-	chmod o-rwx $FIC_PARAM $FIC_CONF
+	chmod o-rwx $CONF_FILE
 } # End of init ()
 ##################################################################
 ##			Fonction network			##
 ## - Définition du plan d'adressage du réseau de consultation	##
 	else
        		PRIVATE_IP_MASK=$DEFAULT_PRIVATE_IP_MASK
 	fi
 # Définition de la config réseau côté "LAN de consultation"
 	hostname $HOSTNAME
-	echo "- Hostname : $HOSTNAME" >> $FIC_PARAM
 	PRIVATE_NETWORK=`/bin/ipcalc -n $PRIVATE_IP_MASK | cut -d"=" -f2`			# @ réseau de consultation (ex.: 192.168.182.0)
 	PRIVATE_NETMASK=`/bin/ipcalc -m $PRIVATE_IP_MASK | cut -d"=" -f2`			# masque réseau de consultation (ex.: 255.255.255.0)
 	PRIVATE_IP=`echo $PRIVATE_IP_MASK | cut -d"/" -f1`					# @ip du portail (côté réseau de consultation)
 	private_prefix=`/bin/ipcalc -p $PRIVATE_IP_MASK |cut -d"=" -f2`				# prefixe du réseau (ex. 24)
 	PRIVATE_NETWORK_MASK=$PRIVATE_NETWORK/$private_prefix					# @ + masque du réseau de consult (192.168.182.0/24)
 	DNS1=${DNS1:=208.67.220.220}
 	DNS2=${DNS2:=208.67.222.222}
 	PUBLIC_NETMASK=`grep NETMASK /etc/sysconfig/network-scripts/default-ifcfg-$EXTIF|cut -d"=" -f2`
 	PUBLIC_PREFIX=`/bin/ipcalc -p $PUBLIC_IP $PUBLIC_NETMASK |cut -d"=" -f2`		# prefixe du réseau (ex. 24)
 	PUBLIC_GATEWAY=`grep GATEWAY /etc/sysconfig/network-scripts/default-ifcfg-$EXTIF|cut -d"=" -f2`
-	echo -e "- WAN IP address ($EXTIF) :\t$PUBLIC_IP/$PUBLIC_PREFIX" >> $FIC_PARAM
-	echo -e "- Gateway IP address :\t\t$PUBLIC_GATEWAY" >> $FIC_PARAM
-	echo -e "- DNS servers :\t\t\t$DNS1 and $DNS2" >> $FIC_PARAM
-	echo -e "- LAN IP address ($INTIF) :\t$PRIVATE_IP_MASK" >> $FIC_PARAM
-	echo -e "- Dynamic IP addresses (DHCP) :\tfrom $PRIVATE_DYN_FIRST_IP to $PRIVATE_DYN_LAST_IP" >> $FIC_PARAM
-	echo "PUBLIC_IP=$PUBLIC_IP/$PUBLIC_PREFIX" >> $FIC_CONF
+	echo "PUBLIC_IP=$PUBLIC_IP/$PUBLIC_PREFIX" >> $CONF_FILE
-	echo "GW=$PUBLIC_GATEWAY" >> $FIC_CONF
+	echo "GW=$PUBLIC_GATEWAY" >> $CONF_FILE
-	echo "DNS1=$DNS1" >> $FIC_CONF
+	echo "DNS1=$DNS1" >> $CONF_FILE
-	echo "DNS2=$DNS2" >> $FIC_CONF
+	echo "DNS2=$DNS2" >> $CONF_FILE
-	echo "PRIVATE_IP=$PRIVATE_IP_MASK" >> $FIC_CONF
+	echo "PRIVATE_IP=$PRIVATE_IP_MASK" >> $CONF_FILE
-	echo "DHCP=on" >> $FIC_CONF
+	echo "DHCP=on" >> $CONF_FILE
-	echo "DHCP_FIRST=$PRIVATE_DYN_FIRST_IP" >> $FIC_CONF
+	echo "DHCP_FIRST=$PRIVATE_DYN_FIRST_IP" >> $CONF_FILE
-	echo "DHCP_LAST=$PRIVATE_DYN_LAST_IP" >> $FIC_CONF
+	echo "DHCP_LAST=$PRIVATE_DYN_LAST_IP" >> $CONF_FILE
 	[ -e /etc/sysconfig/network.default ] || cp /etc/sysconfig/network /etc/sysconfig/network.default
 # Configuration réseau
 	cat <<EOF > /etc/sysconfig/network
 NETWORKING=yes
 HOSTNAME="$HOSTNAME"
 	echo "$VERSION du $DATE" > $DIR_WEB/VERSION
 	$SED "s?99/99/9999?$DATE_SHORT?g" $DIR_ACC/menu.php
 	$SED "s?\$DB_RADIUS = .*?\$DB_RADIUS = \"$DB_RADIUS\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
 	$SED "s?\$DB_USER = .*?\$DB_USER = \"$DB_USER\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
 	$SED "s?\$radiuspwd = .*?\$radiuspwd = \"$radiuspwd\"\;?g" $DIR_ACC/phpsysinfo/includes/xml/portail.php
-	$SED "s?^\$private_ip =.*?\$private_ip = \"$PRIVATE_IP\";?g" $DIR_WEB/index.php
 	$SED "s?\$hostname =.*?\$hostname = \"$HOSTNAME\";?g" $DIR_WEB/index.php
 	chmod 640 $DIR_ACC/phpsysinfo/includes/xml/portail.php
 	chown -R apache:apache $DIR_WEB/*
 	for i in ISO base logs/firewall logs/httpd logs/squid ;
 	do
 	[ -e /var/www/error/include/bottom.html.default ] || mv /var/www/error/include/bottom.html /var/www/error/include/bottom.html.default
 	cat <<EOF > /var/www/error/include/bottom.html
 </body>
 </html>
 EOF
-	echo "- ALCASAR Control Center URL : http://$HOSTNAME" >> $FIC_PARAM
 # Définition du premier compte lié au profil 'admin'
 	header_install
 	if [ "$mode" = "install" ]
 	then
 		admin_portal=!
 			if [ "$admin_portal" == "" ]
 				then
 				admin_portal=!
 			fi
 			done
-		echo "- Name of the first account of the admin profile : $admin_portal" >> $FIC_PARAM
 # Création du fichier de clés de ce compte dans le profil "admin"
 		[ -d $DIR_DEST_ETC/digest ] && rm -rf $DIR_DEST_ETC/digest
 		mkdir -p $DIR_DEST_ETC/digest
 		chmod 755 $DIR_DEST_ETC/digest
 		until [ -s $DIR_DEST_ETC/digest/key_admin ]
 				echo "This update need to redefine the first admin account"
 				echo
 				echo -n "Account : "
 			fi
 			read admin_portal
-			echo "- Name of the first account of the admin profile : $admin_portal" >> $FIC_PARAM
 			[ -d $DIR_DEST_ETC/digest ] && rm -rf $DIR_DEST_ETC/digest
 			mkdir -p $DIR_DEST_ETC/digest
 			chmod 755 $DIR_DEST_ETC/digest
 			until [ -s $DIR_DEST_ETC/digest/key_admin ]
 			do
 	Allow from 127.0.0.1
 	Allow from $PRIVATE_NETWORK_MASK
 	ErrorDocument 404 https://$HOSTNAME
 </Directory>
 EOF
-	echo "- User change password URL : https://$HOSTNAME/pass/" >> $FIC_PARAM
 } # End of param_web_radius ()
 ##########################################################################################
 ##			Fonction param_chilli						##
 ## - Paramètrage du fichier d'initialisation et de configuration de coova-chilli	##
 	touch $DIR_DEST_ETC/alcasar-ethers
 # création des fichiers de sites, d'urls et d'adresses MAC de confiance
 	touch $DIR_DEST_ETC/alcasar-macallowed $DIR_DEST_ETC/alcasar-uamallowed $DIR_DEST_ETC/alcasar-uamdomain
 	chown root:apache $DIR_DEST_ETC/alcasar-*
 	chmod 660 $DIR_DEST_ETC/alcasar-*
-	echo "- User disconnect URL : http://alcasar:3990/logoff" >> $FIC_PARAM
 # Configuration des fichier WEB d'interception (secret partagé avec coova-chilli et nom d'organisme)
 	$SED "s?^\$uamsecret =.*?\$uamsecret = \"$secretuam\";?g" $DIR_WEB/intercept.php
 	$SED "s?^\$userpassword=1.*?\$userpassword=1;?g" $DIR_WEB/intercept.php
 	$SED "s?^\$organisme = .*?\$organisme = \"$ORGANISME\";?g" $DIR_WEB/intercept.php $DIR_WEB/status.php
 }  # End of param_chilli ()
 # sshd écoute côté LAN et WAN
 	$SED "s?^#ListenAddress 0\.0\.0\.0?ListenAddress $PRIVATE_IP?g" /etc/ssh/sshd_config
 	$SED "/^ListenAddress $PRIVATE_IP/a\ListenAddress $PUBLIC_IP" /etc/ssh/sshd_config
 # Put the default value in conf file (sshd, QOS, protocols filter and dns filter are off)(web antivirus is on)
 	/sbin/chkconfig --del sshd
-	echo "SSH=off" >> $FIC_CONF
+	echo "SSH=off" >> $CONF_FILE
-	echo "QOS=off" >> $FIC_CONF
+	echo "QOS=off" >> $CONF_FILE
-	echo "LDAP=off" >> $FIC_CONF
+	echo "LDAP=off" >> $CONF_FILE
-	echo "PROTOCOLS_FILTERING=off" >> $FIC_CONF
+	echo "PROTOCOLS_FILTERING=off" >> $CONF_FILE
-	echo "DNS_FILTERING=off" >> $FIC_CONF
+	echo "DNS_FILTERING=off" >> $CONF_FILE
-	echo "WEB_ANTIVIRUS=on" >> $FIC_CONF
+	echo "WEB_ANTIVIRUS=on" >> $CONF_FILE
 # Coloration des prompts
 	[ -e /etc/bashrc.default ]  || cp /etc/bashrc /etc/bashrc.default
 	cp -f $DIR_CONF/bashrc /etc/. ; chmod 644 /etc/bashrc ; chown root:root /etc/bashrc
 # Droits d'exécution pour utilisateur apache et sysadmin
 	[ -e /etc/sudoers.default ]  || cp /etc/sudoers /etc/sudoers.default
 	if [ "$user" == "$rm_users" ]
 	then
 		/usr/sbin/userdel -f $rm_users
 	fi
 done
-# Load the previous conf file
+# Load and update the previous conf file
 if [ "$mode" = "update" ]
 then
 	$DIR_DEST_BIN/alcasar-conf.sh --load
+	$SED "s?^INSTALL_DATE=.*?INSTALL_DATE=$DATE?g" $CONF_FILE
+	$SED "s?^VERSION=.*?VERSION=$VERSION?g" $CONF_FILE
+	$SED "s?^ORGANISM=.*?ORGANISM=$ORGANISM?g" $CONF_FILE
 fi
 rm -f /tmp/alcasar-conf*
 chown -R root:apache $DIR_DEST_ETC/*
 chmod -R 660 $DIR_DEST_ETC/*
 chmod ug+x $DIR_DEST_ETC/digest $DIR_DEST_ETC/alcasar-dnsfilter*

Subversion Repositories ALCASAR

(root)/alcasar.sh – Rev 618 → 628