Line 1... |
Line 1... |
1 |
#/bin/bash
|
1 |
#/bin/bash
|
2 |
# $Id: alcasar-bl.sh 854 2012-04-09 19:31:46Z richard $
|
2 |
# $Id: alcasar-bl.sh 878 2012-06-03 16:07:40Z richard $
|
3 |
|
3 |
|
4 |
# alcasar-bl.sh
|
4 |
# alcasar-bl.sh
|
5 |
# by Franck BOUIJOUX and Richard REY
|
5 |
# by Franck BOUIJOUX and Richard REY
|
6 |
# This script is distributed under the Gnu General Public License (GPL)
|
6 |
# This script is distributed under the Gnu General Public License (GPL)
|
7 |
|
7 |
|
8 |
# Gestion de la BL pour le filtrage de domaine (via dnsmasq) et d'URL (via Dansguardian)
|
8 |
# Gestion de la BL pour le filtrage de domaine (via dnsmasq) et d'URL (via Dansguardian)
|
9 |
# Manage the BL for DnsBlackHole (dnsmasq) and URL filtering (Dansguardian)
|
9 |
# Manage the BL for DnsBlackHole (dnsmasq) and URL filtering (Dansguardian)
|
10 |
|
10 |
|
- |
|
11 |
DIR_CONF="/usr/local/etc"
|
11 |
CONF_FILE="/usr/local/etc/alcasar.conf"
|
12 |
CONF_FILE="$DIR_CONF/alcasar.conf"
|
12 |
private_ip_mask=`grep PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
|
13 |
private_ip_mask=`grep PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
|
13 |
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
|
14 |
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
|
14 |
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1` # ALCASAR LAN IP address
|
15 |
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1` # ALCASAR LAN IP address
|
15 |
DIR_tmp="/tmp/blacklists"
|
16 |
DIR_tmp="/tmp/blacklists"
|
16 |
FILE_tmp="/tmp/fileFilter.txt"
|
17 |
FILE_tmp="/tmp/fileFilter.txt"
|
17 |
DIR_DG="/etc/dansguardian/lists"
|
18 |
DIR_DG="/etc/dansguardian/lists"
|
18 |
DIR_DG_BL="$DIR_DG/blacklists"
|
19 |
DIR_DG_BL="$DIR_DG/blacklists"
|
19 |
BL_CATEGORIES="/usr/local/etc/alcasar-bl-categories"
|
20 |
BL_CATEGORIES="$DIR_CONF/alcasar-bl-categories"
|
- |
|
21 |
WL_CATEGORIES="$DIR_CONF/alcasar-wl-categories"
|
20 |
BL_CATEGORIES_ENABLED="/usr/local/etc/alcasar-bl-categories-enabled"
|
22 |
BL_CATEGORIES_ENABLED="$DIR_CONF/alcasar-bl-categories-enabled"
|
21 |
DIR_DNS_FILTER_AVAILABLE="/usr/local/etc/alcasar-dnsfilter-available"
|
23 |
DIR_DNS_FILTER_AVAILABLE="$DIR_CONF/alcasar-dnsfilter-available"
|
22 |
DIR_DNS_FILTER_ENABLED="/usr/local/etc/alcasar-dnsfilter-enabled"
|
24 |
DIR_DNS_FILTER_ENABLED="$DIR_CONF/alcasar-dnsfilter-enabled"
|
23 |
BL_SERVER="cri.univ-tlse1.fr"
|
25 |
BL_SERVER="dsi.ut-capitole.fr"
|
24 |
SED="/bin/sed -i"
|
26 |
SED="/bin/sed -i"
|
25 |
|
27 |
|
26 |
# Récupération de l'archive de la BL Toulouse
|
- |
|
27 |
function transfert () {
|
- |
|
28 |
mkdir -p $DIR_tmp
|
- |
|
29 |
cd $DIR_tmp
|
- |
|
30 |
wget http://$BL_SERVER/blacklists/download/blacklists.tar.gz
|
- |
|
31 |
}
|
- |
|
32 |
# Décompression de la BL (en conservant la WL)
|
- |
|
33 |
function install () {
|
- |
|
34 |
[ -d $DIR_DG ] || mkdir -p $DIR_DG
|
- |
|
35 |
[ -d $DIR_DG_BL/ossi ] && mv -f $DIR_DG_BL/ossi $DIR_tmp
|
- |
|
36 |
[ -d $DIR_DG_BL/ip ] && mv -f $DIR_DG_BL/ip $DIR_tmp
|
- |
|
37 |
tar zxf $DIR_tmp/blacklists.tar.gz --directory=$DIR_DG/
|
- |
|
38 |
[ -d $DIR_tmp/ossi ] && mv -f $DIR_tmp/ossi $DIR_DG_BL/
|
- |
|
39 |
[ -d $DIR_tmp/ip ] && mv -f $DIR_tmp/ip $DIR_DG_BL/
|
- |
|
40 |
cd /root
|
- |
|
41 |
rm -rf $DIR_tmp
|
- |
|
42 |
}
|
- |
|
43 |
# Permet d'activer/désactiver les catégories de la BL
|
28 |
# Permet d'activer/désactiver les catégories de la BL
|
44 |
function cat_choice (){
|
29 |
function cat_choice (){
|
45 |
# un peu de ménage
|
30 |
# un peu de ménage
|
46 |
rm -rf $DIR_DNS_FILTER_ENABLED/*
|
31 |
rm -rf $DIR_DNS_FILTER_ENABLED/*
|
47 |
$SED "/\.Include/d" $DIR_DG/bannedsitelist $DIR_DG/bannedurllist
|
32 |
$SED "/\.Include/d" $DIR_DG/bannedsitelist $DIR_DG/bannedurllist
|
Line 53... |
Line 38... |
53 |
$SED "1i\/etc\/dansguardian\/lists\/blacklists\/$ENABLE_CATEGORIE" $BL_CATEGORIES
|
38 |
$SED "1i\/etc\/dansguardian\/lists\/blacklists\/$ENABLE_CATEGORIE" $BL_CATEGORIES
|
54 |
ln -s $DIR_DNS_FILTER_AVAILABLE/$ENABLE_CATEGORIE.conf $DIR_DNS_FILTER_ENABLED/$ENABLE_CATEGORIE
|
39 |
ln -s $DIR_DNS_FILTER_AVAILABLE/$ENABLE_CATEGORIE.conf $DIR_DNS_FILTER_ENABLED/$ENABLE_CATEGORIE
|
55 |
echo ".Include<$DIR_DG_BL/$ENABLE_CATEGORIE/domains>" >> $DIR_DG/bannedsitelist # dansguardian s'occupe du contournement par proxy http ;-)
|
40 |
echo ".Include<$DIR_DG_BL/$ENABLE_CATEGORIE/domains>" >> $DIR_DG/bannedsitelist # dansguardian s'occupe du contournement par proxy http ;-)
|
56 |
echo ".Include<$DIR_DG_BL/$ENABLE_CATEGORIE/urls>" >> $DIR_DG/bannedurllist
|
41 |
echo ".Include<$DIR_DG_BL/$ENABLE_CATEGORIE/urls>" >> $DIR_DG/bannedurllist
|
57 |
done
|
42 |
done
|
58 |
sort -k2n $BL_CATEGORIES > $FILE_tmp
|
43 |
sort +0.0 -0.2 $BL_CATEGORIES -o $FILE_tmp
|
59 |
mv $FILE_tmp $BL_CATEGORIES
|
44 |
mv $FILE_tmp $BL_CATEGORIES
|
60 |
}
|
45 |
}
|
61 |
function bl_enable (){
|
46 |
function bl_enable (){
|
62 |
$SED "s/^reportinglevel =.*/reportinglevel = 3/g" /etc/dansguardian/dansguardian.conf
|
47 |
$SED "s/^reportinglevel =.*/reportinglevel = 3/g" /etc/dansguardian/dansguardian.conf
|
63 |
$SED "s?^#\"?\"?g" $DIR_DG/urlregexplist # Enable 'safesearch'
|
- |
|
64 |
if [ "$PARENT_SCRIPT" != "/usr/local/bin/alcasar-conf.sh" ] # don't launch on install stage
|
48 |
if [ "$PARENT_SCRIPT" != "/usr/local/bin/alcasar-conf.sh" ] # don't launch on install stage
|
65 |
then
|
49 |
then
|
66 |
service dansguardian restart
|
50 |
service dansguardian restart
|
67 |
service dnsmasq restart
|
51 |
service dnsmasq restart
|
68 |
/usr/local/bin/alcasar-iptables.sh
|
52 |
/usr/local/bin/alcasar-iptables.sh
|
69 |
fi
|
53 |
fi
|
70 |
}
|
54 |
}
|
71 |
function bl_disable (){
|
55 |
function bl_disable (){
|
72 |
rm -rf $DIR_DNS_FILTER_ENABLED/*
|
56 |
rm -rf $DIR_DNS_FILTER_ENABLED/*
|
73 |
$SED "s/^reportinglevel =.*/reportinglevel = -1/g" /etc/dansguardian/dansguardian.conf
|
57 |
$SED "s/^reportinglevel =.*/reportinglevel = -1/g" /etc/dansguardian/dansguardian.conf
|
74 |
$SED "s?^[^#]?#&?g" $DIR_DG/urlregexplist # Disable 'safesearch'
|
- |
|
75 |
if [ "$PARENT_SCRIPT" != "/usr/local/bin/alcasar-conf.sh" ] # don't launch on install stage
|
58 |
if [ "$PARENT_SCRIPT" != "/usr/local/bin/alcasar-conf.sh" ] # don't launch on install stage
|
76 |
then
|
59 |
then
|
77 |
service dansguardian restart
|
60 |
service dansguardian restart
|
78 |
service dnsmasq restart
|
61 |
service dnsmasq restart
|
79 |
/usr/local/bin/alcasar-iptables.sh
|
62 |
/usr/local/bin/alcasar-iptables.sh
|
Line 109... |
Line 92... |
109 |
# désactivation du filtrage
|
92 |
# désactivation du filtrage
|
110 |
-off | --off)
|
93 |
-off | --off)
|
111 |
$SED "s?^DNS_FILTERING.*?DNS_FILTERING=off?g" $CONF_FILE
|
94 |
$SED "s?^DNS_FILTERING.*?DNS_FILTERING=off?g" $CONF_FILE
|
112 |
bl_disable
|
95 |
bl_disable
|
113 |
;;
|
96 |
;;
|
114 |
# Mise a jour de la blacklist 'Toulouse' (attente validation md5 avant adaptation à notre structure)
|
97 |
# Récupération de l'archive de la BL Toulouse
|
115 |
-download | --download)
|
98 |
-download | --download)
|
116 |
rm -rf /tmp/con_ok.html
|
99 |
rm -rf /tmp/con_ok.html
|
117 |
`/usr/bin/curl $BL_SERVER -# -o /tmp/con_ok.html`
|
100 |
`/usr/bin/curl $BL_SERVER -# -o /tmp/con_ok.html`
|
118 |
if [ ! -e /tmp/con_ok.html ]
|
101 |
if [ ! -e /tmp/con_ok.html ]
|
119 |
then
|
102 |
then
|
120 |
echo "Erreur : le serveur de blacklist ($BL_SERVER) n'est pas joignable"
|
103 |
echo "Erreur : le serveur de blacklist ($BL_SERVER) n'est pas joignable"
|
121 |
else
|
104 |
else
|
- |
|
105 |
rm -rf /tmp/con_ok.html $DIR_tmp
|
122 |
transfert
|
106 |
mkdir $DIR_tmp
|
123 |
install
|
107 |
cd $DIR_tmp
|
124 |
chown -R dansguardian:apache $DIR_DG
|
108 |
wget http://$BL_SERVER/blacklists/download/blacklists.tar.gz
|
125 |
chmod -R g+w $DIR_DG
|
109 |
md5sum $DIR_tmp/blacklists.tar.gz | cut -d" " -f1 > $DIR_tmp/md5sum
|
126 |
rm -rf /tmp/con_ok.html
|
110 |
cd /root
|
127 |
fi
|
111 |
fi
|
128 |
;;
|
112 |
;;
|
129 |
# Adaptation de la BL à notre structure (dnsmasq + DG)
|
113 |
# Adaptation de la BL de Toulouse à notre structure (dnsmasq + DG)
|
130 |
-adapt | --adapt)
|
114 |
-adapt | --adapt)
|
- |
|
115 |
if [ -f $DIR_tmp/blacklists.tar.gz ]
|
- |
|
116 |
then
|
- |
|
117 |
[ -d $DIR_DG_BL/ossi ] && mv -f $DIR_DG_BL/ossi $DIR_tmp
|
- |
|
118 |
rm -rf $DIR_DG_BL
|
- |
|
119 |
mkdir $DIR_DG_BL
|
- |
|
120 |
tar zxf $DIR_tmp/blacklists.tar.gz --directory=$DIR_DG/
|
- |
|
121 |
[ -d $DIR_tmp/ossi ] && mv -f $DIR_tmp/ossi $DIR_DG_BL/
|
- |
|
122 |
rm -rf $DIR_tmp
|
- |
|
123 |
chown -R dansguardian:apache $DIR_DG
|
- |
|
124 |
chmod -R g+w $DIR_DG
|
- |
|
125 |
fi
|
- |
|
126 |
rm -f $BL_CATEGORIES $WL_CATEGORIES $DIR_DNS_FILTER_AVAILABLE/*
|
- |
|
127 |
touch $BL_CATEGORIES $WL_CATEGORIES
|
131 |
find $DIR_DG_BL/ -type f -name domains > $BL_CATEGORIES # On récupère le nom des répertoire (catégories)
|
128 |
find $DIR_DG_BL/ -type f -name domains > $FILE_tmp # On récupère le nom des répertoire (catégories)
|
132 |
$SED "s?\/domains??g" $BL_CATEGORIES # On supprime le suffice "/domains"
|
129 |
$SED "s?\/domains??g" $FILE_tmp # On supprime le suffixe "/domains"
|
- |
|
130 |
for categorie in `cat $FILE_tmp` # creation des deux fichiers de categories (BL / WL)
|
- |
|
131 |
do
|
- |
|
132 |
if [ -e $categorie/usage ]
|
- |
|
133 |
then
|
- |
|
134 |
is_whitelist=`grep white $categorie/usage|wc -l`
|
- |
|
135 |
else
|
- |
|
136 |
is_whitelist=0 # si le fichier 'usage' n'existe pas, on considère que la catégorie est une BL
|
- |
|
137 |
fi
|
- |
|
138 |
if [ $is_whitelist -eq "0" ]
|
- |
|
139 |
then
|
- |
|
140 |
echo "$categorie" >> $BL_CATEGORIES
|
- |
|
141 |
else
|
- |
|
142 |
echo "$categorie" >> $WL_CATEGORIES
|
- |
|
143 |
fi
|
- |
|
144 |
done
|
133 |
rm -f $DIR_DNS_FILTER_AVAILABLE/*
|
145 |
rm -f $FILE_tmp
|
134 |
echo -n "Toulouse BlackList migration process. Please wait : "
|
146 |
echo -n "Toulouse BlackList migration process. Please wait : "
|
135 |
for PATH_FILE in `cat $BL_CATEGORIES` # pour chaque catégorie
|
147 |
for PATH_FILE in `cat $BL_CATEGORIES` # pour chaque catégorie
|
136 |
do
|
148 |
do
|
137 |
echo -n "."
|
149 |
echo -n "."
|
138 |
if [ ! -f $PATH_FILE/urls ] # on crée le fichier 'urls' s'il n'existe pas
|
150 |
if [ ! -f $PATH_FILE/urls ] # on crée le fichier 'urls' s'il n'existe pas
|
139 |
then
|
151 |
then
|
140 |
touch $PATH_FILE/urls
|
152 |
touch $PATH_FILE/urls
|
141 |
chown dansguardian:apache $PATH_FILE/urls
|
153 |
chown dansguardian:apache $PATH_FILE/urls
|
142 |
fi
|
154 |
fi
|
143 |
# suppression des @IP, de caractères acccentués et des lignes commentées
|
155 |
# suppression des @IP, de caractères acccentués et des lignes commentées
|
144 |
egrep -v "([0-9]{1,3}\.){3}[0-9]{1,3}" $PATH_FILE/domains > /tmp/dnsmasq-bl.tmp
|
156 |
egrep -v "([0-9]{1,3}\.){3}[0-9]{1,3}" $PATH_FILE/domains > $FILE_tmp
|
145 |
$SED "/[äâëêïîöôüû]/d" /tmp/dnsmasq-bl.tmp
|
157 |
$SED "/[äâëêïîöôüû]/d" $FILE_tmp
|
146 |
$SED "/^#.*/d" /tmp/dnsmasq-bl.tmp
|
158 |
$SED "/^#.*/d" $FILE_tmp
|
147 |
$SED "s?.*?address=/&/$PRIVATE_IP?g" /tmp/dnsmasq-bl.tmp # Mise en forme dnsmasq
|
159 |
$SED "s?.*?address=/&/$PRIVATE_IP?g" $FILE_tmp # Mise en forme dnsmasq
|
148 |
DOMAINE=`basename $PATH_FILE`
|
160 |
DOMAINE=`basename $PATH_FILE`
|
149 |
mv /tmp/dnsmasq-bl.tmp $DIR_DNS_FILTER_AVAILABLE/$DOMAINE.conf
|
161 |
mv $FILE_tmp $DIR_DNS_FILTER_AVAILABLE/$DOMAINE.conf
|
150 |
done
|
162 |
done
|
151 |
echo
|
163 |
echo
|
152 |
;;
|
164 |
;;
|
153 |
# regénération suite à modification de la BL secondaire ou du choix des catégories
|
165 |
# regénération suite à modification du choix des catégories
|
154 |
-reload | --reload)
|
166 |
-reload | --reload)
|
155 |
# pour Dansguardian
|
167 |
# pour Dansguardian
|
156 |
chown -R dansguardian:apache $DIR_DG_BL/ossi
|
168 |
chown -R dansguardian:apache $DIR_DG_BL/ossi
|
157 |
chmod -R g+w $DIR_DG_BL/ossi
|
169 |
chmod -R g+w $DIR_DG_BL/ossi
|
158 |
cat_choice
|
170 |
cat_choice
|
Line 164... |
Line 176... |
164 |
$SED "/$i/d" $DIR_DNS_FILTER_AVAILABLE/*
|
176 |
$SED "/$i/d" $DIR_DNS_FILTER_AVAILABLE/*
|
165 |
done
|
177 |
done
|
166 |
fi
|
178 |
fi
|
167 |
cp -f $DIR_DG_BL/ossi/domains $DIR_DNS_FILTER_AVAILABLE/ossi.conf
|
179 |
cp -f $DIR_DG_BL/ossi/domains $DIR_DNS_FILTER_AVAILABLE/ossi.conf
|
168 |
$SED "s?.*?address=/&/$PRIVATE_IP?g" $DIR_DNS_FILTER_AVAILABLE/ossi.conf
|
180 |
$SED "s?.*?address=/&/$PRIVATE_IP?g" $DIR_DNS_FILTER_AVAILABLE/ossi.conf
|
169 |
IP_PURE=`grep '^ip' $BL_CATEGORIES_ENABLED|wc -l`
|
- |
|
170 |
if [ $IP_PURE -eq "1" ]; then # filtrage des url sans nom de domaine
|
- |
|
171 |
$SED "s/^\#\*ip$/*ip/g" $DIR_DG/bannedsitelist
|
- |
|
172 |
else
|
- |
|
173 |
$SED "s/^\*ip$/#*ip/g" $DIR_DG/bannedsitelist
|
- |
|
174 |
fi
|
- |
|
175 |
DNS_FILTERING=`grep DNS_FILTERING $CONF_FILE|cut -d"=" -f2` # DNS and URLs filter (on/off)
|
181 |
DNS_FILTERING=`grep DNS_FILTERING $CONF_FILE|cut -d"=" -f2` # DNS and URLs filter (on/off)
|
176 |
DNS_FILTERING=${DNS_FILTERING:=off}
|
182 |
DNS_FILTERING=${DNS_FILTERING:=off}
|
177 |
if [ $DNS_FILTERING = on ]; then
|
183 |
if [ $DNS_FILTERING = on ]; then
|
178 |
bl_enable
|
184 |
bl_enable
|
179 |
else
|
185 |
else
|