Subversion Repositories ALCASAR

Rev

Rev 2688 | Rev 2770 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 2688 Rev 2769
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/bash
2 
 
 2 
 
3 
# $Id: alcasar-bl.sh 2688 2019-01-18 23:15:49Z lucas.echard $
 3 
# $Id: alcasar-bl.sh 2769 2019-11-24 22:31:36Z rexy $
4 
 
 4 
 
5 
# alcasar-bl.sh
 5 
# alcasar-bl.sh
6 
# by Franck BOUIJOUX and Richard REY
 6 
# by Franck BOUIJOUX and Richard REY
7 
# This script is distributed under the Gnu General Public License (GPL)
 7 
# This script is distributed under the Gnu General Public License (GPL)
8 
 
 8 
 
9 
# Gestion de la BL pour le filtrage de domaine (via unbound) et d'URL (via E2guardian)
 9 
# Gestion de la BL pour le filtrage de domaine (via unbound) et d'URL (via E2guardian)
10 
# Manage the BL for DnsBlackHole (unbound) and URL filtering (E2guardian)
 10 
# Manage the BL for domain filtering (with unbound) and URL filtering (with E2guardian)
11 
 
 11 
 
12 
DIR_CONF="/usr/local/etc"
 12 
DIR_CONF="/usr/local/etc"
13 
CONF_FILE="$DIR_CONF/alcasar.conf"
 13 
CONF_FILE="$DIR_CONF/alcasar.conf"
14 
private_ip_mask=`grep ^PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
 14 
private_ip_mask=`grep ^PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
15 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
 15 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
Line 31... Line 31...
31 
DIR_DNS_BL_ENABLED="$DIR_SHARE/unbound-bl-enabled"			# symbolic link to the domains BL (only enabled categories)
 31 
DIR_DNS_BL_ENABLED="$DIR_SHARE/unbound-bl-enabled"			# symbolic link to the domains BL (only enabled categories)
32 
DIR_DNS_WL_ENABLED="$DIR_SHARE/unbound-wl-enabled"			#	'	'	'	WL	'	'
 32 
DIR_DNS_WL_ENABLED="$DIR_SHARE/unbound-wl-enabled"			#	'	'	'	WL	'	'
33 
DIR_IP_BL_ENABLED="$DIR_SHARE/iptables-bl-enabled"			#	'	'	ip BL (only enabled categories)
 33 
DIR_IP_BL_ENABLED="$DIR_SHARE/iptables-bl-enabled"			#	'	'	ip BL (only enabled categories)
34 
DIR_IP_WL_ENABLED="$DIR_SHARE/iptables-wl-enabled"			#	'	'	ip WL (ossi and ossi-* imported from ACC)
 34 
DIR_IP_WL_ENABLED="$DIR_SHARE/iptables-wl-enabled"			#	'	'	ip WL (ossi and ossi-* imported from ACC)
35 
REHABILITATED_DNS_FILE="/etc/unbound/conf.d/blacklist/rehabilitated.conf"
 35 
REHABILITATED_DNS_FILE="/etc/unbound/conf.d/blacklist/rehabilitated.conf"
- 
 
 36 
CNC_BL_NAME="ossi-bl-candc"
36 
BL_SERVER="dsi.ut-capitole.fr"
 37 
BL_SERVER="dsi.ut-capitole.fr"
37 
SED="/bin/sed -i"
 38 
SED="/bin/sed -i"
38 
 
 39 
 
39 
# enable/disable the BL & WL categories
 40 
# enable/disable the BL & WL categories
40 
function cat_choice (){
 41 
function cat_choice (){
Line 107... Line 108...
107 
	#	MAX_TLD=18
 108 
	#	MAX_TLD=18
108 
	#fi
 109 
	#fi
109 
	# search for correction	egrep "([a-zA-Z0-9_-.]+\.){1,2}[a-zA-Z]{2,$MAX_TLD}" $ossi_custom_dir/domains > $FILE_tmp
 110 
	# search for correction	egrep "([a-zA-Z0-9_-.]+\.){1,2}[a-zA-Z]{2,$MAX_TLD}" $ossi_custom_dir/domains > $FILE_tmp
110 
}
 111 
}
111 
 
 112 
 
112 
usage="Usage: alcasar-bl.sh { -cat_choice or --cat_choice } | { -download or --download } | { -adapt or --adapt } | { -reload or --reload } | { -update_cat or --update_cat }"
 113 
usage="Usage: alcasar-bl.sh { -cat_choice or --cat_choice } | { -download or --download } | { -adapt or --adapt } | { -reload or --reload } | { -install_ossi_candc or --install_ossi_candc }"
113 
nb_args=$#
 114 
nb_args=$#
114 
args=$1
 115 
args=$1
115 
if [ $nb_args -eq 0 ]
 116 
if [ $nb_args -eq 0 ]
116 
then
 117 
then
117 
	args="-h"
 118 
	args="-h"
Line 182... Line 183...
182 
SOURCE: ALCASAR Team
 183 
SOURCE: ALCASAR Team
183 
DESC FR: Adresses IP des noeuds (routeurs) d'entrée du réseau TOR
 184 
DESC FR: Adresses IP des noeuds (routeurs) d'entrée du réseau TOR
184 
DESC EN: IP addresses of input TOR nodes (routers)
 185 
DESC EN: IP addresses of input TOR nodes (routers)
185 
NAME FR: Noeuds TOR
 186 
NAME FR: Noeuds TOR
186 
NAME EN: TOR nodes
 187 
NAME EN: TOR nodes
- 
 
 188 
 
- 
 
 189 
NAME: ossi-bl-ultrasurf
- 
 
 190 
DEFAULT_TYPE: black
- 
 
 191 
SOURCE: ALCASAR Team
- 
 
 192 
DESC FR: Adresses IP des point de sortie ULTRASURF
- 
 
 193 
DESC EN: IP addresses of output points of ULTRASURF
- 
 
 194 
NAME FR: Points de sortie ULTRASURF
- 
 
 195 
NAME EN: ULTRASURF output points
- 
 
 196 
 
- 
 
 197 
NAME: ossi-bl-candc
- 
 
 198 
DEFAULT_TYPE: black
- 
 
 199 
SOURCE: Bambenek Consulting: https://osint.bambenekconsulting.com
- 
 
 200 
DESC FR: liste des URLs et IPs des serveurs command & control
- 
 
 201 
DESC EN: list of URLs and IPs of command & control servers
- 
 
 202 
NAME FR: Serveurs Command & Control
- 
 
 203 
NAME EN: Command & Control Server
- 
 
 204 
 
187 
EOF
 205 
EOF
188 
			# Retrieve custom files (ossi)
 206 
# Retrieve custom files (ossi)
189 
			for x in $(ls -1 $DIR_tmp | grep "^ossi-*")
 207 
			for x in $(ls -1 $DIR_tmp | grep "^ossi-*")
190 
			do
 208 
			do
191 
				mv $DIR_tmp/$x $DIR_DG_BL
 209 
				mv $DIR_tmp/$x $DIR_DG_BL
192 
			done
 210 
			done
193 
		fi
 211 
		fi
Line 262... Line 280...
262 
		chmod 770 $DIR_DNS_BL $DIR_DNS_WL $DIR_IP_BL $DIR_IP_WL
 280 
		chmod 770 $DIR_DNS_BL $DIR_DNS_WL $DIR_IP_BL $DIR_IP_WL
263 
		chmod -f 660 $BL_CATEGORIES $WL_CATEGORIES $BL_CATEGORIES_ENABLED $WL_CATEGORIES_ENABLED $DIR_DNS_BL/* $DIR_DNS_WL/* $DIR_IP_BL/* $DIR_IP_WL/*
 281 
		chmod -f 660 $BL_CATEGORIES $WL_CATEGORIES $BL_CATEGORIES_ENABLED $WL_CATEGORIES_ENABLED $DIR_DNS_BL/* $DIR_DNS_WL/* $DIR_IP_BL/* $DIR_IP_WL/*
264 
		rm -f $FILE_tmp $FILE_ip_tmp
 282 
		rm -f $FILE_tmp $FILE_ip_tmp
265 
		rm -rf $DIR_tmp
 283 
		rm -rf $DIR_tmp
266 
		;;
 284 
		;;
267 
	# Rsync the categories which are listed in "/usr/local/etc/update_cat.conf". Cron run this function every 12h
 - 
 
268 
	-update_cat | --update_cat)
 285 
    # install C&C-Server Blacklist.
269 
		if [ $(cat /usr/local/etc/update_cat.conf | wc -l) -ne 0 ]
 - 
 
270 
		then
 - 
 
271 
			echo -n "Updating categories in /usr/local/etc/update_cat.conf ..."
 - 
 
272 
			cat /usr/local/etc/update_cat.conf | while read LIGNE_RSYNC
 - 
 
273 
			do
 - 
 
274 
				CATEGORIE=$(echo $LIGNE_RSYNC | cut -d' ' -f1)
 - 
 
275 
				URL=$(echo $LIGNE_RSYNC | cut -d' ' -f2)
 - 
 
276 
				PATH_FILE=$(find $DIR_DG_BL/ -type d -name $CATEGORIE) # retrieve directory name of the category
 - 
 
277 
				rsync -rv $URL $(dirname $PATH_FILE ) #rsync inside of the blacklist directory
 - 
 
278 
				# Creation of unbound and Iptables BL and WL
 286 
    -install_ossi_candc | --install_ossi_candc)
279 
				DOMAIN=$(basename $PATH_FILE)
 - 
 
280 
				cp $PATH_FILE/domains $FILE_tmp
 - 
 
281 
				clean_split  # clean ossi custom files & split them for unbound and for iptables
 - 
 
282 
				black=`grep black $PATH_FILE/usage |wc -l`
 - 
 
283 
				if [ $black == "1" ]
 287 
        ## download
284 
				then
 - 
 
285 
					# adapt to the unbound syntax for the blacklist
 288 
        /usr/local/bin/alcasar-bl-autoupdate.sh --update_ossi-bl-candc
286 
					$SED "s?.*?local-zone: & typetransparent\nlocal-zone-tag: & blacklist?g" $FILE_tmp
 289 
        ## enable blacklist by default by creating symlinks
287 
					mv $FILE_tmp $DIR_DNS_BL/$DOMAIN.conf
 290 
        if [ -e ${DIR_DNS_BL_ENABLED}/${CNC_BL_NAME} ]; then
288 
					mv $FILE_ip_tmp $DIR_IP_BL/$DOMAIN
 291 
		    rm ${DIR_DNS_BL_ENABLED}/${CNC_BL_NAME}
289 
				else
 292 
	    fi
290 
					# adapt to the unbound syntax for the whitelist
 - 
 
291 
					$SED "s?.*?local-zone: & transparent?g" $FILE_tmp
 - 
 
292 
					mv $FILE_tmp $DIR_DNS_WL/$DOMAIN.conf
 293 
	    if [ -e ${DIR_IP_BL_ENABLED}/${CNC_BL_NAME} ]; then
293 
					mv $FILE_ip_tmp $DIR_IP_WL/$DOMAIN
 294 
		    rm ${DIR_IP_BL_ENABLED}/${CNC_BL_NAME}
294 
				fi
 295 
	    fi
295 
				rm -f $FILE_tmp $FILE_ip_tmp
 - 
 
296 
			done
 - 
 
297 
			/usr/bin/systemctl restart unbound-whitelist
 - 
 
298 
			/usr/bin/systemctl restart dnsmasq-whitelist
 - 
 
299 
			/usr/bin/systemctl restart unbound-blacklist
 296 
 		echo "Creating symlinks to enable blacklist"
300 
			/usr/bin/systemctl restart e2guardian
 297 
        ln -s ${DIR_DNS_BL}/${CNC_BL_NAME}.conf ${DIR_DNS_BL_ENABLED}/${CNC_BL_NAME}
301 
			/usr/local/bin/alcasar-iptables.sh
 - 
 
302 
		else
 - 
 
303 
			echo -n "/usr/local/etc/update_cat.conf is empty ..."
 298 
        ln -s ${DIR_IP_BL}/${CNC_BL_NAME} ${DIR_IP_BL_ENABLED}/${CNC_BL_NAME}
304 
		fi
 - 
 
305 
		echo
 299 
		exit 0
306 
		;;
 300 
		;;
307 
	# reload when selected categories are changed or when ossi change his custom files
 301 
	# reload when selected categories are changed or when ossi change his custom files
308 
	-reload | --reload)
 302 
	-reload | --reload)
309 
		# for DG
 303 
		# for E2Gardian
310 
		cat_choice
 304 
		cat_choice
311 
		#  for unbound (rehabilitated domain names)
 305 
		#  for unbound (rehabilitated domain names)
312 
		rm -f $REHABILITATED_DNS_FILE
 306 
		rm -f $REHABILITATED_DNS_FILE
313 
		if [ "$(wc -w $DIR_DG/exceptionsitelist | cut -d " " -f1)" != "0" ]
 307 
		if [ "$(wc -w $DIR_DG/exceptionsitelist | cut -d " " -f1)" != "0" ]
314 
		then
 308 
		then