Subversion Repositories ALCASAR

Rev

Rev 2811 | Rev 2824 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 2811 Rev 2813
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/bash
2 
# $Id: alcasar-conf.sh 2811 2020-04-15 22:07:11Z rexy $
 2 
# $Id: alcasar-conf.sh 2813 2020-04-26 21:26:32Z rexy $
3 
 
 3 
 
4 
# alcasar-conf.sh
 4 
# alcasar-conf.sh
5 
# by REXY
 5 
# by REXY
6 
# This script is distributed under the Gnu General Public License (GPL)
 6 
# This script is distributed under the Gnu General Public License (GPL)
7 
 
 7 
 
Line 89... Line 89...
89 
		cp -f /etc/pki/tls/certs/alcasar.crt* $DIR_UPDATE
 89 
		cp -f /etc/pki/tls/certs/alcasar.crt* $DIR_UPDATE
90 
		cp -f /etc/pki/tls/private/alcasar.key* $DIR_UPDATE
 90 
		cp -f /etc/pki/tls/private/alcasar.key* $DIR_UPDATE
91 
		[ -e /etc/pki/tls/private/alcasar.pem ] && cp -f /etc/pki/tls/private/alcasar.pem $DIR_UPDATE # since V3.3
 91 
		[ -e /etc/pki/tls/private/alcasar.pem ] && cp -f /etc/pki/tls/private/alcasar.pem $DIR_UPDATE # since V3.3
92 
		cp -f /etc/pki/CA/alcasar-ca.crt $DIR_UPDATE
 92 
		cp -f /etc/pki/CA/alcasar-ca.crt $DIR_UPDATE
93 
		cp -f /etc/pki/CA/private/alcasar-ca.key $DIR_UPDATE
 93 
		cp -f /etc/pki/CA/private/alcasar-ca.key $DIR_UPDATE
94 
		if [ -e /etc/pki/tls/certs/server-chain.crt ]; then
 94 
		if [ -e /etc/pki/tls/certs/server-chain.pem ]; then
95 
			cp -f /etc/pki/tls/certs/server-chain.crt* $DIR_UPDATE # autosigned and official if exist
 95 
			cp -f /etc/pki/tls/certs/server-chain.pem $DIR_UPDATE # autosigned and official if exist
96 
		else
 96 
		else
97 
			cp -f /etc/pki/tls/certs/alcasar.crt $DIR_UPDATE/server-chain.crt
 97 
			cp -f /etc/pki/tls/certs/alcasar.crt $DIR_UPDATE/server-chain.pem
98 
		fi
 98 
		fi
99 
# pureip & safesearch status
 99 
# pureip & safesearch status
100 
		[ -d /etc/dansguardian ] && dg_path=/etc/dansguardian || dg_path=/etc/e2guardian
 100 
		[ -d /etc/dansguardian ] && dg_path=/etc/dansguardian || dg_path=/etc/e2guardian
101 
 
 101 
 
102 
		if ! grep -Eq '^WL_SAFESEARCH=' $DIR_UPDATE/etc/alcasar.conf; then
 102 
		if ! grep -Eq '^WL_SAFESEARCH=' $DIR_UPDATE/etc/alcasar.conf; then
Line 192... Line 192...
192 
		cp -f $DIR_UPDATE/alcasar-ca.crt /etc/pki/CA/
 192 
		cp -f $DIR_UPDATE/alcasar-ca.crt /etc/pki/CA/
193 
		cp -f $DIR_UPDATE/alcasar-ca.key /etc/pki/CA/private/
 193 
		cp -f $DIR_UPDATE/alcasar-ca.key /etc/pki/CA/private/
194 
		cp -f $DIR_UPDATE/alcasar.crt /etc/pki/tls/certs/
 194 
		cp -f $DIR_UPDATE/alcasar.crt /etc/pki/tls/certs/
195 
		cp -f $DIR_UPDATE/alcasar.key /etc/pki/tls/private/
 195 
		cp -f $DIR_UPDATE/alcasar.key /etc/pki/tls/private/
196 
		cp -f $DIR_UPDATE/alcasar.pem /etc/pki/tls/private/
 196 
		cp -f $DIR_UPDATE/alcasar.pem /etc/pki/tls/private/
197 
		[ -e $DIR_UPDATE/server-chain.crt ] && cp -f $DIR_UPDATE/server-chain.crt* /etc/pki/tls/certs/ # autosigned and official if exist
 197 
		[ -e $DIR_UPDATE/server-chain.pem ] && cp -f $DIR_UPDATE/server-chain.pem /etc/pki/tls/certs/ # autosigned and official if exist
198 
		chown root:apache /etc/pki/CA; chmod 750 /etc/pki/CA
 198 
		chown root:apache /etc/pki/CA; chmod 750 /etc/pki/CA
199 
		chmod 640 /etc/pki/CA/*
 199 
		chmod 640 /etc/pki/CA/*
200 
		chown root:root /etc/pki/CA/private; chmod 700 /etc/pki/CA/private
 200 
		chown root:root /etc/pki/CA/private; chmod 700 /etc/pki/CA/private
201 
		chmod 600 /etc/pki/CA/private/*
 201 
		chmod 600 /etc/pki/CA/private/*
202 
		chown -R root:apache /etc/pki/tls/private; chmod 750 /etc/pki/tls/private
 202 
		chown -R root:apache /etc/pki/tls/private; chmod 750 /etc/pki/tls/private
Line 437... Line 437...
437 
	local-zone: "$HOSTNAME.$DOMAIN" static
 437 
	local-zone: "$HOSTNAME.$DOMAIN" static
438 
	local-data: "$HOSTNAME.$DOMAIN A $PRIVATE_IP"
 438 
	local-data: "$HOSTNAME.$DOMAIN A $PRIVATE_IP"
439 
	local-zone: "$HOSTNAME" static
 439 
	local-zone: "$HOSTNAME" static
440 
	local-data: "$HOSTNAME A $PRIVATE_IP"
 440 
	local-data: "$HOSTNAME A $PRIVATE_IP"
441 
EOF
 441 
EOF
- 
 
 442 
		if [ "$HOSTNAME" != 'alcasar' ]
- 
 
 443 
		then
- 
 
 444 
			echo -e "\tlocal-zone: \"alcasar\" static" >> /etc/unbound/conf.d/common/local-dns/${INTIF}.conf
- 
 
 445 
			echo -e "\tlocal-zone: \"alcasar A $PRIVATE_IP\"" >> /etc/unbound/conf.d/common/local-dns/${INTIF}.conf
- 
 
 446 
			echo -e "\tlocal-zone: \"alcasar\" static" >> /etc/unbound/conf.d/forward/iface.lo.conf
- 
 
 447 
			echo -e "\tlocal-zone: \"alcasar A 127.0.0.1\"" >> /etc/unbound/conf.d/forward/iface.lo.conf
- 
 
 448 
		fi
442 
		# Configuration file for lo of forward unbound
 449 
		# Configuration file for lo of forward
443 
		cat << EOF > /etc/unbound/conf.d/forward/iface.lo.conf
 450 
		cat << EOF > /etc/unbound/conf.d/forward/iface.lo.conf
444 
server:
 451 
server:
445 
	interface: 127.0.0.1@53
 452 
	interface: 127.0.0.1@53
446 
	access-control-view: 127.0.0.1/8 lo
 453 
	access-control-view: 127.0.0.1/8 lo
447 
view:
 454 
view:
Line 452... Line 459...
452 
	local-zone: "$HOSTNAME" static
 459 
	local-zone: "$HOSTNAME" static
453 
	local-data: "$HOSTNAME A 127.0.0.1"
 460 
	local-data: "$HOSTNAME A 127.0.0.1"
454 
	local-zone: "$DOMAIN." static
 461 
	local-zone: "$DOMAIN." static
455 
	local-data: "$DOMAIN. A"
 462 
	local-data: "$DOMAIN. A"
456 
EOF
 463 
EOF
457 
		if [ "$HOSTNAME" != 'alcasar' ]
 - 
 
458 
		then
 - 
 
459 
			echo -e "\tlocal-zone: \"alcasar\" static" >> /etc/unbound/conf.d/common/local-dns/${INTIF}.conf
 - 
 
460 
			echo -e "\tlocal-zone: \"alcasar A $PRIVATE_IP\"" >> /etc/unbound/conf.d/common/local-dns/${INTIF}.conf
 - 
 
461 
			echo -e "\tlocal-zone: \"alcasar\" static" >> /etc/unbound/conf.d/forward/iface.lo.conf
 - 
 
462 
			echo -e "\tlocal-zone: \"alcasar A 127.0.0.1\"" >> /etc/unbound/conf.d/forward/iface.lo.conf
 - 
 
463 
		fi
 - 
 
464 
		# Configuration file for $INTIF of forward unbound
 464 
		# Configuration file for $INTIF of forward
465 
		cat << EOF > /etc/unbound/conf.d/forward/iface.${INTIF}.conf
 465 
		cat << EOF > /etc/unbound/conf.d/forward/iface.${INTIF}.conf
466 
server:
 466 
server:
467 
	interface: ${PRIVATE_IP}@53
 467 
	interface: ${PRIVATE_IP}@53
468 
	access-control-view: $PRIVATE_NETWORK_MASK $INTIF
 468 
	access-control-view: $PRIVATE_NETWORK_MASK $INTIF
469 
 
 469 
 
470 
view:
 470 
view:
471 
	name: "$INTIF"
 471 
	name: "$INTIF"
472 
	view-first: yes
 472 
	view-first: yes
473 
EOF
 473 
EOF
474 
		# Configuration file for $INTIF of blacklist unbound
 474 
		# Configuration file for $INTIF of blacklist
475 
		cat << EOF > /etc/unbound/conf.d/blacklist/iface.${INTIF}.conf
 475 
		cat << EOF > /etc/unbound/conf.d/blacklist/iface.${INTIF}.conf
476 
server:
 476 
server:
477 
	interface: ${PRIVATE_IP}@54
 477 
	interface: ${PRIVATE_IP}@54
478 
	access-control: $PRIVATE_IP_MASK allow
 478 
	access-control: $PRIVATE_IP_MASK allow
479 
	access-control-tag: $PRIVATE_IP_MASK "blacklist"
 479 
	access-control-tag: $PRIVATE_IP_MASK "blacklist"
480 
	access-control-tag-action: $PRIVATE_IP_MASK "blacklist" redirect
 480 
	access-control-tag-action: $PRIVATE_IP_MASK "blacklist" redirect
481 
	access-control-tag-data: $PRIVATE_IP_MASK "blacklist" "A $PRIVATE_IP"
 481 
	access-control-tag-data: $PRIVATE_IP_MASK "blacklist" "A $PRIVATE_IP"
482 
EOF
 482 
EOF
483 
		# Configuration file for $INTIF of whitelist unbound
 483 
		# Configuration file for $INTIF of whitelist
484 
		cat << EOF > /etc/unbound/conf.d/whitelist/iface.${INTIF}.conf
 484 
		cat << EOF > /etc/unbound/conf.d/whitelist/iface.${INTIF}.conf
485 
server:
 485 
server:
486 
	interface: ${PRIVATE_IP}@55
 486 
	interface: ${PRIVATE_IP}@55
487 
	access-control: $PRIVATE_IP_MASK allow
 487 
	access-control: $PRIVATE_IP_MASK allow
488 
	access-control-tag: $PRIVATE_IP_MASK "whitelist"
 488 
	access-control-tag: $PRIVATE_IP_MASK "whitelist"
489 
	access-control-tag-action: $PRIVATE_IP_MASK "whitelist" redirect
 489 
	access-control-tag-action: $PRIVATE_IP_MASK "whitelist" redirect
490 
	access-control-tag-data: $PRIVATE_IP_MASK "whitelist" "A $PRIVATE_IP"
 490 
	access-control-tag-data: $PRIVATE_IP_MASK "whitelist" "A $PRIVATE_IP"
491 
EOF
 491 
EOF
492 
		# Configuration file for $INTIF of blackhole unbound
 492 
		# Configuration file for $INTIF of blackhole
493 
		cat << EOF > /etc/unbound/conf.d/blackhole/iface.${INTIF}.conf
 493 
		cat << EOF > /etc/unbound/conf.d/blackhole/iface.${INTIF}.conf
494 
server:
 494 
server:
495 
	interface: ${PRIVATE_IP}@56
 495 
	interface: ${PRIVATE_IP}@56
496 
	access-control-view: $PRIVATE_NETWORK_MASK $INTIF
 496 
	access-control-view: $PRIVATE_NETWORK_MASK $INTIF
497 
view:
 497 
view: