WebSVN – ALCASAR – Diff – /alcasar.sh

 #!/bin/bash
-#  $Id: alcasar.sh 3257 2025-02-25 23:41:27Z rexy $
+#  $Id: alcasar.sh 3269 2025-04-21 21:57:13Z rexy $
 # ALCASAR is a Free and open source NAC (Network Access Controler) created by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy)
 # ALCASAR is based on a stripped Mageia (LSB) with the following open source softwares Coovachilli, freeradius, mariaDB, apache, php, netfilter, e2guardian, ntpd, openssl, unbound, gammu, Ulog, fail2ban, vnstat, wkhtml2pdf, ipt_NETFLOW, NFsen and NFdump
 # contact : info@alcasar.net
 	echo "set superusers=\"root\"" >> /etc/grub.d/40_custom
 	echo "password_pbkdf2 root $pbkdf2" >> /etc/grub.d/40_custom
 	echo "# Login name and password to protect GRUB2 boot menu (!!!qwerty keyboard) : " > $PASSWD_FILE
 	echo "GRUB2_user=root" >> $PASSWD_FILE
 	echo "GRUB2_password=$grub2pwd" >> $PASSWD_FILE
-	mysqlpwd=`cat /dev/urandom | tr -dc '[:alnum:]' | head -c16`
+	dbpwd=`cat /dev/urandom | tr -dc '[:alnum:]' | head -c16`
 	echo "# Login name and Password of MariaDB administrator:" >> $PASSWD_FILE
-	echo "db_root=$mysqlpwd" >> $PASSWD_FILE
+	echo "db_root=$dbpwd" >> $PASSWD_FILE
 	radiuspwd=`cat /dev/urandom | tr -dc '[:alnum:]' | head -c16`
 	echo "# Login name and password of MariaDB user:" >> $PASSWD_FILE
 	echo "db_user=$DB_USER" >> $PASSWD_FILE
 	echo "db_password=$radiuspwd" >> $PASSWD_FILE
 	secretuam=`cat /dev/urandom | tr -dc '[:alnum:]' | head -c16`
 	chmod 640 $PASSWD_FILE
 #  copy scripts in in /usr/local/bin
 	cp -fr $DIR_SCRIPTS/alcasar* $DIR_DEST_BIN/. ; chown -R root:root $DIR_DEST_BIN/alcasar* ; chmod -R 740 $DIR_DEST_BIN/alcasar*
 #  copy conf files in /usr/local/etc
 	cp -f $DIR_CONF/etc/alcasar* $DIR_DEST_ETC/. ; chown -R root:apache $DIR_DEST_ETC ; chmod 770 $DIR_DEST_ETC ; chmod 660 $DIR_DEST_ETC/alcasar*
-	$SED "s?^DB_RADIUS=.*?DB_RADIUS=\"$DB_RADIUS\"?g" $DIR_DEST_BIN/alcasar-mysql.sh
+	$SED "s?^DB_RADIUS=.*?DB_RADIUS=\"$DB_RADIUS\"?g" $DIR_DEST_BIN/alcasar-mariadb.sh
 # generate main conf file
 	cat <<EOF > $CONF_FILE
 ##########################################
 ##                                      ##
 ##          ALCASAR Parameters          ##
 sleep 2 # wait for time server responce
 } # End of time_server()
 #####################################################################
 ##                           "init_db"                             ##
-## - Mysql initialization                                          ##
+## - MariaDb initialization                                          ##
 ## - Set admin (root) password                                     ##
 ## - Remove unused users & databases                               ##
 ## - Radius database creation                                      ##
 ## - Copy of accounting tables (mtotacct, totacct) & userinfo      ##
 #####################################################################
 init_db()
+{
-	if [ "`systemctl is-active mysqld`" == "active" ]
+	if [ "`systemctl is-active mariadb`" == "active" ]
 	then
-		systemctl stop mysqld
+		systemctl stop mariadb
 	fi
 	rm -rf /var/lib/mysql # to be sure that there is no former installation
 	[ -e /etc/my.cnf.default ] || cp /etc/my.cnf /etc/my.cnf.default
-	$SED "s?^tmpdir.*?tmpdir=/tmp?g" /etc/my.cnf
 	$SED "s?^port.*?#&?g" /etc/my.cnf # we use unix socket only
+	[ -e /etc/my.cnf.d/server.cnf.default ] || cp /etc/my.cnf.d/server.cnf /etc/my.cnf.d/server.cnf.default
+	$SED "s?^tmpdir.*?tmpdir=/tmp?g" /etc/my.cnf.d/server.cnf
-	$SED "s?^;collation_server =.*?collation_server = utf8_unicode_ci?g" /etc/my.cnf
+	$SED "s?^;collation_server =.*?collation_server = utf8_unicode_ci?g" /etc/my.cnf.d/server.cnf
-	$SED "s?^;character_set_server =.*?character_set_server = utf8?g" /etc/my.cnf  # accentuated user names are allowed
+	$SED "s?^;character_set_server =.*?character_set_server = utf8?g" /etc/my.cnf.d/server.cnf  # accentuated user names are allowed
-	[ -e /etc/my.cnf.d/feedback.cnf ] && $SED "s?^plugin-load.*?#&?g" /etc/my.cnf.d/feedback.cnf # remove the feedback plugin (ALCASAR doesn't report anything !)
-	[ -e /etc/my.cnf.d/auth_gssapi.cnf ] && $SED "s?^plugin-load.*?#&?g" /etc/my.cnf.d/auth_gssapi.cnf # remove GSS plugin (ALCASAR doesn't use Kerberos)
-	/usr/sbin/mysqld-prepare-db-dir > /dev/null 2>&1
+	/usr/sbin/mariadb-prepare-db-dir > /dev/null 2>&1
 	/usr/bin/systemctl set-environment MYSQLD_OPTS="--skip-grant-tables --skip-networking"
 	/usr/bin/systemctl start mysqld
 	nb_round=1
 	while [ ! -S /var/lib/mysql/mysql.sock ] && [ $nb_round -lt 10 ] # we wait until mariadb is on
 	do
 	then
 		echo "Problème : la base données 'MariaDB' ne s'est pas lancée !"
 		exit
 	fi
 # Secure the server
-	/usr/bin/mysql --execute "GRANT ALL PRIVILEGES ON *.* TO root@'localhost' IDENTIFIED BY '$mysqlpwd';"
+	/usr/bin/mariadb --execute "GRANT ALL PRIVILEGES ON *.* TO root@'localhost' IDENTIFIED BY '$dbpwd';"
-	MYSQL="/usr/bin/mysql -uroot -p$mysqlpwd --execute"
+	SQL="/usr/bin/mariadb -uroot -p$dbpwd --execute"
-	$MYSQL "DROP DATABASE IF EXISTS test;DROP DATABASE IF EXISTS tmp;"
+	$SQL "DROP DATABASE IF EXISTS test;DROP DATABASE IF EXISTS tmp;"
-	$MYSQL "CONNECT mysql;DELETE from user where User='';DELETE FROM user WHERE User='root' AND Host NOT IN ('localhost','127.0.0.1','::1');FLUSH PRIVILEGES;"
+	$SQL "CONNECT mysql;DELETE from user where User='';DELETE FROM user WHERE User='root' AND Host NOT IN ('localhost','127.0.0.1','::1');FLUSH PRIVILEGES;"
 # Create 'radius' database
-	$MYSQL "CREATE DATABASE IF NOT EXISTS $DB_RADIUS;GRANT ALL ON $DB_RADIUS.* TO $DB_USER@localhost IDENTIFIED BY '$radiuspwd';FLUSH PRIVILEGES;"
+	$SQL "CREATE DATABASE IF NOT EXISTS $DB_RADIUS;GRANT ALL ON $DB_RADIUS.* TO $DB_USER@localhost IDENTIFIED BY '$radiuspwd';FLUSH PRIVILEGES;"
 # Add an empty radius database structure
-	/usr/bin/mysql -u$DB_USER -p$radiuspwd $DB_RADIUS < $DIR_CONF/empty-radiusd-db.sql
+	/usr/bin/mariadb -u$DB_USER -p$radiuspwd $DB_RADIUS < $DIR_CONF/empty-radiusd-db.sql
 # modify the start script in order to close accounting connexion when the system is comming down or up
-	cp /lib/systemd/system/mysqld.service /etc/systemd/system/mysqld.service
+	cp /lib/systemd/system/mysqld.service /etc/systemd/system/mariadb.service
+	$SED "s?^ExecStart=.*?ExecStart=/usr/sbin/mariadbd?g" /etc/systemd/system/mariadb.service
-	$SED "/^ExecStart=/a ExecStop=$DIR_DEST_BIN/alcasar-mysql.sh -acct_stop" /etc/systemd/system/mysqld.service
+	$SED "/^ExecStart=/a ExecStop=$DIR_DEST_BIN/alcasar-mariadb.sh -acct_stop" /etc/systemd/system/mariadb.service
-	$SED "/^ExecStop=/a ExecStartPost=$DIR_DEST_BIN/alcasar-mysql.sh -acct_stop" /etc/systemd/system/mysqld.service
+	$SED "/^ExecStop=/a ExecStartPost=$DIR_DEST_BIN/alcasar-mariadb.sh -acct_stop" /etc/systemd/system/mariadb.service
 	/usr/bin/systemctl unset-environment MYSQLD_OPTS
+	/usr/bin/systemctl stop mysqld
-	/usr/bin/systemctl daemon-reload
+	/usr/bin/systemctl start mariadb
 } # End of init_db()
 ###################################################################
 ##                           "freeradius"                        ##
 ## - Set the configuration files                                 ##
 ## - Set the shared secret between coova-chilli and freeradius   ##
-## - Adapt the Mysql conf file and counters                      ##
+## - Adapt the MariaDB conf file and counters                      ##
 ###################################################################
 freeradius()
+{
 	cp -f $DIR_CONF/empty-radiusd-db.sql /etc/raddb/
 	chown -R radius:radius /etc/raddb
 	chown -R radius:radius /etc/raddb/mods-config/sql/main/mysql/queries.conf
 # sqlcounter modifications
 	[ -e /etc/raddb/mods-available/sqlcounter.default ] || cp /etc/raddb/mods-available/sqlcounter /etc/raddb/mods-available/sqlcounter.default
 	cp -f $DIR_CONF/radius/sqlcounter /etc/raddb/mods-available/sqlcounter
 	chown -R radius:radius /etc/raddb/mods-available/sqlcounter
-# make certain that mysql is up before freeradius start
+# make certain that mariaDB is up before freeradius start
 	cp /lib/systemd/system/radiusd.service /etc/systemd/system/radiusd.service
-	$SED "s?^After=.*?After=syslog.target network.target mysqld.service?g" /etc/systemd/system/radiusd.service
+	$SED "s?^After=.*?After=syslog.target network.target mariadb.service?g" /etc/systemd/system/radiusd.service
 	/usr/bin/systemctl daemon-reload
 # Allow apache to change some conf files (ie : ldap on/off)
 	chgrp apache /etc/raddb /etc/raddb/sites-available /etc/raddb/mods-available
 	chmod 750 /etc/raddb /etc/raddb/sites-available /etc/raddb/mods-available
 } # End of freeradius()
 0 * * 0 root nice -n 19 run-parts --report /etc/cron.weekly
 0 1 * * root nice -n 19 run-parts --report /etc/cron.monthly
 EOF
 	[ -e /etc/anacrontab.default ] || cp /etc/anacrontab /etc/anacrontab.default
 	cat <<EOF >> /etc/anacrontab
-	8	cron.MysqlDump		nice /etc/cron.d/alcasar-mysql
+	8	cron.MariaDBDump	nice /etc/cron.d/alcasar-mariadb
 	10	cron.logExport		nice /etc/cron.d/alcasar-archive
 EOF
-	cat <<EOF > /etc/cron.d/alcasar-mysql
+	cat <<EOF > /etc/cron.d/alcasar-mariadb
 # Verify, repair and export users database (every monday at 4:45 am)
-4 * * 1 root $DIR_DEST_BIN/alcasar-mysql.sh --dump
+4 * * 1 root $DIR_DEST_BIN/alcasar-mariadb.sh --dump
 # Remove users whose expiration date is exceeded for more more than 7 days (every Monday at 4:40 am)
-4 * * * root $DIR_DEST_BIN/alcasar-mysql.sh --expire_user 2>&1 >/dev/null
+4 * * * root $DIR_DEST_BIN/alcasar-mariadb.sh --expire_user 2>&1 >/dev/null
 EOF
 	cat <<EOF > /etc/cron.d/alcasar-archive
 # Archiving logs (traceability & users database) (every Monday at 5:35 am)
 5 * * 1 root $DIR_DEST_BIN/alcasar-archive.sh --now
 EOF
 	groupadd -f gammu_smsd
 	useradd -r -g gammu_smsd -s /bin/false -c "system user for gammu_smsd" gammu_smsd
 	usermod -a -G dialout gammu_smsd
 # Create 'gammu' database
-	MYSQL="/usr/bin/mysql -uroot -p$mysqlpwd --execute"
+	SQL="/usr/bin/mariadb -uroot -p$dbpwd --execute"
-	$MYSQL "CREATE DATABASE IF NOT EXISTS $DB_GAMMU; GRANT ALL ON $DB_GAMMU.* TO $DB_USER@localhost IDENTIFIED BY '$radiuspwd'; FLUSH PRIVILEGES;"
+	$SQL "CREATE DATABASE IF NOT EXISTS $DB_GAMMU; GRANT ALL ON $DB_GAMMU.* TO $DB_USER@localhost IDENTIFIED BY '$radiuspwd'; FLUSH PRIVILEGES;"
 # Add a gammu database structure
-	/usr/bin/mysql -u$DB_USER -p$radiuspwd $DB_GAMMU < $DIR_CONF/empty-gammu-smsd-db.sql
+	/usr/bin/mariadb -u$DB_USER -p$radiuspwd $DB_GAMMU < $DIR_CONF/empty-gammu-smsd-db.sql
 # Config file for the gammu_smsd daemon & gammu (ttyUSB0 as default com port)
 	cat << EOF > /etc/gammurc
 [gammu]
 device = /dev/ttyUSB0
 # Create the systemd unit
 	cat << EOF > /etc/systemd/system/gammu-smsd.service
 [Unit]
 Description=SMS daemon for Gammu
 Documentation=man:gammu-smsd(1)
-After=network.target mysqld.service
+After=network.target mariadb.service
 [Service]
 Type=forking
 ExecStart=/usr/bin/gammu-smsd --config /etc/gammu_smsd_conf --user=gammu_smsd --group=gammu_smsd --pid=/run/gammu-smsd.pid --daemon
 ExecReload=/bin/kill -HUP $MAINPID
 	do
 		find /var/log/$dir -type f -name "*.log-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]" -exec gzip {} \;
 	done
 	/usr/bin/systemctl daemon-reload
 # processes started at boot time (Systemctl)
-	for i in alcasar-network mysqld httpd ntpd iptables unbound unbound-blacklist unbound-whitelist unbound-blackhole radiusd nfcapd nfsen-ng e2guardian ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban vnstat sshd
+	for i in alcasar-network mariadb httpd ntpd iptables unbound unbound-blacklist unbound-whitelist unbound-blackhole radiusd nfcapd nfsen-ng e2guardian ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban vnstat sshd
 	do
 		/usr/bin/systemctl -q enable $i.service
 	done
 # disable processes at boot time (Systemctl)

Subversion Repositories ALCASAR

(root)/alcasar.sh @ 3200 – Rev 3257 → 3269