Subversion Repositories ALCASAR

Rev

Rev 3222 | Rev 3231 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 3222 Rev 3230
Line 1... Line 1...
1
#!/bin/bash
1
#!/bin/bash
2
#  $Id: alcasar.sh 3222 2024-07-17 09:56:42Z rexy $
2
#  $Id: alcasar.sh 3230 2024-11-06 23:38:15Z rexy $
3
 
3
 
4
# ALCASAR is a Free and open source NAC (Network Access Controler) created by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy)
4
# ALCASAR is a Free and open source NAC (Network Access Controler) created by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy)
5
# ALCASAR is based on a stripped Mageia (LSB) with the following open source softwares Coovachilli, freeradius, mariaDB, lighttpd, php, netfilter, e2guardian, ntpd, openssl, unbound, gammu, Ulog, fail2ban, vnstat, wkhtml2pdf, ipt_NETFLOW, NFsen and NFdump
5
# ALCASAR is based on a stripped Mageia (LSB) with the following open source softwares Coovachilli, freeradius, mariaDB, apache, php, netfilter, e2guardian, ntpd, openssl, unbound, gammu, Ulog, fail2ban, vnstat, wkhtml2pdf, ipt_NETFLOW, NFsen and NFdump
6
# contact : info@alcasar.net
6
# contact : info@alcasar.net
7
 
7
 
8
# Install script for ALCASAR (a secured and authenticated Internet access control captive portal)
8
# Install script for ALCASAR (a secured and authenticated Internet access control captive portal)
9
# This script is distributed under the Gnu General Public License (GPLV3)
9
# This script is distributed under the Gnu General Public License (GPLV3)
10
 
10
 
Line 46... Line 46...
46
DIR_INSTALL=`pwd`						# current directory
46
DIR_INSTALL=`pwd`						# current directory
47
DIR_CONF="$DIR_INSTALL/conf"			# install directory (with conf files)
47
DIR_CONF="$DIR_INSTALL/conf"			# install directory (with conf files)
48
DIR_SCRIPTS="$DIR_INSTALL/scripts"		# install directory (with script files)
48
DIR_SCRIPTS="$DIR_INSTALL/scripts"		# install directory (with script files)
49
DIR_BLACKLIST="$DIR_INSTALL/blacklist"	# install directory (with blacklist files)
49
DIR_BLACKLIST="$DIR_INSTALL/blacklist"	# install directory (with blacklist files)
50
DIR_SAVE="/var/Save"					# backup directory (traceability_log, user_db, security_log)
50
DIR_SAVE="/var/Save"					# backup directory (traceability_log, user_db, security_log)
51
DIR_WEB="/var/www/html"					# directory of Lighttpd
51
DIR_WEB="/var/www/html"					# directory of Apache
52
DIR_E2G="/etc/e2guardian"				# directory of E2Guardian
52
DIR_E2G="/etc/e2guardian"				# directory of E2Guardian
53
DIR_ACC="$DIR_WEB/acc"					# directory of the 'ALCASAR Control Center'
53
DIR_ACC="$DIR_WEB/acc"					# directory of the 'ALCASAR Control Center'
54
DIR_DEST_BIN="/usr/local/bin"			# directory of ALCASAR scripts
54
DIR_DEST_BIN="/usr/local/bin"			# directory of ALCASAR scripts
55
DIR_DEST_ETC="/usr/local/etc"			# directory of ALCASAR conf files
55
DIR_DEST_ETC="/usr/local/etc"			# directory of ALCASAR conf files
56
DIR_DEST_SHARE="/usr/local/share"		# directory of share files used by ALCASAR (unbound for instance)
56
DIR_DEST_SHARE="/usr/local/share"		# directory of share files used by ALCASAR (unbound for instance)
Line 774... Line 774...
774
# the script "$DIR_DEST_BIN/alcasar-iptables.sh" is started at the end of this script in order not to cut network flow in case of using ssh
774
# the script "$DIR_DEST_BIN/alcasar-iptables.sh" is started at the end of this script in order not to cut network flow in case of using ssh
775
} # End of network()
775
} # End of network()
776
 
776
 
777
##################################################################
777
##################################################################
778
##                           "CA"                               ##
778
##                           "CA"                               ##
779
## - Creating the CA and the server certificate (lighttpd)      ##
779
## - Creating the CA and the server certificate (httpd)         ##
780
##################################################################
780
##################################################################
781
CA()
781
CA()
782
{
782
{
783
	$DIR_DEST_BIN/alcasar-CA.sh
783
	$DIR_DEST_BIN/alcasar-CA.sh
784
	chmod 755 /etc/pki/
784
	chmod 755 /etc/pki/
Line 792... Line 792...
792
} # End of CA()
792
} # End of CA()
793
 
793
 
794
######################################################
794
######################################################
795
##                       "ACC"                      ##
795
##                       "ACC"                      ##
796
## - copy ALCASAR Control Center (ACC) files        ##
796
## - copy ALCASAR Control Center (ACC) files        ##
797
## - configuration of the web server (Lighttpd)     ##
797
## - configuration of the web server (Apache)       ##
798
## - creation of the first ACC admin account        ##
798
## - creation of the first ACC admin account        ##
799
## - secure the ACC access                          ##
799
## - secure the ACC access                          ##
800
######################################################
800
######################################################
801
ACC()
801
ACC()
802
{
802
{
Line 844... Line 844...
844
	$SED "s?^display_errors.*?display_errors = Off?" /etc/php.ini
844
	$SED "s?^display_errors.*?display_errors = Off?" /etc/php.ini
845
	$SED "s?^display_startup_errors.*?display_startup_errors = Off?" /etc/php.ini
845
	$SED "s?^display_startup_errors.*?display_startup_errors = Off?" /etc/php.ini
846
	$SED "s?^html_errors.*?html_errors = Off?g" /etc/php.ini
846
	$SED "s?^html_errors.*?html_errors = Off?g" /etc/php.ini
847
	$SED "s?^expose_php.*?expose_php = Off?g" /etc/php.ini
847
	$SED "s?^expose_php.*?expose_php = Off?g" /etc/php.ini
848
	$SED "s?^allow_url_fopen.*?allow_url_fopen = Off?" /etc/php.ini
848
	$SED "s?^allow_url_fopen.*?allow_url_fopen = Off?" /etc/php.ini
849
# Configuring & securing Lighttpd
849
# Configuring & securing Apache
850
	rm -rf /var/www/cgi-bin/* /var/www/perl/* /var/www/icons/README* /var/www/error/README*
850
	rm -rf /var/www/cgi-bin/* /var/www/perl/* /var/www/icons/README* /var/www/error/README*
851
	[ -e /etc/lighttpd/lighttpd.conf.default ] || cp /etc/lighttpd/lighttpd.conf /etc/lighttpd/lighttpd.conf.default
851
	[ -e /etc/httpd/conf/httpd.conf.default ] || cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.default
852
	$SED "s?^#server\.bind.*?server\.bind = \"$PRIVATE_IP\"?g" /etc/lighttpd/lighttpd.conf
852
	$SED "s?^#ServerName.*?ServerName $HOSTNAME.$DOMAIN?g" /etc/httpd/conf/httpd.conf
853
	$SED "s?^server\.bind.*?server\.bind = \"$PRIVATE_IP\"?g" /etc/lighttpd/lighttpd.conf
853
	$SED "s?^Listen.*?Listen $PRIVATE_IP:80?g" /etc/httpd/conf/httpd.conf
854
	$SED "s?^#server\.tag.*?server\.tag = \"\"?g" /etc/lighttpd/lighttpd.conf
854
	$SED "s?Options Indexes.*?Options -Indexes?g" /etc/httpd/conf/httpd.conf
-
 
855
	echo "ServerTokens Prod" >> /etc/httpd/conf/httpd.conf
855
	echo "include \"vhosts.d/alcasar.conf\"" >> /etc/lighttpd/lighttpd.conf
856
	echo "ServerSignature Off" >> /etc/httpd/conf/httpd.conf
856
 
-
 
857
	[ -e /etc/lighttpd/modules.conf.default ] || cp /etc/lighttpd/modules.conf /etc/lighttpd/modules.conf.default
857
	[ -e /etc/httpd/conf/modules.d/00_base.conf.default ] || cp /etc/httpd/conf/modules.d/00_base.conf /etc/httpd/conf/modules.d/00_base.conf.default
858
	$SED "s?^#[ ]*\"mod_auth\",.*?\"mod_auth\",?g" /etc/lighttpd/modules.conf
858
	$SED "s?^LoadModule authn_anon_module.*?#LoadModule authn_anon_module modules/mod_authn_anon.so?g" /etc/httpd/conf/modules.d/00_base.conf
859
	$SED "s?^#[ ]*\"mod_authn_file\",.*?\"mod_authn_file\",?g" /etc/lighttpd/modules.conf
859
	$SED "s?^LoadModule status_module.*?#LoadModule status_module modules/mod_status.so?g" /etc/httpd/conf/modules.d/00_base.conf
860
	$SED "s?^#[ ]*\"mod_alias\",.*?\"mod_alias\",?g" /etc/lighttpd/modules.conf
860
	$SED "s?^LoadModule info_module.*?#LoadModule info_module modules/mod_info.so?g" /etc/httpd/conf/modules.d/00_base.conf
861
	$SED "s?^#[ ]*\"mod_redirect\",.*?\"mod_redirect\",?g" /etc/lighttpd/modules.conf
861
	$SED "s?^LoadModule imagemap_module.*?#LoadModule imagemap_module modules/mod_imagemap.so?g" /etc/httpd/conf/modules.d/00_base.conf
862
	$SED "/^[ ]*\"mod_redirect\",/a\"mod_openssl\"," /etc/lighttpd/modules.conf
862
	$SED "s?^LoadModule rewrite_module.*?#LoadModule rewrite_module modules/mod_rewrite.so?g" /etc/httpd/conf/modules.d/00_base.conf
863
	$SED "s?^#include conf_dir + \"/conf.d/fastcgi.conf\".*?include conf_dir + \"/conf.d/fastcgi.conf\"?g" /etc/lighttpd/modules.conf
863
	$SED "s?^LoadModule speling_module.*?#LoadModule speling_module modules/mod_speling.so?g" /etc/httpd/conf/modules.d/00_base.conf
864
 
-
 
865
	[ -e /etc/lighttpd/conf.d/fastcgi.conf.default ] || cp /etc/lighttpd/conf.d/fastcgi.conf /etc/lighttpd/conf.d/fastcgi.conf.default
864
	[ -e /etc/httpd/conf/conf.d/ssl.conf.default ] || cp /etc/httpd/conf/conf.d/ssl.conf /etc/httpd/conf/conf.d/ssl.conf.default
-
 
865
	echo "Listen $PRIVATE_IP:443" > /etc/httpd/conf/conf.d/ssl.conf # Listen only on INTIF
-
 
866
	echo "SSLProtocol all -SSLv2 -SSLv3" >> /etc/httpd/conf/conf.d/ssl.conf  # exclude vulnerable protocols
-
 
867
	echo "SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS" >> /etc/httpd/conf/conf.d/ssl.conf # Define the cipher suite
-
 
868
	echo "SSLHonorCipherOrder on" >> /etc/httpd/conf/conf.d/ssl.conf # The Browser must respect the order of the cipher suite
-
 
869
	echo "SSLPassPhraseDialog  builtin" >> /etc/httpd/conf/conf.d/ssl.conf # in case of passphrase the dialog will be perform on stdin
-
 
870
	echo "SSLSessionCache \"shmcb:/run/httpd/ssl_scache(512000)\"" >> /etc/httpd/conf/conf.d/ssl.conf # default cache size
-
 
871
	echo "SSLSessionCacheTimeout 300" >> /etc/httpd/conf/conf.d/ssl.conf # default cache time in seconds
-
 
872
# Error page management
-
 
873
	[ -e /etc/httpd/conf/conf.d/multilang-errordoc.conf.default ] || cp /etc/httpd/conf/conf.d/multilang-errordoc.conf /etc/httpd/conf/conf.d/multilang-errordoc.conf.default
866
	cp $DIR_CONF/lighttpd/conf.d/fastcgi.conf /etc/lighttpd/conf.d/fastcgi.conf
874
	cat <<EOF > /etc/httpd/conf/conf.d/multilang-errordoc.conf
-
 
875
Alias /error/ "/var/www/html/"
-
 
876
<Directory "/usr/share/httpd/error">
-
 
877
    AllowOverride None
-
 
878
    Options IncludesNoExec
-
 
879
    AddOutputFilter Includes html
-
 
880
    AddHandler type-map var
-
 
881
    Require all granted
-
 
882
    LanguagePriority en cs de es fr it ja ko nl pl pt-br ro sv tr
-
 
883
    ForceLanguagePriority Prefer Fallback
-
 
884
</Directory>
-
 
885
ErrorDocument 400 /error/error.php?error=400
-
 
886
ErrorDocument 401 /error/error.php?error=401
-
 
887
ErrorDocument 403 /error/error.php?error=403
-
 
888
ErrorDocument 404 /error/index.php
-
 
889
ErrorDocument 405 /error/error.php?error=405
-
 
890
ErrorDocument 408 /error/error.php?error=408
-
 
891
ErrorDocument 410 /error/error.php?error=410
-
 
892
ErrorDocument 411 /error/error.php?error=411
-
 
893
ErrorDocument 412 /error/error.php?error=412
-
 
894
ErrorDocument 413 /error/error.php?error=413
-
 
895
ErrorDocument 414 /error/error.php?error=414
-
 
896
ErrorDocument 415 /error/error.php?error=415
-
 
897
ErrorDocument 500 /error/error.php?error=500
-
 
898
ErrorDocument 501 /error/error.php?error=501
-
 
899
ErrorDocument 502 /error/error.php?error=502
-
 
900
ErrorDocument 503 /error/error.php?error=503
-
 
901
ErrorDocument 506 /error/error.php?error=506
867
 
902
EOF
868
	[ -e /etc/php-fpm.conf.default ] || cp /etc/php-fpm.conf /etc/php-fpm.conf.default
903
	[ -e /usr/share/httpd/error/include/top.html.default ] || cp /usr/share/httpd/error/include/top.html /usr/share/httpd/error/include/top.html.default
869
	$SED "s?^;listen\.owner.*?listen\.owner = apache?g" /etc/php-fpm.conf
904
	$SED "s?background-color.*?background-color: #EFEFEF; }?g" /usr/share/httpd/error/include/top.html
870
	$SED "s?^;listen\.group.*?listen\.group = apache?g" /etc/php-fpm.conf
905
	[ -e /usr/share/httpd/error/include/bottom.html.default ] || cp /usr/share/httpd/error/include/bottom.html /usr/share/httpd/error/include/bottom.html.default
871
	$SED "s?^;listen\.mode.*?listen\.mode = 0660?g" /etc/php-fpm.conf
906
	cat <<EOF > /usr/share/httpd/error/include/bottom.html
-
 
907
</body>
-
 
908
</html>
872
 
909
EOF
-
 
910
# ACC partitioning
873
	[ -d /etc/lighttpd/vhosts.d ] || mkdir /etc/lighttpd/vhosts.d
911
	rm -f /etc/httpd/conf/vhosts.d/alcasar*
874
	cp $DIR_CONF/lighttpd/vhosts.d/* /etc/lighttpd/vhosts.d/
912
	cat <<EOF > /etc/httpd/conf/vhosts.d/alcasar.conf
-
 
913
<Directory $DIR_WEB>
-
 
914
        AllowOverride None
-
 
915
        Order deny,allow
-
 
916
        Deny from all
-
 
917
        Allow from 127.0.0.1
-
 
918
        Allow from $PRIVATE_NETWORK_MASK
-
 
919
        ErrorDocument 404 https://$HOSTNAME.$DOMAIN/
-
 
920
</Directory>
-
 
921
<Directory $DIR_WEB/certs>
-
 
922
        AddType application/x-x509-ca-cert crt
-
 
923
</Directory>
-
 
924
<Directory $DIR_ACC>
-
 
925
        SSLRequireSSL
-
 
926
        AllowOverride None
-
 
927
        Order deny,allow
-
 
928
        Deny from all
-
 
929
        Allow from 127.0.0.1
-
 
930
        Allow from $PRIVATE_NETWORK_MASK
-
 
931
        require valid-user
-
 
932
        AuthType digest
-
 
933
        AuthName "ALCASAR Control Center (ACC)"
-
 
934
        AuthDigestDomain $HOSTNAME.$DOMAIN
875
	$SED 's/^$SERVER\["socket"\] == ".*:443.*/$SERVER\["socket"\] == "'"$PRIVATE_IP"':443" {/g' /etc/lighttpd/vhosts.d/alcasar-with-ssl.conf /etc/lighttpd/vhosts.d/alcasar-without-ssl.conf
935
        BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
-
 
936
        AuthUserFile $DIR_DEST_ETC/digest/key_all
-
 
937
        ErrorDocument 404 https://$HOSTNAME.$DOMAIN/
-
 
938
</Directory>
-
 
939
<Directory $DIR_ACC/admin>
-
 
940
        SSLRequireSSL
-
 
941
        AllowOverride None
-
 
942
        Order deny,allow
-
 
943
        Deny from all
-
 
944
        Allow from 127.0.0.1
-
 
945
        Allow from $PRIVATE_NETWORK_MASK
-
 
946
        require valid-user
-
 
947
        AuthType digest
-
 
948
        AuthName "ALCASAR Control Center (ACC)"
-
 
949
        AuthDigestDomain $HOSTNAME.$DOMAIN
876
	$SED "s/^\([\t ]*\)var.server_name.*/\1var.server_name = \"$PRIVATE_IP\"/g" /etc/lighttpd/vhosts.d/alcasar-with-ssl.conf /etc/lighttpd/vhosts.d/alcasar-without-ssl.conf
950
        BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
-
 
951
        AuthUserFile $DIR_DEST_ETC/digest/key_admin
-
 
952
        ErrorDocument 404 https://$HOSTNAME.$DOMAIN/
-
 
953
</Directory>
-
 
954
<Directory $DIR_ACC/manager>
-
 
955
        SSLRequireSSL
-
 
956
        AllowOverride None
-
 
957
        Order deny,allow
-
 
958
        Deny from all
-
 
959
        Allow from 127.0.0.1
-
 
960
        Allow from $PRIVATE_NETWORK_MASK
-
 
961
        require valid-user
-
 
962
        AuthType digest
-
 
963
        AuthName "ALCASAR Control Center (ACC)"
-
 
964
        AuthDigestDomain $HOSTNAME.$DOMAIN
877
	ln -s /etc/lighttpd/vhosts.d/alcasar-without-ssl.conf /etc/lighttpd/vhosts.d/alcasar.conf
965
        BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
-
 
966
        AuthUserFile $DIR_DEST_ETC/digest/key_manager
-
 
967
        ErrorDocument 404 https://$HOSTNAME.$DOMAIN/
878
 
968
</Directory>
-
 
969
<Directory $DIR_ACC/backup>
-
 
970
        SSLRequireSSL
-
 
971
        AllowOverride None
-
 
972
        Order deny,allow
-
 
973
        Deny from all
-
 
974
        Allow from 127.0.0.1
-
 
975
        Allow from $PRIVATE_NETWORK_MASK
-
 
976
        require valid-user
-
 
977
        AuthType digest
-
 
978
        AuthName "ALCASAR Control Center (ACC)"
879
	[ -d /var/log/lighttpd ] || mkdir /var/log/lighttpd
979
        AuthDigestDomain $HOSTNAME.$DOMAIN
880
	[ -e /var/log/lighttpd/access.log ] || touch /var/log/lighttpd/access.log
980
        BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
881
	[ -e /var/log/lighttpd/error.log ] || touch /var/log/lighttpd/error.log
981
        AuthUserFile $DIR_DEST_ETC/digest/key_backup
-
 
982
        ErrorDocument 404 https://$HOSTNAME.$DOMAIN/
882
 
983
</Directory>
-
 
984
Alias /save/ "$DIR_SAVE/"
-
 
985
<Directory $DIR_SAVE>
-
 
986
        SSLRequireSSL
-
 
987
        Options Indexes
-
 
988
        Order deny,allow
-
 
989
        Deny from all
-
 
990
        Allow from 127.0.0.1
-
 
991
        Allow from $PRIVATE_NETWORK_MASK
-
 
992
        require valid-user
-
 
993
        AuthType digest
-
 
994
        AuthName "ALCASAR Control Center (ACC)"
883
	chown -R apache:apache /var/log/lighttpd
995
        AuthDigestDomain $HOSTNAME.$DOMAIN
-
 
996
        AuthUserFile $DIR_DEST_ETC/digest/key_backup
-
 
997
        ErrorDocument 404 https://$HOSTNAME.$DOMAIN/
-
 
998
</Directory>
884
 
999
EOF
885
# Creation of the first account (in 'admin' profile)
1000
# Creation of the first account (in 'admin' profile)
886
	if [ "$mode" = "install" ]
1001
	if [ "$mode" = "install" ]
887
	then
1002
	then
888
		header_install
1003
		header_install
889
# Creation of keys file for the admin account ("admin")
1004
# Creation of keys file for the admin account ("admin")
Line 900... Line 1015...
900
		done
1015
		done
901
	fi
1016
	fi
902
# Creation of ACC certs links
1017
# Creation of ACC certs links
903
	[ -d /var/www/html/certs ] || mkdir /var/www/html/certs
1018
	[ -d /var/www/html/certs ] || mkdir /var/www/html/certs
904
	ln -s /etc/pki/CA/alcasar-ca.crt /var/www/html/certs/certificat_alcasar_ca.crt
1019
	ln -s /etc/pki/CA/alcasar-ca.crt /var/www/html/certs/certificat_alcasar_ca.crt
905
# Run lighttpd after coova (in order waiting tun0 to be up)
1020
# Run Apache after coova (in order waiting tun0 to be up)
906
	cp /lib/systemd/system/lighttpd.service /etc/systemd/system/lighttpd.service
1021
	cp /lib/systemd/system/httpd.service /etc/systemd/system/httpd.service
907
	$SED "s?^After=.*?After=network.target remote-fs.target nss-lookup.target chilli.service?g" /etc/systemd/system/lighttpd.service
1022
	$SED "s?^After=.*?After=network.target remote-fs.target nss-lookup.target chilli.service?g" /etc/systemd/system/httpd.service
908
	# Log file for ACC access imputability
1023
	# Log file for ACC access imputability
909
	[ -e $DIR_SAVE/security/acc_access.log ] || touch $DIR_SAVE/security/acc_access.log
1024
	[ -e $DIR_SAVE/security/acc_access.log ] || touch $DIR_SAVE/security/acc_access.log
910
	chown root:apache $DIR_SAVE/security/acc_access.log
1025
	chown root:apache $DIR_SAVE/security/acc_access.log
911
	chmod 664 $DIR_SAVE/security/acc_access.log
1026
	chmod 664 $DIR_SAVE/security/acc_access.log
912
} # End of ACC()
1027
} # End of ACC()
Line 1803... Line 1918...
1803
bantime = 3m
1918
bantime = 3m
1804
findtime = 5m
1919
findtime = 5m
1805
EOF
1920
EOF
1806
 
1921
 
1807
## lighttpd-auth : Ban after 3 failed attempts on ACC. This "jail" uses the default "lighttpd-auth" f2b filter.
1922
## lighttpd-auth : Ban after 3 failed attempts on ACC. This "jail" uses the default "lighttpd-auth" f2b filter.
1808
	cat << EOF > /etc/fail2ban/jail.d/02-alcasar_lighttpd-auth.conf
1923
#	cat << EOF > /etc/fail2ban/jail.d/02-alcasar_lighttpd-auth.conf
1809
[lighttpd-auth]
1924
#[lighttpd-auth]
1810
enabled = true
1925
#enabled = true
1811
#enabled  = false
1926
#enabled  = false
1812
maxretry = 3
1927
#maxretry = 3
1813
bantime = 3m
1928
#bantime = 3m
1814
findtime = 3m
1929
#findtime = 3m
1815
EOF
1930
#EOF
1816
 
1931
 
1817
## mod-evasive : Ban after 3 failed retrieve page attempts (ie : unknown page)
1932
## mod-evasive : Ban after 3 failed retrieve page attempts (ie : unknown page)
1818
	cat << EOF > /etc/fail2ban/jail.d/03-alcasar_mod-evasive.conf
1933
	cat << EOF > /etc/fail2ban/jail.d/03-alcasar_mod-evasive.conf
1819
[alcasar_mod-evasive]
1934
[alcasar_mod-evasive]
1820
#enabled = true
1935
#enabled = true
1821
enabled = false
1936
enabled = false
1822
backend = auto
1937
backend = auto
1823
filter = alcasar_mod-evasive
1938
filter = alcasar_mod-evasive
1824
action = iptables-allports[name=alcasar_mod-evasive]
1939
action = iptables-allports[name=alcasar_mod-evasive]
1825
logpath = /var/log/lighttpd/access.log
1940
logpath = /var/log/httpd/access.log
1826
maxretry = 3
1941
maxretry = 3
1827
bantime = 3m
1942
bantime = 3m
1828
findtime = 3m
1943
findtime = 3m
1829
EOF
1944
EOF
1830
	cat << EOF > /etc/fail2ban/filter.d/alcasar_mod-evasive.conf
1945
	cat << EOF > /etc/fail2ban/filter.d/alcasar_mod-evasive.conf
Line 1839... Line 1954...
1839
enabled = true
1954
enabled = true
1840
#enabled = false
1955
#enabled = false
1841
backend = auto
1956
backend = auto
1842
filter = alcasar_intercept
1957
filter = alcasar_intercept
1843
action = iptables-allports[name=alcasar_intercept]
1958
action = iptables-allports[name=alcasar_intercept]
1844
logpath = /var/log/lighttpd/access.log
1959
logpath = /var/log/httpd/access.log
1845
maxretry = 5
1960
maxretry = 5
1846
bantime = 3m
1961
bantime = 3m
1847
findtime = 3m
1962
findtime = 3m
1848
EOF
1963
EOF
1849
	cat << EOF > /etc/fail2ban/filter.d/alcasar_intercept.conf
1964
	cat << EOF > /etc/fail2ban/filter.d/alcasar_intercept.conf
Line 1858... Line 1973...
1858
enabled = true
1973
enabled = true
1859
#enabled = false
1974
#enabled = false
1860
backend = auto
1975
backend = auto
1861
filter = alcasar_change-pwd
1976
filter = alcasar_change-pwd
1862
action = iptables-allports[name=alcasar_change-pwd]
1977
action = iptables-allports[name=alcasar_change-pwd]
1863
logpath = /var/log/lighttpd/access.log
1978
logpath = /var/log/httpd/access.log
1864
maxretry = 5
1979
maxretry = 5
1865
bantime = 3m
1980
bantime = 3m
1866
findtime = 3m
1981
findtime = 3m
1867
EOF
1982
EOF
1868
	cat << EOF > /etc/fail2ban/filter.d/alcasar_change-pwd.conf
1983
	cat << EOF > /etc/fail2ban/filter.d/alcasar_change-pwd.conf
Line 1879... Line 1994...
1879
	/usr/bin/touch /var/log/auth.log
1994
	/usr/bin/touch /var/log/auth.log
1880
# fail2ban unit
1995
# fail2ban unit
1881
	cp /lib/systemd/system/fail2ban.service /etc/systemd/system/fail2ban.service
1996
	cp /lib/systemd/system/fail2ban.service /etc/systemd/system/fail2ban.service
1882
	$SED '/ExecStart=/a\ExecStop=/usr/bin/fail2ban-client stop' /etc/systemd/system/fail2ban.service
1997
	$SED '/ExecStart=/a\ExecStop=/usr/bin/fail2ban-client stop' /etc/systemd/system/fail2ban.service
1883
	$SED '/Type=/a\PIDFile=/run/fail2ban/fail2ban.pid' /etc/systemd/system/fail2ban.service
1998
	$SED '/Type=/a\PIDFile=/run/fail2ban/fail2ban.pid' /etc/systemd/system/fail2ban.service
1884
	$SED '/After=*/c After=syslog.target network.target lighttpd.service' /etc/systemd/system/fail2ban.service
1999
	$SED '/After=*/c After=syslog.target network.target httpd.service' /etc/systemd/system/fail2ban.service
1885
} # End of fail2ban()
2000
} # End of fail2ban()
1886
 
2001
 
1887
########################################################
2002
########################################################
1888
##                  "gammu_smsd"                      ##
2003
##                  "gammu_smsd"                      ##
1889
## - Creating of SMS management database              ##
2004
## - Creating of SMS management database              ##
Line 2150... Line 2265...
2150
	cp -f $DIR_CONF/logrotate.d/* /etc/logrotate.d/
2265
	cp -f $DIR_CONF/logrotate.d/* /etc/logrotate.d/
2151
	chmod 644 /etc/logrotate.d/*
2266
	chmod 644 /etc/logrotate.d/*
2152
# Log compression
2267
# Log compression
2153
	$SED "s?^delaycompress.*?#&?g" /etc/logrotate.conf
2268
	$SED "s?^delaycompress.*?#&?g" /etc/logrotate.conf
2154
# actualisation des fichiers logs compressés
2269
# actualisation des fichiers logs compressés
2155
	for dir in firewall e2guardian lighttpd
2270
	for dir in firewall e2guardian httpd
2156
	do
2271
	do
2157
		find /var/log/$dir -type f -name "*.log-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]" -exec gzip {} \;
2272
		find /var/log/$dir -type f -name "*.log-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]" -exec gzip {} \;
2158
	done
2273
	done
2159
	/usr/bin/systemctl daemon-reload
2274
	/usr/bin/systemctl daemon-reload
2160
# processes started at boot time (Systemctl)
2275
# processes started at boot time (Systemctl)
2161
	for i in alcasar-network mysqld lighttpd php-fpm ntpd iptables unbound unbound-blacklist unbound-whitelist unbound-blackhole radiusd nfcapd e2guardian ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban vnstat sshd
2276
	for i in alcasar-network mysqld httpd ntpd iptables unbound unbound-blacklist unbound-whitelist unbound-blackhole radiusd nfcapd e2guardian ulogd-ssh ulogd-traceability ulogd-ext-access chilli fail2ban vnstat sshd
2162
	do
2277
	do
2163
		/usr/bin/systemctl -q enable $i.service
2278
		/usr/bin/systemctl -q enable $i.service
2164
	done
2279
	done
2165
 
2280
 
2166
# disable processes at boot time (Systemctl)
2281
# disable processes at boot time (Systemctl)