forked from noplacenoaddress/OpenBSD
-
Notifications
You must be signed in to change notification settings - Fork 0
/
setup_node
executable file
·2592 lines (2515 loc) · 90.8 KB
/
setup_node
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/ksh
# $Telecomlobby: setup_node,v 0.1 11/3/2021 21:01:04 taglio$
#
#unbound: https://blog.c6h12o6.org/post/unbound-dnssec-dns-over-tls/
#sshd: https:/github.com/vedetta-com/vedetta/blob/master/$basedir/src/usr/local/share/doc/vedetta/OpenSSH_Principals.md
#smptd: https://github.com/vedetta-com/caesonia
#smtpd: https://www.vultr.com/docs/an-openbsd-e-mail-server-using-opensmtpd-dovecot-rspamd-and-rainloop
#smtpd: https://prefetch.eu/blog/2020/email-server/
#smtpd: https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-dovecot-and-rspamd/
#smtpd: https://unixsheikh.com/tutorials/arch-linux-mail-server-tutorial-part-2-opensmtpd-dovecot-dkimproxy-and-lets-encrypt.html
#smtpd: https://wiki.archlinux.org/title/OpenSMTPD
#smtpd: https://git.sr.ht/~guidocella/personal-email-server-guide
#nsd and powerdns: https://github.com/vedetta-com/dithematic
#geoip and powerdns: https://doc.powerdns.com/authoritative/backends/geoip.html
#powerdns: https://github.com/PowerDNS/pdns
#geodns: https://jpmens.net/2015/11/12/geodns-with-powerdns-geoip-back-end/
#geodns: https://umbriel.fr/blog/Building_a_DIY_CDN:_traffic_distribution.html
#geodns: https://gdnsd.org/
#ospf: NBMA design https://www.blackhole-networks.com/OSPF_overload/
#ospf: https://www.blackhole-networks.com/OSPF
#dnssec: https://help.dreamhost.com/hc/en-us/articles/219539467
#dnssec: https://github.com/redeltaglio/OpenBSD/raw/master/pdf/dnssec-lacnic-sep2016.handouts.pdf
#dnssec: https://dnsviz.net/
#nsd: https://zonemaster.net/domain_check
#nsd: https://dnschecker.org/
#xl2tpd client: https://findelabs.com/post/connecting-to-openbsd-l2tp-ipsec-vpn/
#audit: https://cisofy.com/lynis/
#tricks: https://ioctl.uk/2018/11/openbsd-hardening-tricks/
#pleroma: https://docs-develop.pleroma.social/backend/
#pleroma: https://umbriel.fr/blog/Pleroma_installation_report.html
# https://github.com/banesullivan/localtileserver
# https://zx2c4.com/ip
# vnstat: https://humdi.net/vnstat/
# FQ-codel: https://help.ui.com/hc/en-us/articles/220716608-EdgeRouter-Quality-of-Service-QoS-Advanced-Queue
# ports rebuild and customize: https://www.exoticsilicon.com/jay/reckless_guide_to_openbsd/dpb
# ctrl: https://oss.oetiker.ch/smokeping/
# ospf: https://rickfreyconsulting.com/rosv6-ospfv2-quick-refrence-guide/
# antispam: http://www.benzedrine.ch/
# memory based filesystem FreeBSD: mdmfs -M -S -o async -s 200m md0 /mnt
#####
#
#TODO ssh reverse tool in installation to launch different process executed by hand
# configure to create /tmp/config.ini
#
#
#####
#set -o errexit
set -o nounset
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/Bin:/home/taglio/Sources/Git/altBSD_network
BACKUPS="/root/Backups"
#GLOBAL VAR
uid=$(id -u)
wheeluser=$(cat /etc/group | grep wheel | sed "s|wheel:\*:0:root||" | sed "s|^.*,||")
app=$(basename $0)
wheeluser=
ver=$(uname -a | awk '{print $3}')
egressinterface=$(ifconfig egress | cut -d : -f1 | head -n1)
publicip=$(ifconfig "${egressinterface}" | grep inet |grep -v inet6 | cut -d ' ' -f2)
publicnetmask=$(ifconfig "${egressinterface}" | grep inet | grep -v inet6 | awk '{print $4}')
publicbcast=$(ifconfig "${egressinterface}" | grep inet | grep -v inet6 | awk '{print $6}')
publichost=$(dig -x $publicip +short @8.8.8.8 | sed 's/.$//')
domainname=$(print $publichost | sed 's/^[^.]*.//')
typeset -u publichostname=$(echo $publichost | sed "s/.$domainname//")
defaultv4router=$(route -n show | awk '/default/{print $2}' | head -n 1)
macdefaultv4router=$(arp -an | grep -w $defaultv4router | awk '{print $2}')
#dyndns=$(host -t a cat-01.hopto.org | cut -d ' ' -f4)
basedir="/home/taglio/Sources/Git/altBSD_network"
tmpdir=$(mktemp -d)
datarelease=$(date +"%d%m%Y%H%m%S")
longdate=$(date)
userna=$(id -nu $uid)
ipv6ctrl=
ipv6egress=
ipv6prefix=
ipv6defrouter=
localipv6=$(ifconfig "${egressinterface}" | grep inet6 | grep % | awk '{print $2}' | sed "s|%.*||")
localprefix=$(ifconfig "${egressinterface}" | grep inet6 | grep % | awk '{print $4}')
sha256ctrl=0
[[ -e /etc/hostname.vether0 ]] && \
routerid=$(cat /etc/hostname.vether0 | grep inet | awk '{print $2}' | sed "s/\/32//" | sed '/^$/d') && \
routeridlast=$(echo $routerid | cut -d . -f4)
umask 002
if [[ $uid -ne 0 ]]; then
print $0 "you've got to run $0 as UID=0 \n"
exit 1
fi
#if [[ $_ == "/bin/sh" ]]; then
#print $0 "you've got to run $0 with ksh command interpreter or directly\n"
#exit 1
#fi
if [[ $# -eq 0 ]]; then
print $0 "have to be used with the following options \
\n \
\n-I -> install \
\n-U -> upgrade \
\n-D -> daemons \
\n-A -> administrate \
\n"
exit 1
fi
function error_exit {
echo "${app}: ${1:-"Unknown Error"}" 1>&2
exit 1
}
function handler {
}
function pidof {
ps axc -o pid,command | awk "\$2~/^`echo $1`\$/ {print \$1}"
}
function pkg {
typeset var phase=$1
case $phase in
"shell")
pkg_add colorls nano wget fping iperf uptimed oidentd sqlite3 \
nmap ipcalc arpd
;;
"smtpd")
pkg_add opensmtpd-filter-rspamd \
dovecot dovecot-pigeonhole gnupg-- rspamd--
;;
"pdns")
pkg_add ldns-utils drill validns libyaml yaml-cpp luajit libmaxminddb
;;
"tor")
pkg_add tor privoxy
;;
"l2tp")
pkg_add x2ltpd
;;
"compile")
autoconfver=$(pkg_info -Q autoconf | grep -e "^autoconf-[0-9]" | tail -n 1 | sed "s| .*$||")
#automakever=$(pkg_info -Q automake | grep -e "^automake-[0-9]" | tail -n 1 | sed "s| .*$||")
automakever="automake-1.16.3"
pkg_add "${autoconfver}" "${automakever}" gmake-- bison ragel libtool boost
if [[ ! -e "/etc/profile" ]]; then
echo AUTOCONF_VERSION="$(echo "${autoconfver}" | sed "s|^autoconf-||")" >> "/etc/profile"
echo AUTOMAKE_VERSION="$(echo "${automakever}" | sed "s|^automake-||" | sed "s|.[0-9]$||")" >> "/etc/profile"
echo "export AUTOCONF_VERSION AUTOMAKE_VERSION" >> "/etc/profile"
fi
AUTOCONF_VERSION="$(echo "${autoconfver}" | sed "s|^autoconf-||")"
AUTOMAKE_VERSION="$(echo "${automakever}" | sed "s|^automake-||" | sed "s|.[0-9]p[0-9].*$||")"
export AUTOCONF_VERSION AUTOMAKE_VERSION
;;
esac
}
function cleanold {
typeset var directory=$1
for file in $directory*.old; do
if [[ -e "$file" ]]; then
mv $file $BACKUPS
fi
done
for file in $directory.*.old; do
if [[ -e "$file" ]]; then
mv $file $BACKUPS
fi
done
}
function custom {
[[ $(ifconfig "${egressinterface}" | grep inet6 | grep -v fe80 | grep -v temporary) != "" ]] && \
ipv6egress=$(ifconfig "${egressinterface}" | grep inet6 | grep -v fe80 | grep -v temporary| awk '{print $2}')
for file in $(find $1 -type f -maxdepth $2); do
(: "${hostname?}") 2>/dev/null && sed -i "s/\/HOSTNAME\//$hostname/g" $file
(: "${landomainname?}") 2>/dev/null && sed -i "s/\/LANDOMAINNAME\//$landomainname/g" $file
(: "${routerid?}") 2>/dev/null && sed -i "s/\/ROUTERID\//$routerid/g" $file
(: "${publichost?}") 2>/dev/null && sed -i "s/\/PUBLICHOST\//$publichost/g" $file
(: "${domainname?}") 2>/dev/null && sed -i "s/\/DOMAINNAME\//$domainname/g" $file
(: "${srcid?}") 2>/dev/null && sed -i "s/\/SRCID\//$srcid/g" $file
(: "${publichostname?}") 2>/dev/null && sed -i "s/\/PUBLICHOSTNAME\//$publichostname/g" $file
(: "${publicip?}") 2>/dev/null && sed -i "s/\/PUBLICIP\//$publicip/g" $file
(: "${dyndns?}") 2>/dev/null && sed -i "s/\/DYNDNS\//$dyndns/g" $file
(: "${publicnetmask?}") 2>/dev/null && sed -i "s/\/PUBLICNETMASK\//$publicnetmask/g" $file
(: "${publicbcast?}") 2>/dev/null && sed -i "s/\/PUBLICBCAST\//$publicbcast/g" $file
(: "${ipv6egress?}") 2>/dev/null && sed -i "s/\/PUBV6\//${ipv6egress}/g" $file
(: "${ipv6prefix?}") 2>/dev/null && sed -i "s/\/PREFIX\//${ipv6prefix}/g" $file
(: "${localipv6?}") 2>/dev/null && sed -i "s/\/LOCALV6\//${localipv6}/g" $file
(: "${localprefix?}") 2>/dev/null && sed -i "s/\/LOCALPREFIX\//${localprefix}/g" $file
(: "${defaultv4router?}") 2>/dev/null && sed -i "s/\/ROUTEV4\//${defaultv4router}/g" $file
(: "${ipv6defrouter?}") 2>/dev/null && sed -i "s/\/ROUTEV6\//${ipv6defrouter}/g" $file
(: "${longdate?}") 2>/dev/null && sed -i "s/\/LONGDATE\//${longdate}/g" $file
(: "${egressinterface?}") 2>/dev/null && sed -i "s/\/EGRESS\//${egressinterface}/g" $file
done
}
function sha256compare {
if [[ -e $1 ]]; then
oldsha256=$(sha256 $1 | awk '{print $4}')
else
oldsha256=""
fi
newsha256=$(sha256 $2 | awk '{print $4}')
if [ "$oldsha256" != "$newsha256" ]; then
sha256ctrl=1
else
sha256ctrl=0
fi
}
function config_nsd {
serial=$(date +"%Y%m%d%S")
case $1 in
"basic")
case $2 in
"master")
install -o root -g _nsd -m 0540 "$basedir/src/var/nsd/etc/master.template" /var/nsd/etc/nsd.conf
custom "/var/nsd/etc/" 1
sed -i "s/\/GRESLAVE12\//$3/" /var/nsd/etc/nsd.conf
sed -i "s/\/GRESLAVE56\//$4/" /var/nsd/etc/nsd.conf
sed -i "s|/TSIG/|${5}|" /var/nsd/etc/nsd.conf
sed -i "s/\/NSDDOMAIN\//${6}/" /var/nsd/etc/nsd.conf
if [[ $(echo ${6} | grep -c "-") -ne 0 ]]; then
sed -i "s/\/ZONEFILE\//`echo ${6} | sed -e "s/-//g" -e "s/\.//g"`.zone/" /var/nsd/etc/nsd.conf
else
sed -i "s/\/ZONEFILE\//${6}.zone/" /var/nsd/etc/nsd.conf
fi
zonefile=$(cat /var/nsd/etc/nsd.conf | grep zonefile | awk '{print $2}' | sed "s/\"//g" | cut -d \/ -f2)
install -o root -g _nsd -m 0540 "$basedir/src/var/nsd/zones/master/zone.template" "/var/nsd/zones/master/$zonefile"
sed -i "s/\/NSDDOMAIN\//${6}/" "/var/nsd/zones/master/$zonefile"
ns1=$(whois $6 | grep Name\ Server | tail -n 3 | awk 'FNR == 1' | awk '{print $3}' | tr '[:upper:]' '[:lower:]')
ns2=$(whois $6 | grep Name\ Server | tail -n 3 | awk 'FNR == 2' | awk '{print $3}' | tr '[:upper:]' '[:lower:]')
ns3=$(whois $6 | grep Name\ Server | tail -n 3 | awk 'FNR == 3' | awk '{print $3}' | tr '[:upper:]' '[:lower:]')
sed -i "s/\/SERIAL\//${serial}/" "/var/nsd/zones/master/$zonefile"
sed -i "s/\/FIRST\//${ns1}/" "/var/nsd/zones/master/$zonefile"
sed -i "s/\/SECOND\//${ns2}/" "/var/nsd/zones/master/$zonefile"
sed -i "s/\/THIRD\//${ns3}/" "/var/nsd/zones/master/$zonefile"
[[ $(nsd-checkconf /var/nsd/etc/nsd.conf) == "" ]] && \
rcctl start nsd \
|| \
echo "NSD configuration failed" && \
exit 1
;;
"slave")
install -o root -g _nsd -m 0540 "$basedir/src/var/nsd/etc/slave.template" /var/nsd/etc/nsd.conf
custom "/var/nsd/etc/" 1
sed -i "s/\/GRESLAVE\//$3/" /var/nsd/etc/nsd.conf
sed -i "s|/TSIG/|${4}|" /var/nsd/etc/nsd.conf
sed -i "s/\/NSDDOMAIN\//${5}/" /var/nsd/etc/nsd.conf
if [[ $(echo ${5} | grep -c "-") -ne 0 ]]; then
sed -i "s/\/ZONEFILE\//`echo ${5} | sed -e "s/-//g" -e "s/\.//g"`.zone/" /var/nsd/etc/nsd.conf
else
sed -i "s/\/ZONEFILE\//${5}.zone/" /var/nsd/etc/nsd.conf
fi
[[ $(nsd-checkconf /var/nsd/etc/nsd.conf) == "" ]] && \
rcctl start nsd \
|| \
echo "NSD configuration failed" && \
exit 1
;;
esac
;;
*)
;;
esac
}
function jails {
[[ -e "/jails" ]] || mkdir "/jails"
[[ -e "/jails/${1}" ]] || mkdir -p "/jails/${1}/usr/{lib,libexec,local/lib/}" ; mkdir -p "/jails/${1}/var/{run,log}" ; mkdir "/jails/${1}/dev"
}
function config_pdns {
pkg "compile"
pkg "pdns"
jails "pdns"
su "${wheeluser}"
if [[ -d "/home/${wheeluser}/Sources/Git/pdns" ]]; then
cd "/home/${wheeluser}/Sources/Git/"
git pull
else
cd "/home/${wheeluser}/Sources/Git/"
git clone https://github.com/PowerDNS/pdns.git
fi
cd "${basedir}/../pdns"
autoreconf -vi
./configure --prefix="/jails/pdns" --with-modules="geoip" --disable-lua-records
gmake
cd docs
make html-docs
cd ..
make install
if [ 0 = $(grep -c MANPATH /etc/profile) ]; then
echo "MANPATH=:/jails/pdns/share/man" >> "/etc/profile"
echo "export MANPATH" >> "/etc/profile"
makewhatis "/jails/pdns/share/man"
export "MANPATH=:/jails/pdns/share/man"
fi
if ! getent passwd _powerdns 1>&-; then
useradd -m -u 609 -g =uid -c "PowerDNS Server" -d /nonexistent -s /sbin/nologin _powerdns
fi
cp -p "/usr/lib/"{libc++.so.8.0,libc++abi.so.5.0,libc.so.96.1,libcrypto.so.47.0,libpthread.so.26.1,libm.so.10.1} "/jails/pdns/usr/lib/"
cp -p "/usr/libexec/ld.so" "/jails/pdns/usr/libexec"
cp -p "/usr/local/lib/"{libmaxminddb.so.0.0,libyaml-cpp.so.3.0,libluajit-5.1.so.1.0} "/jails/pdns/usr/local/lib/"
rcctl set syslogd flags "-a /jails/pdns/dev/log"
rcctl restart syslogd
cd "/jails/pdns/dev"
sh "/dev/MAKEDEV" std
rm -rf console klog kmem ksysms mem stderr stdin stdout xf86 zero
cd "${basedir}"
[[ -d "/jails/pdns/etc/pdns" ]] || mkdir "/jails/pdns/etc/pdns"
[[ -L "/etc/pdns" ]] || ln -s "/jails/pdns/etc/pdns" "/etc/pdns"
[[ -e "/jails/pdns/etc/pdns/GeoLite2-Country.mmdb" ]] || cp "/var/db/GeoIP/GeoLite2-Country.mmdb" "/jails/pdns/etc/pdns/GeoLite2-Country.mmdb"
install -o root -g wheel -m 0644 "src/openbsd/pdns.openbsd" "/jails/pdns/etc/pdns/pdns.conf"
custom "/jails/pdns/etc/pdns"
ln -s "/jail/pdns/etc/pdns/pdns.conf" "/jails/pdns/etc"
install -o root -g wheel -m 0644 "src/openbsd/geo-zone.yml" "/jails/pdns/etc/pdns/geo-zone.yml"
[[ -e "/tmp/powerdns_distributed" ]] || echo "file uploaded from WS not found" ; exit 1
}
function edgeos_script {
sed -i "s/\/TUN\//tun$1/g" "/tmp/$pophost/ES-$publichostname-updown.sh"
sed -i "s/\/ROUTERIDLAST\//$2/g" "/tmp/$pophost/ES-$publichostname-updown.sh"
i=0
result=""
while [[ $i -le $1 ]]
do
otherstun="ctrltun${i}=\$(/sbin/ip route ls table \${PREFIX} | grep tun${i})"
result+=$(printf '%s' "$otherstun")$'\n'
sed -i "s|${result}|/OTHERSTUN/|" "/tmp/$pophost/ES-$publichostname-updown.sh"
(( i = i + 1 ))
done
i=0
metric=1
result=""
while [[ $i -lt $1 ]]
do
otherstun="[[ \$ctrltun${i} == "" ]] && /sbin/ip route add table \${PREFIX} metric ${metric} default nexthop dev tun${i}"
result+=$(printf '%s' "$otherstun")$'\n'
sed -i "s|${result}|/OTHERSTUN2/|" "/tmp/$pophost/ES-$publichostname-updown.sh"
(( i = i + 1 ))
(( metric = metric + 1 ))
done
}
function backup {
CURRENTBACKUP="$BACKUPS/$datarelease"
mkdir -p "$CURRENTBACKUP/$1/"
case $1 in
"static")
cp -p /etc/{hostname.$egressinterface,mygate} "$CURRENTBACKUP/$1/"
;;
"basic")
mkdir -p "$CURRENTBACKUP/$1/{$uidna,root,etc}"
for file in $(find "/home/$uidna" -type f -maxdepth 1 -name ".*"); do
cp -p $file "$CURRENTBACKUP/$1/$uidna"
done
for file in $(find "/root" -type f -maxdepth 1 -name ".*"); do
cp -p $file "$CURRENTBACKUP/$1/root"
done
cp -p /etc/{dhclient.conf,resolv.conf.tail,doas.conf,myname,sysctl.conf,hostname.vether0,daily.local,rc.local} "$CURRENTBACKUP/$1/etc"
;;
"users")
for file in $(find "/home/$uidna/Bin" -type f -maxdepth 1 ); do
cp -p $file "$CURRENTBACKUP/$1"
done
;;
"scripts")
for file in $(find "/root/Bin" -type f -maxdepth 1 ); do
cp -p $file "$CURRENTBACKUP/$1"
done
;;
"unbound")
mkdir -p "$CURRENTBACKUP/$1/{etc,db}"
for file in $(find "/var/unbound/etc" -type f -maxdepth 1); do
cp -p $file "$CURRENTBACKUP/$1/etc"
done
for file in $(find "/var/unbound/db" -type f -maxdepth 1); do
cp -p $file "$CURRENTBACKUP/$1/db"
done
;;
"ssh")
for file in $(find "/etc/ssh" -type f -maxdepth 2); do
cp -p $file "$CURRENTBACKUP/$1/"
done
;;
"ipsec")
cp -Rp /etc/iked/ "$CURRENTBACKUP/$1/"
cp -p /etc/{iked.conf,iked.conf.*} "$CURRENTBACKUP/$1/"
;;
"gre")
configuration "gre"
;;
"pf")
for file in $(find "/etc" -type f -maxdepth 1 -name "pf.*"); do
cp -p $file "$CURRENTBACKUP/$1/"
done
;;
"ospf")
configuration "ospf"
;;
"ntpd")
configuration "ntpd"
;;
"remote")
if [[ -d /etc/ssh/remote_install ]]; then
for file in $(find "/etc/ssh/remote_install" -type f -maxdepth 1); do
cp -p $file "$CURRENTBACKUP/$1/"
done
fi
;;
"httpdbasic")
for file in $(find /etc -name "httpd.*" -type f -maxdepth 1); do
cp -p $file "$CURRENTBACKUP/$1/"
done
;;
"nsd")
for file in $(find "/var/nsd" -type f -not -path "/var/nsd/run/*"); do
cp -p $file "$CURRENTBACKUP/$1/"
done
;;
"newospf")
cp -p /etc/ospfd.conf "$CURRENTBACKUP/$1/"
;;
"relayd")
configuration "relayd"
;;
"all")
sh setup_node -I
;;
esac
}
function upgrade {
case $1 in
"unbound")
dhclient=$(pidof "dhclient")
[[ "${dhclient}" != "" ]] && \
pkill dhclient && \
rcctl stop dhclient && \
rcctl disable dhclient
install -o root -g wheel -m 0644 $basedir/src/etc/resolv.conf /etc/
install -o _unbound -g _unbound -m 0750 $basedir/src/var/unbound/etc/unbound.conf /var/unbound/etc/unbound.conf
install -o _unbound -g _unbound -m 0750 $basedir/src/var/unbound/etc/stub-zone.conf /var/unbound/etc/stub-zone.conf
rcctl restart unbound || error_exit "$LINENO: ERROR: UNBOUND failed."
;;
"ssh")
if [[ ! -d "$basedir/../OpenBSD-private-CA" ]]; then
echo "OpenBSD-private-CA not found cloning it..."
cd ..
git clone https://github.com/redeltaglio/OpenBSD-private-CA.git
chown -R taglio:wheel OpenBSD-private-CA/
cd OpenBSD-private-CA
ksh setup_host
else
cd "$basedir/../OpenBSD-private-CA"
git pull
cd ..
chown -R taglio:wheel OpenBSD-private-CA/
cd OpenBSD-private-CA
ksh setup_host
fi
[[ -e "/etc/ssh/principals/taglio" ]] && rm -rf /etc/ssh/principals/taglio
echo "wheel" > /etc/ssh/principals/taglio
;;
"ipsec")
sha256compare "/etc/iked/ca/ca.crt" "$basedir/src/etc/iked/ca/ca.crt"
if [[ $sha256ctrl -eq 1 ]]; then
echo "ca.crt upgrade"
install -o root -g wheel -m 0644 $basedir/src/etc/ca/ca.crt /etc/iked/ca/
fi
tmpdir=$(mktemp -d)
openssl pkcs12 -nodes -in "/tmp/$publichost.p12" -nocerts -passin pass:123456789 -passout pass:123456789 -out "$tmpdir/local.key"
openssl pkcs12 -nodes -in "/tmp/$publichost.p12" -clcerts -nokeys -passin pass:123456789 -passout pass:123456789 -out "$tmpdir/$publichost.crt"
openssl x509 -pubkey -noout -passin pass:123456789 -in "/etc/iked/certs/$publichost.crt" > "$tmpdir/local.pub"
sha256compare "/etc/iked/private/local.key" "$tmpdir/local.key"
if [[ $sha256ctrl -eq 1 ]]; then
echo "local.key upgrade"
openssl pkcs12 -nodes -in "/tmp/$publichost.p12" -nocerts -passin pass:123456789 -passout pass:123456789 -out /etc/iked/private/local.key
openssl pkcs12 -nodes -in "/tmp/$publichost.p12" -clcerts -nokeys -passin pass:123456789 -passout pass:123456789 -out "/etc/iked/certs/$publichost.crt"
openssl x509 -pubkey -noout -passin pass:123456789 -in "/etc/iked/certs/$publichost.crt" > /etc/iked/local.pub
fi
rm -rf $tmpdir
for file in $(find $basedir/src/etc/iked/pubkeys/ufqdn/ -name "*@*"); do
filename=$(basename $file)
sha256compare "$file" "/etc/iked/pubkeys/ufqdn/$filename"
if [[ $sha256ctrl -eq 1 ]]; then
echo "$filename upgrade"
install -o root -g wheel -m 0644 $file /etc/iked/pubkeys/ufqdn/
fi
done
rm -rf $tmpdir
tmpdir=$(mktemp -d)
cp $basedir/src/etc/iked.conf $tmpdir
if [[ $(grep -c hostname /tmp/config.ini) -eq 1 ]]; then
srcid=$(cat /tmp/config.ini | grep hostname |cut -d \# -f2)
else
srcid=$(hostname -s)
fi
#if [[ "$srcid" == "varuna" ]]; then
# srcid="neo"
#fi
for vpnc_ip in $(dig vpnc.$domainname A +short @8.8.8.8); do
vpnc_host=$(dig -x $vpnc_ip +short @8.8.8.8 | sed 's/.$//')
if [[ -e "/etc/iked.conf.$vpnc_host" ]]; then
echo include \"/etc/iked.conf.$vpnc_host\" >> "$tmpdir/iked.conf"
if grep -q "ecp384" "/etc/iked.conf.$vpnc_host"; then
cp $basedir/src/etc/iked.conf.mikrotik "$tmpdir/iked.conf.$vpnc_host"
elif grep -q "ecp256" "/etc/iked.conf.$vpnc_host"; then
cp $basedir/src/etc/iked.conf.edgeos "$tmpdir/iked.conf.$vpnc_host"
else
cp $basedir/src/etc/iked.conf.openbsd "$tmpdir/iked.conf.$vpnc_host"
fi
sed -i "s/\/POP\//$vpnc_host/g" "$tmpdir/iked.conf.$vpnc_host"
sed -i "s/\/POPIP\//$vpnc_ip/g" "$tmpdir/iked.conf.$vpnc_host"
type=$(cat "/etc/iked.conf.$vpnc_host" | head -n 1 | awk '{print $3}')
sed -i "s/\/TYPE\//$type/g" "$tmpdir/iked.conf.$vpnc_host"
sed -i "s/\/PUBLICIP\//$publicip/g" "$tmpdir/iked.conf.$vpnc_host"
sed -i "s/\/PUBLICHOST\//$publichost/g" "$tmpdir/iked.conf.$vpnc_host"
sed -i "s/\/SRCID\//$srcid/g" "$tmpdir/iked.conf.$vpnc_host"
sed -i "s/\/DOMAINNAME\//$domainname/g" "$tmpdir/iked.conf.$vpnc_host"
encx=$(cat "/etc/iked.conf.$vpnc_host" | awk -F'enc' '{print substr($2,0,1)}' | tail -n 1)
sed -i "s/\/X\//$encx/g" "$tmpdir/iked.conf.$vpnc_host"
sha256compare "/etc/iked.conf.$vpnc_host" "$tmpdir/iked.conf.$vpnc_host"
if [[ $sha256ctrl -eq 1 ]]; then
echo "$vpnc_host upgrade"
install -o root -g wheel -m 0640 "$tmpdir/iked.conf.$vpnc_host" /etc/
fi
fi
done
for vpnc_host in $(dig vpnc.telecomlobby.com TXT +short @8.8.8.8 | sed 's/\"//g'); do
if [[ -e "/etc/iked.conf.$vpnc_host" ]]; then
echo include \"/etc/iked.conf.${vpnc_host}\" >> "$tmpdir/iked.conf"
fi
vpnc_ip=$(dig $vpnc_host A +short @8.8.8.8 | tail -n 1)
cp $basedir/src/etc/iked.conf.edgeos "$tmpdir/iked.conf.$vpnc_host"
sed -i "s/\/POP\//$vpnc_host/g" "$tmpdir/iked.conf.$vpnc_host"
sed -i "s/\/POPIP\//$vpnc_ip/g" "$tmpdir/iked.conf.$vpnc_host"
type=$(cat "/etc/iked.conf.$vpnc_host" | head -n 1 | awk '{print $3}')
sed -i "s/\/TYPE\//$type/g" "$tmpdir/iked.conf.$vpnc_host"
sed -i "s/\/PUBLICIP\//$publicip/g" "$tmpdir/iked.conf.$vpnc_host"
sed -i "s/\/PUBLICHOST\//$publichost/g" "$tmpdir/iked.conf.$vpnc_host"
sed -i "s/\/SRCID\//$srcid/g" "$tmpdir/iked.conf.$vpnc_host"
sed -i "s/\/DOMAINNAME\//$domainname/g" "$tmpdir/iked.conf.$vpnc_host"
encx=$(cat "/etc/iked.conf.$vpnc_host" | awk -F'enc' '{print substr($2,0,1)}' | tail -n 1)
sed -i "s/\/X\//$encx/g" "$tmpdir/iked.conf.$vpnc_host"
sha256compare "/etc/iked.conf.$vpnc_host" "$tmpdir/iked.conf.$vpnc_host"
if [[ $sha256ctrl -eq 1 ]]; then
echo "$vpnc_host upgrade"
install -o root -g wheel -m 0640 "$tmpdir/iked.conf.$vpnc_host" /etc/
fi
sha256compare "/etc/iked.conf.$vpnc_host" "$tmpdir/iked.conf.$vpnc_host"
if [[ $sha256ctrl -eq 1 ]]; then
echo "$vpnc_host upgrade"
install -o root -g wheel -m 0640 "$tmpdir/iked.conf.$vpnc_host" /etc/
fi
done
sha256compare "/etc/iked.conf" "$tmpdir/iked.conf"
if [[ $sha256ctrl -eq 1 ]]; then
echo "iked.conf upgrade"
install -o root -g wheel -m 0600 "$tmpdir/iked.conf" /etc/iked.conf
fi
iked -n
if [[ $sha256ctrl -eq 1 ]]; then
rcctl restart iked || error_exit "$LINENO: ERROR: IKED failed."
fi
;;
"gre")
configuration "gre"
;;
"pf")
tmpdir=$(mktemp -d)
for file in $(find $basedir/src/etc/ -name "pf.*" -type f -maxdepth 1); do
cp $file $tmpdir
done
for vpnc_ip in $(dig vpnc.$domainname A +short @8.8.8.8); do
echo "$vpnc_ip/32" >> "$tmpdir/pf.conf.table.ipsec"
done
for vpnc_ip in $(dig vpncN.$domainname A +short @8.8.8.8); do
echo "$vpnc_ip/32" >> "$tmpdir/pf.conf.table.ipsec"
done
for vpnc_host in $(dig vpnc.telecomlobby.com TXT +short @8.8.8.8 | sed 's/\"//g'); do
vpnc_ip=$(dig $vpnc_host A +short @8.8.8.8 | tail -n 1)
if [[ ! -z $vpnc_ip ]]; then
echo "$vpnc_ip/32" >> "$tmpdir/pf.conf.table.ipsec"
fi
done
for grefile in $(ls /etc/hostname.gre*[0-9]); do
greinterface=$(echo $grefile | cut -d . -f2)
echo "pass in quick on ${greinterface} to vether0 tagged PERMITTED reply-to ${greinterface}" >> "$tmpdir/pf.conf.macro.gre.tag.in"
echo "queue outq on ${greinterface} bandwidth 55M max 60M flows 6144 qlimit 6144 default" >> "$tmpdir/pf.conf.macro.queue.out"
done
if [[ -e "/etc/pf.conf.macro.public" ]]; then
echo "pf.conf.macro.public upgrade"
custom "$tmpdir" "1"
sha256compare "/etc/pf.conf.macro.public" "$tmpdir/pf.conf.macro.public" || sha256ctrl=1
if [[ $sha256ctrl -eq 1 ]]; then
install -o root -g wheel -m 0640 "$tmpdir/pf.conf.macro.public" /etc/
fi
fi
if [[ -e "/etc/pf.conf.macro.gre.tag.in" ]]; then
echo "pf.conf.macro.gre.tag.in upgrade"
custom "$tmpdir" "1"
sha256compare "/etc/pf.conf.macro.gre.tag.in" "$tmpdir/pf.conf.macro.gre.tag.in" || sha256ctrl=1
if [[ $sha256ctrl -eq 1 ]]; then
install -o root -g wheel -m 0640 "$tmpdir/pf.conf.macro.gre.tag.in" /etc/
pfctl -nf /etc/pf.conf
pfctl -f /etc/pf.conf
fi
fi
if [[ -e "/etc/pf.conf.macro.queue.out" ]]; then
echo "pf.conf.macro.queue.out upgrade"
custom "$tmpdir" "1"
sha256compare "/etc/pf.conf.macro.queue.out" "$tmpdir/pf.conf.macro.queue.out" || sha256ctrl=1
if [[ $sha256ctrl -eq 1 ]]; then
install -o root -g wheel -m 0640 "$tmpdir/pf.conf.macro.queue.out" /etc/
pfctl -nf /etc/pf.conf
pfctl -f /etc/pf.conf
fi
else
install -o root -g wheel -m 0640 "$tmpdir/pf.conf.macro.queue.out" /etc/
pfctl -nf /etc/pf.conf
pfctl -f /etc/pf.conf
fi
[[ -e "/etc/pf.conf.table.ipsec" ]] && sha256compare "/etc/pf.conf.table.ipsec" "$tmpdir/pf.conf.table.ipsec" || sha256ctrl=1
if [[ $sha256ctrl -eq 1 ]]; then
echo "pf.conf.table.ipsec upgrade"
install -o root -g wheel -m 0640 "$tmpdir/pf.conf.table.ipsec" /etc/
pfctl -nf /etc/pf.conf
pfctl -f /etc/pf.conf
fi
[[ -e "/etc/pf.conf.table.lte" ]] && sha256compare "/etc/pf.conf.table.lte" "$tmpdir/pf.conf.table.lte" || sha256ctrl=1
if [[ $sha256ctrl -eq 1 ]]; then
echo "pf.conf.table.lte upgrade"
install -o root -g wheel -m 0640 "$tmpdir/pf.conf.table.lte" /etc/
pfctl -nf /etc/pf.conf
pfctl -f /etc/pf.conf
fi
[[ -e "/etc/pf.conf.table.nsd" ]] && sha256compare "/etc/pf.conf.table.nsd" "$tmpdir/pf.conf.table.nsd" || sha256ctrl=1
if [[ $sha256ctrl -eq 1 ]]; then
echo "pf.conf.table.nsd upgrade"
install -o root -g wheel -m 0640 "$tmpdir/pf.conf.table.nsd" /etc/
pfctl -nf /etc/pf.conf
pfctl -f /etc/pf.conf
fi
[[ -e "/etc/pf.conf.table.users" ]] && sha256compare "/etc/pf.conf.table.users" "$tmpdir/pf.conf.table.users" || sha256ctrl=1
if [[ $sha256ctrl -eq 1 ]]; then
echo "pf.conf.table.users upgrade"
install -o root -g wheel -m 0640 "$tmpdir/pf.conf.table.users" /etc/
pfctl -nf /etc/pf.conf
pfctl -f /etc/pf.conf
fi
[[ -e "/etc/pf.conf.table.locals" ]] && sha256compare "/etc/pf.conf.table.locals" "$tmpdir/pf.conf.table.locals" || sha256ctrl=1
if [[ $sha256ctrl -eq 1 ]]; then
echo "pf.conf.table.locals upgrade"
install -o root -g wheel -m 0640 "$tmpdir/pf.conf.table.locals" /etc/
pfctl -nf /etc/pf.conf
pfctl -f /etc/pf.conf
fi
[[ -e "/etc/pf.conf.table.clientes" ]] && sha256compare "/etc/pf.conf.table.clientes" "$tmpdir/pf.conf.table.clientes" || sha256ctrl=1
if [[ $sha256ctrl -eq 1 ]]; then
echo "pf.conf.table.clientes upgrade"
install -o root -g wheel -m 0640 "$tmpdir/pf.conf.table.clientes" /etc/
pfctl -nf /etc/pf.conf
pfctl -f /etc/pf.conf
fi
for file in $(find /etc -maxdepth 1 -name "iked.conf.*") ; do
tagged=$(echo $file | sed "s/\/etc\/iked.conf.//")
count=$(dig $tagged A +short @8.8.8.8 | wc -l)
if [[ $count -gt 1 ]]; then
iptagged=$(dig $tagged A +short @8.8.8.8 | tail -n 1)
else
iptagged=$(dig $tagged A +short @8.8.8.8)
fi
sed -i "s/\/TAGGED\//${tagged}/g" $tmpdir/pf.conf.macro.enc.{in,out}
sed -i "s/\/IPTAGGED\//${iptagged}/g" $tmpdir/pf.conf.macro.enc.{in,out}
cat $basedir/src/openbsd/pf.conf.openbsd | head -n 1 >> $tmpdir/pf.conf.macro.enc.in
cat $basedir/src/openbsd/pf.conf.openbsd | tail -n 1 >> $tmpdir/pf.conf.macro.enc.out
done
sed -i '$d' $tmpdir/pf.conf.macro.enc.{in,out}
sha256compare "/etc/pf.conf.macro.enc.in" "$tmpdir/pf.conf.macro.enc.in"
if [[ $sha256ctrl -eq 1 ]]; then
echo "pf.conf.macro.enc.in upgrade"
install -o root -g wheel -m 0640 "$tmpdir/pf.conf.macro.enc.in" /etc/
fi
sha256compare "/etc/pf.conf.macro.enc.out" "$tmpdir/pf.conf.macro.enc.out"
if [[ $sha256ctrl -eq 1 ]]; then
echo "pf.conf.macro.enc.out upgrade"
install -o root -g wheel -m 0640 "$tmpdir/pf.conf.macro.enc.out" /etc/
fi
landomainname=$(cat /etc/myname | sed 's/^[^.]*.//')
custom "$tmpdir" "1"
sha256compare "/etc/pf.conf" "$tmpdir/pf.conf"
if [[ $sha256ctrl -eq 1 ]]; then
echo "pf.conf upgrade"
install -o root -g wheel -m 0640 "$tmpdir/pf.conf" /etc/
fi
if [[ $sha256ctrl -eq 1 ]]; then
pfctrl=$(pfctl -nf /etc/pf.conf)
if [[ -z $pfctrl ]]; then
echo "PF ruleset OK"
fi
ctrl=
while [ -z $ctrl ]
do
echo 'The load PF rules and enable it type 1 '
read ctrl
if [[ "$ctrl" -eq 1 ]]; then
if [[ $(pfctl -si | head -n 1 | grep -c "Disabled") -eq 1 ]]; then
pfctl -f /etc/pf.conf
ctrl=
while [ -z $ctrl ]
do
echo 'Your connection will be close type 1 to continue '
read ctrl
pfctl -e && exit 1
done
elif [[ $(pfctl -si | head -n 1 | grep -c "Disabled") -eq 0 ]]; then
pfctl -f /etc/pf.conf
fi
fi
done
fi
;;
"ospf")
(: "${hostname?}") 2>/dev/null || hostname=$(hostname -s)
(: "${landomainname?}") 2>/dev/null || landomainname=$(hostname | sed "s/`hostname -s`.//")
configuration "ospf"
;;
"ntpd")
configuration "ntpd"
;;
"remote")
tmpdir=$(mktemp -d)
if [[ -d "/etc/ssh/remote_install" ]]; then
cp $basedir/src/etc/ssh/remote_install/* $tmpdir
custom "$tmpdir" "1"
sha256compare "/etc/ssh/remote_install/remote_install.conf" "$tmpdir/remote_install.conf"
if [[ $sha256ctrl -eq 1 ]]; then
echo "remote_install.conf upgrade"
install -o root -g wheel -m 0640 "$tmpdir/remote_install.conf" /etc/ssh/remote_install
fi
sha256compare "/etc/ssh/remote_install/authorized_keys" "$tmpdir/authorized_keys"
if [[ $sha256ctrl -eq 1 ]]; then
echo "authorized_keys upgrade"
install -o root -g wheel -m 0640 "$tmpdir/authorized_keys" /etc/ssh/remote_install
fi
else
mkdir /etc/ssh/remote_install
for file in $(find $basedir/src/etc/ssh/remote_install/ -type f); do
filename=$(basename $file)
if [[ "$filename" != "rc.local" ]]; then
install -o root -g wheel -m 0640 $file /etc/ssh/remote_install/
fi
done
custom "/etc/ssh/remote_install" "1"
fi
sha256compare "$basedir/src/usr/local/sbin/remote-install" "/usr/local/sbin/remote-install"
if [[ $sha256ctrl -eq 1 ]]; then
echo "remote-install upgrade"
install -o root -g wheel -m 0750 $basedir/src/usr/local/sbin/remote-install /usr/local/sbin/
fi
if [[ $(grep -c remote_install.conf /etc/rc.local) -eq 0 ]]; then
cat $basedir/src/etc/ssh/remote_install/rc.local >> /etc/rc.local
fi
pidof_remote=$(pidof "remote")
if [[ -z $pidof_remote ]]; then
/usr/sbin/sshd -f /etc/ssh/remote_install/remote_install.conf
else
kill -9 $(cat /var/run/sshd-remote-install.pid)
/usr/sbin/sshd -f /etc/ssh/remote_install/remote_install.conf
fi
install -o root -g wheel -m 0640 $basedir/src/etc/httpd.conf.acmefirst /etc/httpd.conf
custom "/etc/" "1"
httpd -n
pidof_httpd=$(pidof "httpd")
if [[ -z $pidof_remote ]]; then
rcctl enable httpd
rcctl start httpd || error_exit "$LINENO: ERROR: HTTPD failed."
else
rcctl restart httpd
fi
;;
"remoteinstall")
echo "connecting to remote OpenBSD MESH hosts..."
cat /dev/null > /etc/ssh/ssh_known_hosts
for file in $(find /etc -maxdepth 1 -name "iked.conf.*" -type f); do
if [[ $(grep -c "brainpool512" $file) -eq 1 ]]; then
remotehost=$(echo $file | sed "s/\/etc\/iked.conf.//")
ssh-keyscan -t ed25519 -p 31137 $remotehost > /etc/ssh/ssh_known_hosts
ssh -p 31137 $remotehost -v
fi
done
sleep 31
ctrl=
while [ -z $ctrl ]
do
echo 'Have you add the root ssh key to admin user onto mikrotik ?'
cat /root/.ssh/id_rsa.pub
echo 'Type 1 to continue '
read ctrl
if [[ "$ctrl" -eq 1 ]]; then
echo "ok"
else
error_exit "$LINENO: EXIT FROM USER."
fi
done
;;
"relayd")
configuration "relayd"
;;
"newhost")
sh "$basedir/$app" -U pf
install -o root -g wheel -m 0640 $basedir/src/etc/ssh/remote_install/authorized_keys /etc/ssh/remote_install/
pubkey=$(ls -lt "$basedir/src/etc/iked/pubkeys/ufqdn/" | awk '{print $9}' | awk 'FNR == 2 {print}')
install -o root -g wheel -m 0640 "$basedir/src/etc/iked/pubkeys/ufqdn/$pubkey" /etc/iked/pubkeys/ufqdn/
;;
"scripts")
configuration "scripts"
;;
"file")
if [[ ! -e "$BACKUPS/file" ]]; then
mkdir "$BACKUPS/file"
fi
fileupdate=
while [ -z $fileupdate ]
do
echo "Which file do you want to update [type dst complete PATH]? "
read fileupdate
[[ -e $fileupdate ]] && cp -p $fileupdate "$BACKUPS/file/$(basename $fileupdate)"
gitfile="$basedir/src$fileupdate"
install -o root -g wheel -m 0644 $gitfile $fileupdate
done
;;
"dyndnspop")
for vpnc_host in $(dig vpnc.telecomlobby.com TXT +short @8.8.8.8 | sed 's/\"//g'); do
vpnc_ip=$(dig $vpnc_host A +short @8.8.8.8 | tail -n 1)
if [[ ! -z $vpnc_ip ]]; then
for iked_conf in $(ls /etc/iked.conf.*); do
if [[ $(grep -c "ecp256" $iked_conf) -eq 2 ]]; then
pophost=$(cat $iked_conf | head -n 1 | awk '{print $2}' | sed 's/"//g')
greinterface=$(cat $iked_conf | tail -n 1 | awk '{print $4}' | sed 's/enc/gre/')
sh /root/Bin/change_endpoint.sh $greinterface $pophost
fi
done
fi
done
;;
"newospf")
ospfdtmp=$(mktemp)
area0tmp=$(mktemp)
routerid=$(cat /etc/ospfd.conf | grep router\-id | awk '{print $2}' | sed "s/\"//g")
loc=$(curl -s "http://ipinfo.io/$publicip" | grep loc | awk '{print $2}' | sed 's/.$//' | sed "s/\"//g")
long=$(echo $loc | cut -d , -f2 | cut -d . -f1)
lat=$(echo $loc | cut -d , -f1 | cut -d . -f1)
echo -e "\nLAT --> $lat"
echo -e "LONG --> $long\n"
if [[ $long -ge -180 && $long -le -60 && $lat -ge 0 ]]; then group=12 && ospfarea="0.0.1.2"; fi
if [[ $long -ge -60 && $long -le 60 && $lat -ge 0 ]]; then group=34 && ospfarea="0.0.3.4"; fi
if [[ $long -ge 60 && $long -le 180 && $lat -ge 0 ]]; then group=56 && ospfarea="0.0.5.6"; fi
if [[ $long -ge -180 && $long -le -60 && $lat -le 0 ]]; then group=12 && ospfarea="0.0.1.2"; fi
if [[ $long -ge -60 && $long -le 60 && $lat -le 0 ]]; then group=34 && ospfarea="0.0.3.4"; fi
if [[ $long -ge 60 && $long -le 180 && $lat -le 0 ]]; then group=56 && ospfarea="0.0.5.6"; fi
printf "%s\n\n" "# \$OpenBSD: ospfd.conf,v 1.2 2018/08/07 07:06:20 claudio Exp $" > $ospfdtmp
printf "%s\n" "router-id \"$routerid\"" >> $ospfdtmp
printf "%s\n" "# areas" >> $ospfdtmp
printf "%s\n" "area $ospfarea {" >> $ospfdtmp
for grefile in $(ls /etc/hostname.gre*[0-9]); do
greinterface=$(echo $grefile | cut -d . -f2)
greppublicip=$(cat $grefile | grep tunnel | awk '{print $5}')
remoteloc=$(curl -s "http://ipinfo.io/$greppublicip" | grep loc | awk '{print $2}' | sed 's/.$//' | sed "s/\"//g")
remotelong=$(echo $remoteloc | cut -d , -f2 | cut -d . -f1)
remotelat=$(echo $remoteloc | cut -d , -f1 | cut -d . -f1)
if [[ $remotelong -ge -180 && $remotelong -le -60 && $remotelat -ge 0 ]]; then remotegroup=12 && ospfarea="0.0.1.2"; fi
if [[ $remotelong -ge -60 && $remotelong -le 60 && $remotelat -ge 0 ]]; then remotegroup=34 && ospfarea="0.0.3.4"; fi
if [[ $remotelong -ge 60 && $remotelong -le 180 && $remotelat -ge 0 ]]; then remotegroup=56 && ospfarea="0.0.5.6"; fi
if [[ $remotelong -ge -180 && $remotelong -le -60 && $remotelat -le 0 ]]; then remotegroup=12 && ospfarea="0.0.1.2"; fi
if [[ $remotelong -ge -60 && $remotelong -le 60 && $remotelat -le 0 ]]; then remotegroup=34 && ospfarea="0.0.3.4"; fi
if [[ $remotelong -ge 60 && $remotelong -le 180 && $remotelat -le 0 ]]; then remotegroup=56 && ospfarea="0.0.5.6"; fi
[[ $group = $remotegroup ]] && \
awk "/$greinterface/{x=NR+8}(NR<=x){print}" /etc/ospfd.conf | sed '/type p2p/d' | sed '/metric/d' | uniq -u | awk 'NF' >> $ospfdtmp || \
awk "/$greinterface/{x=NR+8}(NR<=x){print}" /etc/ospfd.conf | sed '/type p2p/d' | sed '/metric/d' | uniq -u | awk 'NF' >> $area0tmp
done
printf "\t%s\n" " interface vether0 {" >> $ospfdtmp
printf "\t\t%s\n" "metric 1" >> $ospfdtmp
printf "\t\t%s\n" "passive" >> $ospfdtmp
printf "\t%s\n" "}" >> $ospfdtmp
printf "%s\n" "}" >> $ospfdtmp
printf "%s\n" "area 0.0.0.0 {" >> $ospfdtmp
cat $area0tmp >> $ospfdtmp
printf "%s\n" "}" >> $ospfdtmp
cat $ospfdtmp
#/usr/sbin/ospfd -nf $ospfdtmp
#install -o root -g wheel -m 0600 $ospfdtmp /etc/ospfd.conf
#/usr/sbin/ospfd -nf /etc/ospfd.conf
#/usr/sbin/rcctl restart ospfd
;;
"vedetta")
dhcpleased=$(pidof "dhcpleased")
resolvd=$(pidof "resolvd")
[[ "${dhcpleased}" != "" ]] && rcctl stop dhcpleased
[[ "${resolvd}" != "" ]] && rcctl stop resolvd
dhcpleased=$(cat /etc/rc.conf.local | grep dhcpleased)
resolvd=$(cat /etc/rc.conf.local | grep resolvd)
[[ "${dhcpleased}" == "" ]] && rcctl disable dhcpleased
[[ "${resolvd}" == "" ]] && \
rcctl disable resolvd && \
sed -i '/resolvd/d' "/etc/resolv.conf"
if ! getent passwd tsig 1>&-; then
useradd -u 25353 -g =uid -c "TSIG Wizard" -m -d /home/tsig -s /home/tsig tsig
fi
[ 0 = $(grep -c "github" /etc/changelist) ] && cat "src/openbsd/changelist.openbsd" >> "/etc/changelist"
[[ ! -e "/etc/mtree/special.local" ]] && \
install -o root -g wheel -m 0644 "src/openbsd/mtree.openbsd" "/etc/mtree/special.login" && \
custom "/etc/mtree" "1"
;;
esac
}
function admin {
case $1 in
"cleanlast")
[[ -e "/tmp/cleantmp" ]] && sh $basedir/tools/clean_last $(cat /tmp/cleantmp)
;;
"vultrvpc")
ifconfig vio1 > /dev/null 2>&1
[ $? -eq 0 ] && (
ipvpc=
while [ -z $ipvpc ]
do
echo "Type vio1 Vultr VPC assigned IPv4: [IPv4] "
read ipvpc
done
maskvpc=
while [ -z $maskvpc ]
do
echo "Type vio1 Vultr VPC assigned Netmask: [Netmask] "
read maskvpc
done
ifconfig vio1 "${ipvpc}" netmask "${maskvpc}" up
ifconfig vio1 mtu 1450
echo "-inet" > /etc/hostname.vio1
echo "-inet6" >> /etc/hostname.vio1
echo "mtu 1450" >> /etc/hostname.vio1
echo "!ifconfig vio1 ${ipvpc} netmask ${maskvpc}" >> /etc/hostname.vio1
echo "up" >> /etc/hostname.vio1
)
ctrl=
while [ -z $ctrl ]
do
echo "Do you want to add the interface to OSPFD? [yes/no] "
read ctrl
done
case $ctrl in
"yes")
ospfvio1md5=
while [ -z $ospfvio1md5 ]
do
echo "Type md5 for the interface "
read ospfvio1md5
done
sed -i '$d' /etc/ospfd.conf
cat << EOF >> /etc/ospfd.conf
interface vio1 {
auth-type crypt
EOF
echo "auth-md 1 \"${ospfvio1md5}\"" >> /etc/ospfd.conf
cat << EOF >> /etc/ospfd.conf
auth-md-keyid 1
router-dead-time 40
hello-interval 10
retransmit-interval 5
transmit-delay 1
type p2p
}
}
EOF
pidof_ospfd=$(pidof "ospfd")