initial commit
This commit is contained in:
commit
d30dd2fc84
25 changed files with 2042 additions and 0 deletions
250
Oracle Siebel 15.0.txt
Normal file
250
Oracle Siebel 15.0.txt
Normal file
|
|
@ -0,0 +1,250 @@
|
|||
Siebel HOST: SIEBELHOST
|
||||
- install telnet
|
||||
- install iis
|
||||
- install jre-8u71-windows-x64
|
||||
|
||||
0. Prepare Siebel Install Image using snic.bat from the zips.
|
||||
java -jar snic.jar also works
|
||||
|
||||
1. Install 64bit Oracle Database 11g.
|
||||
|
||||
global database name:SIEBELDB
|
||||
db administrative pass:SiebelDb1password1
|
||||
|
||||
The Database Control URL is https://localhost:1158/em
|
||||
user: SYS
|
||||
connect as: SYSDBA
|
||||
|
||||
create tablespaces:
|
||||
size 5GB
|
||||
|
||||
SBLDATA
|
||||
SBLDATA01.DBF
|
||||
|
||||
SBLINDX
|
||||
SBLINDX01.DBF
|
||||
|
||||
|
||||
2. Install 32bit Oracle Database 11g Client
|
||||
|
||||
Type: Administrator
|
||||
|
||||
Place tnsnames.ora into C:\Oracle\product\11.2.0\client_1\network\admin
|
||||
|
||||
tnsnames.ora contents:
|
||||
|
||||
SIEBELDB =
|
||||
(DESCRIPTION =
|
||||
(ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1521))
|
||||
(CONNECT_DATA =
|
||||
(SERVER = DEDICATED)
|
||||
(SERVICE_NAME = SIEBELDB)
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
|
||||
3. Create Users (based on oracle grantusr.sql)
|
||||
cmd.exe
|
||||
sqlplus sys@siebeldb as sysdba
|
||||
|
||||
create role sse_role;
|
||||
grant create session to sse_role;
|
||||
|
||||
create role tblo_role;
|
||||
grant ALTER SESSION, CREATE CLUSTER, CREATE DATABASE LINK, CREATE INDEXTYPE,
|
||||
CREATE OPERATOR, CREATE PROCEDURE, CREATE SEQUENCE, CREATE SESSION,
|
||||
CREATE SYNONYM, CREATE TABLE, CREATE TRIGGER, CREATE TYPE, CREATE VIEW,
|
||||
CREATE DIMENSION, CREATE MATERIALIZED VIEW, QUERY REWRITE, ON COMMIT REFRESH
|
||||
to tblo_role;
|
||||
|
||||
create user SIEBEL identified by sadmin1password1;
|
||||
grant tblo_role to SIEBEL;
|
||||
grant sse_role to SIEBEL;
|
||||
alter user SIEBEL quota 0 on SYSTEM quota 0 on SYSAUX;
|
||||
alter user SIEBEL default tablespace SBLDATA;
|
||||
alter user SIEBEL temporary tablespace temp;
|
||||
alter user SIEBEL quota unlimited on SBLDATA;
|
||||
alter user SIEBEL quota unlimited on SBLINDX;
|
||||
|
||||
create user SADMIN identified by sadmin1password1;
|
||||
grant sse_role to SADMIN;
|
||||
alter user SADMIN default tablespace sbldata;
|
||||
alter user SADMIN temporary tablespace temp;
|
||||
alter user SADMIN quota unlimited on SBLDATA;
|
||||
alter user SADMIN quota unlimited on SBLINDX;
|
||||
|
||||
----
|
||||
|
||||
4. INSTALL SIEBEL SERVER from Network Image. General Config:
|
||||
|
||||
Oracle Home Name: SES_HOME
|
||||
Location: c:\Siebel\15.0.0.0.0\ses
|
||||
-gateway name server
|
||||
-siebel server
|
||||
-database configuration utilities
|
||||
Program folder name: Siebel Enterprise Server 15.0.0.0.0
|
||||
|
||||
5. SIEBEL ENTERPRISE CONFIGURATION
|
||||
|
||||
5.1. Install new gateway name
|
||||
|
||||
5.2. Install new enterprise in a gateway name server:
|
||||
|
||||
Gateway Name server port: 2320
|
||||
name server account name: SADMIN
|
||||
pass: sadmin1password1
|
||||
enterprise name: SBA_82
|
||||
|
||||
Siebel File system: C:\Siebel\15.0.0.0.0\ses\gtwysrvr\fs
|
||||
database table owner: SIEBEL
|
||||
sqlnet connect string: SIEBELDB
|
||||
user name: SADMIN
|
||||
pass: sadmin1password1
|
||||
|
||||
6. DATABASE SERVER CONFIGURATION
|
||||
|
||||
Make desktop shortcut to C:\Windows\SysWOW64\odbcad32.exe
|
||||
run as admin and get ODBC Data Source Name: SBA_82_DSN
|
||||
|
||||
db username: SADMIN
|
||||
pass: sadmin1password1
|
||||
db table owner: SIEBEL
|
||||
pass: sadmin1password1
|
||||
|
||||
index tables space name: SBLINDX
|
||||
table space name: SBLDATA
|
||||
|
||||
Wait 3 hours max.
|
||||
|
||||
Check Program Files\Oracle\Inventory\logs for errors
|
||||
|
||||
7. SIEBEL SERVER CONFIGURATION
|
||||
gateway login: SADMIN
|
||||
|
||||
Enable Open UI -> NO.
|
||||
Component Groups:
|
||||
-CallCenter
|
||||
-Remote
|
||||
-ORCL
|
||||
-WorkFlow
|
||||
-Communications
|
||||
|
||||
broker port: 2321
|
||||
tcp/ip for syncronization manager: 40400
|
||||
|
||||
8. SIEBEL ENTERPRISE CONFIGURATION - SWSE Profile
|
||||
|
||||
Enterprise Name: SBA_82
|
||||
|
||||
Path: C:\Siebel\15.0.0.0.0\ses\gtwysrvr\admin\Webserver
|
||||
|
||||
HI Employee User: SIEBANON
|
||||
HI pass: siebanon123
|
||||
|
||||
SI contact user: SIEBANON
|
||||
pass: siebanon123c
|
||||
|
||||
token: 615 112 419 907 (spaces are just for readability here)
|
||||
statistic page: _stats.swe
|
||||
|
||||
http port: 8080
|
||||
https port: 8443
|
||||
|
||||
9. POPULATE THE FS DIR:
|
||||
|
||||
Copy all files from C:\Siebel\15.0.0.0.0\ses\dbsrvr\FILES
|
||||
to: C:\Siebel\15.0.0.0.0\ses\gtwysrvr\fs\att
|
||||
|
||||
10. INSTALL SIEBEL WEB SERVER EXTENSION
|
||||
|
||||
C:\Siebel_Install_Image\15.0.0.0\Windows\Server\Siebel_Web_Server_Extension\Disk1\install
|
||||
|
||||
swse seed: 612 451 241 125 121 (again spaces are for readability)
|
||||
|
||||
11. Siebel Web Server Extension Configuration
|
||||
|
||||
Load balancing: Single Siebel Server
|
||||
profile location : C:\Siebel\15.0.0.0.0\ses\gtwysrvr\admin\Webserver
|
||||
|
||||
12. Fix Permission
|
||||
Go to C:\Siebel\15.0.0.0.0\eappweb
|
||||
Right click properties -> sharing -> advanced sharing.
|
||||
share this folder.
|
||||
|
||||
permissions -> add -> advanced -> find and add:
|
||||
IUSR
|
||||
IIS_IUSRS
|
||||
|
||||
with full permissions.
|
||||
|
||||
13. Setup ISS
|
||||
|
||||
cmd.exe ->
|
||||
iisreset
|
||||
|
||||
14. INSTALL WEB CLIENT:
|
||||
|
||||
C:\Siebel_Install_Image\15.0.0.0\Windows\Client\Siebel_Web_Client\Disk1\install
|
||||
start setup.bat
|
||||
|
||||
name: CLIENT_HOME
|
||||
path: C:\Siebel\15.0.0.0.0\Client
|
||||
|
||||
select: developer web client
|
||||
enable openui: no
|
||||
db alias: SIEBELDB
|
||||
owner: SIEBEL
|
||||
siebel FS: C:\SIEBEL_FS
|
||||
gateway addr: SIEBELHOST
|
||||
enterprise: SBA_82
|
||||
request: SIEBELHOST
|
||||
|
||||
15. Install Siebel Tools:
|
||||
|
||||
C:\Siebel_Install_Image\15.0.0.0\Windows\Client\Siebel_Tools\Disk1\install
|
||||
start setup.bat
|
||||
home: TOOLS_HOME
|
||||
c:\Siebel\15.0.0.0.0\Tools
|
||||
|
||||
db alias: SIEBELDB
|
||||
owner: SIEBEL
|
||||
siebel FS: C:\SIEBEL_FS
|
||||
|
||||
gateway addr: SIEBELHOST
|
||||
enterprise: SBA_82
|
||||
|
||||
installation spawns C:\Siebel\15.0.0.0.0\Client\PUBLIC\enu\predeploy.htm
|
||||
unblock active x on your IE
|
||||
|
||||
16. Web Access
|
||||
login using the start menu shortcuts is:
|
||||
userid: SADMIN
|
||||
pass: sadmin1password1
|
||||
connect to: Server
|
||||
|
||||
add http://siebelhost:8080 to trusted sites
|
||||
(http://siebelhost.crm.example.com:8080/start.swe should also be trusted in my case...)
|
||||
|
||||
and in internet tools setup low security profile to start activex controls automatically
|
||||
|
||||
17. Setup anon user:
|
||||
Go to Site map -> Administration User -> Employees
|
||||
click New and add:
|
||||
|
||||
Last Name: SIEBANON
|
||||
First Name: SIEBANON
|
||||
User ID: SIEBANON
|
||||
|
||||
Position: Siebel Administrator (?)
|
||||
Ctrl+S to save.
|
||||
|
||||
cmd.exe -> sqlplus sys@siebeldb as sysdba
|
||||
|
||||
create user SIEBANON identified by siebanon123;
|
||||
|
||||
grant sse_role to SIEBANON;
|
||||
|
||||
exit
|
||||
|
||||
iisreset
|
||||
1
README.md
Normal file
1
README.md
Normal file
|
|
@ -0,0 +1 @@
|
|||
A collection of files I have used for various tasks.
|
||||
116
Redundant-BGP.txt
Normal file
116
Redundant-BGP.txt
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
Redundant BGP with 2 ISPs, VRRP and Bird.
|
||||
|
||||
/etc/sysctl.conf:
|
||||
net.ipv4.conf.all.rp_filter=0
|
||||
net.ipv4.conf.lo.rp_filter=0
|
||||
net.ipv4.conf.default.rp_filter=0
|
||||
net.ipv4.conf.eth1.rp_filter=1
|
||||
net.ipv4.ip_forward=1
|
||||
net.ipv4.conf.default.forwarding=1
|
||||
net.ipv4.conf.all.forwarding=1
|
||||
|
||||
my as = 2000
|
||||
|
||||
|
||||
as 321 as2000 as 123
|
||||
|
||||
ebgp ibgp ebgp
|
||||
isp2 ------> RT2 <------> RT1 <------ isp1
|
||||
| .22 .21 |
|
||||
eth0 . eth1 | eth0
|
||||
. |
|
||||
^
|
||||
vrrp .1
|
||||
|
||||
|
||||
/etc/keepalived/keepalived.conf:
|
||||
vrrp_instance VI_1 {
|
||||
state MASTER
|
||||
#state BACKUP #RT2
|
||||
|
||||
interface eth1 #interconnect
|
||||
virtual_router_id 51
|
||||
|
||||
priority 100
|
||||
#priority 150 #RT2
|
||||
|
||||
advert_int 1
|
||||
|
||||
authentication {
|
||||
auth_type PASS
|
||||
auth_pass <CHANGEME>
|
||||
}
|
||||
|
||||
virtual_ipaddress {
|
||||
x.x.x.1 dev eth1
|
||||
}
|
||||
|
||||
#notify /script.sh #misc
|
||||
}
|
||||
|
||||
|
||||
/etc/bird/bird.conf:
|
||||
log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug };
|
||||
#log stderr all;
|
||||
#log "tmp" all;
|
||||
debug protocols all;
|
||||
|
||||
# Router ID
|
||||
router id x.x.x.21;
|
||||
#router id x.x.x.22; #RT2
|
||||
|
||||
protocol kernel RT1 {
|
||||
learn; # Learn all alien routes from the kernel
|
||||
persist; # Don't remove routes on bird shutdown
|
||||
scan time 0; # Scan kernel routing table every 20 seconds, 0 disables the scanning and only netlink is used to send/receive kernel routes
|
||||
import all; # Default is import all
|
||||
export all; # Default is export none
|
||||
device routes;
|
||||
graceful restart;
|
||||
}
|
||||
|
||||
protocol device {
|
||||
scan time 60;
|
||||
}
|
||||
|
||||
protocol static {
|
||||
route x.x.x.0/24 via x.x.x.1;
|
||||
}
|
||||
|
||||
# Import all directly connected routes. These come in with RTS_DEVICE
|
||||
protocol direct evrdirect {
|
||||
interface "*";
|
||||
export all;
|
||||
}
|
||||
|
||||
filter bgp_out
|
||||
{
|
||||
#dont poison the ISPs with anything else except your prefix
|
||||
if net = x.x.x.0/24 then accept;
|
||||
else reject;
|
||||
}
|
||||
|
||||
protocol bgp RT1 {
|
||||
local as 2000;
|
||||
neighbor x.x.x.22 as 2000; # iBGP peering
|
||||
#neighbor x.x.x.x.21 as 2000; on RT2
|
||||
keepalive time 5;
|
||||
graceful restart;
|
||||
import all;
|
||||
export all;
|
||||
preference 50; # highest preference "wins".
|
||||
direct;
|
||||
gateway direct;
|
||||
}
|
||||
|
||||
protocol bgp MAIN {
|
||||
local as 2000;
|
||||
neighbor y.y.y.y as 123;
|
||||
#neighbor z.z.z.z as 321; on RT1
|
||||
keepalive time 5;
|
||||
graceful restart;
|
||||
import all;
|
||||
export filter bgp_out;
|
||||
hold time 30;
|
||||
preference 100;
|
||||
}
|
||||
17
Windows Oracle env vars.txt
Normal file
17
Windows Oracle env vars.txt
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
some tips i've found in stack overflow. could be useful:
|
||||
|
||||
fix symbolic links:
|
||||
|
||||
cd c:\windows\system32
|
||||
mklink /d ora112 c:\Oracle\product\11.2.0\dbhome_1
|
||||
cd c:\Windows\sysWOW64
|
||||
mklink /d ora112 c:\Oracle\product\11.2.0\client_1
|
||||
|
||||
PATH=C:\windows\System32\ora112\bin;C:\ProgramData\Oracle\Java\javapath;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\DTS\Binn\;C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\;C:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\;C:\Program Files (x86)\Microsoft SQL Server\100\DTS\Binn\;C:\Program Files\Microsoft\Web Platform Installer\;C:\Program Files (x86)\Microsoft ASP.NET\ASP.NET Web Pages\v1.0\;C:\Program Files\Microsoft SQL Server\110\Tools\Binn\
|
||||
|
||||
ORACLE_HOME=c:\windows\system32\ora112
|
||||
Set Registry value HKLM\Software\ORACLE\KEY_OraClient11g_home1\ORACLE_HOME to:
|
||||
C:\Windows\System32\ora112
|
||||
|
||||
Set Registry value HKLM\Software\Wow6432Node\ORACLE\KEY_OraClient11g_home1\ORACLE_HOME to:
|
||||
C:\Windows\System32\ora112 (not C:\Windows\SysWOW64\System32\ora112)
|
||||
138
configs/.tmux.conf
Normal file
138
configs/.tmux.conf
Normal file
|
|
@ -0,0 +1,138 @@
|
|||
# afx .tmux.conf 2017
|
||||
|
||||
# unbind all does not recover the default binds but we can list them
|
||||
# and fill the 'gaps' with manual rebind in the conf file using this command:
|
||||
# tmux -f /dev/null -L temp start-server \; list-keys
|
||||
unbind-key -a
|
||||
|
||||
set-option -g prefix F2 # ctrl+b => F2
|
||||
#bind-key a send-key M-a # alt+a = alt+a+a
|
||||
bind-key Left send-key M-Left
|
||||
bind-key Right send-key M-Right
|
||||
|
||||
#set tab names
|
||||
set-window-option -g automatic-rename on
|
||||
set-option -g set-titles on
|
||||
|
||||
set -g base-index 1 #0 is too far from ` ;)
|
||||
set -g status-keys vi
|
||||
set -g history-limit 10000
|
||||
set -sg escape-time 0 #No delay for escape key press
|
||||
set -g terminal-overrides "screen.xterm-new" #disable italic in searches
|
||||
setw -g mode-keys vi
|
||||
#setw -g mode-mouse off #tmux 1.9
|
||||
#set-option -g mouse on #tmux 2.1
|
||||
|
||||
bind-key r source-file ~/.tmux.conf
|
||||
bind-key R refresh-client
|
||||
|
||||
bind-key : command-prompt
|
||||
bind-key c new-window
|
||||
bind-key w list-window
|
||||
bind-key Space next-layout
|
||||
bind-key d detach
|
||||
bind-key t clock-mode
|
||||
bind-key n command-prompt 'rename-window %%'
|
||||
bind-key x confirm-before -p "kill-pane #W? (y/n)" kill-pane
|
||||
bind-key X confirm-before -p "kill-window #W? (y/n)" kill-window
|
||||
bind-key N command-prompt 'rename-session %%'
|
||||
bind-key f command-prompt "find-window '%%'"
|
||||
bind-key i display-message
|
||||
bind-key l last-window
|
||||
bind-key w choose-window
|
||||
bind-key Escape copy-mode -u
|
||||
bind-key Up copy-mode -u
|
||||
|
||||
bind-key | split-window -h
|
||||
bind-key \ split-window -h
|
||||
bind-key = split-window -v
|
||||
bind-key - split-window -v
|
||||
#bind-key < swap-window -t :-
|
||||
#bind-key > swap-window -t :+
|
||||
bind-key 0 select-window -t :0
|
||||
bind-key 1 select-window -t :1
|
||||
bind-key 2 select-window -t :2
|
||||
bind-key 3 select-window -t :3
|
||||
bind-key 4 select-window -t :4
|
||||
bind-key 5 select-window -t :5
|
||||
bind-key 6 select-window -t :6
|
||||
bind-key 7 select-window -t :7
|
||||
bind-key 8 select-window -t :8
|
||||
bind-key 9 select-window -t :9
|
||||
|
||||
# pane selection with Ctrl+ArrowKeys
|
||||
bind -n C-Left select-pane -L
|
||||
bind -n C-Right select-pane -R
|
||||
bind -n C-Up select-pane -U
|
||||
bind -n C-Down select-pane -D
|
||||
|
||||
# pane resize with Shift+ArrowKeys
|
||||
bind -n S-Left resize-pane -L
|
||||
bind -n S-Right resize-pane -R
|
||||
bind -n S-Up resize-pane -U
|
||||
bind -n S-Down resize-pane -D
|
||||
|
||||
# switch tabs with Alt+Comma and Alt+Dot
|
||||
bind -n M-, previous-window
|
||||
bind -n M-. next-window
|
||||
|
||||
# loud or quiet?
|
||||
set-option -g visual-activity off
|
||||
set-option -g visual-bell off
|
||||
set-option -g visual-silence off
|
||||
set-window-option -g monitor-activity on
|
||||
set-option -g bell-action none
|
||||
|
||||
# THEME
|
||||
set -g default-terminal "screen-256color"
|
||||
set -g status-position top
|
||||
set -g status-left ''
|
||||
set -g status-utf8 on
|
||||
# Basic status bar colors
|
||||
set -g status-fg colour240
|
||||
set -g status-bg colour233
|
||||
# Left side of status bar
|
||||
set -g status-left-bg colour233
|
||||
set -g status-left-fg colour243
|
||||
set -g status-left-length 40
|
||||
set -g status-left "#[fg=colour232,bg=colour39,bold] #S #[fg=colour233,bg=colour240] #(whoami) #[fg=colour240,bg=colour235] #I:#P "
|
||||
# Right side of status bar
|
||||
set -g status-right-bg colour233
|
||||
set -g status-right-fg colour243
|
||||
set -g status-right-length 150
|
||||
set -g status-right "#[fg=colour235,bg=colour233]#[fg=colour240,bg=colour235] %H:%M:%S #[fg=colour240,bg=colour235]#[fg=colour233,bg=colour240] %d-%b-%y #[fg=colour245,bg=colour240]#[fg=colour232,bg=colour245,bold] #H "
|
||||
# Window status
|
||||
set -g window-status-format " #I:#W#F "
|
||||
set -g window-status-current-format " #I:#W#F "
|
||||
# Current window status
|
||||
set -g window-status-current-bg colour39
|
||||
set -g window-status-current-fg colour232
|
||||
# Window with activity status
|
||||
set -g window-status-activity-bg colour75 # fg and bg are flipped here due to
|
||||
set -g window-status-activity-fg colour233 # a bug in tmux
|
||||
# Window separator
|
||||
set -g window-status-separator ""
|
||||
# Window status alignment
|
||||
set -g status-justify centre
|
||||
# Pane border
|
||||
set -g pane-border-bg default
|
||||
set -g pane-border-fg colour238
|
||||
# Active pane border
|
||||
set -g pane-active-border-bg default
|
||||
set -g pane-active-border-fg colour39
|
||||
# Pane number indicator
|
||||
set -g display-panes-colour colour233
|
||||
set -g display-panes-active-colour colour245
|
||||
# Clock mode
|
||||
set -g clock-mode-colour colour39
|
||||
set -g clock-mode-style 24
|
||||
# Message
|
||||
set -g message-bg colour39
|
||||
set -g message-fg black
|
||||
# Command message
|
||||
set -g message-command-bg colour233
|
||||
set -g message-command-fg black
|
||||
# Mode
|
||||
set -g mode-bg colour39
|
||||
set -g mode-fg colour232
|
||||
|
||||
50
configs/putty-base16-irblack.reg
Normal file
50
configs/putty-base16-irblack.reg
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
Windows Registry Editor Version 5.00
|
||||
|
||||
|
||||
|
||||
[HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\Base16-IR Black]
|
||||
|
||||
|
||||
"Colour0"="145,143,136"
|
||||
|
||||
"Colour1"="181,179,170"
|
||||
|
||||
"Colour2"="0,0,0"
|
||||
|
||||
"Colour3"="36,36,34"
|
||||
|
||||
"Colour4"="0,0,0"
|
||||
|
||||
"Colour5"="217,215,204"
|
||||
|
||||
"Colour6"="0,0,0"
|
||||
|
||||
"Colour7"="108,108,102"
|
||||
|
||||
"Colour8"="255,108,96"
|
||||
|
||||
"Colour9"="233,192,98"
|
||||
|
||||
"Colour10"="168,255,96"
|
||||
|
||||
"Colour11"="36,36,34"
|
||||
|
||||
"Colour12"="255,255,182"
|
||||
|
||||
"Colour13"="72,72,68"
|
||||
|
||||
"Colour14"="150,203,254"
|
||||
|
||||
"Colour15"="145,143,136"
|
||||
|
||||
"Colour16"="255,115,253"
|
||||
|
||||
"Colour17"="217,215,204"
|
||||
|
||||
"Colour18"="198,197,254"
|
||||
|
||||
"Colour19"="177,138,61"
|
||||
|
||||
"Colour20"="181,179,170"
|
||||
|
||||
"Colour21"="253,251,238"
|
||||
44
plesk-wordpress-web.config.txt
Normal file
44
plesk-wordpress-web.config.txt
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<configuration>
|
||||
<system.webServer>
|
||||
|
||||
<httpErrors>
|
||||
<remove statusCode="502" subStatusCode="-1" />
|
||||
<remove statusCode="501" subStatusCode="-1" />
|
||||
<remove statusCode="500" subStatusCode="-1" />
|
||||
<remove statusCode="412" subStatusCode="-1" />
|
||||
<remove statusCode="406" subStatusCode="-1" />
|
||||
<remove statusCode="405" subStatusCode="-1" />
|
||||
<remove statusCode="404" subStatusCode="-1" />
|
||||
<remove statusCode="403" subStatusCode="-1" />
|
||||
<remove statusCode="401" subStatusCode="-1" />
|
||||
<error statusCode="400" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\bad_request.html" />
|
||||
<error statusCode="407" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\proxy_authentication_required.html" />
|
||||
<error statusCode="414" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\request-uri_too_long.html" />
|
||||
<error statusCode="415" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\unsupported_media_type.html" />
|
||||
<error statusCode="503" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\maintenance.html" />
|
||||
<error statusCode="401" prefixLanguageFilePath="" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\unauthorized.html" />
|
||||
<error statusCode="403" prefixLanguageFilePath="" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\forbidden.html" />
|
||||
<error statusCode="404" prefixLanguageFilePath="" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\not_found.html" />
|
||||
<error statusCode="405" prefixLanguageFilePath="" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\method_not_allowed.html" />
|
||||
<error statusCode="406" prefixLanguageFilePath="" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\not_acceptable.html" />
|
||||
<error statusCode="412" prefixLanguageFilePath="" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\precondition_failed.html" />
|
||||
<error statusCode="500" prefixLanguageFilePath="" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\internal_server_error.html" />
|
||||
<error statusCode="501" prefixLanguageFilePath="" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\not_implemented.html" />
|
||||
<error statusCode="502" prefixLanguageFilePath="" path="D:\appdata\IIS\vhosts\domain.tld\error_docs\bad_gateway.html" />
|
||||
</httpErrors>
|
||||
|
||||
<rewrite>
|
||||
<rules>
|
||||
<rule name="Main Rule" stopProcessing="true">
|
||||
<match url=".*" />
|
||||
<conditions logicalGrouping="MatchAll">
|
||||
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
|
||||
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
|
||||
</conditions>
|
||||
<action type="Rewrite" url="index.php" />
|
||||
</rule>
|
||||
</rules>
|
||||
</rewrite>
|
||||
</system.webServer>
|
||||
</configuration>
|
||||
116
scripts/aclset.sh
Normal file
116
scripts/aclset.sh
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
#!/bin/bash
|
||||
|
||||
# afx acl setup
|
||||
|
||||
### vars
|
||||
|
||||
watchdir="/srv/test"
|
||||
domainadmin="afx"
|
||||
password="CHANGEME"
|
||||
|
||||
###
|
||||
|
||||
#init
|
||||
controlfile="control.txt"
|
||||
passfile="password.txt"
|
||||
aclset="";
|
||||
acldel="";
|
||||
old_IFS=$IFS # save the field separator
|
||||
IFS=$'\n' # new field separator, the end of line
|
||||
exec > /tmp/afxacl.log 2>&1
|
||||
|
||||
mlocate --database=/tmp/afxacl.db $controlfile > /tmp/afxacl.set.1.tmp
|
||||
mlocate --database=/tmp/afxacl.db $passfile > /tmp/afxacl.del.1.tmp
|
||||
updatedb --database-root=$watchdir --output /tmp/afxacl.db -l 0
|
||||
mlocate --database=/tmp/afxacl.db $controlfile > /tmp/afxacl.set.2.tmp
|
||||
mlocate --database=/tmp/afxacl.db $passfile > /tmp/afxacl.del.2.tmp
|
||||
|
||||
setlist=`diff /tmp/afxacl.set.1.tmp /tmp/afxacl.set.2.tmp`
|
||||
aclset=`echo "$setlist" | grep '>'`
|
||||
dellist=`diff /tmp/afxacl.del.1.tmp /tmp/afxacl.del.2.tmp`
|
||||
acldel=`echo "$dellist" | grep '>'`
|
||||
|
||||
#del
|
||||
if [ -n "$acldel" ]
|
||||
then
|
||||
while read dline;
|
||||
do
|
||||
curcontroldel=`echo "$dline" | cut -c 3-`;
|
||||
echo "unlocking $curcontroldel"
|
||||
ccut=`expr ${#passfile} + 1`
|
||||
cdir=`echo "$curcontroldel" | rev | cut -c $ccut- | rev`
|
||||
echo ""
|
||||
if [ -d "$cdir" ];
|
||||
then
|
||||
if grep -q $password "$curcontroldel";
|
||||
then
|
||||
echo "password accepted"
|
||||
chattr -i "$cdir/$controlfile"
|
||||
rm "$cdir/$controlfile"
|
||||
setfacl -R --remove-all "$cdir"
|
||||
chmod 770 "$cdir"
|
||||
echo ""
|
||||
echo "current permissions:"
|
||||
getfacl "$cdir"
|
||||
rm "$curcontroldel"
|
||||
else
|
||||
echo "invalid password!"
|
||||
rm "$curcontroldel"
|
||||
fi
|
||||
else
|
||||
echo "warning: whole dir was deleted"
|
||||
fi
|
||||
echo ""
|
||||
echo ""
|
||||
done < <(echo "$acldel")
|
||||
fi
|
||||
|
||||
# set
|
||||
if [ -n "$aclset" ]
|
||||
then
|
||||
while read cline;
|
||||
do
|
||||
curcontrolset=`echo "$cline" | cut -c 3-`;
|
||||
echo "setting up acl from $curcontrolset"
|
||||
ccuser=`stat -c "%U" "$curcontrolset"`
|
||||
if [ "$ccuser" != "$domainadmin" ];
|
||||
then
|
||||
echo "$ccuser is not a valid admin!"
|
||||
rm $curcontrolset
|
||||
continue;
|
||||
fi
|
||||
|
||||
echo ""
|
||||
ccut=`expr ${#controlfile} + 1`
|
||||
cdir=`echo "$curcontrolset" | rev | cut -c $ccut- | rev`
|
||||
chmod 700 "$cdir"
|
||||
for uline in $(cat "$curcontrolset")
|
||||
do
|
||||
echo "add user $uline ..."
|
||||
setfacl -R -n -m u:$uline:rwx "$cdir"
|
||||
done
|
||||
echo "add admin $domainadmin ..."
|
||||
setfacl -R -n -m u:$domainadmin:rwx "$cdir"
|
||||
setfacl -R -n -m m::rwx "$cdir"
|
||||
|
||||
chattr +i "$curcontrolset"
|
||||
echo ""
|
||||
echo "current permissions:"
|
||||
getfacl "$cdir"
|
||||
echo ""
|
||||
echo ""
|
||||
done < <(echo "$aclset")
|
||||
|
||||
fi
|
||||
|
||||
IFS=$old_IFS # restore default field separator
|
||||
|
||||
if [ -s /tmp/afxacl.log ];
|
||||
then
|
||||
mutt -s "setacl.sh notice" mailbox@server.com < /tmp/afxacl.log
|
||||
fi
|
||||
|
||||
#cleantmp
|
||||
rm /tmp/afxacl.set*
|
||||
rm /tmp/afxacl.del*
|
||||
|
||||
33
scripts/arduino.py
Normal file
33
scripts/arduino.py
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
#!/usr/bin/env python
|
||||
|
||||
""" arduino reader by afx """
|
||||
|
||||
import time, serial
|
||||
from sys import argv
|
||||
|
||||
def query_arduino():
|
||||
global serial
|
||||
serial = serial.Serial('/dev/ttyACM0', 9600)
|
||||
serial.write('1')
|
||||
query = serial.readline().strip('\r\n').split()
|
||||
fo = open('/etc/scripts/.arduino.db', 'wb')
|
||||
fo.write(','.join(query))
|
||||
fo.close()
|
||||
|
||||
def print_arduino(pmode):
|
||||
fr = open('/etc/scripts/.arduino.db', 'r+')
|
||||
rquery = fr.read(100);
|
||||
print(rquery.split(',')[pmode])
|
||||
fr.close()
|
||||
|
||||
if __name__ == "__main__":
|
||||
mode = argv
|
||||
if mode[1] == 'temp':
|
||||
print_arduino(0)
|
||||
elif mode[1] == 'humid':
|
||||
print_arduino(1)
|
||||
elif mode[1] == 'query':
|
||||
query_arduino()
|
||||
else:
|
||||
print('Usage: script.py [temp] [humid]')
|
||||
|
||||
76
scripts/blackhole.py
Normal file
76
scripts/blackhole.py
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
#!/usr/bin/python3
|
||||
|
||||
# simple ip blackhole list :)
|
||||
# afx Nov 2016
|
||||
#
|
||||
# requires Pygtail
|
||||
# should be installed to iptables filtered machine with DROP and LOG policy
|
||||
# the idea is that any traffic coming to this serviceless machine can be assumed
|
||||
# as bad and then listed for further processing
|
||||
|
||||
from pygtail import Pygtail
|
||||
|
||||
import sys
|
||||
import signal
|
||||
import re
|
||||
import time
|
||||
import json
|
||||
|
||||
kernlog = '/var/log/kern.log'
|
||||
dbfile = '/var/www/html/blacklist.txt'
|
||||
|
||||
#add whitelisted ips here:
|
||||
whitelist = [ '1.2.3.4',
|
||||
'5.6.7.8' ]
|
||||
|
||||
######
|
||||
|
||||
def signal_handler(signal, frame):
|
||||
print('You\'ve pressed Ctrl+C. Listing stats and exiting...')
|
||||
print('')
|
||||
print(json.dumps(stats))
|
||||
sys.exit(0)
|
||||
|
||||
signal.signal(signal.SIGINT, signal_handler)
|
||||
|
||||
print('.o.oOo.o. blackhole.py by afx .o.oOo.o.')
|
||||
print('^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^')
|
||||
print('Whitelist: {}'.format(whitelist))
|
||||
blacklist = []
|
||||
stats = {}
|
||||
try:
|
||||
blackfile = open(dbfile, 'r')
|
||||
for item in blackfile:
|
||||
blacklist.append(item.strip())
|
||||
blackfile.close()
|
||||
print('Blacklist: {}'.format(blacklist))
|
||||
except Exception as e:
|
||||
print(e)
|
||||
print('Blacklist empty.')
|
||||
print('')
|
||||
|
||||
while True:
|
||||
time.sleep(1)
|
||||
for line in Pygtail(kernlog):
|
||||
query = re.findall( r'SRC=[0-9]+(?:\.[0-9]+){3}', line )
|
||||
newip = query[0][4:]
|
||||
if newip in whitelist:
|
||||
print('{} whitelisted'.format(newip))
|
||||
continue
|
||||
elif newip in blacklist:
|
||||
try:
|
||||
oldcounter = stats[newip]
|
||||
except:
|
||||
oldcounter = 0
|
||||
counter = oldcounter + 1
|
||||
stats.update({ newip: counter })
|
||||
print('{} -> {}'.format(newip, str(stats[newip])))
|
||||
else:
|
||||
print('{} blackholed'.format(newip))
|
||||
blacklist.append(newip)
|
||||
blackfile = open(dbfile, 'w')
|
||||
for item in blacklist:
|
||||
blackfile.write("%s\n" % item)
|
||||
blackfile.close()
|
||||
|
||||
#EOF
|
||||
29
scripts/clean-maildir.sh
Normal file
29
scripts/clean-maildir.sh
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
#!/bin/sh
|
||||
# Time to wait before removing mails from the Junk folder (Default: 7 days) Set 0 to turn off.
|
||||
junk_max_hours=$((24*2))
|
||||
# Time to wait before removing mails from the Trash folder (Default: 30 days) Set 0 to turn off.
|
||||
trash_max_hours=$((24*10))
|
||||
for domain in /var/vmail/*
|
||||
do
|
||||
if [ -d "$domain" ]
|
||||
then
|
||||
for user in $domain/*
|
||||
do
|
||||
if [ "$junk_max_hours" -gt "0" ]
|
||||
then
|
||||
if [ -d "$user/Maildir/.Junk" ]
|
||||
then
|
||||
tmpreaper -m $junk_max_hours $user/Maildir/.Junk/{cur,new}
|
||||
fi
|
||||
fi
|
||||
if [ "$trash_max_hours" -gt "0" ]
|
||||
then
|
||||
if [ -d "$user/Maildir/.Trash" ]
|
||||
then
|
||||
tmpreaper -m $trash_max_hours $user/Maildir/.Trash/{cur,new}
|
||||
fi
|
||||
fi
|
||||
done
|
||||
fi
|
||||
done
|
||||
|
||||
49
scripts/cronic.sh
Normal file
49
scripts/cronic.sh
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Cronic v2 - cron job report wrapper
|
||||
# Copyright 2007 Chuck Houpt. No rights reserved, whatsoever.
|
||||
# Public Domain CC0: http://creativecommons.org/publicdomain/zero/1.0/
|
||||
|
||||
set -eu
|
||||
|
||||
OUT=/tmp/cronic.out.$$
|
||||
ERR=/tmp/cronic.err.$$
|
||||
TRACE=/tmp/cronic.trace.$$
|
||||
|
||||
set +e
|
||||
"$@" >$OUT 2>$TRACE
|
||||
RESULT=$?
|
||||
set -e
|
||||
|
||||
PATTERN="^${PS4:0:1}\\+${PS4:1}"
|
||||
if grep -aq "$PATTERN" $TRACE
|
||||
then
|
||||
! grep -av "$PATTERN" $TRACE > $ERR
|
||||
else
|
||||
ERR=$TRACE
|
||||
fi
|
||||
|
||||
if [ $RESULT -ne 0 -o -s "$ERR" ]
|
||||
then
|
||||
echo "Cronic detected failure or error output for the command:"
|
||||
echo "$@"
|
||||
echo
|
||||
echo "RESULT CODE: $RESULT"
|
||||
echo
|
||||
echo "ERROR OUTPUT:"
|
||||
cat "$ERR"
|
||||
echo
|
||||
echo "STANDARD OUTPUT:"
|
||||
cat "$OUT"
|
||||
if [ $TRACE != $ERR ]
|
||||
then
|
||||
echo
|
||||
echo "TRACE-ERROR OUTPUT:"
|
||||
cat "$TRACE"
|
||||
fi
|
||||
fi
|
||||
|
||||
rm -f "$OUT"
|
||||
rm -f "$ERR"
|
||||
rm -f "$TRACE"
|
||||
|
||||
333
scripts/iptables-vlan.sh
Normal file
333
scripts/iptables-vlan.sh
Normal file
|
|
@ -0,0 +1,333 @@
|
|||
#!/bin/bash
|
||||
|
||||
SYSCTL="/sbin/sysctl -w"
|
||||
|
||||
IPT="/sbin/iptables"
|
||||
IPTS="/sbin/iptables-save"
|
||||
IPTR="/sbin/iptables-restore"
|
||||
|
||||
# Internet Interface
|
||||
INET_IFACE="eth1"
|
||||
INET_IP="1.2.3.4"
|
||||
INET_ADMIN="2.3.4.5"
|
||||
|
||||
VPN_IFACE="tun+"
|
||||
VPN_IP="10.8.0.1"
|
||||
VPN_NET="10.8.0.0/8"
|
||||
VPN_BCAST="10.255.255.255"
|
||||
|
||||
# Local Interface Information
|
||||
LOCAL_IFACE="eth0"
|
||||
LOCAL_IP="192.168.5.1"
|
||||
LOCAL_NET="192.168.5.0/24"
|
||||
LOCAL_BCAST="192.168.5.255"
|
||||
|
||||
EVOIP_IFACE="vlan1234"
|
||||
EVOIP_IP="10.20.5.50"
|
||||
EVOIP_NET="10.20.5.48/29"
|
||||
EVOIP_BCAST="10.20.5.55"
|
||||
|
||||
VIDEO_IFACE="vlan1015"
|
||||
VIDEO_IP="192.168.15.1"
|
||||
VIDEO_NET="192.168.15.0/24"
|
||||
VIDEO_BCAST="192.168.15.255"
|
||||
|
||||
VOIP_IFACE="vlan1016"
|
||||
VOIP_IP="192.168.16.1"
|
||||
VOIP_NET="192.168.16.0/24"
|
||||
VOIP_BCAST="192.168.16.255"
|
||||
|
||||
WIFI_IFACE="vlan1017"
|
||||
WIFI_IP="192.168.17.1"
|
||||
WIFI_NET="192.168.17.0/24"
|
||||
WIFI_BCAST="192.168.17.255"
|
||||
|
||||
# Localhost Interface
|
||||
|
||||
LO_IFACE="lo"
|
||||
LO_IP="127.0.0.1"
|
||||
|
||||
# Save and Restore arguments handled here
|
||||
if [ "$1" = "save" ]
|
||||
then
|
||||
echo -n "Saving firewall to /etc/sysconfig/iptables ... "
|
||||
$IPTS > /etc/scripts/iptables
|
||||
echo "done"
|
||||
exit 0
|
||||
elif [ "$1" = "restore" ]
|
||||
then
|
||||
echo -n "Restoring firewall from /etc/sysconfig/iptables ... "
|
||||
$IPTR < /etc/scripts/iptables
|
||||
echo "done"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Loading kernel modules ..."
|
||||
|
||||
/sbin/modprobe ip_tables
|
||||
/sbin/modprobe ip_conntrack
|
||||
/sbin/modprobe iptable_filter
|
||||
/sbin/modprobe iptable_mangle
|
||||
/sbin/modprobe iptable_nat
|
||||
/sbin/modprobe ipt_LOG
|
||||
/sbin/modprobe ipt_limit
|
||||
/sbin/modprobe ipt_MASQUERADE
|
||||
#/sbin/modprobe ipt_owner
|
||||
#/sbin/modprobe ipt_REJECT
|
||||
#/sbin/modprobe ipt_mark
|
||||
#/sbin/modprobe ipt_tcpmss
|
||||
/sbin/modprobe multiport
|
||||
/sbin/modprobe ipt_state
|
||||
#/sbin/modprobe ipt_unclean
|
||||
/sbin/modprobe ip_nat_ftp
|
||||
/sbin/modprobe ip_conntrack_ftp
|
||||
#/sbin/modprobe ip_conntrack_irc
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "1" > /proc/sys/net/ipv4/ip_forward
|
||||
else
|
||||
$SYSCTL net.ipv4.ip_forward="1"
|
||||
fi
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
|
||||
else
|
||||
$SYSCTL net.ipv4.tcp_syncookies="1"
|
||||
fi
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
|
||||
else
|
||||
$SYSCTL net.ipv4.conf.all.rp_filter="1"
|
||||
fi
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
|
||||
else
|
||||
$SYSCTL net.ipv4.icmp_echo_ignore_broadcasts="1"
|
||||
fi
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
|
||||
else
|
||||
$SYSCTL net.ipv4.conf.all.accept_source_route="0"
|
||||
fi
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "1" > /proc/sys/net/ipv4/conf/all/secure_redirects
|
||||
else
|
||||
$SYSCTL net.ipv4.conf.all.secure_redirects="1"
|
||||
fi
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
|
||||
else
|
||||
$SYSCTL net.ipv4.conf.all.log_martians="1"
|
||||
fi
|
||||
|
||||
###############################################################################
|
||||
echo "Flushing Tables ..."
|
||||
|
||||
# Reset Default Policies
|
||||
$IPT -P INPUT ACCEPT
|
||||
$IPT -P FORWARD ACCEPT
|
||||
$IPT -P OUTPUT ACCEPT
|
||||
$IPT -t nat -P PREROUTING ACCEPT
|
||||
$IPT -t nat -P POSTROUTING ACCEPT
|
||||
$IPT -t nat -P OUTPUT ACCEPT
|
||||
$IPT -t mangle -P PREROUTING ACCEPT
|
||||
$IPT -t mangle -P OUTPUT ACCEPT
|
||||
|
||||
$IPT -F
|
||||
$IPT -t nat -F
|
||||
$IPT -t mangle -F
|
||||
$IPT -X
|
||||
$IPT -t nat -X
|
||||
$IPT -t mangle -X
|
||||
|
||||
if [ "$1" = "stop" ]
|
||||
then
|
||||
echo "Firewall completely flushed! Now running with no firewall."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
$IPT -P INPUT DROP
|
||||
$IPT -P OUTPUT DROP
|
||||
$IPT -P FORWARD DROP
|
||||
###############################################################################
|
||||
|
||||
#$IPT -N bad_packets
|
||||
#$IPT -N bad_tcp_packets
|
||||
$IPT -N icmp_packets
|
||||
$IPT -N udp_inbound
|
||||
$IPT -N udp_outbound
|
||||
$IPT -N tcp_inbound
|
||||
$IPT -N tcp_outbound
|
||||
|
||||
#$IPT -A bad_packets -p ALL -i $INET_IFACE -s $LOCAL_NET -j LOG --log-prefix "fp=bad_packets:2 a=DROP "
|
||||
$IPT -A bad_packets -p ALL -i $INET_IFACE -s $LOCAL_NET -j DROP
|
||||
#$IPT -A bad_packets -p ALL -m state --state INVALID -j LOG --log-prefix "fp=bad_packets:1 a=DROP "
|
||||
$IPT -A bad_packets -p ALL -m state --state INVALID -j DROP
|
||||
$IPT -A bad_packets -p tcp -j bad_tcp_packets
|
||||
$IPT -A bad_packets -p ALL -j RETURN
|
||||
|
||||
$IPT -A bad_tcp_packets -p tcp -i $LOCAL_IFACE -j RETURN
|
||||
#$IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "fp=bad_tcp_packets:1 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
|
||||
#$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j LOG --log-prefix "fp=bad_tcp_packets:2 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j DROP
|
||||
#$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j LOG --log-prefix "fp=bad_tcp_packets:3 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j DROP
|
||||
#$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j LOG --log-prefix "fp=bad_tcp_packets:4 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
|
||||
#$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LOG --log-prefix "fp=bad_tcp_packets:5 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
|
||||
#$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "fp=bad_tcp_packets:6 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
|
||||
#$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-prefix "fp=bad_tcp_packets:7 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
|
||||
$IPT -A bad_tcp_packets -p tcp -j RETURN
|
||||
|
||||
#$IPT -A icmp_packets --fragment -p ICMP -j LOG --log-prefix "fp=icmp_packets:1 a=DROP "
|
||||
$IPT -A icmp_packets --fragment -p ICMP -j DROP
|
||||
$IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j DROP
|
||||
$IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
|
||||
$IPT -A icmp_packets -p ICMP -j RETURN
|
||||
#$IPT -A icmp_packets -p ICMP -j ACCEPT
|
||||
|
||||
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 137 -j DROP
|
||||
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 138 -j DROP
|
||||
$IPT -A udp_inbound -p UDP -s 0/0 --source-port 67 --destination-port 68 -j ACCEPT
|
||||
$IPT -A udp_inbound -m state --state NEW -p UDP -s 0/0 --destination-port 1194 -j ACCEPT #vpn
|
||||
$IPT -A udp_inbound -p UDP -j RETURN
|
||||
|
||||
$IPT -A tcp_inbound -p TCP -s $INET_ADMIN --destination-port 2222 -j ACCEPT #ssh
|
||||
$IPT -A tcp_inbound -p TCP -j RETURN
|
||||
|
||||
$IPT -A udp_outbound -p UDP -s 0/0 -j ACCEPT
|
||||
$IPT -A tcp_outbound -p TCP -s 0/0 -j ACCEPT
|
||||
|
||||
###############################################################################
|
||||
echo "Process INPUT chain ..."
|
||||
|
||||
$IPT -A INPUT -p ALL -i $LO_IFACE -j ACCEPT
|
||||
#$IPT -A INPUT -p ALL -j bad_packets
|
||||
$IPT -A INPUT -p ALL -i $LOCAL_IFACE -s $LOCAL_NET -j ACCEPT
|
||||
$IPT -A INPUT -p ALL -i $LOCAL_IFACE -d $LOCAL_BCAST -j ACCEPT
|
||||
|
||||
$IPT -A INPUT -p ALL -i $WIFI_IFACE -s $WIFI_NET -j ACCEPT
|
||||
$IPT -A INPUT -p ALL -i $WIFI_IFACE -d $WIFI_BCAST -j ACCEPT
|
||||
|
||||
$IPT -A INPUT -p ALL -i $VIDEO_IFACE -s $VIDEO_NET -j ACCEPT
|
||||
$IPT -A INPUT -p ALL -i $VIDEO_IFACE -d $VIDEO_BCAST -j ACCEPT
|
||||
|
||||
$IPT -A INPUT -p ALL -i $VOIP_IFACE -s $VOIP_NET -j ACCEPT
|
||||
$IPT -A INPUT -p ALL -i $VOIP_IFACE -d $VOIP_BCAST -j ACCEPT
|
||||
|
||||
$IPT -A INPUT -p ALL -i $VPN_IFACE -j ACCEPT
|
||||
$IPT -A INPUT -p ALL -i $EVOIP_IFACE -j ACCEPT
|
||||
|
||||
$IPT -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
$IPT -A INPUT -p TCP -i $INET_IFACE -j tcp_inbound
|
||||
$IPT -A INPUT -p UDP -i $INET_IFACE -j udp_inbound
|
||||
$IPT -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
|
||||
|
||||
#$IPT -A INPUT -m pkttype --pkt-type broadcast -j DROP
|
||||
#$IPT -A INPUT -j LOG --log-prefix "fp=INPUT:99 a=DROP "
|
||||
|
||||
###############################################################################
|
||||
echo "Process FORWARD chain ..."
|
||||
|
||||
#$IPT -A FORWARD -p ALL -j bad_packets
|
||||
$IPT -A FORWARD -p tcp -i $LOCAL_IFACE -j tcp_outbound
|
||||
$IPT -A FORWARD -p udp -i $LOCAL_IFACE -j udp_outbound
|
||||
$IPT -A FORWARD -p ALL -i $LOCAL_IFACE -j ACCEPT
|
||||
|
||||
#forward VIDEO vlan1015 to internet but not to the local network!
|
||||
###$IPT -A FORWARD -p ALL -i $VIDEO_IFACE -d $LOCAL_NET -j LOG --log-prefix "fp=FORWARD:99 a=DROP "
|
||||
###$IPT -A FORWARD -p ALL -i $VIDEO_IFACE -d $LOCAL_NET -j DROP
|
||||
$IPT -A FORWARD -p ALL -i $VIDEO_IFACE -d $LOCAL_NET -j ACCEPT
|
||||
$IPT -A FORWARD -p ALL -i $VIDEO_IFACE -s $VIDEO_NET -j ACCEPT
|
||||
|
||||
#forward VOIP vlan1016 to internet but not to the local network!
|
||||
$IPT -A FORWARD -p ALL -i $VOIP_IFACE -d $LOCAL_NET -j LOG --log-prefix "fp=FORWARD:99 a=DROP "
|
||||
$IPT -A FORWARD -p ALL -i $VOIP_IFACE -d $LOCAL_NET -j DROP
|
||||
$IPT -A FORWARD -p ALL -i $VOIP_IFACE -s $VOIP_NET -j ACCEPT
|
||||
|
||||
#forward WIFI vlan1017 to internet but not to the local network!
|
||||
$IPT -A FORWARD -p ALL -i $WIFI_IFACE -d $LOCAL_NET -j LOG --log-prefix "fp=FORWARD:99 a=DROP "
|
||||
$IPT -A FORWARD -p ALL -i $WIFI_IFACE -d $LOCAL_NET -j DROP
|
||||
#wifi to DVR allowed:
|
||||
$IPT -A FORWARD -p ALL -i $WIFI_IFACE -d 192.168.15.2 -j ACCEPT
|
||||
$IPT -A FORWARD -p ALL -i $WIFI_IFACE -d 192.168.15.1 -j ACCEPT
|
||||
$IPT -A FORWARD -p ALL -i $WIFI_IFACE -d $VIDEO_NET -j DROP
|
||||
$IPT -A FORWARD -p ALL -i $WIFI_IFACE -d $VOIP_NET -j LOG --log-prefix "fp=FORWARD:99 a=DROP "
|
||||
$IPT -A FORWARD -p ALL -i $WIFI_IFACE -d $VOIP_NET -j DROP
|
||||
$IPT -A FORWARD -p ALL -i $WIFI_IFACE -s $WIFI_NET -j ACCEPT
|
||||
|
||||
#forward VPN
|
||||
$IPT -A FORWARD -p ALL -i $VPN_IFACE -s $VPN_NET -j ACCEPT
|
||||
#$IPT -A FORWARD -i $VPN_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
$IPT -A FORWARD -i $EVOIP_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
$IPT -A FORWARD -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
$IPT -A FORWARD -j LOG --log-prefix "fp=FORWARD:99 a=DROP "
|
||||
|
||||
###############################################################################
|
||||
echo "Process OUTPUT chain ..."
|
||||
|
||||
$IPT -A OUTPUT -m state -p icmp --state INVALID -j DROP
|
||||
$IPT -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
|
||||
$IPT -A OUTPUT -p ALL -o $LO_IFACE -j ACCEPT
|
||||
|
||||
$IPT -A OUTPUT -p ALL -s $LOCAL_IP -j ACCEPT
|
||||
$IPT -A OUTPUT -p ALL -o $LOCAL_IFACE -j ACCEPT
|
||||
|
||||
$IPT -A OUTPUT -p ALL -s $VIDEO_IP -j ACCEPT
|
||||
$IPT -A OUTPUT -p ALL -o $VIDEO_IFACE -j ACCEPT
|
||||
|
||||
$IPT -A OUTPUT -p ALL -s $WIFI_IP -j ACCEPT
|
||||
$IPT -A OUTPUT -p ALL -o $WIFI_IFACE -j ACCEPT
|
||||
|
||||
$IPT -A OUTPUT -p ALL -s $VOIP_IP -j ACCEPT
|
||||
$IPT -A OUTPUT -p ALL -o $VOIP_IFACE -j ACCEPT
|
||||
|
||||
$IPT -A OUTPUT -p ALL -o $VPN_IFACE -j ACCEPT
|
||||
|
||||
$IPT -A OUTPUT -p ALL -o $EVOIP_IFACE -j ACCEPT
|
||||
$IPT -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT
|
||||
$IPT -A OUTPUT -j LOG --log-prefix "fp=OUTPUT:99 a=DROP "
|
||||
|
||||
###############################################################################
|
||||
echo "Load rules for nat table ..."
|
||||
|
||||
$IPT -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE
|
||||
$IPT -t nat -A POSTROUTING -o $EVOIP_IFACE -j MASQUERADE
|
||||
$IPT -t nat -A POSTROUTING -s $VPN_NET -o $INET_IFACE -j MASQUERADE #vpn
|
||||
|
||||
###
|
||||
echo "Loading extra rules ..."
|
||||
|
||||
#VOIP
|
||||
$IPT -I FORWARD -p udp -i $EVOIP_IFACE -d 192.168.16.2 --dport 5060 -j ACCEPT
|
||||
$IPT -t nat -I PREROUTING -p udp -i $EVOIP_IFACE --dport 5060 -j DNAT --to 192.168.16.2:5060
|
||||
$IPT -I FORWARD -p udp -i $EVOIP_IFACE -d 192.168.16.2 --dport 10000:20000 -j ACCEPT
|
||||
$IPT -t nat -I PREROUTING -p udp -i $EVOIP_IFACE --dport 10000:20000 -j DNAT --to 192.168.16.2:10000-20000
|
||||
|
||||
#NVR
|
||||
$IPT -I FORWARD -p tcp -i $INET_IFACE -s 0/0 -d 192.168.15.251 --dport 8001 -j ACCEPT
|
||||
$IPT -t nat -I PREROUTING -p tcp -i $INET_IFACE --dport 8001 -j DNAT --to 192.168.15.251:8001
|
||||
$IPT -t nat -I PREROUTING -p tcp -i $WIFI_IFACE -s $WIFI_NET -d $INET_IP --dport 8001 -j DNAT --to 192.168.15.251:8001
|
||||
$IPT -t nat -I POSTROUTING -p tcp -o $WIFI_IFACE -s $VIDEO_NET -d 192.168.15.251 --dport 8001 -j SNAT --to $INET_IP
|
||||
#substream
|
||||
$IPT -I FORWARD -p tcp -i $INET_IFACE -s 0/0 -d 192.168.15.251 --dport 554 -j ACCEPT
|
||||
$IPT -t nat -I PREROUTING -p tcp -i $INET_IFACE --dport 554 -j DNAT --to 192.168.15.251:554
|
||||
$IPT -t nat -I PREROUTING -p tcp -i $WIFI_IFACE -s $WIFI_NET -d $INET_IP --dport 554 -j DNAT --to 192.168.15.250:554
|
||||
$IPT -t nat -I POSTROUTING -p tcp -o $WIFI_IFACE -s $VIDEO_NET -d 192.168.15.251 --dport 554 -j SNAT --to $INET_IP
|
||||
267
scripts/iptables.sh
Normal file
267
scripts/iptables.sh
Normal file
|
|
@ -0,0 +1,267 @@
|
|||
#!/bin/bash
|
||||
|
||||
### iptables.sh for ipv4
|
||||
|
||||
SYSCTL="/sbin/sysctl -w"
|
||||
|
||||
IPT="/sbin/iptables"
|
||||
IPTS="/sbin/iptables-save"
|
||||
IPTR="/sbin/iptables-restore"
|
||||
|
||||
# Internet Interface
|
||||
INET_IFACE="pub"
|
||||
#INET_IFACE2="pub2"
|
||||
INET_ADMIN="1.2.3.4"
|
||||
INET_ORB="2.3.4.5"
|
||||
|
||||
# Local Interface Information
|
||||
LOCAL_IFACE="dmz"
|
||||
LOCAL_IP="192.168.0.5"
|
||||
LOCAL_NET="192.168.0.0/24"
|
||||
LOCAL_BCAST="192.168.0.255"
|
||||
|
||||
# Localhost Interface
|
||||
|
||||
LO_IFACE="lo"
|
||||
LO_IP="127.0.0.1"
|
||||
|
||||
# Save and Restore arguments handled here
|
||||
if [ "$1" = "save" ]
|
||||
then
|
||||
echo -n "Saving firewall to /etc/sysconfig/iptables ... "
|
||||
$IPTS > /etc/scripts/iptables
|
||||
echo "done"
|
||||
exit 0
|
||||
elif [ "$1" = "restore" ]
|
||||
then
|
||||
echo -n "Restoring firewall from /etc/sysconfig/iptables ... "
|
||||
$IPTR < /etc/scripts/iptables
|
||||
echo "done"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Loading kernel modules ..."
|
||||
|
||||
/sbin/modprobe ip_tables
|
||||
/sbin/modprobe ip_conntrack
|
||||
# /sbin/modprobe iptable_filter
|
||||
# /sbin/modprobe iptable_mangle
|
||||
# /sbin/modprobe iptable_nat
|
||||
# /sbin/modprobe ipt_LOG
|
||||
# /sbin/modprobe ipt_limit
|
||||
# /sbin/modprobe ipt_MASQUERADE
|
||||
# /sbin/modprobe ipt_owner
|
||||
# /sbin/modprobe ipt_REJECT
|
||||
# /sbin/modprobe ipt_mark
|
||||
# /sbin/modprobe ipt_tcpmss
|
||||
# /sbin/modprobe multiport
|
||||
# /sbin/modprobe ipt_state
|
||||
# /sbin/modprobe ipt_unclean
|
||||
/sbin/modprobe ip_nat_ftp
|
||||
/sbin/modprobe ip_conntrack_ftp
|
||||
/sbin/modprobe ip_conntrack_irc
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "1" > /proc/sys/net/ipv4/ip_forward
|
||||
else
|
||||
$SYSCTL net.ipv4.ip_forward="1"
|
||||
fi
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
|
||||
else
|
||||
$SYSCTL net.ipv4.tcp_syncookies="1"
|
||||
fi
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
|
||||
else
|
||||
$SYSCTL net.ipv4.conf.all.rp_filter="1"
|
||||
fi
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
|
||||
else
|
||||
$SYSCTL net.ipv4.icmp_echo_ignore_broadcasts="1"
|
||||
fi
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
|
||||
else
|
||||
$SYSCTL net.ipv4.conf.all.accept_source_route="0"
|
||||
fi
|
||||
|
||||
if [ "$SYSCTL" = "" ]
|
||||
then
|
||||
echo "1" > /proc/sys/net/ipv4/conf/all/secure_redirects
|
||||
else
|
||||
$SYSCTL net.ipv4.conf.all.secure_redirects="1"
|
||||
fi
|
||||
|
||||
#if [ "$SYSCTL" = "" ]
|
||||
#then
|
||||
# echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
|
||||
#else
|
||||
# $SYSCTL net.ipv4.conf.all.log_martians="1"
|
||||
#fi
|
||||
|
||||
|
||||
###############################################################################
|
||||
|
||||
echo "Flushing Tables ..."
|
||||
|
||||
# Reset Default Policies
|
||||
$IPT -P INPUT ACCEPT
|
||||
$IPT -P FORWARD ACCEPT
|
||||
$IPT -P OUTPUT ACCEPT
|
||||
$IPT -t nat -P PREROUTING ACCEPT
|
||||
$IPT -t nat -P POSTROUTING ACCEPT
|
||||
$IPT -t nat -P OUTPUT ACCEPT
|
||||
$IPT -t mangle -P PREROUTING ACCEPT
|
||||
$IPT -t mangle -P OUTPUT ACCEPT
|
||||
|
||||
$IPT -F
|
||||
$IPT -t nat -F
|
||||
$IPT -t mangle -F
|
||||
$IPT -X
|
||||
$IPT -t nat -X
|
||||
$IPT -t mangle -X
|
||||
|
||||
if [ "$1" = "stop" ]
|
||||
then
|
||||
echo "Firewall completely flushed! Now running with no firewall."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
$IPT -P INPUT DROP
|
||||
$IPT -P OUTPUT DROP
|
||||
$IPT -P FORWARD DROP
|
||||
|
||||
###############################################################################
|
||||
|
||||
$IPT -N bad_packets
|
||||
$IPT -N bad_tcp_packets
|
||||
$IPT -N icmp_packets
|
||||
$IPT -N udp_inbound
|
||||
$IPT -N udp_outbound
|
||||
$IPT -N tcp_inbound
|
||||
$IPT -N tcp_outbound
|
||||
|
||||
$IPT -A bad_packets -p ALL -i $INET_IFACE -s $LOCAL_NET -j LOG --log-prefix "fp=bad_packets:2 a=DROP "
|
||||
$IPT -A bad_packets -p ALL -i $INET_IFACE -s $LOCAL_NET -j DROP
|
||||
|
||||
$IPT -A bad_packets -p ALL -m state --state INVALID -j LOG --log-prefix "fp=bad_packets:1 a=DROP "
|
||||
$IPT -A bad_packets -p ALL -m state --state INVALID -j DROP
|
||||
$IPT -A bad_packets -p tcp -j bad_tcp_packets
|
||||
$IPT -A bad_packets -p ALL -j RETURN
|
||||
|
||||
$IPT -A bad_tcp_packets -p tcp -i $LOCAL_IFACE -j RETURN
|
||||
|
||||
$IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "fp=bad_tcp_packets:1 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
|
||||
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j LOG --log-prefix "fp=bad_tcp_packets:2 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j DROP
|
||||
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j LOG --log-prefix "fp=bad_tcp_packets:3 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j DROP
|
||||
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j LOG --log-prefix "fp=bad_tcp_packets:4 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
|
||||
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LOG --log-prefix "fp=bad_tcp_packets:5 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
|
||||
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "fp=bad_tcp_packets:6 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
|
||||
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-prefix "fp=bad_tcp_packets:7 a=DROP "
|
||||
$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
|
||||
|
||||
$IPT -A bad_tcp_packets -p tcp -j RETURN
|
||||
|
||||
### ICMP
|
||||
#$IPT -A icmp_packets --fragment -p ICMP -j LOG \
|
||||
# --log-prefix "fp=icmp_packets:1 a=DROP "
|
||||
#$IPT -A icmp_packets --fragment -p ICMP -j DROP
|
||||
#$IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j DROP
|
||||
#$IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
|
||||
#$IPT -A icmp_packets -p ICMP -j RETURN
|
||||
$IPT -A icmp_packets -p ICMP -j ACCEPT
|
||||
|
||||
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 137 -j DROP
|
||||
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 138 -j DROP
|
||||
$IPT -A udp_inbound -p UDP -s 0/0 --source-port 67 --destination-port 68 -j ACCEPT
|
||||
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 53 -j ACCEPT
|
||||
$IPT -A udp_inbound -p UDP -j RETURN
|
||||
|
||||
$IPT -A tcp_inbound -p TCP -s $INET_ORB --destination-port 10000 -j ACCEPT
|
||||
$IPT -A tcp_inbound -p TCP -s $INET_ORB --destination-port 10001 -j ACCEPT
|
||||
$IPT -A tcp_inbound -p TCP -s $INET_ADMIN --destination-port 22 -j ACCEPT
|
||||
$IPT -A tcp_inbound -p TCP -j RETURN
|
||||
|
||||
$IPT -A udp_outbound -p UDP -s 0/0 -j ACCEPT
|
||||
$IPT -A tcp_outbound -p TCP -s 0/0 -j ACCEPT
|
||||
|
||||
|
||||
###############################################################################
|
||||
echo "Process INPUT chain ..."
|
||||
|
||||
$IPT -A INPUT -p ALL -i $LO_IFACE -j ACCEPT
|
||||
$IPT -A INPUT -p ALL -j bad_packets
|
||||
$IPT -A INPUT -p ALL -i $LOCAL_IFACE -s $LOCAL_NET -j ACCEPT
|
||||
$IPT -A INPUT -p ALL -i $LOCAL_IFACE -d $LOCAL_BCAST -j ACCEPT
|
||||
$IPT -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
|
||||
-j ACCEPT
|
||||
|
||||
$IPT -A INPUT -p TCP -i $INET_IFACE -j tcp_inbound
|
||||
#$IPT -A INPUT -p TCP -i $INET_IFACE2 -j tcp_inbound
|
||||
$IPT -A INPUT -p UDP -i $INET_IFACE -j udp_inbound
|
||||
$IPT -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
|
||||
|
||||
$IPT -A INPUT -m pkttype --pkt-type broadcast -j DROP
|
||||
$IPT -A INPUT -j LOG --log-prefix "fp=INPUT:99 a=DROP "
|
||||
|
||||
###############################################################################
|
||||
echo "Process FORWARD chain ..."
|
||||
|
||||
$IPT -A FORWARD -p ALL -j bad_packets
|
||||
$IPT -A FORWARD -p tcp -i $LOCAL_IFACE -j tcp_outbound
|
||||
$IPT -A FORWARD -p udp -i $LOCAL_IFACE -j udp_outbound
|
||||
$IPT -A FORWARD -p ALL -i $LOCAL_IFACE -j ACCEPT
|
||||
$IPT -A FORWARD -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
|
||||
-j ACCEPT
|
||||
$IPT -A FORWARD -j LOG --log-prefix "fp=FORWARD:99 a=DROP "
|
||||
|
||||
###############################################################################
|
||||
echo "Process OUTPUT chain ..."
|
||||
|
||||
#$IPT -A OUTPUT -m state -p icmp --state INVALID -j DROP
|
||||
$IPT -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
|
||||
$IPT -A OUTPUT -p ALL -o $LO_IFACE -j ACCEPT
|
||||
$IPT -A OUTPUT -p ALL -s $LOCAL_IP -j ACCEPT
|
||||
$IPT -A OUTPUT -p ALL -o $LOCAL_IFACE -j ACCEPT
|
||||
$IPT -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT
|
||||
#$IPT -A OUTPUT -p ALL -o $INET_IFACE2 -j ACCEPT
|
||||
$IPT -A OUTPUT -j LOG --log-prefix "fp=OUTPUT:99 a=DROP "
|
||||
|
||||
###############################################################################
|
||||
echo "Load rules for nat table ..."
|
||||
|
||||
### MASQUERADE
|
||||
$IPT -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE
|
||||
|
||||
###
|
||||
###
|
||||
###
|
||||
echo "Loading additiona rules ..."
|
||||
|
||||
### VPN
|
||||
#$IPT -I INPUT -i tun+ -j ACCEPT
|
||||
#$IPT -I OUTPUT -o tun+ -j ACCEPT
|
||||
|
||||
127
scripts/mpd-playlists.sh
Normal file
127
scripts/mpd-playlists.sh
Normal file
|
|
@ -0,0 +1,127 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# kozunak.sh - kozunak.org radio sheduler by afx
|
||||
|
||||
# Usage: kozunak.sh <subdir>
|
||||
|
||||
#SETTINGS
|
||||
radiodir="/srv/sftp/radio" #location of the music parent dir
|
||||
mpdconf="/usr/local/etc/musicpd.conf" #location of mpd.conf
|
||||
alwaysrestart=0 #debug purpouses
|
||||
|
||||
################################################
|
||||
|
||||
#BOOT
|
||||
prefix="kozunak.sh: [`date "+%H:%M"`]"
|
||||
if [ ! -d $radiodir/$1 ] || [ "$1" == "" ] ; then
|
||||
echo "$prefix no such playlist $1"
|
||||
exit
|
||||
fi
|
||||
|
||||
if [ ! -x $mpdconf ] ; then
|
||||
echo "cant find musicpd.conf!"
|
||||
exit
|
||||
fi
|
||||
|
||||
hour=`date +%H`
|
||||
if [ "$hour" = "06" ] || [ $alwaysrestart == 1 ]; then
|
||||
echo "$prefix server restart"
|
||||
musicpd --kill
|
||||
sleep 2
|
||||
rm -f /var/run/mpd/database
|
||||
#mpd --create-db $mpdconf
|
||||
musicpd $mpdconf
|
||||
fi
|
||||
|
||||
#FIX
|
||||
IFS='
|
||||
'
|
||||
for i in 1 2
|
||||
do
|
||||
|
||||
#SCAN FILES
|
||||
find "$radiodir/$1/" -depth 1 -name "*.flac" | while read flac ; do
|
||||
tmp1flac_a=`metaflac --show-tag=Artist "$flac"`
|
||||
tmp2flac_a=${tmp1flac_a:7}
|
||||
tmp1flac_n=`metaflac --show-tag=Title "$flac"`
|
||||
tmp2flac_n=${tmp1flac_n:6}
|
||||
baseflac=$(basename "$flac")
|
||||
dirflac=$(dirname "$flac")
|
||||
newflac=$(echo "$tmp2flac_a - $tmp2flac_n.flac" | tr ' ' '_' | tr '?' '_' | tr '/' '_' | tr -d '#' | tr -d '\n')
|
||||
if [ "$tmp2flac_a" == "" ] || [ "$tmp2flac_n" == "" ] ; then
|
||||
if [ "${baseflac:0:2}" == "__" ] ; then
|
||||
newflac=$(echo "$baseflac" | tr ' ' '_' | tr '?' '_' | tr '/' '_')
|
||||
else
|
||||
newflac=$(echo "__$baseflac" | tr ' ' '_' | tr '?' '_' | tr '/' '_')
|
||||
fi
|
||||
fi
|
||||
if [ "$baseflac" != "$newflac" ] ; then
|
||||
echo "$prefix found $baseflac -> $newflac"
|
||||
mv "$flac" "$dirflac/$newflac"
|
||||
fi
|
||||
done
|
||||
find "$radiodir/$1/" -depth 1 -name "*.mp3" | while read mp3 ; do
|
||||
tmpmp3_a=`id3info "$mp3" | grep -i '^=== TPE1 ' | sed 's/^=== TPE1.*: //'`
|
||||
if [ "$tmpmp3_a" == "" ] ; then
|
||||
tmpmp3_a=`id3v2 -l "$mp3" | grep -i '^TP1 ' | sed 's/^TP1.*: //'`
|
||||
fi
|
||||
tmpmp3_n=`id3info "$mp3" | grep -i '^=== TIT2 ' | sed 's/^=== TIT2.*: //'`
|
||||
if [ "$tmpmp3_n" == "" ] ; then
|
||||
tmpmp3_n=`id3v2 -l "$mp3" | grep -i '^TT2 ' | sed 's/^TT2.*: //'`
|
||||
fi
|
||||
basemp3=$(basename "$mp3")
|
||||
dirmp3=$(dirname "$mp3")
|
||||
newmp3=$(echo "$tmpmp3_a - $tmpmp3_n.mp3" | tr ' ' '_' | tr '?' '_' | tr '/' '_' | tr -d '#' | tr -d '\n')
|
||||
if [ "$tmpmp3_a" == "" ] || [ "$tmpmp3_n" == "" ] ; then
|
||||
if [ "${basemp3:0:2}" == "__" ] ; then
|
||||
newmp3=$(echo "$basemp3" | tr ' ' '_' | tr '?' '_' | tr '/' '_')
|
||||
else
|
||||
newmp3=$(echo "__$basemp3" | tr ' ' '_' | tr '?' '_' | tr '/' '_')
|
||||
fi
|
||||
fi
|
||||
if [ "$basemp3" != "$newmp3" ] ; then
|
||||
echo "$prefix found $basemp3 -> $newmp3"
|
||||
mv "$mp3" "$dirmp3/$newmp3"
|
||||
fi
|
||||
done
|
||||
done
|
||||
unset IFS
|
||||
|
||||
#INIT MPD
|
||||
musicdir=`awk '/^music_directory/ {print $2}' $mpdconf | cut -d '"' -f2`
|
||||
crnt=`mpc -f %file% | head -n 1`
|
||||
find $musicdir/* -not -name "$crnt" -exec rm {} +
|
||||
mpc --no-status crop
|
||||
|
||||
#IMPORT IN MPD
|
||||
count=0
|
||||
find "$radiodir/$1/" -depth 1 -name "*" > /tmp/kozunak.temp
|
||||
while read fle ; do
|
||||
bsfile=$(basename "$fle")
|
||||
if [ "$bsfile" = "$crnt" ] ; then
|
||||
continue
|
||||
fi
|
||||
ln -s "$fle" "$musicdir/$bsfile"
|
||||
chown nobody:ftpsrv "$musicdir/$bsfile"
|
||||
chmod g+w "$musicdir/$bsfile"
|
||||
let "count+=1"
|
||||
done < /tmp/kozunak.temp
|
||||
mpc --no-status --wait update
|
||||
sleep 20
|
||||
mpc ls | mpc add
|
||||
mpc --no-status random on
|
||||
mpc --no-status repeat on
|
||||
if [ "$hour" = "06" ] || [ $alwaysrestart == 1 ]; then
|
||||
mpc --no-status play
|
||||
else
|
||||
mpc --no-status next
|
||||
mpc --no-status next
|
||||
sleep 2
|
||||
mpc --no-status del 1
|
||||
rm "$musicdir/$crnt"
|
||||
fi
|
||||
|
||||
#CHANGE BACKGROUND
|
||||
#rnd=`/root/scripts/devrandom 1 4`
|
||||
|
||||
#ln -fs /usr/local/www/nginx/purple$rnd.jpg /usr/local/www/nginx/purple.jpg
|
||||
25
scripts/mssqldump.bat
Normal file
25
scripts/mssqldump.bat
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
@ECHO ON
|
||||
SETLOCAL
|
||||
|
||||
del c:\sqlbackup\*.bak
|
||||
|
||||
REM Get date in format YYYY-MM-DD (assumes the locale is the United States)
|
||||
FOR /F "tokens=1,2,3,4 delims=/ " %%A IN ('Date /T') DO SET NowDate=%%D-%%B-%%C
|
||||
|
||||
REM Build a list of databases to backup
|
||||
SET DBList=%SystemDrive%SQLDBList.txt
|
||||
SqlCmd -E -S DBHOSTNAME -h-1 -W -Q "SET NoCount ON; SELECT Name FROM master.dbo.sysDatabases WHERE [Name] NOT IN ('master','model','msdb','tempdb')" > "%DBList%"
|
||||
|
||||
REM Backup each database, prepending the date to the filename
|
||||
FOR /F "tokens=*" %%I IN (%DBList%) DO (
|
||||
ECHO Backing up database: %%I
|
||||
SqlCmd -E -S DBHOSTNAME -Q "BACKUP DATABASE [%%I] TO Disk='C:\sqlbackup\%NowDate%_%%I.bak'"
|
||||
ECHO.
|
||||
)
|
||||
|
||||
#pause
|
||||
|
||||
REM Clean up the temp file
|
||||
IF EXIST "%DBList%" DEL /F /Q "%DBList%"
|
||||
|
||||
ENDLOCAL
|
||||
3
scripts/rdb.sh
Normal file
3
scripts/rdb.sh
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/bash
|
||||
|
||||
rdiff-backup --print-statistics --exclude /proc --exclude /mnt --exclude /media --exclude /sys --exclude /dev $@
|
||||
78
scripts/rec-tape.sh
Normal file
78
scripts/rec-tape.sh
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
#!/bin/bash
|
||||
|
||||
# afx tape backup from proxmox dumps
|
||||
|
||||
TAPE=/dev/nst0
|
||||
SOURCE=(
|
||||
"/srv/proxmox/1/dump"
|
||||
"/srv/proxmox/2/dump"
|
||||
)
|
||||
|
||||
###
|
||||
human_print(){
|
||||
while read B dummy; do
|
||||
[ $B -lt 1024 ] && echo ${B} B && break
|
||||
KB=$(((B+512)/1024))
|
||||
[ $KB -lt 1024 ] && echo ${KB} KB && break
|
||||
MB=$(((KB+512)/1024))
|
||||
[ $MB -lt 1024 ] && echo ${MB} MB && break
|
||||
GB=$(((MB+512)/1024))
|
||||
[ $GB -lt 1024 ] && echo ${GB} GB && break
|
||||
echo $(((GB+512)/1024)) TB
|
||||
done
|
||||
}
|
||||
|
||||
echo "--- tape backup by afx ---"
|
||||
rm /tmp/reclist.txt 2> /dev/null
|
||||
#mt -f $TAPE defcompression 1
|
||||
|
||||
for srcpath in "${SOURCE[@]}"
|
||||
do
|
||||
vmids=()
|
||||
|
||||
if [ "$(ls -A $srcpath)" ]; then
|
||||
echo "[ok] $srcpath"
|
||||
cd $srcpath
|
||||
else
|
||||
echo "[skip] $srcpath"
|
||||
echo ""
|
||||
continue
|
||||
fi
|
||||
|
||||
vmids+=`ls -1d *.vma.lzo 2> /dev/null | cut -d "-" -f3 | sort | uniq`
|
||||
vmids+=`ls -1d *.vma.gz 2> /dev/null | cut -d "-" -f3 | sort | uniq`
|
||||
for vmid in $vmids
|
||||
do
|
||||
last=`ls -1rt $srcpath | grep -E ".lzo$|.gz$" | grep -E "vzdump.*-$vmid-" | tail -1`
|
||||
size=`stat -c %s $last | human_print`
|
||||
echo "VM $vmid last backup is $last ($size)"
|
||||
echo "$srcpath/$last" >> /tmp/reclist.txt
|
||||
done
|
||||
echo ""
|
||||
done
|
||||
|
||||
cat /tmp/reclist.txt | while read file
|
||||
do
|
||||
du "$file"
|
||||
done | awk '{i+=$1} END {print "Total bytes: " i / 1048576 " GB"}'
|
||||
|
||||
read -r -p "Do you want record this list? [y/N] " response
|
||||
if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]
|
||||
then
|
||||
echo "[`date +'%Y-%m-%d %T'`]: << REWIND"
|
||||
mt -f $TAPE rewind
|
||||
echo "[`date +'%Y-%m-%d %T'`]: () REC"
|
||||
#tar -cvf - -T /tmp/reclist.txt | dd of=$TAPE bs=2M
|
||||
#blocksize 256k (lto-4 default) -b n*512
|
||||
tar -b 512 -cvf $TAPE -T /tmp/reclist.txt
|
||||
echo ""
|
||||
echo "[`date +'%Y-%m-%d %T'`]: [] STOP"
|
||||
echo "file list" > /root/tape-`date +'%Y-%m-%d'`.log
|
||||
echo "---" >> /root/tape-`date +'%Y-%m-%d'`.log
|
||||
cat /tmp/reclist.txt >> /root/tape-`date +'%Y-%m-%d'`.log
|
||||
read -n 1 -s -p "Press any key to display smart & tape info and quit..."
|
||||
smartctl -a $TAPE
|
||||
tapeinfo -f $TAPE
|
||||
fi
|
||||
|
||||
echo "Bye."
|
||||
81
scripts/rsync-weekly.sh
Normal file
81
scripts/rsync-weekly.sh
Normal file
|
|
@ -0,0 +1,81 @@
|
|||
#!/bin/bash [40/1057]
|
||||
|
||||
#find the full backups and rsync them to remote host
|
||||
|
||||
SOURCE=(
|
||||
"/srv/nfs-backup/host1/dump"
|
||||
"/srv/nfs-backup/host2/dump"
|
||||
)
|
||||
HOST=1.2.3.4
|
||||
|
||||
ENCSRC="/srv/nfs-backup/latest-hardlink"
|
||||
ENCTARGET="/tmp/latest-encfs"
|
||||
ENCCONFIG="/etc/scripts/.encfs6.xml"
|
||||
|
||||
ENCPASS=my_strong_password
|
||||
|
||||
###
|
||||
human_print(){
|
||||
while read B dummy; do
|
||||
[ $B -lt 1024 ] && echo ${B} B && break
|
||||
KB=$(((B+512)/1024))
|
||||
[ $KB -lt 1024 ] && echo ${KB} KB && break
|
||||
MB=$(((KB+512)/1024))
|
||||
[ $MB -lt 1024 ] && echo ${MB} MB && break
|
||||
GB=$(((MB+512)/1024))
|
||||
[ $GB -lt 1024 ] && echo ${GB} GB && break
|
||||
echo $(((GB+512)/1024)) TB
|
||||
done
|
||||
}
|
||||
|
||||
rm /tmp/reclist.txt 2> /dev/null
|
||||
mkdir $ENCSRC
|
||||
mkdir $ENCTARGET
|
||||
|
||||
for srcpath in "${SOURCE[@]}"
|
||||
do
|
||||
vmids=()
|
||||
|
||||
if [ "$(ls -A $srcpath)" ]; then
|
||||
echo "[ok] $srcpath"
|
||||
cd $srcpath
|
||||
else
|
||||
echo "[skip] $srcpath"
|
||||
echo ""
|
||||
continue
|
||||
fi
|
||||
|
||||
host=`echo $srcpath | rev | cut -d'/' -f 2 | rev`
|
||||
mkdir "$ENCSRC/$host"
|
||||
|
||||
vmids+=`ls -1d *.vma.lzo 2> /dev/null | cut -d "-" -f3 | sort | uniq`
|
||||
vmids+=`ls -1d *.vma.gz 2> /dev/null | cut -d "-" -f3 | sort | uniq`
|
||||
for vmid in $vmids
|
||||
do
|
||||
last=`ls -1rt $srcpath | grep -E ".lzo$|.gz$" | grep -E "vzdump.*-$vmid-" | tail -1`
|
||||
size=`stat -c %s $last | human_print`
|
||||
echo "VM $vmid last backup is $last ($size)"
|
||||
ln $srcpath/$last $ENCSRC/$host/
|
||||
echo "$srcpath/$last" >> /tmp/reclist.txt
|
||||
done
|
||||
echo ""
|
||||
done
|
||||
|
||||
cat /tmp/reclist.txt | while read file
|
||||
do
|
||||
du "$file"
|
||||
done | awk '{i+=$1} END {print "Total bytes: " i / 1048576 " GB"}'
|
||||
|
||||
#reverse encfs
|
||||
echo $ENCPASS | ENCFS6_CONFIG=$ENCCONFIG encfs --reverse --idle=60 -o ro --stdinpass $ENCSRC $ENCTARGET
|
||||
|
||||
#sync
|
||||
#rsync -vap -e 'ssh -p 2222' --files-from=/tmp/reclist.txt / backup@$HOST:/srv/backup
|
||||
rsync -vap --copy-links -e 'ssh -p 2222' $ENCTARGET/ backup@$HOST:/srv/backup/weekly-encfs
|
||||
rsync -vap -e 'ssh -p 2222' $ENCCONFIG backup@$HOST:/srv/backup/weekly-encfs/.encfs6.xml
|
||||
|
||||
#cleanup
|
||||
fusermount -u $ENCTARGET
|
||||
rmdir $ENCTARGET
|
||||
rm -fr $ENCSRC
|
||||
|
||||
24
scripts/thinkpad_cooldown.sh
Normal file
24
scripts/thinkpad_cooldown.sh
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
#!/bin/bash
|
||||
|
||||
# install:
|
||||
|
||||
# echo "options thinkpad_acpi fan_control=1" >> /etc/modprobe.d/thinkpad_acpi.conf
|
||||
|
||||
echo "-- ] thinkpad cooldown swtich [ --"
|
||||
echo ""
|
||||
echo ""
|
||||
|
||||
while true; do
|
||||
echo level disengaged > /proc/acpi/ibm/fan
|
||||
echo
|
||||
echo "> max speed"
|
||||
echo "Press key to return to switch mode..."
|
||||
read -n 1
|
||||
|
||||
echo level auto > /proc/acpi/ibm/fan
|
||||
echo
|
||||
echo "> auto"
|
||||
echo "Press key to return to switch mode..."
|
||||
read -n 1
|
||||
done
|
||||
|
||||
125
squid-with-clam-and-qlproxy-test.conf
Normal file
125
squid-with-clam-and-qlproxy-test.conf
Normal file
|
|
@ -0,0 +1,125 @@
|
|||
# squid.conf by afx
|
||||
|
||||
#ports
|
||||
http_port 192.168.10.1:3128 intercept
|
||||
https_port 192.168.10.1:3127 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/etc/opt/quintolabs/qlproxy/afx.pem capath=/etc/ssl/certs
|
||||
http_port 192.168.10.1:8080
|
||||
|
||||
#generic
|
||||
visible_hostname proxy.deflax.net
|
||||
icp_port 0
|
||||
dns_v4_first on
|
||||
pid_filename /var/run/squid.pid
|
||||
#cache_effective_user proxy
|
||||
#cache_effective_group proxy
|
||||
error_default_language bg
|
||||
coredump_dir /var/spool/squid
|
||||
icon_directory /usr/share/squid/icons
|
||||
cache_mgr admin@fqdn.com
|
||||
access_log /var/log/squid/access.log
|
||||
cache_log /var/log/squid/cache.log
|
||||
cache_store_log none
|
||||
pinger_enable on
|
||||
pinger_program /usr/lib/squid/pinger
|
||||
netdb_filename /var/log/squid/netdb.state
|
||||
sslcrtd_program /bin/ssl_crtd -s /var/spool/squid_ssldb -M 4MB -b 2048
|
||||
sslcrtd_children 25
|
||||
sslproxy_capath /etc/ssl/certs
|
||||
|
||||
#timeouts
|
||||
peer_connect_timeout 2 minutes
|
||||
persistent_request_timeout 2 minutes
|
||||
|
||||
#logfile_rotate 0
|
||||
#debug_options rotate=0
|
||||
|
||||
#acl
|
||||
acl localnet src 192.168.10.0/24 # RFC1918 possible internal network
|
||||
acl allsrc src all
|
||||
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 3128 3127 1025-65535
|
||||
acl sslports port 443 563
|
||||
acl purge method PURGE
|
||||
acl connect method CONNECT
|
||||
acl HTTP proto HTTP
|
||||
acl HTTPS proto HTTPS
|
||||
acl allowed_subnets src 192.168.10.0/24
|
||||
acl dynamic urlpath_regex cgi-bin \?
|
||||
|
||||
#ssl
|
||||
always_direct allow all
|
||||
#acl broken_ip dst "/etc/squid/ip_whitelist.acl"
|
||||
acl broken_sites dstdomain "/etc/squid/ssl_whitelist.acl"
|
||||
#ssl_bump none localhost
|
||||
ssl_bump none broken_sites
|
||||
#ssl_bump none broken_ip
|
||||
sslproxy_cert_error allow all
|
||||
sslproxy_flags DONT_VERIFY_PEER
|
||||
ssl_bump server-first all
|
||||
|
||||
uri_whitespace strip
|
||||
|
||||
#cache settings
|
||||
cache_dir ufs /var/spool/squid/cache/squid 14000 16 256
|
||||
#cache deny dynamic
|
||||
cache deny all
|
||||
cache_mem 8 MB
|
||||
maximum_object_size_in_memory 1024 KB
|
||||
memory_replacement_policy heap GDSF
|
||||
cache_replacement_policy heap LFUDA
|
||||
minimum_object_size 0 KB
|
||||
maximum_object_size 10 KB
|
||||
offline_mode off
|
||||
memory_pools off
|
||||
|
||||
#httpaccess
|
||||
http_access allow manager localhost
|
||||
http_access deny manager
|
||||
http_access allow purge localhost
|
||||
http_access deny purge
|
||||
http_access deny !safeports
|
||||
http_access deny CONNECT !sslports
|
||||
|
||||
# Facebook Like Button Denial
|
||||
#acl facebook dstdomain .facebook.com
|
||||
#acl facebook_like urlpath_regex -i ^\/plugins\/like\.php
|
||||
#deny_info error-facebook-like facebook_like
|
||||
#http_access deny facebook facebook_like
|
||||
|
||||
request_body_max_size 0 KB
|
||||
delay_pools 1
|
||||
delay_class 1 2
|
||||
delay_parameters 1 -1/-1 -1/-1
|
||||
delay_initial_bucket_level 100
|
||||
delay_access 1 allow allsrc
|
||||
|
||||
icap_enable on
|
||||
icap_preview_enable on
|
||||
icap_preview_size 4096
|
||||
icap_persistent_connections on
|
||||
icap_send_client_ip on
|
||||
icap_send_client_username on
|
||||
icap_client_username_header X-Client-Username
|
||||
icap_service qlproxy1 reqmod_precache bypass=1 icap://127.0.0.1:1344/reqmod
|
||||
icap_service qlproxy2 respmod_precache bypass=1 icap://127.0.0.1:1344/respmod
|
||||
icap_service squidclamav1 reqmod_precache bypass=1 icap://127.0.0.1:1345/squidclamav
|
||||
icap_service squidclamav2 respmod_precache bypass=1 icap://127.0.0.1:1345/squidclamav
|
||||
|
||||
#acl qlproxy_icap_edomains dstdomain "/etc/opt/quintolabs/qlproxy/squid/icap_exclusions_domains.conf"
|
||||
#acl qlproxy_icap_etypes rep_mime_type "/etc/opt/quintolabs/qlproxy/squid/icap_exclusions_contenttypes.conf"
|
||||
|
||||
adaptation_service_chain svcRequest qlproxy1 squidclamav1
|
||||
adaptation_service_chain svcResponse qlproxy2 squidclamav2
|
||||
adaptation_access svcRequest allow all
|
||||
adaptation_access svcResponse allow all
|
||||
|
||||
#no clamav
|
||||
#adaptation_access svcRequest deny qlproxy_icap_edomains
|
||||
#adaptation_access svcResponse deny qlproxy_icap_edomains
|
||||
#adaptation_access svcResponse deny qlproxy_icap_etypes
|
||||
#adaptation_access qlproxy1 allow all
|
||||
#adaptation_access qlproxy2 allow all
|
||||
|
||||
http_access allow allowed_subnets
|
||||
http_access allow localhost
|
||||
http_access deny allsrc
|
||||
|
||||
3
thinkfan/cputemp.sh
Normal file
3
thinkfan/cputemp.sh
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/bash
|
||||
|
||||
cat /sys/devices/virtual/hwmon/hwmon1/temp1_input | head -c2
|
||||
3
thinkfan/fanspeed.sh
Normal file
3
thinkfan/fanspeed.sh
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/bash
|
||||
|
||||
cat /proc/acpi/ibm/fan | grep ^speed | cut -d ':' -f 2 | sed -e 's/[[:space:]]*//'
|
||||
11
thinkfan/thinkfan.conf
Normal file
11
thinkfan/thinkfan.conf
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
hwmon /sys/devices/virtual/hwmon/hwmon1/temp1_input
|
||||
tp_fan /proc/acpi/ibm/fan
|
||||
|
||||
(0, 0, 25)
|
||||
(2, 20, 30)
|
||||
(3, 25, 31)
|
||||
(4, 30, 36)
|
||||
(5, 35, 41)
|
||||
(6, 40, 47)
|
||||
(7, 46, 53)
|
||||
(126, 50, 32767)
|
||||
43
thinkfan/ubuntu-debian-HOWTO.txt
Normal file
43
thinkfan/ubuntu-debian-HOWTO.txt
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
#/etc/thinkfan.conf:
|
||||
hwmon /sys/devices/virtual/hwmon/hwmon0/temp1_input
|
||||
tp_fan /proc/acpi/ibm/fan
|
||||
|
||||
(0, 0, 25)
|
||||
(1, 20, 30)
|
||||
(2, 25, 31)
|
||||
(3, 30, 36)
|
||||
(4, 35, 41)
|
||||
(5, 40, 47)
|
||||
(6, 46, 50)
|
||||
(7, 49, 56)
|
||||
(126, 55, 32767)
|
||||
|
||||
|
||||
#/etc/systemd/system/thinkfan.service
|
||||
[Unit]
|
||||
Description=simple and lightweight fan control program
|
||||
After=syslog.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
ExecStart=/usr/local/sbin/thinkfan
|
||||
PIDFile=/var/run/thinkfan.pid
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
|
||||
#INSTALL (as root)
|
||||
echo "options thinkpad_acpi fan_control=1" >> /etc/modprobe.d/thinkpad.conf
|
||||
reboot
|
||||
apt install lm-sensors cmake-curses-gui libyaml-cpp-dev libboost-all-dev
|
||||
wget https://github.com/vmatare/thinkfan/archive/0.9.3.tar.gz
|
||||
tar xzvf 0.9.3.tar.gz
|
||||
cd thinkfan-0.9.3
|
||||
mkdir build; cd build
|
||||
cmake -D CMAKE_BUILD_TYPE:STRING=Debug ..
|
||||
make
|
||||
cp thinkfan /usr/local/sbin
|
||||
sudo systemctl enable thinkfan.service
|
||||
sudo systemctl start thinkfan.service
|
||||
Loading…
Reference in a new issue