release 0.3.2

14 files changed, 642 insertions, 137 deletions

diff --git a/tools/conf/etc/iptables/iptables-br.sh b/tools/conf/etc/iptables/iptables-br.sh
index 104e574..25a3331 100644
--- a/tools/conf/etc/iptables/iptables-br.sh
+++ b/tools/conf/etc/iptables/iptables-br.sh
@@ -147,16 +147,14 @@ IPT="/usr/sbin/iptables"
 SPAMLIST="blockedip"
 SPAMDROPMSG="BLOCKED IP DROP"
 # public interface to network/internet
-PUB_IF="wlp7s0"
-DHCP_SERV="192.168.1.1"
-PUB_IP="192.168.1.33"
-NET_ADDR="192.168.1.0/24"
+#PUB_IF="wlp7s0"
+PUB_IF="br0"
+PUB_IP="10.0.0.254"
+NET_ADDR="10.0.0.0/8"
+GW="10.0.0.1"
 # private interface for virtual/internal
-PRIV_IF="br0"
-PRIV_IP="10.0.0.1"
-
-modprobe ip_conntrack
-modprobe ip_conntrack_ftp
+PRIV_IF="wlp7s0"
+PRIV_IP="192.168.1.33"
 
 echo "Stopping ipv4 firewall and deny everyone..."
 
@@ -170,149 +168,214 @@ iptables -t raw -F
 iptables -t raw -X
 iptables -t security -F
 iptables -t security -X
+iptables -N blocker
 
-
-echo "Starting ipv4 firewall filter table..."
+iptables -N netconf_in
+iptables -N netconf_out
+iptables -N server_in
+iptables -N server_out
+iptables -N client_in
+iptables -N client_out
 
 # Set Default Rules
 iptables -P INPUT DROP
 iptables -P FORWARD DROP
 iptables -P OUTPUT DROP
 
-###### AP rules  ######
-echo 1 > /proc/sys/net/ipv4/ip_forward
-$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -j ACCEPT
-$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -j ACCEPT
-$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP}
-
-# Block sync
-$IPT -A INPUT -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: "
-$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
-
-# Block Fragments
-$IPT -A INPUT -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: "
-$IPT -A INPUT -f -j DROP
-
-# Block bad stuff
-$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
-$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
-
-$IPT -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: "
-$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
-
-$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: "
-$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-
-$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: "
-$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
-
-$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: "
-$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
-
-$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-
-
-###### Input Chain ######
-
-# Unlimited on local
-$IPT -A INPUT -i ${PRIV_IF} -j ACCEPT
-#$IPT -A INPUT -i lo -s ${PRIV_IP} -j ACCEPT
-
+echo "Starting ipv4 firewall tables..."
 # Unlimited on loopback
 $IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
-$IPT -A INPUT -i lo -s 192.168.1.33 -d 192.168.1.33 -j ACCEPT
-
-echo "Allow input from DNS Server"
-$IPT -A INPUT -i ${PUB_IF} -p udp --dport 1024:65535 --sport 53 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input from Https server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input to HTTPS Server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-#echo "Allow input from HTTP Server"
-#$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input from IRC server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 1024:65535 --sport 6667 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input from FTP server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 1024:65535 --sport 21 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input from git server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input from POP3S server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input from SMTPS server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input to HTTP Server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-#echo "Allow input to DNS Server"
-#$IPT -A INPUT -i ${PUB_IF} -p udp --sport 1024:65535 --dport 53  -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-
-echo "Allow input to SSH server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-###### Output Chain ######
-
-# Unlimited on loopback
 $IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
-$IPT -A OUTPUT -o lo -s 192.168.1.33 -d 192.168.1.33 -j ACCEPT
-#$IPT -A OUTPUT -o lo -d ${PRIV_IP} -j ACCEPT
-
-# Unlimited on local
-$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT
-
-echo "Allow output to DNS server"
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 53 --sport 1024:65535 -j ACCEPT
-
-echo "Allow output to https server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 443  -j ACCEPT
-
-echo "Allow output from https server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
-
-#echo "Allow output from http server"
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
-
-#echo "Allow to HTTP server"
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow output to SSH server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow output to ftp server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow output to git server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 9418 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow output to IRC  server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT
 
-echo "Allow output to SMTPS server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 465 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+#modprobe ip_conntrack
+#modprobe ip_conntrack_ftp
+#echo 1 > /proc/sys/net/ipv4/ip_forward
+
+####### blocker Chain  ######
+## Block google dns
+$IPT -A blocker -s 8.8.0.0/24 -j LOG --log-level 7 --log-prefix "iptables: blocker google: "
+$IPT -A blocker -s 8.8.0.0/24 -j DROP
+## Block sync
+$IPT -A blocker -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: "
+$IPT -A blocker -p tcp ! --syn -m state --state NEW -j DROP
+## Block Fragments
+$IPT -A blocker -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: "
+$IPT -A blocker -f -j DROP
+
+$IPT -A blocker -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
+$IPT -A blocker -p tcp --tcp-flags ALL ALL -j DROP
+
+$IPT -A blocker -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: "
+$IPT -A blocker -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
+
+$IPT -A blocker -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: "
+$IPT -A blocker -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+
+$IPT -A blocker -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: "
+$IPT -A blocker -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
+
+$IPT -A blocker -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: "
+$IPT -A blocker -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
+
+$IPT -A blocker -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
+## Return to caller
+$IPT -A blocker -j RETURN
+
+####### server input Chain  ######
+echo "server_in chain: Allow to SSH server"
+$IPT -A server_in -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "server_in chain: Allow input to HTTPS Server"
+$IPT -A server_in -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+#echo "server_in chain: Allow input to HTTP Server"
+#$IPT -A server_in -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "server_in chain: Allow input to DNS Server"
+$IPT -A server_in -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A server_in -p tcp --dport 53 --sport 1024:65535  -m state --state NEW,ESTABLISHED -j ACCEPT
+
+## Return to caller
+$IPT -A server_in -j RETURN
+
+####### server output Chain  ######
+echo "server_out chain: Allow output from DNS server"
+$IPT -A server_out -p udp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+$IPT -A server_out -p tcp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+echo "server_out chain: Allow output from https server"
+$IPT -A server_out -p tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+#echo "server_out chain: Allow output from http server"
+#$IPT -A server_out -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+echo "server_out chain: Allow output from SSH server"
+$IPT -A server_out -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+## Return to caller
+$IPT -A server_out -j RETURN
+
+####### client input Chain  ######
+echo "client_in chain: Allow input from IRC server"
+$IPT -A client_in -p tcp --sport 6667 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from FTP server"
+$IPT -A client_in -p tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from GIT server"
+$IPT -A client_in -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from POP3S server"
+$IPT -A client_in -p tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from SMTPS server"
+$IPT -A client_in -p tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+#echo "client_in chain: Allow input from HTTP Server"
+#$IPT -A client_in -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from HTTPS server"
+$IPT -A client_in -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+#$IPT -A client_in -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from DNS Server"
+$IPT -A client_in -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from SSH Server"
+$IPT -A client_in -p udp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A client_in -p udp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+## Return to caller
+$IPT -A client_in -j RETURN
+
+####### client output Chain  ######
+echo "client_out chain: Allow output to IRC  server"
+$IPT -A client_out -p tcp --dport 6667 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to FTP server"
+$IPT -A client_out -p tcp --dport 21 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to GIT server"
+$IPT -A client_out -p tcp --dport 9418 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to POP3S server"
+$IPT -A client_out -p tcp --dport 995 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to SMTPS server"
+$IPT -A client_out -p tcp --dport 465 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to HTTPS server"
+$IPT -A client_out -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+#$IPT -A client_out -p udp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+##echo "Allow to HTTP server"
+#$IPT -A client_out -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to DNS server"
+$IPT -A client_out -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to SSH server"
+$IPT -A client_out -p tcp --dport 22 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A client_out -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+## Return to caller
+$IPT -A client_out -j RETURN
+
+
+####### netconf input Chain  ######
+echo "netconf_in chain: Allow DHCP protocol"
+$IPT -A netconf_in -p udp --sport 68 --dport 67 -j ACCEPT
+echo "netconf_in chain: Allow RIP protocol for ${NET_ADDR}"
+$IPT -A netconf_in -p udp --sport 520 --dport 520 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT
+#echo "netconf chain: Allow ICMP from ${NET_ADDR}"
+#$IPT -A netconf_in -p icmp -s ${NET_ADDR} -j ACCEPT
+echo "netconf_in chain: Allow ICMP from all"
+$IPT -A netconf_in -p icmp -j LOG --log-level 7 --log-prefix "iptables: netconf_in ICMP: "
+$IPT -A netconf_in -p icmp -j ACCEPT
+
+## Return to caller
+$IPT -A netconf_in -j RETURN
+
+
+####### netconf output Chain  ######
+echo "netconf_out chain: Allow output from DHCP server"
+$IPT -A netconf_out -p udp --sport 67 --dport 68 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT
+echo "netconf_out chain: Allow RIP protocol for ${NET_ADDR}"
+$IPT -A netconf_out -p udp --sport 520 --dport 520 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT
+#echo "netconf chain: Allow ICMP output to ${NET_ADDR}"
+#$IPT -A netconf_out -p icmp -d ${NET_ADDR} -j ACCEPT
+echo "netconf chain: Allow ICMP output to all"
+$IPT -A netconf_out -p icmp -j LOG --log-level 7 --log-prefix "iptables: netconf_out ICMP: "
+$IPT -A netconf_out -p icmp -j ACCEPT
+
+## Return to caller
+$IPT -A netconf_out -j RETURN
+
+####### AP rules  ######
+$IPT -A FORWARD -j blocker
+#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -d ${NET_ADDR}  -j ACCEPT
+$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j netconf_in
+$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j netconf_out
+$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j client_in
+$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -j client_out
+#$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP}
+
+####### Input Chain ######
+$IPT -A INPUT -j blocker
+$IPT -A INPUT -i ${PUB_IF} -j server_in
+$IPT -A INPUT -i ${PUB_IF} -j client_in
+$IPT -A INPUT -i ${PUB_IF} -j netconf_in
+
+####### Output Chain ######
+$IPT -A OUTPUT -j blocker
+$IPT -A OUTPUT -o ${PUB_IF} -j server_out
+$IPT -A OUTPUT -o ${PUB_IF} -j client_out
+$IPT -A OUTPUT -o ${PUB_IF} -j netconf_out
 
-echo "Allow output to POP3S server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 995 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-## less logs
-
-echo "Drop RIP protocol"
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -s $NET_ADDR -j DROP
-
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -d $DHCP_SERV -j ACCEPT
 
 ## log everything else and drop
 $IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: "
 $IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: "
 $IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: "
-#
+
 exit 0
+
+#$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -s ${NET_ADDR} -j ACCEPT
+#$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -d ${NET_ADDR} -j ACCEPT
+#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -p udp --sport 68 --dport 67 -j ACCEPT
+#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF}  -p udp --sport 520 --dport 520 -j ACCEPT
+#
+## You Dirty bitch
+#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -d ${NET_ADDR}  -j ACCEPT
+
+## Unlimited on loopback
+#$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT
+##$IPT -A OUTPUT -o lo -d ${PRIV_IP} -j ACCEPT
+#
+## Unlimited on local
+#$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT
+#
+### less logs
+#
+
+#echo "Allow output DHCP protocol"
+#$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT
+
diff --git a/tools/conf/etc/logrotate.conf b/tools/conf/etc/logrotate.conf
new file mode 100644
index 0000000..896b779
--- /dev/null
+++ b/tools/conf/etc/logrotate.conf
@@ -0,0 +1,133 @@
+# see "man logrotate" for details
+# rotate log files weekly
+weekly
+
+# keep 4 weeks worth of backlogs
+rotate 4
+
+# create new (empty) log files after rotating old ones
+create
+
+# uncomment this if you want your log files compressed
+compress
+
+olddir /var/log/old
+
+notifempty
+
+maxsize 5M
+
+# some packages can drop log rotation information into 
+# this directory
+include /etc/logrotate.d
+
+# few generic files to rotate
+/var/log/wtmp {
+    create 0644 root root
+    rotate 5
+}
+
+/var/log/btmp {
+    create 0600 root root
+    rotate 5
+}
+
+# system-specific logs may be also be configured here.
+/var/log/faillog {
+    maxsize 5M
+}
+
+/var/log/lastlog {
+    maxsize 5M
+}
+
+/var/log/auth {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/cron {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/debug {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/kernel {
+    rotate 5
+    create 0644 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/daemon {
+    compress
+    rotate 5
+    create 644 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+
+}
+
+/var/log/messages {
+    rotate 5
+    create 0644 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/mail {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/user {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
diff --git a/tools/conf/etc/logrotate.d/dnsmasq b/tools/conf/etc/logrotate.d/dnsmasq
new file mode 100644
index 0000000..3151ddc
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/dnsmasq
@@ -0,0 +1,11 @@
+/var/log/dnsmasq {
+    weekly
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
diff --git a/tools/conf/etc/logrotate.d/fail2ban b/tools/conf/etc/logrotate.d/fail2ban
new file mode 100644
index 0000000..c2dc4cd
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/fail2ban
@@ -0,0 +1,5 @@
+/var/log/fail2ban.log {
+    weekly
+    create 0644 root root
+    rotate 5
+ }
diff --git a/tools/conf/etc/logrotate.d/gitolite b/tools/conf/etc/logrotate.d/gitolite
new file mode 100644
index 0000000..547d6b6
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/gitolite
@@ -0,0 +1,12 @@
+/var/log/gitolite {
+    rotate 5
+    monthly
+    create 0644 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+
+}
diff --git a/tools/conf/etc/logrotate.d/lynis b/tools/conf/etc/logrotate.d/lynis
new file mode 100644
index 0000000..8cf9181
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/lynis
@@ -0,0 +1,10 @@
+/var/log/lynis.log {
+    rotate 5
+    monthly
+    create 0644 root root
+}
+/var/log/lynis-report.dat {
+    rotate 5
+    monthly
+    create 0644 root root
+}
diff --git a/tools/conf/etc/logrotate.d/nginx b/tools/conf/etc/logrotate.d/nginx
new file mode 100644
index 0000000..ae05445
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/nginx
@@ -0,0 +1,23 @@
+/var/log/nginx/access.log {
+    weekly
+    create 0664 root www
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/nginx/error.log {
+    weekly
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
diff --git a/tools/conf/etc/logrotate.d/ntp b/tools/conf/etc/logrotate.d/ntp
new file mode 100644
index 0000000..c46b590
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/ntp
@@ -0,0 +1,5 @@
+/var/log/ntp.log {
+    weekly
+    create 0644 root root
+    rotate 5
+}
diff --git a/tools/conf/etc/logrotate.d/php-fpm b/tools/conf/etc/logrotate.d/php-fpm
new file mode 100644
index 0000000..c778658
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/php-fpm
@@ -0,0 +1,5 @@
+/var/log/php-fpm.log {
+    rotate 5
+    monthly
+    create 0644 root root
+}
diff --git a/tools/conf/etc/logrotate.d/postgres b/tools/conf/etc/logrotate.d/postgres
new file mode 100644
index 0000000..fc59aad
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/postgres
@@ -0,0 +1,17 @@
+/var/log/pgsql {
+    weekly
+    compress
+    delaycompress
+    rotate 10
+    notifempty
+    create 660 postgres postgres
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+
+}
+
+
diff --git a/tools/conf/etc/logrotate.d/samhain b/tools/conf/etc/logrotate.d/samhain
new file mode 100644
index 0000000..d60f810
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/samhain
@@ -0,0 +1,24 @@
+/var/log/samhain.log {
+    weekly
+    rotate 52
+    nocreate
+    missingok
+    compress
+
+    prerotate
+        if test -f /var/run/samhain.pid; then \
+          PIN=`cat /var/run/samhain.pid`; \
+          /bin/kill -TTIN $PIN; \
+          sleep 1; \
+          AA=0; \
+          while test "x$AA" != "x120"; do \
+           AA=$(( AA + 1 )); \
+           if test -f /var/log/samhain.log.lock; then \
+             sleep 1; \
+           else \
+             break; \
+           fi \
+          done; \
+        fi
+    endscript
+}
diff --git a/tools/conf/etc/logrotate.d/shorewall b/tools/conf/etc/logrotate.d/shorewall
new file mode 100644
index 0000000..a7dffdf
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/shorewall
@@ -0,0 +1,11 @@
+/var/log/shorewall-init.log {
+  missingok
+  notifempty
+  create 0600 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
diff --git a/tools/conf/etc/logrotate.d/shorewall6 b/tools/conf/etc/logrotate.d/shorewall6
new file mode 100644
index 0000000..ee5e246
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/shorewall6
@@ -0,0 +1,5 @@
+/var/log/shorewall6-init.log {
+  missingok
+  notifempty
+  create 0600 root root
+}
diff --git a/tools/conf/etc/syslog-ng.conf b/tools/conf/etc/syslog-ng.conf
new file mode 100644
index 0000000..5b5fc75
--- /dev/null
+++ b/tools/conf/etc/syslog-ng.conf
@@ -0,0 +1,181 @@
+#############################################################################
+# Simple syslog-ng.conf for crux.nu,
+#
+# Silvino Silva < silvino at bk dot ru >
+# Created: 1/12/2014
+#
+# Reference:
+# 	http://www.campin.net/syslog-ng/expanded-syslog-ng.con
+#
+# Notes:
+#	* f_error and f_console are not used
+# --------------------------------------------------------------------------
+@version: 3.5
+@include "scl.conf"
+
+options {
+	flush_lines(0);
+	time_reopen(10);
+	chain_hostnames(off);
+	create_dirs(no);
+	stats_freq(1200);
+	use_dns(no);
+	use_fqdn(no);
+	perm(0600);
+	log_fifo_size(2048);
+	log_msg_size(1024);
+	keep_hostname(yes);
+};
+
+#############################################
+# sources
+#
+source s_log { unix-dgram("/dev/log"); };
+source s_internal { internal(); };
+source s_kernel { file("/proc/kmsg" program_override("kernel")); };
+
+template t_debug { template("$DATE fac $FACILITY lvl $LEVEL prg $PROGRAM: $MSG\n"); };
+
+#############################################
+# common destinations
+#
+
+destination d_auth 	{ file("/var/log/auth"); };
+destination d_cron 	{ file("/var/log/cron"); };
+destination d_daemon	{ file("/var/log/daemon"); };
+destination d_kernel 	{ file("/var/log/kernel"); };
+destination d_lpr	{ file("/var/log/lpr"); };
+destination d_mail 	{ file("/var/log/mail"); };
+destination d_user	{ file("/var/log/user"); };
+destination d_syslog    { file("/val/log/syslog"); };
+
+destination d_debug 	{ file("/var/log/debug" template(t_debug)); };
+destination d_error	{ file("/var/log/error"); };
+destination d_messages	{ file("/var/log/messages"); };
+
+destination d_console	        { usertty("root"); };
+destination d_console_all	{ usertty("root"); };
+
+#############################################
+# custom destinations
+#
+
+destination d_shorewall_warn { file ("/var/log/shorewall/warn.log"); };
+destination d_shorewall_info { file ("/var/log/shorewall/info.log"); };
+destination d_dnsmasq	{ file("/var/log/dnsmasq"); };
+destination d_postgres  { file("/var/log/pgsql"); };
+destination d_sshd      { file("/var/log/sshd"); };
+destination d_gitolite  { file("/var/log/gitolite"); };
+destination d_nginx_access { file("/var/log/nginx/access.log" owner(root) group(www) perm(0644));  };
+destination d_nginx_error  { file("/var/log/nginx/error.log"); };
+
+#############################################
+# common filters
+#
+
+filter f_info 		{ level(info); };
+filter f_notice 	{ level(notice); };
+filter f_warn 		{ level(warn); };
+filter f_err 		{ level(err); };
+filter f_crit 		{ level(crit .. emerg); };
+
+filter f_emerg		{ level(emerg); };
+filter f_alert		{ level(alert); };
+
+filter f_debug 		{
+	level(debug)
+	and not facility(auth, authpriv, mail, news)
+};
+
+filter f_error   	{ level(err..emerg); };
+filter f_auth 		{ facility(auth, authpriv); };
+filter f_cron 		{ facility(cron); };
+filter f_daemon	        { facility(daemon); };
+filter f_kernel 	{ facility(kern); };
+filter f_lpr		{ facility(lpr); };
+
+filter f_local          { facility(
+    local0,
+    local1,
+    local2,
+    local3,
+    local4,
+    local5,
+    local6,
+    local7
+    );
+};
+
+filter f_mail 		{ facility(mail); };
+filter f_syslog 	{ facility(syslog); };
+filter f_user		{ facility(user); };
+filter f_console        { level(warn .. emerg); };
+
+#############################################
+# custom filters
+#
+
+filter f_messages 	{
+    level(info..warn)
+    and not facility(auth, authpriv, mail, cron)
+};
+
+filter f_dnsmasq { program("dnsmasq"); };
+filter f_postgres { facility(local0); };
+filter f_sshd { facility(local1); };
+
+filter f_shorewall_warn {
+        level (warn)
+        and match ("iptables" value("MESSAGE"));
+};
+
+filter f_shorewall_info {
+        level (info)
+        and match ("iptables" value("MESSAGE"));
+};
+
+filter f_gitolite { program("gitolite"); };
+
+filter f_nginx_access {
+        match("nginx_access:" value("MESSAGE"));
+};
+
+filter f_nginx_error {
+	match("nginx_error:" value("MESSAGE"));
+};
+
+
+log { source (s_kernel); filter (f_shorewall_warn); destination (d_shorewall_warn); flags(final);};
+log { source (s_kernel); filter (f_shorewall_info); destination (d_shorewall_info); flags(final);};
+log { source(s_log); filter(f_dnsmasq); destination(d_dnsmasq); flags(final); };
+log { source(s_log); filter(f_postgres); destination(d_postgres); flags(final); };
+log { source(s_log); filter(f_sshd); destination(d_sshd); flags(final); };
+log { source(s_log); filter(f_gitolite); destination(d_gitolite); flags(final); };
+log { source(s_log); filter(f_nginx_error); destination(d_nginx_error); flags(final); };
+log { source(s_log); filter(f_local); filter(f_nginx_access); destination(d_nginx_access); flags(final); };
+
+#############################################
+# connect filter and destination
+#
+
+log { source(s_log); filter(f_auth); destination(d_auth); };
+log { source(s_log); filter(f_cron); destination(d_cron); };
+log { source(s_log); filter(f_daemon); destination(d_daemon); };
+log { source(s_kernel); filter(f_kernel); destination(d_kernel); };
+log { source(s_log); filter(f_lpr); destination(d_lpr); };
+log { source(s_log); source(s_internal); filter(f_syslog); destination(d_syslog); };
+log { source(s_log); filter(f_user); destination(d_user); };
+
+log { source(s_log); filter(f_mail); destination(d_mail); };
+log { source(s_log); filter(f_mail); filter(f_info); destination(d_mail); };
+log { source(s_log); filter(f_mail); filter(f_info); destination(d_mail); };
+log { source(s_log); filter(f_mail); filter(f_info); destination(d_mail); };
+
+log { source(s_log); filter(f_debug); destination(d_debug); };
+log { source(s_log); filter(f_error); destination(d_error); };
+
+#log { source(s_log); filter(f_console); destination(d_console_all); };
+log { source(s_log); filter(f_crit);    destination(d_console); };
+
+#default log
+log { source(s_log); filter(f_messages); destination(d_messages); };