diff options
author | Silvino Silva <silvino@bk.ru> | 2017-10-09 01:19:10 +0100 |
---|---|---|
committer | Silvino Silva <silvino@bk.ru> | 2017-10-09 01:19:10 +0100 |
commit | 46f82a26c6679573c1699311950f8699f09aedf3 (patch) | |
tree | 534f6c62b590298968d22b32a4d36366e0d583f2 /tools | |
parent | c0148601ebe2196375f26572624590cad2751845 (diff) | |
parent | b3a6bc5ad6b8f294efcbcf3c0039626918eccd69 (diff) | |
download | doc-46f82a26c6679573c1699311950f8699f09aedf3.tar.gz |
Merge branch 'h-0.3.2' into develop
Diffstat (limited to 'tools')
-rw-r--r-- | tools/conf/etc/iptables/iptables-br.sh | 337 | ||||
-rw-r--r-- | tools/conf/etc/logrotate.conf | 133 | ||||
-rw-r--r-- | tools/conf/etc/logrotate.d/dnsmasq | 11 | ||||
-rw-r--r-- | tools/conf/etc/logrotate.d/fail2ban | 5 | ||||
-rw-r--r-- | tools/conf/etc/logrotate.d/gitolite | 12 | ||||
-rw-r--r-- | tools/conf/etc/logrotate.d/lynis | 10 | ||||
-rw-r--r-- | tools/conf/etc/logrotate.d/nginx | 23 | ||||
-rw-r--r-- | tools/conf/etc/logrotate.d/ntp | 5 | ||||
-rw-r--r-- | tools/conf/etc/logrotate.d/php-fpm | 5 | ||||
-rw-r--r-- | tools/conf/etc/logrotate.d/postgres | 17 | ||||
-rw-r--r-- | tools/conf/etc/logrotate.d/samhain | 24 | ||||
-rw-r--r-- | tools/conf/etc/logrotate.d/shorewall | 11 | ||||
-rw-r--r-- | tools/conf/etc/logrotate.d/shorewall6 | 5 | ||||
-rw-r--r-- | tools/conf/etc/syslog-ng.conf | 181 | ||||
-rw-r--r-- | tools/gitolite.html | 4 | ||||
-rw-r--r-- | tools/qemu.html | 140 | ||||
-rw-r--r-- | tools/scripts/pkgmk-test.conf | 30 | ||||
-rw-r--r-- | tools/scripts/runvm/c12-dvd | 15 | ||||
-rw-r--r-- | tools/scripts/runvm/profile/crux | 10 | ||||
-rw-r--r-- | tools/scripts/runvm/runvm.sh | 14 | ||||
-rw-r--r-- | tools/syslog-ng.html | 7 |
21 files changed, 757 insertions, 242 deletions
diff --git a/tools/conf/etc/iptables/iptables-br.sh b/tools/conf/etc/iptables/iptables-br.sh index 104e574..25a3331 100644 --- a/tools/conf/etc/iptables/iptables-br.sh +++ b/tools/conf/etc/iptables/iptables-br.sh @@ -147,16 +147,14 @@ IPT="/usr/sbin/iptables" SPAMLIST="blockedip" SPAMDROPMSG="BLOCKED IP DROP" # public interface to network/internet -PUB_IF="wlp7s0" -DHCP_SERV="192.168.1.1" -PUB_IP="192.168.1.33" -NET_ADDR="192.168.1.0/24" +#PUB_IF="wlp7s0" +PUB_IF="br0" +PUB_IP="10.0.0.254" +NET_ADDR="10.0.0.0/8" +GW="10.0.0.1" # private interface for virtual/internal -PRIV_IF="br0" -PRIV_IP="10.0.0.1" - -modprobe ip_conntrack -modprobe ip_conntrack_ftp +PRIV_IF="wlp7s0" +PRIV_IP="192.168.1.33" echo "Stopping ipv4 firewall and deny everyone..." @@ -170,149 +168,214 @@ iptables -t raw -F iptables -t raw -X iptables -t security -F iptables -t security -X +iptables -N blocker - -echo "Starting ipv4 firewall filter table..." +iptables -N netconf_in +iptables -N netconf_out +iptables -N server_in +iptables -N server_out +iptables -N client_in +iptables -N client_out # Set Default Rules iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP -###### AP rules ###### -echo 1 > /proc/sys/net/ipv4/ip_forward -$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -j ACCEPT -$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -j ACCEPT -$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP} - -# Block sync -$IPT -A INPUT -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: " -$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP - -# Block Fragments -$IPT -A INPUT -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: " -$IPT -A INPUT -f -j DROP - -# Block bad stuff -$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP -$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP - -$IPT -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: " -$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # NULL packets - -$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: " -$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP - -$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: " -$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS - -$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: " -$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans - -$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP - - -###### Input Chain ###### - -# Unlimited on local -$IPT -A INPUT -i ${PRIV_IF} -j ACCEPT -#$IPT -A INPUT -i lo -s ${PRIV_IP} -j ACCEPT - +echo "Starting ipv4 firewall tables..." # Unlimited on loopback $IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A INPUT -i lo -s 192.168.1.33 -d 192.168.1.33 -j ACCEPT - -echo "Allow input from DNS Server" -$IPT -A INPUT -i ${PUB_IF} -p udp --dport 1024:65535 --sport 53 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input from Https server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -$IPT -A INPUT -i ${PUB_IF} -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input to HTTPS Server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT - -#echo "Allow input from HTTP Server" -#$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input from IRC server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 1024:65535 --sport 6667 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input from FTP server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 1024:65535 --sport 21 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input from git server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input from POP3S server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input from SMTPS server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input to HTTP Server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT - -#echo "Allow input to DNS Server" -#$IPT -A INPUT -i ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT - -echo "Allow input to SSH server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT - -###### Output Chain ###### - -# Unlimited on loopback $IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A OUTPUT -o lo -s 192.168.1.33 -d 192.168.1.33 -j ACCEPT -#$IPT -A OUTPUT -o lo -d ${PRIV_IP} -j ACCEPT - -# Unlimited on local -$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT - -echo "Allow output to DNS server" -$IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 53 --sport 1024:65535 -j ACCEPT - -echo "Allow output to https server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 443 -j ACCEPT - -echo "Allow output from https server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT - -#echo "Allow output from http server" -#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT - -#echo "Allow to HTTP server" -#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT - -echo "Allow output to SSH server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT - -echo "Allow output to ftp server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT - -echo "Allow output to git server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 9418 -m state --state NEW,ESTABLISHED -j ACCEPT - -echo "Allow output to IRC server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT -echo "Allow output to SMTPS server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 465 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +#modprobe ip_conntrack +#modprobe ip_conntrack_ftp +#echo 1 > /proc/sys/net/ipv4/ip_forward + +####### blocker Chain ###### +## Block google dns +$IPT -A blocker -s 8.8.0.0/24 -j LOG --log-level 7 --log-prefix "iptables: blocker google: " +$IPT -A blocker -s 8.8.0.0/24 -j DROP +## Block sync +$IPT -A blocker -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: " +$IPT -A blocker -p tcp ! --syn -m state --state NEW -j DROP +## Block Fragments +$IPT -A blocker -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: " +$IPT -A blocker -f -j DROP + +$IPT -A blocker -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP +$IPT -A blocker -p tcp --tcp-flags ALL ALL -j DROP + +$IPT -A blocker -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: " +$IPT -A blocker -p tcp --tcp-flags ALL NONE -j DROP # NULL packets + +$IPT -A blocker -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: " +$IPT -A blocker -p tcp --tcp-flags SYN,RST SYN,RST -j DROP + +$IPT -A blocker -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: " +$IPT -A blocker -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS + +$IPT -A blocker -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: " +$IPT -A blocker -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans + +$IPT -A blocker -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP +## Return to caller +$IPT -A blocker -j RETURN + +####### server input Chain ###### +echo "server_in chain: Allow to SSH server" +$IPT -A server_in -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "server_in chain: Allow input to HTTPS Server" +$IPT -A server_in -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +#echo "server_in chain: Allow input to HTTP Server" +#$IPT -A server_in -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "server_in chain: Allow input to DNS Server" +$IPT -A server_in -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A server_in -p tcp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT + +## Return to caller +$IPT -A server_in -j RETURN + +####### server output Chain ###### +echo "server_out chain: Allow output from DNS server" +$IPT -A server_out -p udp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +$IPT -A server_out -p tcp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +echo "server_out chain: Allow output from https server" +$IPT -A server_out -p tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +#echo "server_out chain: Allow output from http server" +#$IPT -A server_out -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +echo "server_out chain: Allow output from SSH server" +$IPT -A server_out -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT + +## Return to caller +$IPT -A server_out -j RETURN + +####### client input Chain ###### +echo "client_in chain: Allow input from IRC server" +$IPT -A client_in -p tcp --sport 6667 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from FTP server" +$IPT -A client_in -p tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from GIT server" +$IPT -A client_in -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from POP3S server" +$IPT -A client_in -p tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from SMTPS server" +$IPT -A client_in -p tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +#echo "client_in chain: Allow input from HTTP Server" +#$IPT -A client_in -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from HTTPS server" +$IPT -A client_in -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +#$IPT -A client_in -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from DNS Server" +$IPT -A client_in -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from SSH Server" +$IPT -A client_in -p udp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +$IPT -A client_in -p udp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT + +## Return to caller +$IPT -A client_in -j RETURN + +####### client output Chain ###### +echo "client_out chain: Allow output to IRC server" +$IPT -A client_out -p tcp --dport 6667 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to FTP server" +$IPT -A client_out -p tcp --dport 21 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to GIT server" +$IPT -A client_out -p tcp --dport 9418 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to POP3S server" +$IPT -A client_out -p tcp --dport 995 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to SMTPS server" +$IPT -A client_out -p tcp --dport 465 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to HTTPS server" +$IPT -A client_out -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +#$IPT -A client_out -p udp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +##echo "Allow to HTTP server" +#$IPT -A client_out -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to DNS server" +$IPT -A client_out -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to SSH server" +$IPT -A client_out -p tcp --dport 22 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A client_out -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT + +## Return to caller +$IPT -A client_out -j RETURN + + +####### netconf input Chain ###### +echo "netconf_in chain: Allow DHCP protocol" +$IPT -A netconf_in -p udp --sport 68 --dport 67 -j ACCEPT +echo "netconf_in chain: Allow RIP protocol for ${NET_ADDR}" +$IPT -A netconf_in -p udp --sport 520 --dport 520 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT +#echo "netconf chain: Allow ICMP from ${NET_ADDR}" +#$IPT -A netconf_in -p icmp -s ${NET_ADDR} -j ACCEPT +echo "netconf_in chain: Allow ICMP from all" +$IPT -A netconf_in -p icmp -j LOG --log-level 7 --log-prefix "iptables: netconf_in ICMP: " +$IPT -A netconf_in -p icmp -j ACCEPT + +## Return to caller +$IPT -A netconf_in -j RETURN + + +####### netconf output Chain ###### +echo "netconf_out chain: Allow output from DHCP server" +$IPT -A netconf_out -p udp --sport 67 --dport 68 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT +echo "netconf_out chain: Allow RIP protocol for ${NET_ADDR}" +$IPT -A netconf_out -p udp --sport 520 --dport 520 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT +#echo "netconf chain: Allow ICMP output to ${NET_ADDR}" +#$IPT -A netconf_out -p icmp -d ${NET_ADDR} -j ACCEPT +echo "netconf chain: Allow ICMP output to all" +$IPT -A netconf_out -p icmp -j LOG --log-level 7 --log-prefix "iptables: netconf_out ICMP: " +$IPT -A netconf_out -p icmp -j ACCEPT + +## Return to caller +$IPT -A netconf_out -j RETURN + +####### AP rules ###### +$IPT -A FORWARD -j blocker +#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT +$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j netconf_in +$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j netconf_out +$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j client_in +$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -j client_out +#$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP} + +####### Input Chain ###### +$IPT -A INPUT -j blocker +$IPT -A INPUT -i ${PUB_IF} -j server_in +$IPT -A INPUT -i ${PUB_IF} -j client_in +$IPT -A INPUT -i ${PUB_IF} -j netconf_in + +####### Output Chain ###### +$IPT -A OUTPUT -j blocker +$IPT -A OUTPUT -o ${PUB_IF} -j server_out +$IPT -A OUTPUT -o ${PUB_IF} -j client_out +$IPT -A OUTPUT -o ${PUB_IF} -j netconf_out -echo "Allow output to POP3S server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 995 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT - -## less logs - -echo "Drop RIP protocol" -$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -s $NET_ADDR -j DROP - -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -d $DHCP_SERV -j ACCEPT ## log everything else and drop $IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " $IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " $IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " -# + exit 0 + +#$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -s ${NET_ADDR} -j ACCEPT +#$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -d ${NET_ADDR} -j ACCEPT +#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -p udp --sport 68 --dport 67 -j ACCEPT +#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -p udp --sport 520 --dport 520 -j ACCEPT +# +## You Dirty bitch +#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT + +## Unlimited on loopback +#$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT +##$IPT -A OUTPUT -o lo -d ${PRIV_IP} -j ACCEPT +# +## Unlimited on local +#$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT +# +### less logs +# + +#echo "Allow output DHCP protocol" +#$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT + diff --git a/tools/conf/etc/logrotate.conf b/tools/conf/etc/logrotate.conf new file mode 100644 index 0000000..896b779 --- /dev/null +++ b/tools/conf/etc/logrotate.conf @@ -0,0 +1,133 @@ +# see "man logrotate" for details +# rotate log files weekly +weekly + +# keep 4 weeks worth of backlogs +rotate 4 + +# create new (empty) log files after rotating old ones +create + +# uncomment this if you want your log files compressed +compress + +olddir /var/log/old + +notifempty + +maxsize 5M + +# some packages can drop log rotation information into +# this directory +include /etc/logrotate.d + +# few generic files to rotate +/var/log/wtmp { + create 0644 root root + rotate 5 +} + +/var/log/btmp { + create 0600 root root + rotate 5 +} + +# system-specific logs may be also be configured here. +/var/log/faillog { + maxsize 5M +} + +/var/log/lastlog { + maxsize 5M +} + +/var/log/auth { + create 0644 root root + rotate 5 + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript +} + +/var/log/cron { + create 0644 root root + rotate 5 + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript +} + +/var/log/debug { + create 0644 root root + rotate 5 + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript +} + +/var/log/kernel { + rotate 5 + create 0644 root root + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript +} + +/var/log/daemon { + compress + rotate 5 + create 644 root root + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript + +} + +/var/log/messages { + rotate 5 + create 0644 root root + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript +} + +/var/log/mail { + create 0644 root root + rotate 5 + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript +} + +/var/log/user { + create 0644 root root + rotate 5 + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript +} + diff --git a/tools/conf/etc/logrotate.d/dnsmasq b/tools/conf/etc/logrotate.d/dnsmasq new file mode 100644 index 0000000..3151ddc --- /dev/null +++ b/tools/conf/etc/logrotate.d/dnsmasq @@ -0,0 +1,11 @@ +/var/log/dnsmasq { + weekly + create 0644 root root + rotate 5 + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript +} diff --git a/tools/conf/etc/logrotate.d/fail2ban b/tools/conf/etc/logrotate.d/fail2ban new file mode 100644 index 0000000..c2dc4cd --- /dev/null +++ b/tools/conf/etc/logrotate.d/fail2ban @@ -0,0 +1,5 @@ +/var/log/fail2ban.log { + weekly + create 0644 root root + rotate 5 + } diff --git a/tools/conf/etc/logrotate.d/gitolite b/tools/conf/etc/logrotate.d/gitolite new file mode 100644 index 0000000..547d6b6 --- /dev/null +++ b/tools/conf/etc/logrotate.d/gitolite @@ -0,0 +1,12 @@ +/var/log/gitolite { + rotate 5 + monthly + create 0644 root root + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript + +} diff --git a/tools/conf/etc/logrotate.d/lynis b/tools/conf/etc/logrotate.d/lynis new file mode 100644 index 0000000..8cf9181 --- /dev/null +++ b/tools/conf/etc/logrotate.d/lynis @@ -0,0 +1,10 @@ +/var/log/lynis.log { + rotate 5 + monthly + create 0644 root root +} +/var/log/lynis-report.dat { + rotate 5 + monthly + create 0644 root root +} diff --git a/tools/conf/etc/logrotate.d/nginx b/tools/conf/etc/logrotate.d/nginx new file mode 100644 index 0000000..ae05445 --- /dev/null +++ b/tools/conf/etc/logrotate.d/nginx @@ -0,0 +1,23 @@ +/var/log/nginx/access.log { + weekly + create 0664 root www + rotate 5 + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript +} + +/var/log/nginx/error.log { + weekly + create 0644 root root + rotate 5 + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript +} diff --git a/tools/conf/etc/logrotate.d/ntp b/tools/conf/etc/logrotate.d/ntp new file mode 100644 index 0000000..c46b590 --- /dev/null +++ b/tools/conf/etc/logrotate.d/ntp @@ -0,0 +1,5 @@ +/var/log/ntp.log { + weekly + create 0644 root root + rotate 5 +} diff --git a/tools/conf/etc/logrotate.d/php-fpm b/tools/conf/etc/logrotate.d/php-fpm new file mode 100644 index 0000000..c778658 --- /dev/null +++ b/tools/conf/etc/logrotate.d/php-fpm @@ -0,0 +1,5 @@ +/var/log/php-fpm.log { + rotate 5 + monthly + create 0644 root root +} diff --git a/tools/conf/etc/logrotate.d/postgres b/tools/conf/etc/logrotate.d/postgres new file mode 100644 index 0000000..fc59aad --- /dev/null +++ b/tools/conf/etc/logrotate.d/postgres @@ -0,0 +1,17 @@ +/var/log/pgsql { + weekly + compress + delaycompress + rotate 10 + notifempty + create 660 postgres postgres + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript + +} + + diff --git a/tools/conf/etc/logrotate.d/samhain b/tools/conf/etc/logrotate.d/samhain new file mode 100644 index 0000000..d60f810 --- /dev/null +++ b/tools/conf/etc/logrotate.d/samhain @@ -0,0 +1,24 @@ +/var/log/samhain.log { + weekly + rotate 52 + nocreate + missingok + compress + + prerotate + if test -f /var/run/samhain.pid; then \ + PIN=`cat /var/run/samhain.pid`; \ + /bin/kill -TTIN $PIN; \ + sleep 1; \ + AA=0; \ + while test "x$AA" != "x120"; do \ + AA=$(( AA + 1 )); \ + if test -f /var/log/samhain.log.lock; then \ + sleep 1; \ + else \ + break; \ + fi \ + done; \ + fi + endscript +} diff --git a/tools/conf/etc/logrotate.d/shorewall b/tools/conf/etc/logrotate.d/shorewall new file mode 100644 index 0000000..a7dffdf --- /dev/null +++ b/tools/conf/etc/logrotate.d/shorewall @@ -0,0 +1,11 @@ +/var/log/shorewall-init.log { + missingok + notifempty + create 0600 root root + sharedscripts + postrotate + if [ -f /var/run/syslog-ng.pid ]; then \ + kill -HUP `cat /var/run/syslog-ng.pid`; \ + fi; + endscript +} diff --git a/tools/conf/etc/logrotate.d/shorewall6 b/tools/conf/etc/logrotate.d/shorewall6 new file mode 100644 index 0000000..ee5e246 --- /dev/null +++ b/tools/conf/etc/logrotate.d/shorewall6 @@ -0,0 +1,5 @@ +/var/log/shorewall6-init.log { + missingok + notifempty + create 0600 root root +} diff --git a/tools/conf/etc/syslog-ng.conf b/tools/conf/etc/syslog-ng.conf new file mode 100644 index 0000000..5b5fc75 --- /dev/null +++ b/tools/conf/etc/syslog-ng.conf @@ -0,0 +1,181 @@ +############################################################################# +# Simple syslog-ng.conf for crux.nu, +# +# Silvino Silva < silvino at bk dot ru > +# Created: 1/12/2014 +# +# Reference: +# http://www.campin.net/syslog-ng/expanded-syslog-ng.con +# +# Notes: +# * f_error and f_console are not used +# -------------------------------------------------------------------------- +@version: 3.5 +@include "scl.conf" + +options { + flush_lines(0); + time_reopen(10); + chain_hostnames(off); + create_dirs(no); + stats_freq(1200); + use_dns(no); + use_fqdn(no); + perm(0600); + log_fifo_size(2048); + log_msg_size(1024); + keep_hostname(yes); +}; + +############################################# +# sources +# +source s_log { unix-dgram("/dev/log"); }; +source s_internal { internal(); }; +source s_kernel { file("/proc/kmsg" program_override("kernel")); }; + +template t_debug { template("$DATE fac $FACILITY lvl $LEVEL prg $PROGRAM: $MSG\n"); }; + +############################################# +# common destinations +# + +destination d_auth { file("/var/log/auth"); }; +destination d_cron { file("/var/log/cron"); }; +destination d_daemon { file("/var/log/daemon"); }; +destination d_kernel { file("/var/log/kernel"); }; +destination d_lpr { file("/var/log/lpr"); }; +destination d_mail { file("/var/log/mail"); }; +destination d_user { file("/var/log/user"); }; +destination d_syslog { file("/val/log/syslog"); }; + +destination d_debug { file("/var/log/debug" template(t_debug)); }; +destination d_error { file("/var/log/error"); }; +destination d_messages { file("/var/log/messages"); }; + +destination d_console { usertty("root"); }; +destination d_console_all { usertty("root"); }; + +############################################# +# custom destinations +# + +destination d_shorewall_warn { file ("/var/log/shorewall/warn.log"); }; +destination d_shorewall_info { file ("/var/log/shorewall/info.log"); }; +destination d_dnsmasq { file("/var/log/dnsmasq"); }; +destination d_postgres { file("/var/log/pgsql"); }; +destination d_sshd { file("/var/log/sshd"); }; +destination d_gitolite { file("/var/log/gitolite"); }; +destination d_nginx_access { file("/var/log/nginx/access.log" owner(root) group(www) perm(0644)); }; +destination d_nginx_error { file("/var/log/nginx/error.log"); }; + +############################################# +# common filters +# + +filter f_info { level(info); }; +filter f_notice { level(notice); }; +filter f_warn { level(warn); }; +filter f_err { level(err); }; +filter f_crit { level(crit .. emerg); }; + +filter f_emerg { level(emerg); }; +filter f_alert { level(alert); }; + +filter f_debug { + level(debug) + and not facility(auth, authpriv, mail, news) +}; + +filter f_error { level(err..emerg); }; +filter f_auth { facility(auth, authpriv); }; +filter f_cron { facility(cron); }; +filter f_daemon { facility(daemon); }; +filter f_kernel { facility(kern); }; +filter f_lpr { facility(lpr); }; + +filter f_local { facility( + local0, + local1, + local2, + local3, + local4, + local5, + local6, + local7 + ); +}; + +filter f_mail { facility(mail); }; +filter f_syslog { facility(syslog); }; +filter f_user { facility(user); }; +filter f_console { level(warn .. emerg); }; + +############################################# +# custom filters +# + +filter f_messages { + level(info..warn) + and not facility(auth, authpriv, mail, cron) +}; + +filter f_dnsmasq { program("dnsmasq"); }; +filter f_postgres { facility(local0); }; +filter f_sshd { facility(local1); }; + +filter f_shorewall_warn { + level (warn) + and match ("iptables" value("MESSAGE")); +}; + +filter f_shorewall_info { + level (info) + and match ("iptables" value("MESSAGE")); +}; + +filter f_gitolite { program("gitolite"); }; + +filter f_nginx_access { + match("nginx_access:" value("MESSAGE")); +}; + +filter f_nginx_error { + match("nginx_error:" value("MESSAGE")); +}; + + +log { source (s_kernel); filter (f_shorewall_warn); destination (d_shorewall_warn); flags(final);}; +log { source (s_kernel); filter (f_shorewall_info); destination (d_shorewall_info); flags(final);}; +log { source(s_log); filter(f_dnsmasq); destination(d_dnsmasq); flags(final); }; +log { source(s_log); filter(f_postgres); destination(d_postgres); flags(final); }; +log { source(s_log); filter(f_sshd); destination(d_sshd); flags(final); }; +log { source(s_log); filter(f_gitolite); destination(d_gitolite); flags(final); }; +log { source(s_log); filter(f_nginx_error); destination(d_nginx_error); flags(final); }; +log { source(s_log); filter(f_local); filter(f_nginx_access); destination(d_nginx_access); flags(final); }; + +############################################# +# connect filter and destination +# + +log { source(s_log); filter(f_auth); destination(d_auth); }; +log { source(s_log); filter(f_cron); destination(d_cron); }; +log { source(s_log); filter(f_daemon); destination(d_daemon); }; +log { source(s_kernel); filter(f_kernel); destination(d_kernel); }; +log { source(s_log); filter(f_lpr); destination(d_lpr); }; +log { source(s_log); source(s_internal); filter(f_syslog); destination(d_syslog); }; +log { source(s_log); filter(f_user); destination(d_user); }; + +log { source(s_log); filter(f_mail); destination(d_mail); }; +log { source(s_log); filter(f_mail); filter(f_info); destination(d_mail); }; +log { source(s_log); filter(f_mail); filter(f_info); destination(d_mail); }; +log { source(s_log); filter(f_mail); filter(f_info); destination(d_mail); }; + +log { source(s_log); filter(f_debug); destination(d_debug); }; +log { source(s_log); filter(f_error); destination(d_error); }; + +#log { source(s_log); filter(f_console); destination(d_console_all); }; +log { source(s_log); filter(f_crit); destination(d_console); }; + +#default log +log { source(s_log); filter(f_messages); destination(d_messages); }; diff --git a/tools/gitolite.html b/tools/gitolite.html index a275c23..1fa8e5a 100644 --- a/tools/gitolite.html +++ b/tools/gitolite.html @@ -514,9 +514,9 @@ # # this way it will log - # * * * * * /usr/share/gitolite/deployweb + # * * * * * /srv/gitolite/deploy/deploy.sh # without log - * * * * * /usr/share/gitolite/deployweb > /dev/null 2>&1 + * * * * * /srv/gitolite/deploy/deploy.sh > /dev/null 2>&1 @hourly ID=sys.hourly /usr/sbin/runjobs /etc/cron/hourly @daily ID=sys.daily /usr/sbin/runjobs /etc/cron/daily diff --git a/tools/qemu.html b/tools/qemu.html index fc0f15c..f79b955 100644 --- a/tools/qemu.html +++ b/tools/qemu.html @@ -43,7 +43,7 @@ this describes how to create a qcow2 type;</p> <pre> - $ qemu-img create -f qcow2 crux-img.qcow2 20G + $ qemu-img create -f qcow2 crux-img.qcow2 2000M </pre> <p>Qemu disk images can be treated as regular disks using @@ -61,13 +61,25 @@ to use parted to create a gpt system table;</p> <pre> - # parted --script $DEV \ - mklabel gpt \ - mkpart ESP fat32 1MiB 120MiB \ - mkpart primary ext4 120MiB 720MiB \ - mkpart primary ext4 720MiB 2720MiB \ - mkpart primary ext4 2720MiB 5000MiB \ - set 1 boot on + parted --script ${DEV} \ + mklabel gpt \ + unit mib \ + mkpart primary 1 3 \ + set 1 bios_grub on \ + name 1 grub \ + mkpart ESP fat32 3 59 \ + set 2 boot on \ + name 2 efi \ + mkpart primary ext4 103 200 \ + name 3 boot \ + mkpart primary linux-swap 200 456 \ + name 4 swap \ + mkpart primary ext4 456 3700 \ + name 5 root \ + mkpart primary ext4 3700 4000 \ + name 6 var \ + mkpart primary ext4 4000 100% \ + name 7 home </pre> <pre> @@ -77,22 +89,30 @@ <p>Use /dev/mapper/$(name_of_device) to assign correct blocks;</p> <pre> - # mkfs.fat -F 32 $BLK_EFI - # mkfs.ext4 $BLK_BOOT - # mkfs.ext4 $BLK_ROOT - # mkfs.ext4 $BLK_VAR + mkfs.fat -F 32 /dev/mapper/${DEV_NAME}p2 + mkfs.ext4 /dev/mapper/${DEV_NAME}p3 + mkswap /dev/mapper/${DEV_NAME}p4 + mkfs.ext4 /dev/mapper/${DEV_NAME}p5 + mkfs.ext4 /dev/mapper/${DEV_NAME}p6 + mkfs.ext4 /dev/mapper/${DEV_NAME}p7 </pre> <p>Mount partition;</p> <pre> - # mount $BLK_ROOT $CHROOT - # mkdir -p $CHROOT/boot - # mount $BLK_BOOT $CHROOT/boot - # mkdir -p $CHROOT/boot/efi - # mount $BLK_EFI $CHROOT/boot/efi - # mkdir -p $CHROOT/var - # mount $BLK_VAR $CHROOT/var + mount /dev/mapper/${DEV_NAME}p5 $CHROOT + mkdir -p $CHROOT/proc + mkdir -p $CHROOT/sys + mkdir -p $CHROOT/dev + + mkdir -p $CHROOT/boot + mount /dev/mapper/${DEV_NAME}p3 $CHROOT/boot + mkdir -p $CHROOT/boot/efi + mount /dev/mapper/${DEV_NAME}p2 $CHROOT/boot/efi + mkdir -p $CHROOT/var + mount /dev/mapper/${DEV_NAME}p6 $CHROOT/var + mkdir -p $CHROOT/home + mount /dev/mapper/${DEV_NAME}p7 $CHROOT/home </pre> <p>Before disconnecting image, clean dev mappings;</p> @@ -200,41 +220,40 @@ <p>runvm/profile/crux</p> <pre> - iso=iso/crux-3.2.iso - image=img/crux-img.qcow2 + mac=$(rmac_addr) + memory=1024 + boot=d tap="tap1" + iso=iso/crux-3.3.iso + image=img/crux-standard.qcow2 + other="-vga std -display sdl" </pre> <p>runvm/runvm.sh</p> - <pre> - #!/bin/bash + <pre> function rmac_addr (){ printf '54:60:BE:EF:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256)) } source profile/$1 - boot=$2 - - mac=$(rmac_addr) qemu-system-x86_64 \ -enable-kvm \ - -m 1024 \ + -m ${memory} \ -boot ${boot} \ -cdrom ${iso} \ -hda ${image} \ - -vga std \ - -display sdl \ -device e1000,netdev=t0,mac=${mac} \ -netdev tap,id=t0,ifname=${tap},script=no,downscript=no \ - & + ${other} \ + & </pre> <p>Set guests machines to run under the total resolution provided by host system configure grub on the guest with gfxmode;</p> - <h3 id="guest">Guest Graphics</h2> + <h3 id="guest">Guest Graphics</h3> <p>Get current resolution on host machine;</p> @@ -270,53 +289,36 @@ <pre> export QEMU_AUDIO_DRV=alsa - #export QEMU_AUDIO_DRV=sdl - - - #boot=$1 + memory=1024 boot=c - - iso=iso/crux-3.2.iso - #iso=$2 - - #image=$3 - image=img/crux-img.qcow2 - - #tap=$4 - tap="tap1" - - #mac=$(rmac_addr) + iso=iso/devuan_jessie_1.0.0_amd64_CD.iso + image=img/c12-dvd.qcow2 + tap="tap2" mac="54:60:be:ef:5c:72" - - other="-soundhw hda" + other="-soundhw hda -vga std -display sdl" </pre> - <p>runvm/runvm.sh</p> + <h3 id="sound">Guest USB</h3> <pre> - function rmac_addr (){ - printf '54:60:BE:EF:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256)) - } - - source profile/$1 - boot=$2 - - #mac=$(rmac_addr) + # lsusb + # ls /dev/v4l + </pre> - qemu-system-x86_64 \ - -enable-kvm \ - -m 1024 \ - -boot ${boot} \ - -cdrom ${iso} \ - -hda ${image} \ - -vga std \ - -display sdl \ - -device e1000,netdev=t0,mac=${mac} \ - -netdev tap,id=t0,ifname=${tap},script=no,downscript=no \ - ${other} \ - &> + <pre> + # chown root:kvm /dev/bus/usb/003/004 </pre> + <pre> + export QEMU_AUDIO_DRV=alsa + memory=1024 + boot=c + iso=iso/devuan_jessie_1.0.0_amd64_CD.iso + image=img/c12-dvd.qcow2 + tap="tap2" + mac="54:60:be:ef:5c:72" + other="-soundhw hda -vga std -display sdl -usb -device usb-host,vendorid=0x13d3,productid=0x5652" + </pre> <a href="index.html">Tools Index</a> <p>This is part of the c9 Manual. Copyright (C) 2016 diff --git a/tools/scripts/pkgmk-test.conf b/tools/scripts/pkgmk-test.conf index 1ebdccb..3b0031d 100644 --- a/tools/scripts/pkgmk-test.conf +++ b/tools/scripts/pkgmk-test.conf @@ -2,32 +2,12 @@ # /etc/pkgmk.conf: pkgmk(8) configuration # -export CPPFLAGS="-D_FORTIFY_SOURCE=2" -export CFLAGS="-O2 -march=native -mtune=native -pipe -fPIC -fPIE -fstack-protector-strong --param=ssp-buffer-size=4 -fno-plt -fstack-check" -export CXXFLAGS="${CFLAGS}" -export LDFLAGS="-fPIE -pie -Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now" -export MAKEFLAGS="-j4" +source /etc/pkgmk.conf - -case ${PKGMK_ARCH} in - "64"|"") - ;; - "32") - export CFLAGS="${CFLAGS} -m32" - export CXXFLAGS="${CXXFLAGS} -m32" - export LDFLAGS="${LDFLAGS} -m32" - export PKG_CONFIG_LIBDIR="/usr/lib32/pkgconfig" - ;; - *) - echo "Unknown architecture selected! Exiting." - exit 1 - ;; -esac - -PKGMK_SOURCE_MIRRORS=(https://c9.root.sx/ports/distfiles/) -# PKGMK_SOURCE_DIR="$PWD" -# PKGMK_PACKAGE_DIR="$PWD" -# PKGMK_WORK_DIR="$PWD/work" +#PKGMK_SOURCE_MIRRORS=(https://c9.root.sx/ports/distfiles/) +PKGMK_SOURCE_DIR="$PWD" +PKGMK_PACKAGE_DIR="$PWD" +PKGMK_WORK_DIR="$PWD/work" # PKGMK_DOWNLOAD="no" # PKGMK_IGNORE_FOOTPRINT="no" # PKGMK_IGNORE_NEW="no" diff --git a/tools/scripts/runvm/c12-dvd b/tools/scripts/runvm/c12-dvd new file mode 100644 index 0000000..9cbf201 --- /dev/null +++ b/tools/scripts/runvm/c12-dvd @@ -0,0 +1,15 @@ +export QEMU_AUDIO_DRV=alsa + +memory=1024 + +boot=c + +iso=iso/devuan_jessie_1.0.0_amd64_CD.iso + +image=img/c12-dvd.qcow2 + +tap="tap2" + +mac="54:60:be:ef:5c:72" + +other="-soundhw hda -vga std -display sdl -usb -device usb-ehci -device usb-host,vendorid=0x13d3,productid=0x5652" diff --git a/tools/scripts/runvm/profile/crux b/tools/scripts/runvm/profile/crux index eb2dc63..af33e1b 100644 --- a/tools/scripts/runvm/profile/crux +++ b/tools/scripts/runvm/profile/crux @@ -1,3 +1,7 @@ -iso=iso/crux-3.2.iso -image=img/crux-img.qcow2 -tap="tap1" +mac="54:60:be:ef:5c:64" +memory=1024 +boot=$2 +tap="tap4" +iso=iso/crux-3.3.iso +image=img/c14.qcow2 +other="-vga std -display sdl" diff --git a/tools/scripts/runvm/runvm.sh b/tools/scripts/runvm/runvm.sh index db479cc..1e56a52 100644 --- a/tools/scripts/runvm/runvm.sh +++ b/tools/scripts/runvm/runvm.sh @@ -5,18 +5,22 @@ printf '54:60:BE:EF:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256)) } source profile/$1 -boot=$2 -mac=$(rmac_addr) +#mac=$(rmac_addr) +#memory=1024 +#boot=d +#tap="tap1" +#iso=iso/crux-3.3.iso +#image=img/crux-standard.qcow2 +#other="-soundhw hda -vga std -display sdl" qemu-system-x86_64 \ -enable-kvm \ - -m 1024 \ + -m ${memory} \ -boot ${boot} \ -cdrom ${iso} \ -hda ${image} \ - -vga std \ - -display sdl \ -device e1000,netdev=t0,mac=${mac} \ -netdev tap,id=t0,ifname=${tap},script=no,downscript=no \ + ${other} \ & diff --git a/tools/syslog-ng.html b/tools/syslog-ng.html index 5d6fd2d..e97b50d 100644 --- a/tools/syslog-ng.html +++ b/tools/syslog-ng.html @@ -5,6 +5,9 @@ <title>1. Syslog-ng</title> </head> <body> + + <a href="index.html">Tools Index</a> + <h1>1. Syslog-ng</h1> <p>Syslog-ng offers more than sysklogd, for example, we @@ -157,7 +160,7 @@ <h3 id="syslog-conf">1.4. Syslog-ng configuration</h3> - <p>Example of <a href="../conf/etc/syslog-ng.conf">/etc/syslog-ng.conf</a> + <p>Example of <a href="conf/etc/syslog-ng.conf">/etc/syslog-ng.conf</a> that configures syslog-ng matching tools already installed in the system and some that are part of <a href="../tools/index.html">tools</a>.</p> @@ -251,6 +254,8 @@ $ sudo sh /etc/rc.d/sysklogd stop </pre> + <a href="index.html">Tools Index</a> + <p>This is part of the c9-doc Manual. Copyright (C) 2016 c9 team. |