1. Syslog-ng

From 577fd6418b36ef6d0024a6ccbcf2640922401a31 Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Wed, 2 Aug 2017 19:25:46 +0100 Subject: bumped version 0.3.2 --- index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.html b/index.html index bde784f..7645169 100644 --- a/index.html +++ b/index.html @@ -38,7 +38,7 @@

Version;

-        rev 0.3.1
+        rev 0.3.2

Manifesto helps to have general -- cgit 1.4.1-2-gfad0 From 593fc597166839b42b8e48976447fa37c433a7af Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Sun, 6 Aug 2017 18:48:50 +0100 Subject: tools qemu and core setup scripts revision --- core/scripts/act-chroot.sh | 35 ++++---- core/scripts/backup-system.sh | 122 +++++++++++++++++++++------ core/scripts/setup-install.sh | 176 ++++++++++++++++++++++++++------------- core/scripts/setup-virtual.sh | 76 +++++++++++++++++ tools/qemu.html | 140 ++++++++++++++++--------------- tools/scripts/runvm/c12-dvd | 15 ++++ tools/scripts/runvm/profile/crux | 10 ++- tools/scripts/runvm/runvm.sh | 14 ++-- 8 files changed, 409 insertions(+), 179 deletions(-) create mode 100644 core/scripts/setup-virtual.sh create mode 100644 tools/scripts/runvm/c12-dvd diff --git a/core/scripts/act-chroot.sh b/core/scripts/act-chroot.sh index 5411bc5..317b5b7 100644 --- a/core/scripts/act-chroot.sh +++ b/core/scripts/act-chroot.sh @@ -1,26 +1,25 @@ #!/bin/bash -DEV=$1 -CHROOT="/mnt" -##read BLK_EFI -BLK_EFI="${DEV}2" -##read BLK_BOOT -BLK_BOOT="${DEV}3" -##read BLK_ROOT -BLK_ROOT="${DEV}4" -##read BLK_VAR -BLK_VAR="${DEV}5" -##read BLK_USR -BLK_USR="${DEV}6" -##read BLK_SWP -BLK_SWP="${DEV}7" -##read BLK_HOME -BLK_HOME="${DEV}8" - -#read CHROOT CHROOT="/mnt" +#DEV=$1 +# +###read BLK_EFI +#BLK_EFI="${DEV}2" +###read BLK_BOOT +#BLK_BOOT="${DEV}3" +###read BLK_ROOT +#BLK_ROOT="${DEV}4" +###read BLK_VAR +#BLK_VAR="${DEV}5" +###read BLK_USR +#BLK_USR="${DEV}6" +###read BLK_SWP +#BLK_SWP="${DEV}7" +###read BLK_HOME +#BLK_HOME="${DEV}8" +# #mount $BLK_ROOT $CHROOT # #mount $BLK_BOOT $CHROOT/boot diff --git a/core/scripts/backup-system.sh b/core/scripts/backup-system.sh index 379e449..2bced8a 100644 --- a/core/scripts/backup-system.sh +++ b/core/scripts/backup-system.sh @@ -1,55 +1,125 @@ #!/bin/sh -echo -n "root directory you want backup (/mnt/): " -read ROOT_DIR +ConfirmOrExit () +{ + while true + do + echo -n "Please confirm (y or n) :" + read CONFIRM + case $CONFIRM in + y|Y|YES|yes|Yes) break ;; + n|N|no|NO|No) + echo "Aborting - you entered $CONFIRM" + exit + ;; + *) echo "Please enter only y or n" + esac + done + echo "You entered $CONFIRM. Continuing ..." +} -echo -n "where you want to save (/home/user): " -read DEST_DIR +mkbk_metadata() { + + # must be using gwak instead of sed, xargs and echo + prt-get listinst -v | sed -s s/" "/#/g | xargs -i echo {}.pkg.tar.gz > ${DEST_DIR}/installed.pkg + + # make list and copy installed core packages + prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/core" | cut -d " " -f 3 > ${DEST_DIR}/core.pkg + + prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/opt" | cut -d " " -f 3 > $DEST_DIR/opt.pkg + + prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/contrib" | cut -d " " -f 3 > $DEST_DIR/contrib.pkg -bk_coll() { + prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/xorg" | cut -d " " -f 3 > $DEST_DIR/xorg.pkg + + prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep -v "yes /usr/ports/core" | grep -v "yes /usr/ports/opt" | grep -v "yes /usr/ports/contrib" | grep -v "yes /usr/ports/xorg" | grep "yes " | cut -d " " -f 3 > $DEST_DIR/other.pkg + +} + +mkbk_coll_pkg() { col=$1 # make copy of packages - mkdir ${BKDIR}/${col} + mkdir ${PORT_PKG}/${col} while read line; do if [ ! -f /usr/ports/packages/${line} ]; then echo "Building package: ${line};\n" name=$(echo ${line} | cut -d "#" -f 1) - sudo prt-get update -fr ${name} + #$sudo prt-get update -fr ${name} fi if [ -f /usr/ports/packages/${line} ]; then echo "Backing up package: ${line}" - echo ${line} >> ${BKDIR}/backup.pkg - cp /usr/ports/packages/${line} ${BKDIR}/${col}/ + echo ${line} >> ${DEST_DIR}/backup.pkg + cp /usr/ports/packages/${line} ${PORT_PKG}/${col}/ else echo "Package not found: ${line}" - echo ${line} >> ${BKDIR}/${col}-notfound.pkg + echo ${line} >> ${DEST_DIR}/${col}-notfound.pkg fi - done < $BKDIR/${col}.pkg + done < $DEST_DIR/${col}.pkg } -# Temporary directory -BKDIR=$(pwd)/bkdir -mkdir -p ${BKDIR} +mkbk_coll_ports() { + col=$1 -# must be using gwak instead of sed, xargs and echo -prt-get listinst -v | sed -s s/" "/#/g | xargs -i echo {}.pkg.tar.gz > ${BKDIR}/installed.pkg +# tar --xattrs -zcpf $PORT_PRT/${col}-`date '+%Y-%j-%H-%M-%S'`.tar.gz \ +# --directory=$ROOT_DIR/usr/ports/${col} \ +# . + tar --xattrs -zcpf $PORT_PRT/${col}.tar.gz \ + --directory=$ROOT_DIR/usr/ports/${col} \ + --exclude=.git/ \ + . + +} + +mkbk_data_conf() { + + tar --xattrs -zcpf $DATA_CNF/etc.tar.gz \ + --directory=$ROOT_DIR/etc \ + . + + tar --xattrs -zcpf $DATA_CNF/usr_etc.tar.gz \ + --directory=$ROOT_DIR/usr/etc \ + . +} + + +echo -n "root directory you want backup (/mnt/): " +#read ROOT_DIR +ROOT_DIR=$1 + +echo -n "where you want to save (/home/user): " +DEST_DIR=$2 + +# Temporary directory +PORT_PKG="${DEST_DIR}/crux" +PORT_PRT="${DEST_DIR}/ports" +DATA_CNF="${DEST_DIR}/conf" -# make list and copy installed core packages -prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/core" | cut -d " " -f 3 > ${BKDIR}/core.pkg -bk_coll "core" +echo "ROOT_DIR=${ROOT_DIR}" +echo "DEST_DIR=${DEST_DIR}" +echo "PORT_PKG=${PORT_PKG}" +echo "PORT_PRT=${PORT_PRT}" +echo "DATA_CNF=${DATA_CNF}" +ConfirmOrExit -prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/opt" | cut -d " " -f 3 > $BKDIR/opt.pkg -bk_coll "opt" +mkdir -p ${PORT_PKG} +mkdir -p ${PORT_PRT} +mkdir -p ${DATA_CNF} -prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/contrib" | cut -d " " -f 3 > $BKDIR/contrib.pkg -bk_coll "contrib" +mkbk_metadata +mkbk_data_conf -prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/xorg" | cut -d " " -f 3 > $BKDIR/xorg.pkg -bk_coll "xorg" +mkbk_coll_ports "core" +mkbk_coll_pkg "core" +mkbk_coll_ports "opt" +mkbk_coll_pkg "opt" +mkbk_coll_ports "contrib" +mkbk_coll_pkg "contrib" +mkbk_coll_ports "xorg" +mkbk_coll_pkg "xorg" -prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep -v "yes /usr/ports/core" | grep -v "yes /usr/ports/opt" | grep -v "yes /usr/ports/contrib" | grep -v "yes /usr/ports/xorg" | grep "yes " | cut -d " " -f 3 > $BKDIR/other.pkg +mkbk_coll_pkg "other" #echo $DES_DIR #echo $ROOT_DIR diff --git a/core/scripts/setup-install.sh b/core/scripts/setup-install.sh index c1d2765..ef1cb10 100755 --- a/core/scripts/setup-install.sh +++ b/core/scripts/setup-install.sh @@ -1,29 +1,34 @@ #!/bin/bash -# Set Global Vars -ADMIN_USER=c9admin -DEV=$1 -CHROOT=$2 - # Absolute path to this script, # e.g. /home/user/c9-doc/core/scripts/foo.sh SCRIPT=$(readlink -f "$0") -# Absolute path this script is in, +# Absolute path this script is in, # e.g. /home/user/c9-doc/core/scripts SCRIPTPATH=$(dirname "$SCRIPT") # Absolute path to doc section, # e.g /home/user/c9-doc/core -DIR=$(dirname "$SCRIPTPATH"); +DIR_SCRIPT=$(dirname "$SCRIPTPATH"); # Absolute path to local data, # e.g /home/user/local -DIR_LOCAL="$(dirname $(dirname ${DIR}))/local"; +DIR_LOCAL="$(dirname $(dirname ${DIR_SCRIPT}))/local"; - -DIR_CONF="${DIR}/conf" -DIR_PRT="${DIR}/ports"; -ISO_FILE="${DIR_LOCAL}/crux-3.3.iso" - -ConfirmOrExit () +# Set Global Vars +ADMIN_USER=c9admin +CHROOT=$1 + +# DATA_DIR directory with data to +# to be installed, can be mounted +# iso file or backup directory from +# backup-system script +# from iso monted; +DATA_DIR=$(dirname "$SCRIPTPATH"); +PORT_PKG="${CHROOT}/media/crux" +# from backup; +#DATA_DIR=$2 +#PORT_PKG="${DATA_DIR}/crux" + +ConfirmOrExit() { while true do @@ -44,47 +49,110 @@ ConfirmOrExit () install_core() { - echo "1.1.4 Create core.lst and install pkgadd" - for p in ${CHROOT}mnt/media/crux/core/*; do echo $p >> ${CHROOT}core.lst; done + mkdir -p ${CHROOT}/usr/ports/packages + mkdir -p ${CHROOT}/var/lib/pkg + touch ${CHROOT}/var/lib/pkg/db + + CORE_LS="${DATA_DIR}/core.pkg" - tar xf "${CHROOT}mnt/media/crux/core/pkgutils#5.40-1.pkg.tar.xz" usr/bin/pkgadd -O > ${CHROOT}pkgadd + if [ ! -f ${CORE_LS} ]; then + CORE_LS=${CHROOT}/core.pkg + echo "1.1.4 Create core.pkg and install pkgadd" + for p in ${PORT_PKG}/core/*; + do + echo $(basename $p) >> ${CORE_LS}; + done + fi - chmod +x ${CHROOT}pkgadd + tar xf "${PORT_PKG}/core/pkgutils#5.40-1.pkg.tar.xz" usr/bin/pkgadd -O > ${CHROOT}/pkgadd - echo "1.1.4 File core.lst complete, review list of packages before continue..." + chmod +x ${CHROOT}/pkgadd + + echo "1.1.4 File core.pkg complete, review list of packages before continue..." read PAUSE - vim ${CHROOT}core.lst + vim ${CORE_LS} echo "1.1.4 Starting install" - touch ${CHROOT}/var/lib/pkg/db - cd $CHROOT + #cd $CHROOT while read line; do - echo "Installing $line;\n" - ${CHROOT}pkgadd -u -f -r ${CHROOT} ${line} - done < ${CHROOT}core.lst + pkg=${PORT_PKG}/core/${line} + echo "Installing ${pkg};\n" + ${CHROOT}/pkgadd -f -r ${CHROOT} ${pkg} + done < ${CORE_LS} - rm ${CHROOT}pkgadd - rm ${CHROOT}core.lst + rm ${CHROOT}/pkgadd - mkdir ${CHROOT}usr/ports/packages - cp ${CHROOT}media/crux/core/* ${CHROOT}usr/ports/packages + if [ -f ${CHROOT}/core.pkg ]; then + rm ${CHROOT}/core.pkg; + fi +} + +install_ports() +{ + echo "1.1.5. Install core packages and ports;" + cp ${PORT_PKG}/core/* ${CHROOT}/usr/ports/packages + if [ -f "${PORT_PRT}/core.tar.gz" ]; then + mkdir -p ${CHROOT}/usr/ports/core + tar --xattrs -xpvf $PORT_PRT/core.tar.gz --directory=$CHROOT/usr/ports/core + fi + + echo "1.1.5. Install opt packages and ports;" + cp ${PORT_PKG}/opt/* $CHROOT/usr/ports/packages + if [ -f "${PORT_PRT}/opt.tar.gz" ]; then + mkdir -p ${CHROOT}/usr/ports/opt + tar --xattrs -xpvf $PORT_PRT/opt.tar.gz --directory=$CHROOT/usr/ports/opt + fi + + echo "1.1.5. Install contrib packages and ports;" + cp ${PORT_PKG}/contrib/* $CHROOT/usr/ports/packages + if [ -f "${PORT_PRT}/contrib.tar.gz" ]; then + mkdir -p ${CHROOT}/usr/ports/contrib + tar --xattrs -xpvf $PORT_PRT/contrib.tar.gz --directory=$CHROOT/usr/ports/contrib + fi + + + echo "1.1.5. Install xorg packages and ports;" + cp ${PORT_PKG}/xorg/* $CHROOT/usr/ports/packages + if [ -f "${PORT_PRT}/xorg.tar.gz" ]; then + mkdir -p ${CHROOT}/usr/ports/xorg + tar --xattrs -xpvf $PORT_PRT/xorg.tar.gz --directory=$CHROOT/usr/ports/xorg + fi + + echo "1.1.6. Install extra packages;" + cp ${PORT_PKG}/other/* $CHROOT/usr/ports/packages } setup_core() { + if [ -f "${DATA_CNF}/etc.tar.gz" ]; then + echo "1.1. Extracting configuration data;\n" + tar --xattrs -xpvf $DATA_CNF/etc.tar.gz --directory=$CHROOT/etc + tar --xattrs -xpvf $DATA_CNF/usr_etc.tar.gz --directory=$CHROOT/usr/etc + else + echo "1.1. Copying configuration data;\n" + cp -r $DATA_CNF/skel $CHROOT/etc/ + cp ${PORT_PKG}/handbook.txt $CHROOT/root/ + cp /etc/resolv.conf $CHROOT/etc + cp $DATA_CNF/fstab $CHROOT/etc/ + cp $DATA_CNF/prt-get.conf $CHROOT/etc/ + cp $DATA_CNF/sudoers $CHROOT/etc/ + cp $DATA_CNF/rc.d/* $CHROOT/etc/rc.d/ + cp $DATA_CNF/rc.conf $CHROOT/etc/ + cp $DATA_CNF/pkgmk.conf $CHROOT/etc/ + cp $DATA_CNF/hosts $CHROOT/etc/ + + fi + echo "1.1.7. dns resolver, copy resolv.conf;\n" - cp /etc/resolv.conf $CHROOT/etc + vim /etc/resolv.conf echo "1.1.8. Install Handbook\n" - cp $CHROOT/media/crux/handbook.txt $CHROOT/root/ echo "1.1.9. Install Skeletons\n" - cp -r $DIR_CONF/skel $CHROOT/etc/ echo "1.2.1. Set hostname and hosts;" - cp $DIR_CONF/hosts $CHROOT/etc/ vim $CHROOT/etc/hosts echo "1.2.2. Set timezone;" @@ -103,16 +171,12 @@ setup_core() { chroot $CHROOT /bin/bash -c "usermod -a -G wheel $ADMIN_USER" echo "1.2.4.3. Uncomment to allow members of group wheel to execute any command\n # %wheel ALL=(ALL) ALL" - cp $DIR_CONF/sudoers $CHROOT/etc/ echo "1.2.5. File system table;" - cp $DIR_CONF/fstab $CHROOT/etc/ chroot $CHROOT /bin/bash -c "mount >> /etc/fstab" vim $CHROOT/etc/fstab echo "1.2.6. Initialization Scripts;" - cp $DIR_CONF/rc.d/* $CHROOT/etc/rc.d/ - cp $DIR_CONF/rc.conf $CHROOT/etc/ vim $CHROOT/etc/rc.conf echo "1.3.1. Build as unprivileged user;" @@ -130,7 +194,7 @@ setup_core() { chroot $CHROOT /usr/bin/env -i \ HOME=/root TERM="$TERM" PS1='\u:\w\$ ' \ PATH=/bin:/usr/bin:/sbin:/usr/sbin \ - /bin/bash -c "chown -R root:pkgmk /usr/ports" + /bin/bash -c "chown -R pkgmk:pkgmk /usr/ports" chroot $CHROOT /usr/bin/env -i \ HOME=/root TERM="$TERM" PS1='\u:\w\$ ' \ @@ -158,20 +222,15 @@ setup_core() { vim $CHROOT/etc/fstab echo "1.3.3 Configure pkgmk;" - cp $DIR_CONF/pkgmk.conf $CHROOT/etc/ #vim $CHROOT/etc/pkgmk.conf echo "1.3.4 Configure prt-get;" mv $CHROOT/etc/ports/contrib.rsync.inactive $CHROOT/etc/ports/contrib.rsync - cp $DIR_CONF/prt-get.conf $CHROOT/etc/ #vim $CHROOT/etc/prt-get.conf } -install_packages() { - echo "1.1.5. Install extra packages;" - cp $CHROOT/media/crux/opt/* $CHROOT/usr/ports/packages - cp $CHROOT/media/crux/xorg/* $CHROOT/usr/ports/packages +install_packages() { echo "Installing $CHROOT/usr/ports/packages/fakeroot" $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/fakeroot#* @@ -212,27 +271,28 @@ install_packages() { echo "Installing $CHROOT/usr/ports/packages/dosfstools" $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/dosfstools#* - echo "1.1.6. Install extra ports;\n" +} - mkdir $CHROOT/usr/ports/c9-ports - cp -r $DIR_PRT/* $CHROOT/usr/ports/c9-ports/ -} -echo "SCRIPT=$SCRIPT"; +DATA_CNF="${DATA_DIR}/conf" +PORT_PRT="${DATA_DIR}/ports"; + +#echo "SCRIPT=$SCRIPT"; echo "SCRIPTPATH=$SCRIPTPATH"; -echo "ADMIN_USER="$ADMIN_USER"\n" +echo "ADMIN_USER=${ADMIN_USER}" echo "CHROOT=$CHROOT"; -echo "DIR=$DIR"; -echo "DIR_CONF=$DIR_CONF"; -echo "DIR_PRT=$DIR_PRT"; -echo "ISO_FILE=$ISO_FILE"; +echo "DATA_DIR=$DATA_DIR"; +echo "DATA_CNF=$DATA_CNF"; +echo "PORT_PKG=${PORT_PKG}"; +echo "PORT_PRT=${PORT_PRT}"; + ConfirmOrExit -echo "press enter to continue" -read + install_core -#setup_core -#install_packages +install_ports +setup_core +install_packages echo "Ready to chroot $CHROOT /bin/bash \n" diff --git a/core/scripts/setup-virtual.sh b/core/scripts/setup-virtual.sh new file mode 100644 index 0000000..2b27a9f --- /dev/null +++ b/core/scripts/setup-virtual.sh @@ -0,0 +1,76 @@ +#!/bin/sh + +# First we define the function +ConfirmOrExit () +{ + while true + do + echo -n "Please confirm (y or n) :" + read CONFIRM + case $CONFIRM in + y|Y|YES|yes|Yes) break ;; + n|N|no|NO|No) + echo "Aborting - you entered $CONFIRM" + exit + ;; + *) echo "Please enter only y or n" + esac + done + echo "You entered $CONFIRM. Continuing ..." +} + +DEV_NAME=${1} +CHROOT="/mnt" +DEV="/dev/${DEV_NAME}" + +echo "DEV_NAME=${DEV_NAME}" +echo "DEV=${DEV}" +echo "CHROOT=${CHROOT}" + +ConfirmOrExit + +parted --script ${DEV} \ + mklabel gpt \ + unit mib \ + mkpart primary 1 3 \ + set 1 bios_grub on \ + name 1 grub \ + mkpart ESP fat32 3 59 \ + set 2 boot on \ + name 2 efi \ + mkpart primary ext4 103 200 \ + name 3 boot \ + mkpart primary linux-swap 200 456 \ + name 4 swap \ + mkpart primary ext4 456 3700 \ + name 5 root \ + mkpart primary ext4 3700 4000 \ + name 6 var \ + mkpart primary ext4 4000 100% \ + name 7 home + +kpartx -a -s -l -u ${DEV} + +mkfs.fat -F 32 /dev/mapper/${DEV_NAME}p2 +mkfs.ext4 /dev/mapper/${DEV_NAME}p3 +mkswap /dev/mapper/${DEV_NAME}p4 +mkfs.ext4 /dev/mapper/${DEV_NAME}p5 +mkfs.ext4 /dev/mapper/${DEV_NAME}p6 +mkfs.ext4 /dev/mapper/${DEV_NAME}p7 + +mount /dev/mapper/${DEV_NAME}p5 $CHROOT +mkdir -p $CHROOT/proc +mkdir -p $CHROOT/sys +mkdir -p $CHROOT/dev +mkdir -p $CHROOT/media + +mkdir -p $CHROOT/boot +mount /dev/mapper/${DEV_NAME}p3 $CHROOT/boot +mkdir -p $CHROOT/boot/efi +mount /dev/mapper/${DEV_NAME}p2 $CHROOT/boot/efi +mkdir -p $CHROOT/var +mount /dev/mapper/${DEV_NAME}p6 $CHROOT/var +mkdir -p $CHROOT/home +mount /dev/mapper/${DEV_NAME}p7 $CHROOT/home + + diff --git a/tools/qemu.html b/tools/qemu.html index fc0f15c..f79b955 100644 --- a/tools/qemu.html +++ b/tools/qemu.html @@ -43,7 +43,7 @@ this describes how to create a qcow2 type;

-        $ qemu-img create -f qcow2 crux-img.qcow2 20G
+        $ qemu-img create -f qcow2 crux-img.qcow2 2000M

Qemu disk images can be treated as regular disks using @@ -61,13 +61,25 @@ to use parted to create a gpt system table;

-        # parted --script $DEV \
-            mklabel gpt \
-            mkpart ESP fat32 1MiB 120MiB \
-            mkpart primary ext4 120MiB 720MiB \
-            mkpart primary ext4 720MiB 2720MiB \
-            mkpart primary ext4 2720MiB 5000MiB \
-            set 1 boot on
+        parted --script ${DEV} \
+                mklabel gpt \
+                unit mib \
+                mkpart primary 1 3 \
+                set 1 bios_grub on \
+                name 1 grub \
+                mkpart ESP fat32 3 59 \
+                set 2 boot on \
+                name 2 efi \
+                mkpart primary ext4 103 200 \
+                name 3 boot \
+                mkpart primary linux-swap 200 456 \
+                name 4 swap \
+                mkpart primary ext4 456 3700 \
+                name 5 root \
+                mkpart primary ext4 3700 4000 \
+                name 6 var \
+                mkpart primary ext4 4000 100% \
+                name 7 home

@@ -77,22 +89,30 @@
         Use /dev/mapper/$(name_of_device) to assign correct blocks;
 
         -        # mkfs.fat -F 32 $BLK_EFI
-        # mkfs.ext4 $BLK_BOOT
-        # mkfs.ext4 $BLK_ROOT
-        # mkfs.ext4 $BLK_VAR
+        mkfs.fat -F 32  /dev/mapper/${DEV_NAME}p2
+        mkfs.ext4       /dev/mapper/${DEV_NAME}p3
+        mkswap          /dev/mapper/${DEV_NAME}p4
+        mkfs.ext4       /dev/mapper/${DEV_NAME}p5
+        mkfs.ext4       /dev/mapper/${DEV_NAME}p6
+        mkfs.ext4       /dev/mapper/${DEV_NAME}p7
         
 
         Mount partition;
 
         -        # mount $BLK_ROOT $CHROOT
-        # mkdir -p $CHROOT/boot
-        # mount $BLK_BOOT $CHROOT/boot
-        # mkdir -p $CHROOT/boot/efi
-        # mount $BLK_EFI $CHROOT/boot/efi
-        # mkdir -p $CHROOT/var
-        # mount $BLK_VAR $CHROOT/var
+        mount /dev/mapper/${DEV_NAME}p5 $CHROOT
+        mkdir -p $CHROOT/proc
+        mkdir -p $CHROOT/sys
+        mkdir -p $CHROOT/dev
+
+        mkdir -p $CHROOT/boot
+        mount /dev/mapper/${DEV_NAME}p3 $CHROOT/boot
+        mkdir -p $CHROOT/boot/efi
+        mount /dev/mapper/${DEV_NAME}p2 $CHROOT/boot/efi
+        mkdir -p $CHROOT/var
+        mount /dev/mapper/${DEV_NAME}p6 $CHROOT/var
+        mkdir -p $CHROOT/home
+        mount /dev/mapper/${DEV_NAME}p7 $CHROOT/home
         
 
         Before disconnecting image, clean dev mappings;
@@ -200,41 +220,40 @@
 
         runvm/profile/crux
         -        iso=iso/crux-3.2.iso
-        image=img/crux-img.qcow2
+        mac=$(rmac_addr)
+        memory=1024
+        boot=d
         tap="tap1"
+        iso=iso/crux-3.3.iso
+        image=img/crux-standard.qcow2
+        other="-vga std -display sdl"
         
 
         runvm/runvm.sh
-        -        #!/bin/bash
 
+                 function rmac_addr (){
         printf '54:60:BE:EF:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256))
         }
 
         source profile/$1
-        boot=$2
-
-        mac=$(rmac_addr)
 
         qemu-system-x86_64 \
             -enable-kvm \
-            -m 1024 \
+            -m ${memory} \
             -boot ${boot} \
             -cdrom ${iso} \
             -hda ${image} \
-            -vga std \
-            -display sdl \
             -device e1000,netdev=t0,mac=${mac} \
             -netdev tap,id=t0,ifname=${tap},script=no,downscript=no \
-            &
+            ${other} \
+            &
         
 
         Set guests machines to run under the total resolution provided
         by  host system configure grub on the guest with gfxmode;
 
-        Guest Graphics
+        Guest Graphics
 
         Get current resolution on host machine;
 
@@ -270,53 +289,36 @@
 
                  export QEMU_AUDIO_DRV=alsa
-        #export QEMU_AUDIO_DRV=sdl
-
-
-        #boot=$1
+        memory=1024
         boot=c
-
-        iso=iso/crux-3.2.iso
-        #iso=$2
-
-        #image=$3
-        image=img/crux-img.qcow2
-
-        #tap=$4
-        tap="tap1"
-
-        #mac=$(rmac_addr)
+        iso=iso/devuan_jessie_1.0.0_amd64_CD.iso
+        image=img/c12-dvd.qcow2
+        tap="tap2"
         mac="54:60:be:ef:5c:72"
-
-        other="-soundhw hda"
+        other="-soundhw hda -vga std -display sdl"
         
 
-        runvm/runvm.sh
+        Guest USB
 
         -        function rmac_addr (){
-        printf '54:60:BE:EF:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256))
-        }
-
-        source profile/$1
-        boot=$2
-
-        #mac=$(rmac_addr)
+        # lsusb
+        # ls /dev/v4l
+        
 
-        qemu-system-x86_64 \
-            -enable-kvm \
-            -m 1024 \
-            -boot ${boot} \
-            -cdrom ${iso} \
-            -hda ${image} \
-            -vga std \
-            -display sdl \
-            -device e1000,netdev=t0,mac=${mac} \
-            -netdev tap,id=t0,ifname=${tap},script=no,downscript=no \
-            ${other} \
-            &>
+        +        # chown root:kvm /dev/bus/usb/003/004
         
 
+        +        export QEMU_AUDIO_DRV=alsa
+        memory=1024
+        boot=c
+        iso=iso/devuan_jessie_1.0.0_amd64_CD.iso
+        image=img/c12-dvd.qcow2
+        tap="tap2"
+        mac="54:60:be:ef:5c:72"
+        other="-soundhw hda -vga std -display sdl -usb -device usb-host,vendorid=0x13d3,productid=0x5652"
+        
         Tools Index
         This is part of the c9 Manual.
         Copyright (C) 2016
diff --git a/tools/scripts/runvm/c12-dvd b/tools/scripts/runvm/c12-dvd
new file mode 100644
index 0000000..9cbf201
--- /dev/null
+++ b/tools/scripts/runvm/c12-dvd
@@ -0,0 +1,15 @@
+export QEMU_AUDIO_DRV=alsa
+
+memory=1024
+
+boot=c
+
+iso=iso/devuan_jessie_1.0.0_amd64_CD.iso
+
+image=img/c12-dvd.qcow2
+
+tap="tap2"
+
+mac="54:60:be:ef:5c:72"
+
+other="-soundhw hda -vga std -display sdl -usb -device usb-ehci  -device usb-host,vendorid=0x13d3,productid=0x5652"
diff --git a/tools/scripts/runvm/profile/crux b/tools/scripts/runvm/profile/crux
index eb2dc63..af33e1b 100644
--- a/tools/scripts/runvm/profile/crux
+++ b/tools/scripts/runvm/profile/crux
@@ -1,3 +1,7 @@
-iso=iso/crux-3.2.iso
-image=img/crux-img.qcow2
-tap="tap1"
+mac="54:60:be:ef:5c:64"
+memory=1024
+boot=$2
+tap="tap4"
+iso=iso/crux-3.3.iso
+image=img/c14.qcow2
+other="-vga std -display sdl"
diff --git a/tools/scripts/runvm/runvm.sh b/tools/scripts/runvm/runvm.sh
index db479cc..1e56a52 100644
--- a/tools/scripts/runvm/runvm.sh
+++ b/tools/scripts/runvm/runvm.sh
@@ -5,18 +5,22 @@ printf '54:60:BE:EF:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256))
 }
 
 source profile/$1
-boot=$2
 
-mac=$(rmac_addr)
+#mac=$(rmac_addr)
+#memory=1024
+#boot=d
+#tap="tap1"
+#iso=iso/crux-3.3.iso
+#image=img/crux-standard.qcow2
+#other="-soundhw hda -vga std -display sdl"
 
 qemu-system-x86_64 \
     -enable-kvm \
-    -m 1024 \
+    -m ${memory} \
     -boot ${boot} \
     -cdrom ${iso} \
     -hda ${image} \
-    -vga std \
-    -display sdl \
     -device e1000,netdev=t0,mac=${mac} \
     -netdev tap,id=t0,ifname=${tap},script=no,downscript=no \
+    ${other} \
     &
-- 
cgit 1.4.1-2-gfad0


From ceba9ba0fafc4c1d71a64f3808b5c00a9803b16a Mon Sep 17 00:00:00 2001
From: Silvino Silva 
Date: Fri, 11 Aug 2017 14:41:49 +0100
Subject: fix setup-install fstab

---
 core/scripts/setup-install.sh | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/core/scripts/setup-install.sh b/core/scripts/setup-install.sh
index ef1cb10..aca0115 100755
--- a/core/scripts/setup-install.sh
+++ b/core/scripts/setup-install.sh
@@ -173,7 +173,14 @@ setup_core() {
     #    %wheel ALL=(ALL) ALL"
 
     echo "1.2.5. File system table;"
+
     chroot $CHROOT /bin/bash -c "mount >> /etc/fstab"
+
+    chroot $CHROOT /usr/bin/env -i \
+        HOME=/root TERM="$TERM" PS1='\u:\w\$ ' \
+        PATH=/bin:/usr/bin:/sbin:/usr/sbin \
+        /bin/bash -c "pkgmk   /usr/ports/work tmpfs size=30G,gid=$(id -g pkgmk),uid=$(id pkgmk),defaults,mode=0750 0    0 >> /etc/fstab"
+
     vim $CHROOT/etc/fstab
 
     echo "1.2.6. Initialization Scripts;"
@@ -212,15 +219,6 @@ setup_core() {
     chroot --userspec=pkgmk:pkgmk $CHROOT /bin/bash -c "mkdir /usr/ports/pkgbuild"
     chroot --userspec=pkgmk:pkgmk $CHROOT /bin/bash -c "mkdir /usr/ports/distfiles"
 
-    chroot $CHROOT /usr/bin/env -i \
-        HOME=/root TERM="$TERM" PS1='\u:\w\$ ' \
-        PATH=/bin:/usr/bin:/sbin:/usr/sbin \
-        /bin/bash -c "id pkgmk >> /etc/fstab"
-
-    echo "pkgmk                                           /usr/ports/work tmpfs size=30G,gid=102,uid=101,defaults,mode=0750 0    0" >> $CHROOT/etc/fstab
-
-    vim $CHROOT/etc/fstab
-
     echo "1.3.3 Configure pkgmk;"
     #vim $CHROOT/etc/pkgmk.conf
 
-- 
cgit 1.4.1-2-gfad0


From 897b46ed92e47f9f18ed81ff253f698513b3641c Mon Sep 17 00:00:00 2001
From: Silvino Silva 
Date: Wed, 23 Aug 2017 01:46:26 +0100
Subject: core ports revision, simple configuration

---
 core/ports.html | 54 +++++++++++++++++++-----------------------------------
 1 file changed, 19 insertions(+), 35 deletions(-)

diff --git a/core/ports.html b/core/ports.html
index 6a5e4a8..2d1a17d 100644
--- a/core/ports.html
+++ b/core/ports.html
@@ -73,45 +73,18 @@
         native flag will not run on different hardware. This is the best choice
         if you want gcc to find the best settings based on your hardware.
 
-        Edit /etc/pkgmk.conf and remove pipe from compiler
-        flags;
-
-        -        export CFLAGS="-O2 -march=x86-64"
-        
-
-        If you want native build change the above example to;
-
-        -        export CFLAGS="-O2 -march=native -mtune=native"
-        
-
-        Discover number of cores/cpus to hard code -j option.
-
-        -        $ nproc
-        2
-        
-
-        Set number of cores to use;
-
-        -        export MAKEFLAGS="-j2"
-        
-
-        Example of complete pkgmk.conf for x86_64 with 4 cores, separate
-        distribution files, packages and work directories, uses crux mirror
-        to get the sources.
+        Edit /etc/pkgmk.conf, remove pipe from compiler flags and let the system
+        get from nproc how many cpu's it can use for compiling;
 
                  #
         # /etc/pkgmk.conf: pkgmk(8) configuration
         #
 
-        export CFLAGS="-O2 -march=native -mtune=native"
+        export CFLAGS="-O2 -march=x86-64"
         export CXXFLAGS="${CFLAGS}"
 
-        export MAKEFLAGS="-j4"
+        # export MAKEFLAGS="-j$(nproc)"
 
         case ${PKGMK_ARCH} in
                 "64"|"")
@@ -128,11 +101,13 @@
                         ;;
         esac
 
-        #PKGMK_SOURCE_MIRRORS=(http://crux.nu/distfiles/)
-        PKGMK_SOURCE_DIR="/usr/ports/distfiles"
-        PKGMK_PACKAGE_DIR="/usr/ports/packages"
-        PKGMK_WORK_DIR="/usr/ports/work/$name"
+        # PKGMK_SOURCE_MIRRORS=()
+        # PKGMK_SOURCE_DIR="$PWD"
+        # PKGMK_PACKAGE_DIR="$PWD"
+        # PKGMK_WORK_DIR="$PWD/work"
         # PKGMK_DOWNLOAD="no"
+        # PKGMK_IGNORE_SIGNATURE="no"
+        # PKGMK_IGNORE_MD5SUM="no"
         # PKGMK_IGNORE_FOOTPRINT="no"
         # PKGMK_IGNORE_NEW="no"
         # PKGMK_NO_STRIP="no"
@@ -144,6 +119,15 @@
         # End of file
         
 
+        If you want native build change the above example to;
+
+        +        export CFLAGS="-O2 -march=native -mtune=native"
+        
+
+        Check toolchain for more options on how packages
+        are build.
+
         1.3.4. Configure prt-get
 
         Edit /etc/prt-get.conf;
-- 
cgit 1.4.1-2-gfad0


From bc162e537fe06c4d79bbc9531f24e56819759a73 Mon Sep 17 00:00:00 2001
From: Silvino Silva 
Date: Wed, 23 Aug 2017 01:46:51 +0100
Subject: tools syslogng added link to tools index

---
 tools/syslog-ng.html | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/syslog-ng.html b/tools/syslog-ng.html
index 5d6fd2d..d6cd174 100644
--- a/tools/syslog-ng.html
+++ b/tools/syslog-ng.html
@@ -5,6 +5,9 @@
         1. Syslog-ng
     
     
+
+        Tools Index
+
         1. Syslog-ng
 
         Syslog-ng offers more than sysklogd, for example, we
@@ -251,6 +254,8 @@
         $ sudo sh /etc/rc.d/sysklogd stop
         
 
+        Tools Index
+
         This is part of the c9-doc Manual.
 Copyright (C) 2016
 c9 team.
-- 
cgit 1.4.1-2-gfad0


From 46329d66252eb37e731f670705f6085db74a93f7 Mon Sep 17 00:00:00 2001
From: Silvino Silva 
Date: Sun, 27 Aug 2017 23:00:21 +0100
Subject: added syslog-ng configuration, fix link to configuration

---
 tools/conf/etc/syslog-ng.conf | 181 ++++++++++++++++++++++++++++++++++++++++++
 tools/syslog-ng.html          |   2 +-
 2 files changed, 182 insertions(+), 1 deletion(-)
 create mode 100644 tools/conf/etc/syslog-ng.conf

diff --git a/tools/conf/etc/syslog-ng.conf b/tools/conf/etc/syslog-ng.conf
new file mode 100644
index 0000000..5b5fc75
--- /dev/null
+++ b/tools/conf/etc/syslog-ng.conf
@@ -0,0 +1,181 @@
+#############################################################################
+# Simple syslog-ng.conf for crux.nu,
+#
+# Silvino Silva < silvino at bk dot ru >
+# Created: 1/12/2014
+#
+# Reference:
+# 	http://www.campin.net/syslog-ng/expanded-syslog-ng.con
+#
+# Notes:
+#	* f_error and f_console are not used
+# --------------------------------------------------------------------------
+@version: 3.5
+@include "scl.conf"
+
+options {
+	flush_lines(0);
+	time_reopen(10);
+	chain_hostnames(off);
+	create_dirs(no);
+	stats_freq(1200);
+	use_dns(no);
+	use_fqdn(no);
+	perm(0600);
+	log_fifo_size(2048);
+	log_msg_size(1024);
+	keep_hostname(yes);
+};
+
+#############################################
+# sources
+#
+source s_log { unix-dgram("/dev/log"); };
+source s_internal { internal(); };
+source s_kernel { file("/proc/kmsg" program_override("kernel")); };
+
+template t_debug { template("$DATE fac $FACILITY lvl $LEVEL prg $PROGRAM: $MSG\n"); };
+
+#############################################
+# common destinations
+#
+
+destination d_auth 	{ file("/var/log/auth"); };
+destination d_cron 	{ file("/var/log/cron"); };
+destination d_daemon	{ file("/var/log/daemon"); };
+destination d_kernel 	{ file("/var/log/kernel"); };
+destination d_lpr	{ file("/var/log/lpr"); };
+destination d_mail 	{ file("/var/log/mail"); };
+destination d_user	{ file("/var/log/user"); };
+destination d_syslog    { file("/val/log/syslog"); };
+
+destination d_debug 	{ file("/var/log/debug" template(t_debug)); };
+destination d_error	{ file("/var/log/error"); };
+destination d_messages	{ file("/var/log/messages"); };
+
+destination d_console	        { usertty("root"); };
+destination d_console_all	{ usertty("root"); };
+
+#############################################
+# custom destinations
+#
+
+destination d_shorewall_warn { file ("/var/log/shorewall/warn.log"); };
+destination d_shorewall_info { file ("/var/log/shorewall/info.log"); };
+destination d_dnsmasq	{ file("/var/log/dnsmasq"); };
+destination d_postgres  { file("/var/log/pgsql"); };
+destination d_sshd      { file("/var/log/sshd"); };
+destination d_gitolite  { file("/var/log/gitolite"); };
+destination d_nginx_access { file("/var/log/nginx/access.log" owner(root) group(www) perm(0644));  };
+destination d_nginx_error  { file("/var/log/nginx/error.log"); };
+
+#############################################
+# common filters
+#
+
+filter f_info 		{ level(info); };
+filter f_notice 	{ level(notice); };
+filter f_warn 		{ level(warn); };
+filter f_err 		{ level(err); };
+filter f_crit 		{ level(crit .. emerg); };
+
+filter f_emerg		{ level(emerg); };
+filter f_alert		{ level(alert); };
+
+filter f_debug 		{
+	level(debug)
+	and not facility(auth, authpriv, mail, news)
+};
+
+filter f_error   	{ level(err..emerg); };
+filter f_auth 		{ facility(auth, authpriv); };
+filter f_cron 		{ facility(cron); };
+filter f_daemon	        { facility(daemon); };
+filter f_kernel 	{ facility(kern); };
+filter f_lpr		{ facility(lpr); };
+
+filter f_local          { facility(
+    local0,
+    local1,
+    local2,
+    local3,
+    local4,
+    local5,
+    local6,
+    local7
+    );
+};
+
+filter f_mail 		{ facility(mail); };
+filter f_syslog 	{ facility(syslog); };
+filter f_user		{ facility(user); };
+filter f_console        { level(warn .. emerg); };
+
+#############################################
+# custom filters
+#
+
+filter f_messages 	{
+    level(info..warn)
+    and not facility(auth, authpriv, mail, cron)
+};
+
+filter f_dnsmasq { program("dnsmasq"); };
+filter f_postgres { facility(local0); };
+filter f_sshd { facility(local1); };
+
+filter f_shorewall_warn {
+        level (warn)
+        and match ("iptables" value("MESSAGE"));
+};
+
+filter f_shorewall_info {
+        level (info)
+        and match ("iptables" value("MESSAGE"));
+};
+
+filter f_gitolite { program("gitolite"); };
+
+filter f_nginx_access {
+        match("nginx_access:" value("MESSAGE"));
+};
+
+filter f_nginx_error {
+	match("nginx_error:" value("MESSAGE"));
+};
+
+
+log { source (s_kernel); filter (f_shorewall_warn); destination (d_shorewall_warn); flags(final);};
+log { source (s_kernel); filter (f_shorewall_info); destination (d_shorewall_info); flags(final);};
+log { source(s_log); filter(f_dnsmasq); destination(d_dnsmasq); flags(final); };
+log { source(s_log); filter(f_postgres); destination(d_postgres); flags(final); };
+log { source(s_log); filter(f_sshd); destination(d_sshd); flags(final); };
+log { source(s_log); filter(f_gitolite); destination(d_gitolite); flags(final); };
+log { source(s_log); filter(f_nginx_error); destination(d_nginx_error); flags(final); };
+log { source(s_log); filter(f_local); filter(f_nginx_access); destination(d_nginx_access); flags(final); };
+
+#############################################
+# connect filter and destination
+#
+
+log { source(s_log); filter(f_auth); destination(d_auth); };
+log { source(s_log); filter(f_cron); destination(d_cron); };
+log { source(s_log); filter(f_daemon); destination(d_daemon); };
+log { source(s_kernel); filter(f_kernel); destination(d_kernel); };
+log { source(s_log); filter(f_lpr); destination(d_lpr); };
+log { source(s_log); source(s_internal); filter(f_syslog); destination(d_syslog); };
+log { source(s_log); filter(f_user); destination(d_user); };
+
+log { source(s_log); filter(f_mail); destination(d_mail); };
+log { source(s_log); filter(f_mail); filter(f_info); destination(d_mail); };
+log { source(s_log); filter(f_mail); filter(f_info); destination(d_mail); };
+log { source(s_log); filter(f_mail); filter(f_info); destination(d_mail); };
+
+log { source(s_log); filter(f_debug); destination(d_debug); };
+log { source(s_log); filter(f_error); destination(d_error); };
+
+#log { source(s_log); filter(f_console); destination(d_console_all); };
+log { source(s_log); filter(f_crit);    destination(d_console); };
+
+#default log
+log { source(s_log); filter(f_messages); destination(d_messages); };
diff --git a/tools/syslog-ng.html b/tools/syslog-ng.html
index d6cd174..e97b50d 100644
--- a/tools/syslog-ng.html
+++ b/tools/syslog-ng.html
@@ -160,7 +160,7 @@
 
         
1.4. Syslog-ng configuration
 
-        Example of /etc/syslog-ng.conf
+        
Example of /etc/syslog-ng.conf
         that configures syslog-ng matching tools already installed in the system
         and some that are part of tools.
 
-- 
cgit 1.4.1-2-gfad0


From 0201cd199cbf5c60182881f4cdb4a6a9bf3e9b8c Mon Sep 17 00:00:00 2001
From: Silvino Silva 
Date: Sun, 3 Sep 2017 11:09:44 +0100
Subject: added logrotate configuration

---
 tools/conf/etc/logrotate.conf         | 133 ++++++++++++++++++++++++++++++++++
 tools/conf/etc/logrotate.d/dnsmasq    |  11 +++
 tools/conf/etc/logrotate.d/fail2ban   |   5 ++
 tools/conf/etc/logrotate.d/gitolite   |  12 +++
 tools/conf/etc/logrotate.d/lynis      |  10 +++
 tools/conf/etc/logrotate.d/nginx      |  23 ++++++
 tools/conf/etc/logrotate.d/ntp        |   5 ++
 tools/conf/etc/logrotate.d/php-fpm    |   5 ++
 tools/conf/etc/logrotate.d/postgres   |  17 +++++
 tools/conf/etc/logrotate.d/samhain    |  24 ++++++
 tools/conf/etc/logrotate.d/shorewall  |  11 +++
 tools/conf/etc/logrotate.d/shorewall6 |   5 ++
 12 files changed, 261 insertions(+)
 create mode 100644 tools/conf/etc/logrotate.conf
 create mode 100644 tools/conf/etc/logrotate.d/dnsmasq
 create mode 100644 tools/conf/etc/logrotate.d/fail2ban
 create mode 100644 tools/conf/etc/logrotate.d/gitolite
 create mode 100644 tools/conf/etc/logrotate.d/lynis
 create mode 100644 tools/conf/etc/logrotate.d/nginx
 create mode 100644 tools/conf/etc/logrotate.d/ntp
 create mode 100644 tools/conf/etc/logrotate.d/php-fpm
 create mode 100644 tools/conf/etc/logrotate.d/postgres
 create mode 100644 tools/conf/etc/logrotate.d/samhain
 create mode 100644 tools/conf/etc/logrotate.d/shorewall
 create mode 100644 tools/conf/etc/logrotate.d/shorewall6

diff --git a/tools/conf/etc/logrotate.conf b/tools/conf/etc/logrotate.conf
new file mode 100644
index 0000000..896b779
--- /dev/null
+++ b/tools/conf/etc/logrotate.conf
@@ -0,0 +1,133 @@
+# see "man logrotate" for details
+# rotate log files weekly
+weekly
+
+# keep 4 weeks worth of backlogs
+rotate 4
+
+# create new (empty) log files after rotating old ones
+create
+
+# uncomment this if you want your log files compressed
+compress
+
+olddir /var/log/old
+
+notifempty
+
+maxsize 5M
+
+# some packages can drop log rotation information into 
+# this directory
+include /etc/logrotate.d
+
+# few generic files to rotate
+/var/log/wtmp {
+    create 0644 root root
+    rotate 5
+}
+
+/var/log/btmp {
+    create 0600 root root
+    rotate 5
+}
+
+# system-specific logs may be also be configured here.
+/var/log/faillog {
+    maxsize 5M
+}
+
+/var/log/lastlog {
+    maxsize 5M
+}
+
+/var/log/auth {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/cron {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/debug {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/kernel {
+    rotate 5
+    create 0644 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/daemon {
+    compress
+    rotate 5
+    create 644 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+
+}
+
+/var/log/messages {
+    rotate 5
+    create 0644 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/mail {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/user {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
diff --git a/tools/conf/etc/logrotate.d/dnsmasq b/tools/conf/etc/logrotate.d/dnsmasq
new file mode 100644
index 0000000..3151ddc
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/dnsmasq
@@ -0,0 +1,11 @@
+/var/log/dnsmasq {
+    weekly
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
diff --git a/tools/conf/etc/logrotate.d/fail2ban b/tools/conf/etc/logrotate.d/fail2ban
new file mode 100644
index 0000000..c2dc4cd
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/fail2ban
@@ -0,0 +1,5 @@
+/var/log/fail2ban.log {
+    weekly
+    create 0644 root root
+    rotate 5
+ }
diff --git a/tools/conf/etc/logrotate.d/gitolite b/tools/conf/etc/logrotate.d/gitolite
new file mode 100644
index 0000000..547d6b6
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/gitolite
@@ -0,0 +1,12 @@
+/var/log/gitolite {
+    rotate 5
+    monthly
+    create 0644 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+
+}
diff --git a/tools/conf/etc/logrotate.d/lynis b/tools/conf/etc/logrotate.d/lynis
new file mode 100644
index 0000000..8cf9181
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/lynis
@@ -0,0 +1,10 @@
+/var/log/lynis.log {
+    rotate 5
+    monthly
+    create 0644 root root
+}
+/var/log/lynis-report.dat {
+    rotate 5
+    monthly
+    create 0644 root root
+}
diff --git a/tools/conf/etc/logrotate.d/nginx b/tools/conf/etc/logrotate.d/nginx
new file mode 100644
index 0000000..ae05445
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/nginx
@@ -0,0 +1,23 @@
+/var/log/nginx/access.log {
+    weekly
+    create 0664 root www
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/nginx/error.log {
+    weekly
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
diff --git a/tools/conf/etc/logrotate.d/ntp b/tools/conf/etc/logrotate.d/ntp
new file mode 100644
index 0000000..c46b590
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/ntp
@@ -0,0 +1,5 @@
+/var/log/ntp.log {
+    weekly
+    create 0644 root root
+    rotate 5
+}
diff --git a/tools/conf/etc/logrotate.d/php-fpm b/tools/conf/etc/logrotate.d/php-fpm
new file mode 100644
index 0000000..c778658
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/php-fpm
@@ -0,0 +1,5 @@
+/var/log/php-fpm.log {
+    rotate 5
+    monthly
+    create 0644 root root
+}
diff --git a/tools/conf/etc/logrotate.d/postgres b/tools/conf/etc/logrotate.d/postgres
new file mode 100644
index 0000000..fc59aad
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/postgres
@@ -0,0 +1,17 @@
+/var/log/pgsql {
+    weekly
+    compress
+    delaycompress
+    rotate 10
+    notifempty
+    create 660 postgres postgres
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+
+}
+
+
diff --git a/tools/conf/etc/logrotate.d/samhain b/tools/conf/etc/logrotate.d/samhain
new file mode 100644
index 0000000..d60f810
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/samhain
@@ -0,0 +1,24 @@
+/var/log/samhain.log {
+    weekly
+    rotate 52
+    nocreate
+    missingok
+    compress
+
+    prerotate
+        if test -f /var/run/samhain.pid; then \
+          PIN=`cat /var/run/samhain.pid`; \
+          /bin/kill -TTIN $PIN; \
+          sleep 1; \
+          AA=0; \
+          while test "x$AA" != "x120"; do \
+           AA=$(( AA + 1 )); \
+           if test -f /var/log/samhain.log.lock; then \
+             sleep 1; \
+           else \
+             break; \
+           fi \
+          done; \
+        fi
+    endscript
+}
diff --git a/tools/conf/etc/logrotate.d/shorewall b/tools/conf/etc/logrotate.d/shorewall
new file mode 100644
index 0000000..a7dffdf
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/shorewall
@@ -0,0 +1,11 @@
+/var/log/shorewall-init.log {
+  missingok
+  notifempty
+  create 0600 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
diff --git a/tools/conf/etc/logrotate.d/shorewall6 b/tools/conf/etc/logrotate.d/shorewall6
new file mode 100644
index 0000000..ee5e246
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/shorewall6
@@ -0,0 +1,5 @@
+/var/log/shorewall6-init.log {
+  missingok
+  notifempty
+  create 0600 root root
+}
-- 
cgit 1.4.1-2-gfad0


From 81b4e1d81ba678f0f6c61b25abd45661f8a3a52a Mon Sep 17 00:00:00 2001
From: Silvino Silva 
Date: Tue, 5 Sep 2017 03:03:41 +0100
Subject: fix tools gitolite cron deploy call

---
 tools/gitolite.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/gitolite.html b/tools/gitolite.html
index a275c23..1fa8e5a 100644
--- a/tools/gitolite.html
+++ b/tools/gitolite.html
@@ -514,9 +514,9 @@
         #
 
         # this way it will log
-        # * * * * * /usr/share/gitolite/deployweb
+        # * * * * * /srv/gitolite/deploy/deploy.sh
         # without log
-        * * * * * /usr/share/gitolite/deployweb > /dev/null 2>&1
+        * * * * * /srv/gitolite/deploy/deploy.sh > /dev/null 2>&1
 
         @hourly   ID=sys.hourly   /usr/sbin/runjobs /etc/cron/hourly
         @daily    ID=sys.daily    /usr/sbin/runjobs /etc/cron/daily
-- 
cgit 1.4.1-2-gfad0


From b03d9581807d1faa071dececc4dcb0ac2102fadf Mon Sep 17 00:00:00 2001
From: Silvino Silva 
Date: Fri, 15 Sep 2017 02:29:30 +0100
Subject: dev c language system dev revision

---
 dev/c/index.html  |  87 +-----------------------------
 dev/c/system.html | 159 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 dev/index.html    |   1 +
 3 files changed, 161 insertions(+), 86 deletions(-)
 create mode 100644 dev/c/system.html

diff --git a/dev/c/index.html b/dev/c/index.html
index 684c7d2..1c3b478 100644
--- a/dev/c/index.html
+++ b/dev/c/index.html
@@ -7,92 +7,6 @@
     
         Development Index
 
-        System Development
-
-        System development requires debug kernel know how,
-        in this example will be used qemu and gdb. A simple init
-        program is created. Create init.S;
-
-        -	.global _start
-	_start:
-	    mov $1, %rax
-	    mov $1, %rdi
-	    mov $message, %rsi
-	    mov $message_len, %rdx
-	    syscall
-	    jmp .
-	    message: .ascii "FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR\n"
-	    .equ message_len, . - message
-	
-
-	Assemble, link and create simple initial ram disk;
-
-	-	mkdir d
-	as --64 -o init.o init.S # assemble
-	ld -o d/init init.o      # link
-	cd d
-	find . | cpio -o -H newc | gzip > ../rootfs.cpio.gz
-	
-
-	Clean temporary directory;
-
-	-	cd ..
-	rm -r d/
-	
-
-	Can be used C to create init program;
-
-	-	#include <stdio.h>
-	#include <unistd.h>
-
-	int main() {
-	    printf("FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR\n");
-	    sleep(0xFFFFFFFF);
-	    return 0;
-	}
-	
-
-	-	$ gcc -static init.c -o init
-	
-
-	Test qemu, kernel and simple init program, you should see
-	"FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR";
-
-	-	$ qemu-system-x86_64 -enable-kvm --kernel arch/x86_64/boot/bzImage \
-    	--initrd rootfs.cpio.gz
-	
-
-	If everything goes well you can start qemu without start CPU at
-	startup (-S) and with gdb server on TCP port 1234 (-s).
-
-	-	$ qemu-system-x86_64 -enable-kvm --kernel arch/x86/boot/bzImage \
-                --initrd rootfs.cpio.gz \
-		-S -s
-	
-
-	On another terminal start gdb;
-
-	-	gdb \
-	    -ex "add-auto-load-safe-path $(pwd)" \
-	    -ex "file vmlinux" \
-	    -ex 'set arch i386:x86-64:intel' \
-	    -ex 'target remote localhost:1234' \
-	    -ex 'break start_kernel' \
-	    -ex 'continue' \
-	    -ex 'disconnect' \
-	    -ex 'set arch i386:x86-64' \
-	    -ex 'target remote localhost:1234'
-	
-
-	
         C & GDB
 
         C program with autotools
@@ -172,6 +86,7 @@
         
         strace -c ./program
         
+
         Development Index
         
         This is part of the c9-doc Manual.
diff --git a/dev/c/system.html b/dev/c/system.html
new file mode 100644
index 0000000..65eede1
--- /dev/null
+++ b/dev/c/system.html
@@ -0,0 +1,159 @@
+
+
+    
+        
+        System Development & GDB
+    
+    
+        Development Index
+
+        
System Development
+
+        System development requires knowing how to debug
+        kernel know how, in this example will be used Qemu
+        and GDB. Qemu creates the virtual machine that kernel
+        will run on and GDB will connect to it to help us
+        understand how things tick.
+
+        Kernel Build
+
+        +        $ tar xf linux-4.9.48.tar.xz
+        $ cd linux-4.9.48
+        
+
+        Default configuration disable some security
+        configurations that allow us to debug (random memory
+        layout).
+
+        +        $ make x86_64_defconfig
+        
+
+        Enable CONFIG_DEBUG_INFO, CONFIG_DEBUG_INFO_DWARF4
+        and CONFIG_GDB_SCRIPTS in the kernel;
+
+        +        make x86_64_defconfig
+        cat <<EOF >.config-fragment
+        CONFIG_DEBUG_INFO=y
+        CONFIG_DEBUG_KERNEL=y
+        CONFIG_GDB_SCRIPTS=y
+        EOF
+        ./scripts/kconfig/merge_config.sh .config .config-fragment
+        
+
+        Check or change to your needs the configuration;
+        +        $ make nconfig
+        
+
+        Build Kernel and modules;
+
+        +        $ make -j $(nproc)
+        
+
+        Simple Init
+
+        Now that you have the kernel compiled you can
+        create a simple init program, this program is called
+        when kernel finish to load and setup its internals
+        and is ready to launch first process.
+        Init program should not exit or kernel will panic.
+        Create init.S;
+
+        +        .global _start
+        _start:
+            mov $1, %rax
+            mov $1, %rdi
+            mov $message, %rsi
+            mov $message_len, %rdx
+            syscall
+            jmp .
+            message: .ascii "FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR\n"
+            .equ message_len, . - message
+        
+
+        Assemble, link and create simple initial ram disk;
+
+        +        mkdir d
+        as --64 -o init.o init.S # assemble
+        ld -o d/init init.o      # link
+        cd d
+        find . | cpio -o -H newc | gzip > ../rootfs.cpio.gz
+        
+
+        Clean temporary directory;
+
+        +        cd ..
+        rm -r d/
+        
+
+        Can be used C to create init program;
+
+        +        #include <stdio.h>
+        #include <unistd.h>
+
+        int main() {
+            printf("FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR\n");
+            sleep(0xFFFFFFFF);
+            return 0;
+        }
+        
+
+        +        $ gcc -static init.c -o init
+        
+
+        Start Debugging
+
+        Test qemu, kernel and simple init program, you
+        should see
+        "FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR";
+
+        +        $ qemu-system-x86_64 -enable-kvm --kernel arch/x86_64/boot/bzImage \
+        --initrd rootfs.cpio.gz
+        
+
+        If everything goes well you can start qemu without
+        starting the CPU (-S) and with gdb server on TCP port 1234 (-s).
+
+        +        $ qemu-system-x86_64 -enable-kvm --kernel arch/x86/boot/bzImage \
+                --initrd rootfs.cpio.gz \
+                -S -s
+        
+
+        On another terminal start gdb;
+
+        +        gdb \
+            -ex "add-auto-load-safe-path $(pwd)" \
+            -ex "file vmlinux" \
+            -ex 'set arch i386:x86-64:intel' \
+            -ex 'target remote localhost:1234' \
+            -ex 'break start_kernel' \
+            -ex 'continue' \
+            -ex 'disconnect' \
+            -ex 'set arch i386:x86-64' \
+            -ex 'target remote localhost:1234'
+        
+
+
+        Development Index
+        
+        This is part of the c9-doc Manual.
+        Copyright (C) 2016
+        c9 team.
+        See the file Gnu Free Documentation License
+        for copying conditions.
+
+    
+
+
diff --git a/dev/index.html b/dev/index.html
index cb238d7..e463f6f 100644
--- a/dev/index.html
+++ b/dev/index.html
@@ -45,6 +45,7 @@
             Control Flow
             Functions
             Input & Output
+            System Development
         
 
         
-- 
cgit 1.4.1-2-gfad0


From bc80d72896d6435ce5bdd3af8c9ed0b8e2723e63 Mon Sep 17 00:00:00 2001
From: Silvino Silva 
Date: Fri, 15 Sep 2017 02:34:49 +0100
Subject: dev c system dev added more gdb info

---
 dev/c/system.html | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/dev/c/system.html b/dev/c/system.html
index 65eede1..c91dc34 100644
--- a/dev/c/system.html
+++ b/dev/c/system.html
@@ -145,6 +145,29 @@
             -ex 'target remote localhost:1234'

+	(gdb) info thread
+	  Id   Target Id         Frame
+	* 1    Thread 1 (CPU#0 [running]) start_kernel () at init/main.c:480
+

+ +

+	(gdb) info frame
+	Stack level 0, frame at 0xffffffff81e03f90:
+	 rip = 0xffffffff81f4db2d in start_kernel (init/main.c:480); saved rip = 0xffffffff81f4d28e
+	 called by frame at 0xffffffff81e03fa0
+	 source language c.
+	 Arglist at 0xffffffff81e03f80, args:
+	 Locals at 0xffffffff81e03f80, Previous frame's sp is 0xffffffff81e03f90
+	 Saved registers:
+	  rip at 0xffffffff81e03f88
+

+ +

+	(gdb) print $rip
+	$2 = (void (*)()) 0xffffffff81f4db2d <start_kernel>
+	(gdb)
+

Development Index

-- cgit 1.4.1-2-gfad0 From b01e1b308e96a7ba49bbe9cc7cee5f7d6c966af5 Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Sun, 24 Sep 2017 01:01:26 +0100 Subject: tools user pkgmk get settings from system --- tools/scripts/pkgmk-test.conf | 30 +++++------------------------- 1 file changed, 5 insertions(+), 25 deletions(-) diff --git a/tools/scripts/pkgmk-test.conf b/tools/scripts/pkgmk-test.conf index 1ebdccb..3b0031d 100644 --- a/tools/scripts/pkgmk-test.conf +++ b/tools/scripts/pkgmk-test.conf @@ -2,32 +2,12 @@ # /etc/pkgmk.conf: pkgmk(8) configuration # -export CPPFLAGS="-D_FORTIFY_SOURCE=2" -export CFLAGS="-O2 -march=native -mtune=native -pipe -fPIC -fPIE -fstack-protector-strong --param=ssp-buffer-size=4 -fno-plt -fstack-check" -export CXXFLAGS="${CFLAGS}" -export LDFLAGS="-fPIE -pie -Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now" -export MAKEFLAGS="-j4" +source /etc/pkgmk.conf - -case ${PKGMK_ARCH} in - "64"|"") - ;; - "32") - export CFLAGS="${CFLAGS} -m32" - export CXXFLAGS="${CXXFLAGS} -m32" - export LDFLAGS="${LDFLAGS} -m32" - export PKG_CONFIG_LIBDIR="/usr/lib32/pkgconfig" - ;; - *) - echo "Unknown architecture selected! Exiting." - exit 1 - ;; -esac - -PKGMK_SOURCE_MIRRORS=(https://c9.root.sx/ports/distfiles/) -# PKGMK_SOURCE_DIR="$PWD" -# PKGMK_PACKAGE_DIR="$PWD" -# PKGMK_WORK_DIR="$PWD/work" +#PKGMK_SOURCE_MIRRORS=(https://c9.root.sx/ports/distfiles/) +PKGMK_SOURCE_DIR="$PWD" +PKGMK_PACKAGE_DIR="$PWD" +PKGMK_WORK_DIR="$PWD/work" # PKGMK_DOWNLOAD="no" # PKGMK_IGNORE_FOOTPRINT="no" # PKGMK_IGNORE_NEW="no" -- cgit 1.4.1-2-gfad0 From b3a6bc5ad6b8f294efcbcf3c0039626918eccd69 Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Sun, 24 Sep 2017 01:04:03 +0100 Subject: tools iptables script revision, bridge from ethernet --- tools/conf/etc/iptables/iptables-br.sh | 337 +++++++++++++++++++-------------- 1 file changed, 200 insertions(+), 137 deletions(-) diff --git a/tools/conf/etc/iptables/iptables-br.sh b/tools/conf/etc/iptables/iptables-br.sh index 104e574..25a3331 100644 --- a/tools/conf/etc/iptables/iptables-br.sh +++ b/tools/conf/etc/iptables/iptables-br.sh @@ -147,16 +147,14 @@ IPT="/usr/sbin/iptables" SPAMLIST="blockedip" SPAMDROPMSG="BLOCKED IP DROP" # public interface to network/internet -PUB_IF="wlp7s0" -DHCP_SERV="192.168.1.1" -PUB_IP="192.168.1.33" -NET_ADDR="192.168.1.0/24" +#PUB_IF="wlp7s0" +PUB_IF="br0" +PUB_IP="10.0.0.254" +NET_ADDR="10.0.0.0/8" +GW="10.0.0.1" # private interface for virtual/internal -PRIV_IF="br0" -PRIV_IP="10.0.0.1" - -modprobe ip_conntrack -modprobe ip_conntrack_ftp +PRIV_IF="wlp7s0" +PRIV_IP="192.168.1.33" echo "Stopping ipv4 firewall and deny everyone..." @@ -170,149 +168,214 @@ iptables -t raw -F iptables -t raw -X iptables -t security -F iptables -t security -X +iptables -N blocker - -echo "Starting ipv4 firewall filter table..." +iptables -N netconf_in +iptables -N netconf_out +iptables -N server_in +iptables -N server_out +iptables -N client_in +iptables -N client_out # Set Default Rules iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP -###### AP rules ###### -echo 1 > /proc/sys/net/ipv4/ip_forward -$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -j ACCEPT -$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -j ACCEPT -$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP} - -# Block sync -$IPT -A INPUT -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: " -$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP - -# Block Fragments -$IPT -A INPUT -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: " -$IPT -A INPUT -f -j DROP - -# Block bad stuff -$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP -$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP - -$IPT -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: " -$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # NULL packets - -$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: " -$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP - -$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: " -$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS - -$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: " -$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans - -$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP - - -###### Input Chain ###### - -# Unlimited on local -$IPT -A INPUT -i ${PRIV_IF} -j ACCEPT -#$IPT -A INPUT -i lo -s ${PRIV_IP} -j ACCEPT - +echo "Starting ipv4 firewall tables..." # Unlimited on loopback $IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A INPUT -i lo -s 192.168.1.33 -d 192.168.1.33 -j ACCEPT - -echo "Allow input from DNS Server" -$IPT -A INPUT -i ${PUB_IF} -p udp --dport 1024:65535 --sport 53 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input from Https server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -$IPT -A INPUT -i ${PUB_IF} -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input to HTTPS Server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT - -#echo "Allow input from HTTP Server" -#$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input from IRC server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 1024:65535 --sport 6667 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input from FTP server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 1024:65535 --sport 21 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input from git server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input from POP3S server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input from SMTPS server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - -echo "Allow input to HTTP Server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT - -#echo "Allow input to DNS Server" -#$IPT -A INPUT -i ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT - -echo "Allow input to SSH server" -$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT - -###### Output Chain ###### - -# Unlimited on loopback $IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A OUTPUT -o lo -s 192.168.1.33 -d 192.168.1.33 -j ACCEPT -#$IPT -A OUTPUT -o lo -d ${PRIV_IP} -j ACCEPT - -# Unlimited on local -$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT - -echo "Allow output to DNS server" -$IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 53 --sport 1024:65535 -j ACCEPT - -echo "Allow output to https server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 443 -j ACCEPT - -echo "Allow output from https server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT - -#echo "Allow output from http server" -#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT - -#echo "Allow to HTTP server" -#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT - -echo "Allow output to SSH server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT - -echo "Allow output to ftp server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT - -echo "Allow output to git server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 9418 -m state --state NEW,ESTABLISHED -j ACCEPT - -echo "Allow output to IRC server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT -echo "Allow output to SMTPS server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 465 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +#modprobe ip_conntrack +#modprobe ip_conntrack_ftp +#echo 1 > /proc/sys/net/ipv4/ip_forward + +####### blocker Chain ###### +## Block google dns +$IPT -A blocker -s 8.8.0.0/24 -j LOG --log-level 7 --log-prefix "iptables: blocker google: " +$IPT -A blocker -s 8.8.0.0/24 -j DROP +## Block sync +$IPT -A blocker -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: " +$IPT -A blocker -p tcp ! --syn -m state --state NEW -j DROP +## Block Fragments +$IPT -A blocker -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: " +$IPT -A blocker -f -j DROP + +$IPT -A blocker -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP +$IPT -A blocker -p tcp --tcp-flags ALL ALL -j DROP + +$IPT -A blocker -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: " +$IPT -A blocker -p tcp --tcp-flags ALL NONE -j DROP # NULL packets + +$IPT -A blocker -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: " +$IPT -A blocker -p tcp --tcp-flags SYN,RST SYN,RST -j DROP + +$IPT -A blocker -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: " +$IPT -A blocker -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS + +$IPT -A blocker -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: " +$IPT -A blocker -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans + +$IPT -A blocker -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP +## Return to caller +$IPT -A blocker -j RETURN + +####### server input Chain ###### +echo "server_in chain: Allow to SSH server" +$IPT -A server_in -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "server_in chain: Allow input to HTTPS Server" +$IPT -A server_in -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +#echo "server_in chain: Allow input to HTTP Server" +#$IPT -A server_in -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "server_in chain: Allow input to DNS Server" +$IPT -A server_in -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A server_in -p tcp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT + +## Return to caller +$IPT -A server_in -j RETURN + +####### server output Chain ###### +echo "server_out chain: Allow output from DNS server" +$IPT -A server_out -p udp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +$IPT -A server_out -p tcp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +echo "server_out chain: Allow output from https server" +$IPT -A server_out -p tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +#echo "server_out chain: Allow output from http server" +#$IPT -A server_out -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +echo "server_out chain: Allow output from SSH server" +$IPT -A server_out -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT + +## Return to caller +$IPT -A server_out -j RETURN + +####### client input Chain ###### +echo "client_in chain: Allow input from IRC server" +$IPT -A client_in -p tcp --sport 6667 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from FTP server" +$IPT -A client_in -p tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from GIT server" +$IPT -A client_in -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from POP3S server" +$IPT -A client_in -p tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from SMTPS server" +$IPT -A client_in -p tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +#echo "client_in chain: Allow input from HTTP Server" +#$IPT -A client_in -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from HTTPS server" +$IPT -A client_in -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +#$IPT -A client_in -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from DNS Server" +$IPT -A client_in -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from SSH Server" +$IPT -A client_in -p udp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +$IPT -A client_in -p udp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT + +## Return to caller +$IPT -A client_in -j RETURN + +####### client output Chain ###### +echo "client_out chain: Allow output to IRC server" +$IPT -A client_out -p tcp --dport 6667 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to FTP server" +$IPT -A client_out -p tcp --dport 21 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to GIT server" +$IPT -A client_out -p tcp --dport 9418 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to POP3S server" +$IPT -A client_out -p tcp --dport 995 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to SMTPS server" +$IPT -A client_out -p tcp --dport 465 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to HTTPS server" +$IPT -A client_out -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +#$IPT -A client_out -p udp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +##echo "Allow to HTTP server" +#$IPT -A client_out -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to DNS server" +$IPT -A client_out -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to SSH server" +$IPT -A client_out -p tcp --dport 22 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A client_out -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT + +## Return to caller +$IPT -A client_out -j RETURN + + +####### netconf input Chain ###### +echo "netconf_in chain: Allow DHCP protocol" +$IPT -A netconf_in -p udp --sport 68 --dport 67 -j ACCEPT +echo "netconf_in chain: Allow RIP protocol for ${NET_ADDR}" +$IPT -A netconf_in -p udp --sport 520 --dport 520 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT +#echo "netconf chain: Allow ICMP from ${NET_ADDR}" +#$IPT -A netconf_in -p icmp -s ${NET_ADDR} -j ACCEPT +echo "netconf_in chain: Allow ICMP from all" +$IPT -A netconf_in -p icmp -j LOG --log-level 7 --log-prefix "iptables: netconf_in ICMP: " +$IPT -A netconf_in -p icmp -j ACCEPT + +## Return to caller +$IPT -A netconf_in -j RETURN + + +####### netconf output Chain ###### +echo "netconf_out chain: Allow output from DHCP server" +$IPT -A netconf_out -p udp --sport 67 --dport 68 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT +echo "netconf_out chain: Allow RIP protocol for ${NET_ADDR}" +$IPT -A netconf_out -p udp --sport 520 --dport 520 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT +#echo "netconf chain: Allow ICMP output to ${NET_ADDR}" +#$IPT -A netconf_out -p icmp -d ${NET_ADDR} -j ACCEPT +echo "netconf chain: Allow ICMP output to all" +$IPT -A netconf_out -p icmp -j LOG --log-level 7 --log-prefix "iptables: netconf_out ICMP: " +$IPT -A netconf_out -p icmp -j ACCEPT + +## Return to caller +$IPT -A netconf_out -j RETURN + +####### AP rules ###### +$IPT -A FORWARD -j blocker +#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT +$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j netconf_in +$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j netconf_out +$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j client_in +$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -j client_out +#$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP} + +####### Input Chain ###### +$IPT -A INPUT -j blocker +$IPT -A INPUT -i ${PUB_IF} -j server_in +$IPT -A INPUT -i ${PUB_IF} -j client_in +$IPT -A INPUT -i ${PUB_IF} -j netconf_in + +####### Output Chain ###### +$IPT -A OUTPUT -j blocker +$IPT -A OUTPUT -o ${PUB_IF} -j server_out +$IPT -A OUTPUT -o ${PUB_IF} -j client_out +$IPT -A OUTPUT -o ${PUB_IF} -j netconf_out -echo "Allow output to POP3S server" -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 995 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT - -## less logs - -echo "Drop RIP protocol" -$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -s $NET_ADDR -j DROP - -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -d $DHCP_SERV -j ACCEPT ## log everything else and drop $IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " $IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " $IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " -# + exit 0 + +#$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -s ${NET_ADDR} -j ACCEPT +#$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -d ${NET_ADDR} -j ACCEPT +#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -p udp --sport 68 --dport 67 -j ACCEPT +#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -p udp --sport 520 --dport 520 -j ACCEPT +# +## You Dirty bitch +#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT + +## Unlimited on loopback +#$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT +##$IPT -A OUTPUT -o lo -d ${PRIV_IP} -j ACCEPT +# +## Unlimited on local +#$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT +# +### less logs +# + +#echo "Allow output DHCP protocol" +#$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT + -- cgit 1.4.1-2-gfad0