#!/bin/bash
# Script de instalacao Linux Control
#
# Para instalar execute:
#
# [root]# sh install.sh

echo "Iniciando Instalacao do Linux Control..."
echo " "

# Instalando pacotes necessarios
echo "deb http://ftp.br.debian.org/debian/ etch main" > /etc/apt/sources.list
echo "deb http://security.debian.org/ etch/updates main contrib" >> /etc/apt/sources.list
apt-get update

apt-get install -y apache2 libapache2-mod-perl2 libfcgi-perl libapache2-mod-speedycgi squid iptables psmisc wget bzip2 shaper samba samba-common smbclient libpcap0.7 sudo ntpdate

# Fazendo download do Linux Control
wget http://linuxcontrol.sourceforge.net/linuxcontrol-0.1.tar.bz2

# Descompactando Linux Control
tar -xjpvf linuxcontrol-0.1.tar.bz2 -C /

# Habilitanto repasse de pacotes
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p &> /dev/null

# Fazendo SNAT
GET_GW=$(route -n | grep ^0.0.0.0 | awk '{print $8}')
GET_IP=$(ifconfig $GET_GW | grep "inet " | awk '{print $3}' | cut -d : -f2-)

# Criando Regras de Firewall
iptables -F
iptables -t nat -F
iptables -t nat -A POSTROUTING -o $GET_GW -j MASQUERADE
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
iptables -A FORWARD -s 172.17.0.0/24 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -d 172.17.0.0/24 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -p tcp --dport 1863 -j DROP

# Salvando Regras de Firewall
iptables-save > /usr/local/etc/iptables.rules 

# Restaurando Firewall em tempo de boot
echo "iptables-restore < /usr/local/etc/iptables.rules" >> /etc/init.d/bootmisc.sh

# Habilitando Regras de Firewall durante o boot caso o firewall seja modificado
echo "iptables -t nat -D POSTROUTING -o $GET_GW -j MASQUERADE" >> /etc/init.d/bootmisc.sh
echo "iptables -t nat -A POSTROUTING -o $GET_GW -j MASQUERADE" >> /etc/init.d/bootmisc.sh
echo "iptables -D FORWARD -p tcp --dport 1863 -j DROP" >> /etc/init.d/bootmisc.sh
echo "iptables -I FORWARD -p tcp --dport 1863 -j DROP" >> /etc/init.d/bootmisc.sh
echo "iptables -D FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu" >> /etc/init.d/bootmisc.sh
echo "iptables -I FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu" >> /etc/init.d/bootmisc.sh

# Adicionando privilegios no sudo para www-data
echo "www-data        ALL=NOPASSWD:   /etc/init.d/squid" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /etc/init.d/networking" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /usr/bin/killall" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /sbin/iptables" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /sbin/iptables-save" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /sbin/route" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /sbin/ifconfig" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /etc/init.d/shaper" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /usr/sbin/useradd" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /usr/sbin/userdel" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /usr/bin/smbpasswd" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /bin/chown" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /usr/local/bin/sarg" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /usr/sbin/logrotate" >> /etc/sudoers
echo "www-data        ALL=NOPASSWD:   /etc/init.d/samba" >> /etc/sudoers

# Habilitando imsniff para ser executado em tempo de boot
echo "/usr/local/bin/imsniff &" >> /etc/init.d/bootmisc.sh

# Configurando Perl para rodar no Apache2
echo " " >> /etc/apache2/apache2.conf
echo "     AddHandler cgi-script .cgi .pl" >> /etc/apache2/apache2.conf

echo " " >> /etc/apache2/sites-available/default
echo "<Directory /var/www/*/cgi-bin/>" >> /etc/apache2/sites-available/default
echo "    Options +ExecCGI" >> /etc/apache2/sites-available/default
echo "</Directory>" >> /etc/apache2/sites-available/default

# Configurando Autenticacao para o Linux Control no Apache2
echo " " >> /etc/apache2/sites-available/default
echo "<Directory "/var/www/linux">" >> /etc/apache2/sites-available/default
echo "    AllowOverride AuthConfig" >> /etc/apache2/sites-available/default
echo "    Options Indexes FollowSymLinks MultiViews" >> /etc/apache2/sites-available/default
echo "    Order allow,deny" >> /etc/apache2/sites-available/default
echo "    Allow from all" >> /etc/apache2/sites-available/default
echo "</Directory>" >> /etc/apache2/sites-available/default

# Preparando ambiente de autenticacao no apache
htpasswd -b -c /var/www/linux/password linux 123
htpasswd -b -c /var/www/linux/logout/password logout logout

# Alterando dono de arquivos
chown www-data /usr/local/etc/iptables.rules
chown www-data.www-data /var/www/linux/* -R
chgrp www-data /etc/shaper
chmod g+rwx /etc/shaper
chown www-data /etc/samba/smb.conf
chgrp www-data /etc/network/interfaces
chmod g+rw /etc/network/interfaces

# Criando grupo de maquinas e usuarios para o samba
groupadd -g 3001 maquinas
groupadd -g 3000 samba

# Criando diretorio netlogon para o samba
mkdir /home/netlogon

# Criando o arquivo de usuarios e senhas do samba a partir do passwd
cat /etc/passwd | mksmbpasswd > /etc/samba/smbpasswd

# Configurando placa de rede eth1
echo " " >> /etc/network/interfaces
echo "auto eth1" >> /etc/network/interfaces
echo "iface eth1 inet static" >> /etc/network/interfaces
echo "        address 172.17.0.1" >> /etc/network/interfaces
echo "        netmask 255.255.255.0" >> /etc/network/interfaces

# Liberando para que todos acessem o IP ligado ao gateway
echo "$GET_IP" > /etc/squid/acl/linuxcontrol.txt

# Reiniciando dispositivos de rede
/etc/init.d/networking restart

# Reiniciando Apache, Squid, Samba
/etc/init.d/apache2 stop
/etc/init.d/apache2 start
killall -9 squid
/etc/init.d/squid start
/etc/init.d/samba restart

# Executando programas ao finalizar a instalacao
/usr/local/bin/imsniff &

sleep 2

# Finalizando a instalacao
echo
echo "Acesse Linux Control pelo browser - http://$GET_IP/linux"
echo
echo "Usuario: linux"
echo "Senha:   123"
echo
