Skip to content

Commit 09ee8f8

Browse files
ra-at-diladele-comra-at-diladele-com
committed
7.2.0
1 parent abcf96c commit 09ee8f8

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

76 files changed

+521
-794
lines changed

Diff for: ‎.gitignore

+1-5
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,2 @@
11
license.pem
2-
scripts.ubuntu16/license.pem
3-
scripts.ubuntu18/license.pem
4-
scripts.va/license.pem
5-
scripts.azure/
6-
scripts.aws/
2+
license-cloud.pem

Diff for: ‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,6 @@ Main features of the application are:
1414
- removes annoying web ads
1515
- protects online privacy by disallowing access to web trackers
1616

17-
Web Safety runs on modern versions of CentOS, Debian and Ubuntu Linux, providing comprehensive web filtering solution easily manageble from Web UI. Older version of the application run on FreeBSD (pfSense) and Raspberry PI.
17+
Web Safety runs on modern versions of CentOS, Debian/Raspberry PI and Ubuntu Linux, providing comprehensive web filtering solution easily manageble from Web UI.
1818

1919
More information at https://www.diladele.com

Diff for: ‎appliance/aws/01_pasw.sh

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
3+
# all packages are installed as root
4+
if [[ $EUID -ne 0 ]]; then
5+
echo "This script must be run as root" 1>&2
6+
exit 1
7+
fi
8+
9+
# copy the change password script to bin folder
10+
cp chpass_aws.sh /opt/websafety/bin/
11+
12+
# make it executable
13+
chmod +x /opt/websafety/bin/chpass_aws.sh
14+
15+
# create systemd service that runs exactly once
16+
cp chpass_aws.service /etc/systemd/system/chpass_aws.service
17+
18+
# enable it
19+
systemctl enable chpass_aws.service
20+
systemctl daemon-reload

Diff for: ‎appliance/aws/02_clean.sh

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/bin/bash
2+
3+
# all packages are installed as root
4+
if [[ $EUID -ne 0 ]]; then
5+
echo "This script must be run as root" 1>&2
6+
exit 1
7+
fi
8+
9+
# remove all keys
10+
shred -u /etc/ssh/*_key /etc/ssh/*_key.pub
11+
12+
# authorized keys
13+
find / -name "authorized_keys" -exec rm –f {} \;
14+
15+
# remove source control
16+
find /root/ /home/*/ -name .cvspass -exec rm –f {} \;
17+
find /root/.subversion/auth/svn.simple/ /home/*/.subversion/auth/svn.simple/ -exec rm –rf {} \;
18+
19+
# remove all scripts
20+
cd /home/ubuntu
21+
rm -Rf core.ubuntu18
22+
rm -Rf ui.deb
23+
rm -Rf appliance
24+
25+
rm build-01.sh
26+
rm build-02.sh
27+
rm aws-byol.sh
28+
29+
# remove history
30+
find /root/.*history /home/*/.*history -exec rm -f {} \;

Diff for: ‎appliance/aws/chpass_aws.service

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
[Unit]
2+
Description=Update root password for Web Safety virtual appliance once
3+
4+
[Service]
5+
Type=oneshot
6+
ExecStart=/opt/websafety/bin/chpass_aws.sh
7+
StandardOutput=file:/opt/websafety/var/log/chpass_aws.log
8+
RemainAfterExit=true
9+
10+
[Install]
11+
WantedBy=multi-user.target

Diff for: ‎appliance/aws/chpass_aws.sh

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/bin/bash
2+
#
3+
# update root password in the Web Safety to a random value
4+
# required for vm publication in the AWS Cloud Marketplace
5+
#
6+
7+
FLAG_FILE="/opt/websafety/etc/password_reset.flag"
8+
9+
if [ -f $FLAG_FILE ]; then
10+
11+
echo "Flag file $FLAG_FILE exists, thus root password changed from the built-in"
12+
echo "Password value at least once, no need to do anything, skipping..."
13+
14+
else
15+
16+
# we are using instance id as new password
17+
NEWPASW=`curl http://169.254.169.254/latest/meta-data/instance-id`
18+
19+
# update the password in the database
20+
sudo -u websafety python3 /opt/websafety-ui/var/console/reset_password.py --password=$NEWPASW
21+
22+
# change the template too so that user known what shall be used as password
23+
sudo -u websafety sed -i "s/Passw0rd/InstanceID/g" /opt/websafety-ui/var/console/frame/templates/login.html
24+
25+
# raise the updated password flag so that we do not regenerate it next reboot
26+
echo "Do NOT remove this file!" > "$FLAG_FILE"
27+
echo "Do NOT remove this file!" >> "$FLAG_FILE"
28+
echo "Do NOT remove this file!" >> "$FLAG_FILE"
29+
echo "" >> "$FLAG_FILE"
30+
echo "" >> "$FLAG_FILE"
31+
32+
echo "If you remove this flag file, the /etc/systemd/service/chpass_aws.service service " >> "$FLAG_FILE"
33+
echo "will automatically call /opt/websafety/bin/chpass_aws.sh file that will reset" >> "$FLAG_FILE"
34+
echo "the password of the root user in Web Safety UI to ID of this instance." >> "$FLAG_FILE"
35+
echo "This is required for VMs generated from AMI template in Amazon AWS." >> "$FLAG_FILE"
36+
echo "" >> "$FLAG_FILE"
37+
echo "" >> "$FLAG_FILE"
38+
39+
echo "It is recommended to run \"systemctl disable chpass_aws.service\" to disable this functionality." >> "$FLAG_FILE"
40+
41+
fi

Diff for: ‎appliance/aws/wslicd.service

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
[Unit]
2+
Description=Automatic license activation service for Amazon AWS (runs once after boot)
3+
4+
[Service]
5+
Type=oneshot
6+
ExecStart=/etc/cron.hourly/websafety_license
7+
StandardOutput=file:/opt/websafety/var/log/wslicd.service.log
8+
RemainAfterExit=true
9+
10+
[Install]
11+
WantedBy=multi-user.target

Diff for: ‎appliance/azure/wslicd.service

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
[Unit]
2+
Description=Automatic license activation service for Windows Azure (runs once after boot)
3+
4+
[Service]
5+
Type=oneshot
6+
ExecStart=/etc/cron.hourly/websafety_license
7+
StandardOutput=file:/opt/websafety/var/log/wslicd.service.log
8+
RemainAfterExit=true
9+
10+
[Install]
11+
WantedBy=multi-user.target

Diff for: ‎scripts.va/01_login.sh renamed to ‎appliance/va/01_login.sh

+6-8
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,12 @@ if [ $? -eq 0 ]; then
1717
apt install -y open-vm-tools
1818
fi
1919

20+
# copy the handy monitor.sh script to installation folder
21+
cp monitor.sh /opt/websafety/bin/
22+
23+
# and make it executable
24+
chmod +x /opt/websafety/bin/monitor.sh
25+
2026
# copy the /etc/issue creation script to installation folder
2127
cp va_issue.sh /opt/websafety/bin/
2228

@@ -29,12 +35,4 @@ cp wsissue.service /etc/systemd/system/wsissue.service
2935
# enable it
3036
systemctl enable wsissue.service
3137

32-
# let Web UI of Web Safety to manage the network
33-
sudo -u websafety python3 /opt/websafety/var/console/utils.py --network=ubuntu18
34-
35-
# set new license if present
36-
if [ -f license.pem ]; then
37-
sudo -u websafety cp license.pem /opt/websafety/etc
38-
fi
39-
4038
echo "Success, run next step please."

Diff for: ‎scripts.va/02_harden.sh renamed to ‎appliance/va/02_harden.sh

File renamed without changes.

Diff for: ‎appliance/va/monitor.sh

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash
2+
SESSION=$USER
3+
4+
tmux -2 new-session -d -s $SESSION
5+
6+
# setup a window for tailing log files
7+
tmux new-window -t $SESSION:1 -n 'Logs'
8+
tmux split-window -v
9+
10+
# lower pane is for squid log
11+
tmux select-pane -t 1
12+
tmux send-keys "tail -f /var/log/squid/access.log" C-m
13+
14+
# upper pane is for mc and htop
15+
tmux select-pane -t 0
16+
tmux split-window -h
17+
tmux select-pane -t 0
18+
tmux send-keys "htop" C-m
19+
tmux select-pane -t 1
20+
tmux send-keys "mc" C-m
21+
22+
# set default window and attach to session
23+
tmux select-window -t $SESSION:1
24+
tmux -2 attach-session -t $SESSION

Diff for: ‎scripts.va/va_issue.sh renamed to ‎appliance/va/va_issue.sh

File renamed without changes.

Diff for: ‎scripts.va/wsissue.service renamed to ‎appliance/va/wsissue.service

File renamed without changes.

Diff for: ‎aws-byol.sh

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/bin/bash
2+
3+
# check we are root
4+
if [[ $EUID -ne 0 ]]; then
5+
echo "This script must be run as root" 1>&2
6+
exit 1
7+
fi
8+
9+
# install aws
10+
pushd appliance/aws
11+
bash 01_pasw.sh && bash 02_clean.sh
12+
popd
13+
14+
# set new license
15+
if [ -f license.pem ]; then
16+
sudo -u proxy cp license.pem /opt/websafety/etc/license.pem
17+
fi
18+
19+
# tell
20+
echo "SUCCESS"
21+
echo "SUCCESS"
22+
echo "SUCCESS --- AWS AMI is ready ---"
23+
cat /opt/websafety/etc/license.pem | grep "Not After"
24+
echo "SUCCESS"
25+
echo "SUCCESS"

Diff for: ‎aws-payg.sh

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/bin/bash
2+
3+
# check we are root
4+
if [[ $EUID -ne 0 ]]; then
5+
echo "This script must be run as root" 1>&2
6+
exit 1
7+
fi
8+
9+
#
10+
# be sure to first run
11+
#
12+
# bash build_01.sh
13+
# bash build_02.sh
14+
#
15+
16+
# switch the activation type to AWS instead of default Azure
17+
sed -i "s/activate=azure/activate=aws/g" /etc/cron.hourly/websafety_license
18+
19+
# create aws license update service that runs exactly once
20+
cp appliance/aws/wslicd.service /etc/systemd/system/wslicd.service
21+
22+
# enable it
23+
systemctl enable wslicd.service
24+
systemctl daemon-reload
25+
26+
# set new cloud license
27+
if [ -f license-cloud.pem ]; then
28+
sudo -u proxy cp license-cloud.pem /opt/websafety/etc/license.pem
29+
fi
30+
31+
# tell
32+
echo "SUCCESS"
33+
echo "SUCCESS"
34+
echo "SUCCESS --- AWS PAYG instance is ready ---"
35+
cat /opt/websafety/etc/license.pem | grep "Not After"
36+
echo "SUCCESS"
37+
echo "SUCCESS"

Diff for: ‎azure-byol.sh

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/bin/bash
2+
3+
# check we are root
4+
if [[ $EUID -ne 0 ]]; then
5+
echo "This script must be run as root" 1>&2
6+
exit 1
7+
fi
8+
9+
#
10+
# be sure to first run
11+
#
12+
# bash build_01.sh
13+
# bash build_02.sh
14+
#
15+
16+
# set new license
17+
if [ -f license.pem ]; then
18+
sudo -u proxy cp license.pem /opt/websafety/etc/license.pem
19+
fi
20+
21+
# tell
22+
echo "SUCCESS"
23+
echo "SUCCESS"
24+
echo "SUCCESS --- Azure BYOL instance is ready ---"
25+
cat /opt/websafety/etc/license.pem | grep "Not After"
26+
echo "SUCCESS"
27+
echo "SUCCESS"

Diff for: ‎azure-payg.sh

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#!/bin/bash
2+
3+
# check we are root
4+
if [[ $EUID -ne 0 ]]; then
5+
echo "This script must be run as root" 1>&2
6+
exit 1
7+
fi
8+
9+
#
10+
# be sure to first run
11+
#
12+
# bash build_01.sh
13+
# bash build_02.sh
14+
#
15+
16+
# create azure license update service that runs exactly once
17+
cp appliance/azure/wslicd.service /etc/systemd/system/wslicd.service
18+
19+
# enable it
20+
systemctl enable wslicd.service
21+
systemctl daemon-reload
22+
23+
# set new cloud license
24+
if [ -f license-cloud.pem ]; then
25+
sudo -u proxy cp license-cloud.pem /opt/websafety/etc/license.pem
26+
fi
27+
28+
# tell
29+
echo "SUCCESS"
30+
echo "SUCCESS"
31+
echo "SUCCESS --- Azure PAYG instance is ready ---"
32+
cat /opt/websafety/etc/license.pem | grep "Not After"
33+
echo "SUCCESS"
34+
echo "SUCCESS"

Diff for: ‎ubuntu-va-01.sh renamed to ‎build-01.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ if [[ $EUID -ne 0 ]]; then
66
exit 1
77
fi
88

9-
pushd scripts.ubuntu18 && bash 01_update.sh && popd
9+
pushd core.ubuntu18 && bash 01_update.sh && popd

Diff for: ‎build-02.sh

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/bin/bash
2+
3+
# check we are root
4+
if [[ $EUID -ne 0 ]]; then
5+
echo "This script must be run as root" 1>&2
6+
exit 1
7+
fi
8+
9+
# install core modules of web safety
10+
pushd core.ubuntu18
11+
bash 02_squid.sh && \
12+
bash 03_clamav.sh && \
13+
bash 04_websafety.sh && \
14+
bash 05_integrate.sh
15+
popd
16+
17+
# install web safety ui
18+
pushd ui.deb
19+
bash 01_apache.sh && bash 02_webui.sh
20+
popd
21+
22+
# tell
23+
echo "SUCCESS"
24+
echo "SUCCESS"
25+
echo "SUCCESS Now run va.sh script for the appliance or azure-*.sh or aws-*.sh for cloud instances!"
26+
echo "SUCCESS"
27+
echo "SUCCESS"

Diff for: ‎scripts.centos7/01_update.sh renamed to ‎core.centos8/01_update.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ if [[ $EUID -ne 0 ]]; then
66
exit 1
77
fi
88

9-
# enable epel repository and update
10-
yum -y install epel-release && yum -y update
9+
# update the system
10+
dnf -y update
1111

1212
# disable selinux
1313
sed -i s/SELINUX=enforcing/SELINUX=disabled/g /etc/selinux/config

Diff for: ‎core.centos8/02_squid.sh

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/bash
2+
3+
# install RPMs as root
4+
if [[ $EUID -ne 0 ]]; then
5+
echo "This script must be run as root" 1>&2
6+
exit 1
7+
fi
8+
9+
# install stock squid with ecap libs
10+
dnf -y install squid libecap libecap-devel
11+
12+
# make squid autostart after reboot
13+
systemctl enable squid
14+
systemctl restart squid

0 commit comments

Comments
 (0)