Taglio 29062021

TODO.md

@@ -0,0 +1,15 @@
+- arp sentinel
+
+- ``` shell
+  if [[ $# -eq 0 ]]; then
+  	print $0 "have to be used with the following options \
+  			\n \
+  			\ninstall  -> fresh install OpenBSD VPS \
+  			\nupgrade  -> upgrade OpenBSD VPS \
+  			\nreset    -> reset OpenBSD VPS \
+  			\n"
+
+  	exit 1
+  fi
+  ```
+

clean_last

@@ -0,0 +1,58 @@
+#!/bin/ksh
+
+set -o errexit
+set -o nounset
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/Bin
+BACKUPS="/root/Backups"
+
+uid=$(id -u)
+datarelease=$(date +"%d%m%Y%H%m%S")
+
+
+
+
+function backup {
+	CURRENTBACKUP="$BACKUPS/$datarelease"
+	mkdir -p "$CURRENTBACKUP/$1/"
+	case $1 in
+		"etc")
+			tar -cvf "$CURRENTBACKUP/$1/etc.tar" /etc
+		;;
+	esac
+}
+
+
+if [[ $uid -ne 0 ]]; then
+	print $0 "you've got to run $0 as UID=0 \n"
+	exit 1
+fi
+nohup backup "etc" & > /tmp/nohup
+last=$(basename $(cat /etc/iked.conf | grep "iked.conf." | tail -n 1 | awk '{print $2}' | sed 's/"//g' | sed 's/iked.conf.//'))
+publichostname=$(echo $last | cut -d . -f1)
+domainname=$(echo $last | sed "s/$publichostname.//")
+
+for a in $(dig ipsec20591.$domainname TXT +short @8.8.8.8 | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+	b=$(echo $a | cut -d : -f1)
+	if [[ "$b" -eq "$publichostname" ]]; then
+		srcid=$(echo $a | cut -d : -f2)
+	fi
+done
+
+filename=$(find /etc -name "*$last" -maxdepth 1 -type f)
+sed -i "/$last/d" /etc/iked.conf
+/bin/rm -r "$filename"
+rcctl restart iked
+for file in $(grep "$last" /etc/* | grep hostname | cut -d : -f1); do
+	interface=$(echo $file | cut -d . -f2)
+	if [[ $interface == gre? ]]; then
+		ospfinterface=$interface
+	fi
+	ifconfig $interface destroy
+	/bin/rm -r $file
+done
+pubkey="$srcid@ca.$domainname"
+sed -i "/interface $ospfinterface/,/}/d" /etc/ospfd.conf
+/bin/rm -r "/etc/iked/pubkeys/ufqdn/${pubkey}"
+nohup rcctl restart ospfd & > /tmp/nohup
+exit

console

@@ -0,0 +1,294 @@
+#!/usr/bin/bash
+
+#GLOBAL VAR
+
+uid=$(id -u)
+userna=$(id -nu $uid)
+userhome="/home/taglio"
+proghome="$userhome/Sources/Git/OpenBSD"
+
+if [[ $uid -ne 1000 ]]; then
+	echo -e $0 "you've got to run $0 as UID=1000 \n"
+	exit 1
+fi
+
+if [[ $# -eq 0 ]]; then
+	echo -e $0 "have to be used with the following options \
+			\n-I  -> local domain name [x]\
+			\n-N  -> newhost [o]\
+			\n-G  -> git pull [o]\
+			\n-S  -> scripts [o] \
+			\n-D  -> dyndnspop [o] \
+			\n-F  -> single file update [o] \
+			\n-C  -> cleanlast [o] \
+			\n-RS -> repository ssh update [o] \
+			\n-K  -> new IKED pk12 archive [o] \
+			\n-T  -> tmux and SSH to all openbsd MESH hosts [o] \
+			\n-M  -> Mikrotik RouterOS add new OpenBSD [o] \
+			\n-E  -> Ubiquiti EdgeOS add new OpenBSD [o] \
+			\n-P  -> Mass syspatch OpenBSD hosts [o] \
+			\n-Z  -> Global network domains setup [o] \
+			\n"
+
+	exit 1
+fi
+
+localdomainname=$2
+
+
+case $3 in
+	"-G")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh $vpnc_host.$localdomainname git -C "$proghome" pull
+		done	
+	;;
+	"-N")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh -t $vpnc_host.$localdomainname doas sh "/home/taglio/Sources/Git/OpenBSD/setup_node" -U newhost
+		done	
+	;;
+	"-S")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh -t $vpnc_host.$localdomainname doas sh "/home/taglio/Sources/Git/OpenBSD/setup_node" -U scripts
+		done	
+	;;
+	"-D")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh -t $vpnc_host.$localdomainname doas sh "/home/taglio/Sources/Git/OpenBSD/setup_node" -U dyndnspop
+			sleep 10
+		done	
+	;;
+	"-F")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh -t $vpnc_host.$localdomainname doas sh "/home/taglio/Sources/Git/OpenBSD/setup_node" -U file
+			sleep 10
+		done	
+	;;
+	"-C")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh -t $vpnc_host.$localdomainname doas sh "/home/taglio/Sources/Git/OpenBSD/setup_node" -A cleanlast
+		done	
+	;;
+	"-P")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh -t $vpnc_host.$localdomainname doas syspatch
+		done	
+	;;
+	"-RS")
+		lanhost=
+		while [ -z $lanhost ]
+		do
+			echo 'Type the LAN hostname '
+			read lanhost
+		done
+		pubhost=
+		while [ -z $pubhost ]
+		do
+			echo 'Type the public hostname '
+			read pubhost
+		done
+		hash=
+		while [ -z $hash ]
+		do
+			echo 'Type the ED25519 hash '
+			read hash
+		done 	
+		if [[ $(grep -c $lanhost src/etc/ssh/remote_install/authorized_keys) -gt 0 ]]; then
+			for linenum in $(grep -n $lanhost src/etc/ssh/remote_install/authorized_keys | cut -d : -f1); do
+				sed -i "$linenum"d src/etc/ssh/remote_install/authorized_keys
+			done
+		fi
+
+		echo "ssh-ed25519 $hash root@$lanhost" >> src/etc/ssh/remote_install/authorized_keys
+		#	if [[ $(grep -c $pubhost src/etc/ssh/ssh_known_hosts) -gt 0 ]]; then
+		#		for linenum in $(grep -n $pubhost src/etc/ssh/ssh_known_hosts | cut -d : -f1); do
+		#			sed -i "$linenum"d src/etc/ssh/ssh_known_hosts	
+		#		done
+		#	fi
+		#	
+		#	echo "# $pubhost:31137 SSH-2.0-OpenSSH_8.6" >> src/etc/ssh/ssh_known_hosts
+		#	echo "[$pubhost]:31137 ssh-ed25519 $hash" >> src/etc/ssh/ssh_known_hosts
+		echo -e "remote_install/authorized_keys and ssh_known_hosts UPDATED
+		\n please use git_openbsd.sh to update the public GIT"
+	;;
+	"-K")
+		ikedpub=
+		while [ -z $ikedpub ]
+		do
+			echo 'Type the PATH to the new iked PK12 file '
+			read ikedpub
+		done
+		tmpdir=$(mktemp -d)
+		pk12=$(basename $ikedpub)
+		publichost=$(echo $pk12 | sed 's/.p12//')
+		publichostname=$(echo $publichost | cut -d . -f1)
+		domainname=$(echo $publichost | sed "s/$publichostname.//")
+
+
+		for a in $(dig ipsec20591.$domainname TXT +short @8.8.8.8 | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			b=$(echo $a | cut -d : -f1)
+			if [[ "$b" -eq "$publichostname" ]]; then
+				srcid=$(echo $a | cut -d : -f2)
+			fi
+		done
+		ssh-keygen -f "/home/riccardo/.ssh/known_hosts" -R "$publichost"
+		scp $ikedpub "taglio@$publichost:/tmp"
+		openssl pkcs12 -nodes -in $ikedpub -nocerts -passin pass:123456789 -passout pass:123456789 -out "$tmpdir/local.key"
+		openssl pkcs12 -nodes -in $ikedpub -clcerts -nokeys -passin pass:123456789 -passout pass:123456789 -out "$tmpdir/new.crt"
+		openssl x509 -pubkey -noout -passin pass:123456789 -in "$tmpdir/new.crt"  > src/etc/iked/pubkeys/ufqdn/"$srcid@ca.$domainname"
+		rm -rf $tmpdir
+		echo -e "$srcid@ca.$domainname created please update repository and all the others Openbsd hosts"		
+	;;
+	"-T")
+		echo -e "Launching TMUX"
+		tmux new-session -d -s "LOBBY"
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Creating $vpnc_host TMUX windows"
+			tmux rename-window "$vpnc_host"
+			tmux send -t "LOBBY:$vpnc_host" ssh SPACE "$vpnc_host.$localdomainname" ENTER
+			tmux new-window 
+		done
+		tmux rename-window "CA"
+		tmux send -t "LOBBY:CA" ssh SPACE "ca.$localdomainname" ENTER
+		tmux new-window 
+		tmux rename-window $(hostname -s)
+		tmux -2 attach-session -t "LOBBY"
+	;;
+	"-M")
+		mkhost=
+		while [ -z $mkhost ]
+		do
+			echo 'Type the Mikrotik internal hostname '
+			read mkhost
+		done
+		openbsd=
+		while [ -z $openbsd ]
+		do
+			echo 'Type the new OpenBSD internal hostname '
+			read openbsd
+		done
+		mkaddr=$(ssh admin@$mkhost /ip addr pr where dynamic | awk '{print $3}' | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b")
+		mkpublichost=$(dig -x $mkaddr +short @8.8.8.8 | sed 's/.$//')
+		wget "http://$openbsd.$2/$mkpublichost/$mkpublichost.rsc" -O "/tmp/$mkpublichost.rsc"
+		scp "/tmp/$mkpublichost.rsc" "admin@$mkhost:/$mkpublichost.rsc"
+		ssh admin@$mkhost /import file-name=$mkpublichost.rsc
+		echo -e "Host $openbsd.$2 configured into Mikrotik $mkhost.$2"
+		ssh admin@$mkhost /sys package update check-for-updates
+	;;
+	"-E")
+		edgehost=
+		while [ -z $edgehost ]
+		do
+			echo 'Type the EdgeOS external hostname '
+			read edgehost
+		done
+		openbsd=
+		while [ -z $openbsd ]
+		do
+			echo 'Type the new OpenBSD internal hostname '
+			read openbsd
+		done
+		publicip=$(ssh -q $openbsd.$localdomainname ifconfig egress | awk 'FNR == 7' | awk '{print $2}')
+		publichost=$(dig -x $publicip +short |  sed 's/.$//' | cut -d . -f1)
+		publicdomainname=$(dig -x $publicip +short | sed "s/$publichost.//" | sed 's/.$//')
+		publichostname=$(echo $edgehost | sed "s/.$publicdomainname//")
+		for edge_host in $(dig edgeos.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			publicedgehost=$(echo $edge_host | cut -d : -f2)
+			if [[ $publichostname = $publicedgehost ]]; then
+				edgeos=$(echo $edge_host | cut -d : -f1)
+			fi
+		done
+		wget "http://$openbsd.$2/$edgehost.tar" -O "/tmp/$edgehost.tar"
+		cd /tmp
+		if [[ ! -d "$edgehost" ]]; then
+			mkdir "$edgehost"
+		fi 
+		tar xvf "/tmp/$edgehost.tar" -C "/tmp/$edgehost" 
+		cd $edgehost
+		for file in $(ls .); do
+			if [[ $file = "gre.sh" || $file = "ospf.sh" || $file = "ipsec.sh" ]]; then
+				cat $file | ssh -q $edgeos 
+			elif [[ $file = *updown.sh ]]; then
+				a=$(echo $file | sed "s/-updown.sh//")
+				c=$(echo $a | sed "s/-//")
+				v=$(echo $file | sed "s/$a/$c/")
+				scp -q $file "$edgeos:/tmp"
+				ssh -q $edgeos "sudo mv /tmp/$file /config/ipsec/$v ; chmod +x /config/ipsec/$v"
+			elif [[ $file = *_netwatch.sh ]]; then
+				a=$(echo $file | sed "s/_netwatch.sh//")
+				c=$(echo $a | sed "s/-//")
+				v=$(echo $file | sed "s/$a/$c/")
+				scp -q $file "$edgeos:/tmp"
+				ssh -q $edgeos "sudo mv /tmp/$file /config/scripts/$v; chmod +x /config/scripts/$v"
+			elif [[ $file = *.crt ]]; then
+				scp -q $file "$edgeos:/tmp"
+				ssh -q $edgeos sudo mv "/tmp/$file" /config/auth
+			elif [[ $file = *.conf ]]; then
+				if [[ $(ssh -q $edgeos grep -c telecomlobby-$(head -n 1 $file | cut -d \- -f2) /config/ipsec.conf) -eq 0 ]]; then
+					cat $file | ssh -qt $edgeos "cat - >> /config/ipsec.conf"
+				fi
+			fi
+		done
+		ctrl=
+		while [ -z $ctrl ]
+		do
+			echo "Do you want to restart ipsec into $edgeos "
+			read ctrl
+		done
+		rm -rf "/tmp/$edgehost"
+		case $ctrl in
+			"yes")
+				ssh -q $edgeos ipsec restart
+			;;
+			"no")
+			;;
+			*)
+				echo 'Reply yes or no'
+			;;
+		esac
+
+	;;
+	"-Z")	
+		comdomains=
+		echo -e "Type the two .com domains (the principle and the secondary) divided by a comma: "
+		read comdomains
+		principledomain=$(printf $comdomains | cut -d , -f1)
+		secondarydomain=$(printf $comdomains | cut -d , -f2)
+		for domain in $(printf "$comdomains" | xargs -d, -n1); do
+			echo -e "\n$domain: "
+			whois -H $domain | grep "Name Server" | grep -v "^Name"
+			dnssec=$(whois -H $domain| grep DNSSEC | awk '{print $2}')
+			[[ $dnssec == "unsigned" ]] || echo -e "\nDNSSEC not enable onto $domain!"
+			echo "<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>"
+		done
+		echo -e "You've got servers in:\n"
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			local=$(ssh -q $vpnc_host.$localdomainname readlink /etc/localtime  | sed "s/\/usr\/share\/zoneinfo\///")
+			zonetab=$(ssh -q $vpnc_host.$localdomainname cat /usr/share/zoneinfo/zone.tab | grep $local)
+			[[ $zonetab ]] && echo -e "\n$zonetab\n" || echo -e "\n$local\n"
+			publicip=$(ssh -q $vpnc_host.$localdomainname ifconfig egress | grep inet |grep -v inet6 | cut -d ' ' -f2)
+			curl -s "http://ipinfo.io/$publicip" | sed '/readme/d'
+			loc=$(curl -s "http://ipinfo.io/$publicip" | grep loc | awk '{print $2}' | sed 's/.$//' | sed "s/\"//g")
+			long=$(echo $loc | cut -d , -f2 | cut -d . -f1)
+			lat=$(echo $loc | cut -d , -f1 | cut -d . -f1)
+			echo -e "\nLAT --> $lat"
+			echo -e "LONG --> $long\n"
+			if [[ $long -ge -180 && $long -le -60 && $lat -ge 0 ]]; then group=1; fi
+			if [[ $long -ge -60 && $long -le 60 && $lat -ge 0 ]]; then group=3; fi
+			if [[ $long -ge 60 && $long -le 180 && $lat -ge 0 ]]; then group=5; fi
+			if [[ $long -ge -180 && $long -le -60 && $lat -le 0 ]]; then group=2; fi
+			if [[ $long -ge -60 && $long -le 60 && $lat -le 0 ]]; then group=4; fi
+			if [[ $long -ge 60 && $long -le 180 && $lat -le 0 ]]; then group=6; fi
+			echo -e "GROUP --> $group\n"
+		done
+	;;
+	*)
+	;;
+esac