denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adapt host configuration

Browse Source 
Adapt the configuration of the test hosts to the new Debian-based
system.
This commit is contained in:
Reto Buerki
2012-12-18 16:00:21 +01:00
committed by Tobias Brunner
parent 108040800d
commit 766466b8d1
94 changed files with 680 additions and 24813 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/hosts/alice/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=alice
testing/hosts/alice/etc/conf.d/net
-12
View File
@@ -1,12 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_ALICE broadcast 10.1.255.255 netmask 255.255.0.0"
"PH_IP6_ALICE/16" )
config_eth1=( "PH_IP_ALICE1 broadcast 192.168.0.255 netmask 255.255.255.0"
"PH_IP6_ALICE1/16" )
# For setting the default gateway
#
routes_eth0=( "default via PH_IP_MOON1" )
testing/hosts/alice/etc/freeradius/clients.conf
+4
View File
@@ -0,0 +1,4 @@
client 10.1.0.1 {
secret = gv6URkSs
shortname = moon
}
testing/hosts/alice/etc/freeradius/dictionary
+32
View File
@@ -0,0 +1,32 @@
#
# This is the master dictionary file, which references the
# pre-defined dictionary files included with the server.
#
# Any new/changed attributes MUST be placed in this file, as
# the pre-defined dictionaries SHOULD NOT be edited.
#
# $Id$
#
#
# The filename given here should be an absolute path.
#
$INCLUDE /usr/local/share/freeradius/dictionary
#
# Place additional attributes or $INCLUDEs here. They will
# over-ride the definitions in the pre-defined dictionaries.
#
# See the 'man' page for 'dictionary' for information on
# the format of the dictionary files.
#
# If you want to add entries to the dictionary file,
# which are NOT going to be placed in a RADIUS packet,
# add them here. The numbers you pick should be between
# 3000 and 4000.
#
#ATTRIBUTE My-Local-String 3000 string
#ATTRIBUTE My-Local-IPAddr 3001 ipaddr
#ATTRIBUTE My-Local-Integer 3002 integer
testing/hosts/alice/etc/freeradius/radiusd.conf
+120
View File
@@ -0,0 +1,120 @@
# radiusd.conf -- FreeRADIUS server configuration file.
prefix = /usr
exec_prefix = ${prefix}
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = ${localstatedir}/log/freeradius
raddbdir = ${sysconfdir}/freeradius
radacctdir = ${logdir}/radacct
# name of the running server. See also the "-n" command-line option.
name = freeradius
# Location of config and logfiles.
confdir = ${raddbdir}
run_dir = ${localstatedir}/run
# Should likely be ${localstatedir}/lib/radiusd
db_dir = ${raddbdir}
# libdir: Where to find the rlm_* modules.
libdir = ${exec_prefix}/lib
# pidfile: Where to place the PID of the RADIUS server.
pidfile = ${run_dir}/${name}.pid
# max_request_time: The maximum time (in seconds) to handle a request.
max_request_time = 30
# cleanup_delay: The time to wait (in seconds) before cleaning up
cleanup_delay = 5
# max_requests: The maximum number of requests which the server keeps
max_requests = 1024
# listen: Make the server listen on a particular IP address, and send
listen {
type = auth
ipaddr = 10.1.0.10
port = 0
}
# This second "listen" section is for listening on the accounting
# port, too.
#
listen {
type = acct
ipaddr = 10.1.0.10
port = 0
}
# hostname_lookups: Log the names of clients or just their IP addresses
hostname_lookups = no
# Core dumps are a bad thing. This should only be set to 'yes'
allow_core_dumps = no
# Regular expressions
regular_expressions = yes
extended_expressions = yes
# Logging section. The various "log_*" configuration items
log {
destination = files
file = ${logdir}/radius.log
syslog_facility = daemon
stripped_names = no
auth = yes
auth_badpass = yes
auth_goodpass = yes
}
# The program to execute to do concurrency checks.
checkrad = ${sbindir}/checkrad
# Security considerations
security {
max_attributes = 200
reject_delay = 1
status_server = yes
}
# PROXY CONFIGURATION
proxy_requests = yes
$INCLUDE proxy.conf
# CLIENTS CONFIGURATION
$INCLUDE clients.conf
# THREAD POOL CONFIGURATION
thread pool {
start_servers = 5
max_servers = 32
min_spare_servers = 3
max_spare_servers = 10
max_requests_per_server = 0
}
# MODULE CONFIGURATION
modules {
$INCLUDE ${confdir}/modules/
$INCLUDE eap.conf
$INCLUDE sql.conf
$INCLUDE sql/mysql/counter.conf
}
# Instantiation
instantiate {
exec
expr
expiration
logintime
}
# Policies
$INCLUDE policy.conf
# Include all enabled virtual hosts
$INCLUDE sites-enabled/
testing/hosts/alice/etc/hostname
+1
View File
@@ -0,0 +1 @@
alice
testing/hosts/alice/etc/init.d/iptables
-74
View File
@@ -1,74 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow NAT-T
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/alice/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/alice/etc/init.d/net.eth1
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/alice/etc/init.d/radiusd
-64
View File
@@ -1,64 +0,0 @@
#!/sbin/runscript
opts="${opts} reload"
depend() {
need net
use dns
}
checkconfig() {
# set the location of log files
if ! cd /var/log/radius ; then
eerror "Failed to change current directory to /var/log/radius"
return 1
fi
if [ ! -d /var/run/radiusd ] && ! mkdir /var/run/radiusd ; then
eerror "Failed to create /var/run/radiusd"
return 1
fi
if [ ! -f /etc/raddb/radiusd.conf ] ; then
eerror "No /etc/raddb/radiusd.conf file exists!"
return 1
fi
RADIUSD_OPTS="-xx"
RADIUSD_USER=`grep '^ *user *=' /etc/raddb/radiusd.conf | cut -d ' ' -f 3`
RADIUSD_GROUP=`grep '^ *group *=' /etc/raddb/radiusd.conf | cut -d ' ' -f 3`
if [ -n "${RADIUSD_USER}" ] && ! getent passwd ${RADIUSD_USER} > /dev/null ; then
eerror "${RADIUSD_USER} user missing!"
return 1
fi
if [ -n "${RADIUSD_GROUP}" ] && ! getent group ${RADIUSD_GROUP} > /dev/null ; then
eerror "${RADIUSD_GROUP} group missing!"
return 1
fi
# radius.log is created before privileges are dropped - need to set proper permissions on it
[ -f radius.log ] || touch radius.log || return 1
chown -R "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" . /var/run/radiusd && \
chmod -R u+rwX,g+rX . /var/run/radiusd || return 1
}
start() {
checkconfig || return 1
ebegin "Starting radiusd"
start-stop-daemon --start --quiet --exec /usr/sbin/radiusd -- ${RADIUSD_OPTS} >/dev/null
eend $?
}
stop () {
ebegin "Stopping radiusd"
start-stop-daemon --stop --quiet --pidfile=/var/run/radiusd/radiusd.pid
eend $?
}
reload () {
ebegin "Reloading radiusd"
kill -HUP `</var/run/radiusd/radiusd.pid`
eend $?
}
testing/hosts/alice/etc/ipsec.conf
Executable → Regular
+1 -1
View File
@@ -13,7 +13,7 @@ conn nat-t
leftcert=aliceCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_SUN
right=192.168.0.2
[email protected]
rightsubnet=10.2.0.0/16
auto=add
testing/hosts/alice/etc/network/interfaces
+20
View File
@@ -0,0 +1,20 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address PH_IP_ALICE
netmask 255.255.0.0
broadcast 10.1.255.255
gateway 10.1.0.1
iface eth0 inet6 static
address PH_IP6_ALICE
netmask 16
iface eth1 inet static
address PH_IP_ALICE1
netmask 255.255.255.0
broadcast 192.168.0.255
iface eth1 inet6 static
address PH_IP6_ALICE1
netmask 16
testing/hosts/alice/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/bob/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=bob
testing/hosts/bob/etc/conf.d/net
-10
View File
@@ -1,10 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_BOB broadcast 10.2.255.255 netmask 255.255.0.0"
"PH_IP6_BOB/16" )
# For setting the default gateway
#
routes_eth0=( "default via PH_IP_SUN1" )
testing/hosts/bob/etc/hostname
+1
View File
@@ -0,0 +1 @@
bob
testing/hosts/bob/etc/init.d/iptables
-74
View File
@@ -1,74 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow IKE
iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
# allow NAT-T
iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/bob/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/bob/etc/ipsec.conf
Executable → Regular
View File
testing/hosts/bob/etc/network/interfaces
+12
View File
@@ -0,0 +1,12 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address PH_IP_BOB
netmask 255.255.0.0
broadcast 10.2.255.255
gateway 10.2.0.1
iface eth0 inet6 static
address PH_IP6_BOB
netmask 16
testing/hosts/bob/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/carol/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=carol
testing/hosts/carol/etc/conf.d/net
-10
View File
@@ -1,10 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_CAROL broadcast 192.168.0.255 netmask 255.255.255.0"
"PH_IP6_CAROL/16" )
# For setting the default gateway
#
routes_eth0=( "default via 192.168.0.254" )
testing/hosts/carol/etc/hostname
+1
View File
@@ -0,0 +1 @@
carol
testing/hosts/carol/etc/init.d/iptables
-77
View File
@@ -1,77 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/carol/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/carol/etc/ipsec.conf
Executable → Regular
+2 -2
View File
@@ -9,11 +9,11 @@ conn %default
keyingtries=1
conn home
left=PH_IP_CAROL
left=192.168.0.100
leftcert=carolCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
right=192.168.0.1
rightsubnet=10.1.0.0/16
[email protected]
auto=add
testing/hosts/carol/etc/network/interfaces
+12
View File
@@ -0,0 +1,12 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address PH_IP_CAROL
netmask 255.255.255.0
broadcast 192.168.0.255
gateway 192.168.0.254
iface eth0 inet6 static
address PH_IP6_CAROL
netmask 16
testing/hosts/carol/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/dave/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=dave
testing/hosts/dave/etc/conf.d/net
-10
View File
@@ -1,10 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_DAVE broadcast 192.168.0.255 netmask 255.255.255.0"
"PH_IP6_DAVE/16" )
# For setting the default gateway
#
routes_eth0=( "default via 192.168.0.254" )
testing/hosts/dave/etc/hostname
+1
View File
@@ -0,0 +1 @@
dave
testing/hosts/dave/etc/init.d/iptables
-77
View File
@@ -1,77 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/dave/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/dave/etc/ipsec.conf
Executable → Regular
+2 -2
View File
@@ -9,11 +9,11 @@ conn %default
keyingtries=1
conn home
left=PH_IP_DAVE
left=192.168.0.200
leftcert=daveCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
right=192.168.0.1
rightsubnet=10.1.0.0/16
[email protected]
auto=add
testing/hosts/dave/etc/network/interfaces
+12
View File
@@ -0,0 +1,12 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address PH_IP_DAVE
netmask 255.255.255.0
broadcast 192.168.0.255
gateway 192.168.0.254
iface eth0 inet6 static
address PH_IP6_DAVE
netmask 16
testing/hosts/dave/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/default/etc/default/slapd
+45
View File
@@ -0,0 +1,45 @@
# Default location of the slapd.conf file or slapd.d cn=config directory. If
# empty, use the compiled-in default (/etc/ldap/slapd.d with a fallback to
# /etc/ldap/slapd.conf).
SLAPD_CONF=/etc/ldap/slapd.conf
# System account to run the slapd server under. If empty the server
# will run as root.
SLAPD_USER="openldap"
# System group to run the slapd server under. If empty the server will
# run in the primary group of its user.
SLAPD_GROUP="openldap"
# Path to the pid file of the slapd server. If not set the init.d script
# will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.conf by
# default)
SLAPD_PIDFILE=
# slapd normally serves ldap only on all TCP-ports 389. slapd can also
# service requests on TCP-port 636 (ldaps) and requests via unix
# sockets.
# Example usage:
# SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"
SLAPD_SERVICES="ldap:///"
# If SLAPD_NO_START is set, the init script will not start or restart
# slapd (but stop will still work). Uncomment this if you are
# starting slapd via some other means or if you don't want slapd normally
# started at boot.
#SLAPD_NO_START=1
# If SLAPD_SENTINEL_FILE is set to path to a file and that file exists,
# the init script will not start or restart slapd (but stop will still
# work). Use this for temporarily disabling startup of slapd (when doing
# maintenance, for example, or through a configuration management system)
# when you don't want to edit a configuration file.
SLAPD_SENTINEL_FILE=/etc/ldap/noslapd
# For Kerberos authentication (via SASL), slapd by default uses the system
# keytab file (/etc/krb5.keytab). To use a different keytab file,
# uncomment this line and change the path.
#export KRB5_KTNAME=/etc/krb5.keytab
# Additional options to pass to slapd
SLAPD_OPTIONS=""
testing/hosts/default/etc/iptables.flush
+21
View File
@@ -0,0 +1,21 @@
*filter
-F
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P FORWARD ACCEPT
COMMIT
*nat
-F
COMMIT
*mangle
-F
COMMIT
testing/hosts/default/etc/iptables.rules
+24
View File
@@ -0,0 +1,24 @@
*filter
# default policy is DROP
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
# allow esp
-A INPUT -i eth0 -p 50 -j ACCEPT
-A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
COMMIT
testing/hosts/default/etc/rsyslog.conf
+125
View File
@@ -0,0 +1,125 @@
# /etc/rsyslog.conf Configuration file for rsyslog.
#
# For more information see
# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#################
#### MODULES ####
#################
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support
#$ModLoad immark # provides --MARK-- message capability
# Don't drop messages
$SystemLogRateLimitInterval 0
$RepeatedMsgReduction off
# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
###############
#### RULES ####
###############
#
# First some standard log files. Log by facility.
#
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* /var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
#
# Logging for the mail system. Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
#
# Logging for INN news system.
#
news.crit /var/log/news/news.crit
news.err /var/log/news/news.err
news.notice -/var/log/news/news.notice
#
# Some "catch-all" log files.
#
*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages
#
# Emergencies are sent to everybody logged in.
#
*.emerg :omusrmsg:*
#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
# news.=crit;news.=err;news.=notice;\
# *.=debug;*.=info;\
# *.=notice;*.=warn /dev/tty8
# The named pipe /dev/xconsole is for the `xconsole' utility. To use it,
# you must invoke `xconsole' with the `-file' option:
#
# $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
# busy site..
#
daemon.*;mail.*;\
news.err;\
*.=debug;*.=info;\
*.=notice;*.=warn |/dev/xconsole
testing/hosts/default/etc/security/limits.conf
+58
View File
@@ -0,0 +1,58 @@
# /etc/security/limits.conf
#
#Each line describes a limit for a user in the form:
#
#<domain> <type> <item> <value>
#
#Where:
#<domain> can be:
# - an user name
# - a group name, with @group syntax
# - the wildcard *, for default entry
# - the wildcard %, can be also used with %group syntax,
# for maxlogin limit
# - NOTE: group and wildcard limits are not applied to root.
# To apply a limit to the root user, <domain> must be
# the literal username root.
#
#<type> can have the two values:
# - "soft" for enforcing the soft limits
# - "hard" for enforcing hard limits
#
#<item> can be one of the following:
# - core - limits the core file size (KB)
# - data - max data size (KB)
# - fsize - maximum filesize (KB)
# - memlock - max locked-in-memory address space (KB)
# - nofile - max number of open files
# - rss - max resident set size (KB)
# - stack - max stack size (KB)
# - cpu - max CPU time (MIN)
# - nproc - max number of processes
# - as - address space limit (KB)
# - maxlogins - max number of logins for this user
# - maxsyslogins - max number of logins on the system
# - priority - the priority to run user process with
# - locks - max number of file locks the user can hold
# - sigpending - max number of pending signals
# - msgqueue - max memory used by POSIX message queues (bytes)
# - nice - max nice priority allowed to raise to values: [-20, 19]
# - rtprio - max realtime priority
# - chroot - change root to directory (Debian-specific)
#
#<domain> <type> <item> <value>
#
#* soft core 0
#root hard core 100000
#* hard rss 10000
#@student hard nproc 20
#@faculty soft nproc 20
#@faculty hard nproc 50
#ftp hard nproc 0
#ftp - chroot /ftp
#@student - maxlogins 4
* hard core unlimited
# End of file
testing/hosts/default/etc/sysctl.conf
+60
View File
@@ -0,0 +1,60 @@
#
# /etc/sysctl.conf - Configuration file for setting system variables
# See /etc/sysctl.d/ for additonal system variables
# See sysctl.conf (5) for information.
#
#kernel.domainname = example.com
# Uncomment the following to stop low-level messages on console
#kernel.printk = 3 4 1 3
##############################################################3
# Functions previously found in netbase
#
# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
#net.ipv4.conf.default.rp_filter=1
#net.ipv4.conf.all.rp_filter=1
# Uncomment the next line to enable TCP/IP SYN cookies
# See http://lwn.net/Articles/277146/
# Note: This may impact IPv6 TCP sessions too
#net.ipv4.tcp_syncookies=1
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1
# Uncomment the next line to enable packet forwarding for IPv6
# Enabling this option disables Stateless Address Autoconfiguration
# based on Router Advertisements for this host
net.ipv6.conf.all.forwarding=1
###################################################################
# Additional settings - these settings can improve the network
# security of the host and prevent against some network attacks
# including spoofing attacks and man in the middle attacks through
# redirection. Some network environments, however, require that these
# settings are disabled so review and enable them as needed.
#
# Do not accept ICMP redirects (prevent MITM attacks)
#net.ipv4.conf.all.accept_redirects = 0
#net.ipv6.conf.all.accept_redirects = 0
# _or_
# Accept ICMP redirects only for gateways listed in our default
# gateway list (enabled by default)
# net.ipv4.conf.all.secure_redirects = 1
#
# Do not send ICMP redirects (we are not a router)
#net.ipv4.conf.all.send_redirects = 0
#
# Do not accept IP source route packets (we are not a router)
#net.ipv4.conf.all.accept_source_route = 0
#net.ipv6.conf.all.accept_source_route = 0
#
# Log Martian Packets
#net.ipv4.conf.all.log_martians = 1
#
testing/hosts/moon/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=moon
testing/hosts/moon/etc/conf.d/net
-12
View File
@@ -1,12 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_MOON broadcast 192.168.0.255 netmask 255.255.255.0"
"PH_IP6_MOON/16" )
config_eth1=( "PH_IP_MOON1 broadcast 10.1.255.255 netmask 255.255.0.0"
"PH_IP6_MOON1/16" )
# For setting the default gateway
#
routes_eth0=( "default via 192.168.0.254" )
testing/hosts/moon/etc/hostname
+1
View File
@@ -0,0 +1 @@
moon
testing/hosts/moon/etc/init.d/iptables
-80
View File
@@ -1,80 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/moon/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/moon/etc/init.d/net.eth1
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/moon/etc/ipsec.conf
Executable → Regular
+4 -4
View File
@@ -7,20 +7,20 @@ conn %default
keylife=20m
rekeymargin=3m
keyingtries=1
left=PH_IP_MOON
left=192.168.0.1
leftcert=moonCert.pem
[email protected]
leftfirewall=yes
conn net-net
leftsubnet=10.1.0.0/16
right=PH_IP_SUN
right=192.168.0.2
rightsubnet=10.2.0.0/16
[email protected]
auto=add
conn host-host
right=PH_IP_SUN
right=192.168.0.2
[email protected]
auto=add
testing/hosts/moon/etc/network/interfaces
+21
View File
@@ -0,0 +1,21 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address PH_IP_MOON
netmask 255.255.255.0
broadcast 192.168.0.255
gateway 192.168.0.254
iface eth0 inet6 static
address PH_IP6_MOON
netmask 16
auto eth1
iface eth1 inet static
address PH_IP_MOON1
netmask 255.255.0.0
broadcast 10.1.255.255
iface eth1 inet6 static
address PH_IP6_MOON1
netmask 16
testing/hosts/moon/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/moon/etc/runlevels/default/net.eth1
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/ssh_host_rsa_key.pub
-1
View File
@@ -1 +0,0 @@
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAsxKfTm05po6leGD8C+M0eAR5EE4s1pQXc0D/dVlqrmfZ65h5BFQY9lnwpCvapV6OVqKWx8ICmeIH3OhaPxPPNKlU81f3d0xgh8BRJpWh459DYkRVa5f7ax5eeFE1lelj9s1d0seUl/IZolpJ8Wmt9TN1hwJ0mrkwN4670rb3urc=
testing/hosts/sun/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=sun
testing/hosts/sun/etc/conf.d/net
-14
View File
@@ -1,14 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_SUN broadcast 192.168.0.255 netmask 255.255.255.0"
"PH_IP6_SUN/16" )
config_eth1=( "PH_IP_SUN1 broadcast 10.2.255.255 netmask 255.255.0.0"
"PH_IP6_SUN1/16" )
# For setting the default gateway
#
routes_eth0=( "default via 192.168.0.254" )
testing/hosts/sun/etc/hostname
+1
View File
@@ -0,0 +1 @@
sun
testing/hosts/sun/etc/init.d/iptables
-80
View File
@@ -1,80 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
# allow NAT-T
iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/sun/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/sun/etc/init.d/net.eth1
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/sun/etc/ipsec.conf
Executable → Regular
+3 -3
View File
@@ -7,20 +7,20 @@ conn %default
keylife=20m
rekeymargin=3m
keyingtries=1
left=PH_IP_SUN
left=192.168.0.2
leftcert=sunCert.pem
[email protected]
leftfirewall=yes
conn net-net
leftsubnet=10.2.0.0/16
right=PH_IP_MOON
right=192.168.0.1
rightsubnet=10.1.0.0/16
[email protected]
auto=add
conn host-host
right=PH_IP_MOON
right=192.168.0.1
[email protected]
auto=add
testing/hosts/sun/etc/network/interfaces
+21
View File
@@ -0,0 +1,21 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address PH_IP_SUN
netmask 255.255.255.0
broadcast 192.168.0.255
gateway 192.168.0.254
iface eth0 inet6 static
address PH_IP6_SUN
netmask 16
auto eth1
iface eth1 inet static
address PH_IP_SUN1
netmask 255.255.0.0
broadcast 10.2.255.255
iface eth1 inet6 static
address PH_IP6_SUN1
netmask 16
testing/hosts/sun/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/sun/etc/runlevels/default/net.eth1
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/venus/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=venus
testing/hosts/venus/etc/conf.d/net
-10
View File
@@ -1,10 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_VENUS broadcast 10.1.255.255 netmask 255.255.0.0"
"PH_IP6_VENUS/16" )
# For setting the default gateway
#
routes_eth0=( "default via PH_IP_MOON1" )
testing/hosts/venus/etc/hostname
+1
View File
@@ -0,0 +1 @@
venus
testing/hosts/venus/etc/init.d/iptables
-74
View File
@@ -1,74 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow NAT-T
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/venus/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/venus/etc/ipsec.conf
Executable → Regular
+1 -1
View File
@@ -13,7 +13,7 @@ conn nat-t
leftcert=venusCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_SUN
right=192.168.0.2
[email protected]
rightsubnet=10.2.0.0/16
auto=add
testing/hosts/venus/etc/network/interfaces
+12
View File
@@ -0,0 +1,12 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address PH_IP_VENUS
netmask 255.255.0.0
broadcast 10.1.255.255
gateway 10.1.0.1
iface eth0 inet6 static
address PH_IP6_VENUS
netmask 16
testing/hosts/venus/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/winnetou/etc/apache2/conf.d/testresults-as-text
+1
View File
@@ -0,0 +1 @@
AddType text/plain .iptables .log .sql
testing/hosts/winnetou/etc/apache2/conf/ssl/ca.crt
-22
View File
@@ -1,22 +0,0 @@
-----BEGIN CERTIFICATE-----
MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u
Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y
X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f
FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc
4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/
7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5
gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr
K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud
DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw
ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/
lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n
+g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE
UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy
0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy
gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8=
-----END CERTIFICATE-----
testing/hosts/winnetou/etc/apache2/conf/ssl/server.crt
-24
View File
@@ -1,24 +0,0 @@
-----BEGIN CERTIFICATE-----
MIIEFTCCAv2gAwIBAgIBDjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
b290IENBMB4XDTA1MDYwODE5MTcxNFoXDTEwMDYwNzE5MTcxNFowSjELMAkGA1UE
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xIDAeBgNVBAMTF3dpbm5l
dG91LnN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAwBkz95BmByWVZaEW8cDbeuGr4C1caGAj4QPmuwaIriK+7XqXuh16Ahe3S5vZ
F56WhUSvMDOIyULckKH84oSa3Jx/SCz0g7X42x8vZuq92tpsjcP/u7BlyqpBUtLa
r14qm5wYw/1nQqMcSG3k9MQOQ+e9KgaGqpidxWM/8T4M/41AaFRBK2gQGBUULo26
sjoq3af7Z2jYmWkP/kzj1CHLy9Mgt+UvhKeA+ag5cZnyOG596cqVjlKyqG7vdggk
wW2n+/KDpHNOndYfT7GMFeGXUNzJPkCImWlttic7ssi0mjP3q3MuOP3FNHIRMd2H
AcNcqT0bgdJHqnNzGv8C0Ei9XQIDAQABo4IBCTCCAQUwCQYDVR0TBAIwADALBgNV
HQ8EBAMCA6gwHQYDVR0OBBYEFEMS0mbhrA4zDvmfKf4MntUNxkH4MG0GA1UdIwRm
MGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYDVQQGEwJDSDEZMBcG
A1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBSb290
IENBggEAMCIGA1UdEQQbMBmCF3dpbm5ldG91LnN0cm9uZ3N3YW4ub3JnMDkGA1Ud
HwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcvc3Ryb25nc3dh
bi5jcmwwDQYJKoZIhvcNAQEEBQADggEBACO4+j1Mwt/lbkopeSJst46uFh7OtegG
6IWNE30i3l3FIn9slSwAOMtmZR0hAF8sExvk61EPlzCR/d9trSJ5+gyjPkeF/enw
p61rxPMT13Grzomi9gYlk6Q/0zLmE9uYWEY69Q0bEIUcfdZfwB+F7kesa946JNMc
yHfVEhKtvzmns9ueG0S/8E+6MPDeJv+JHQ++SdWSvOVg6JNxXDGusnim2fjM2Aln
JmqA6iU4IaPl9DUCuXlLOVv/YhwhviNEbF94upyHq8xjOZdzPbKroHXg/2yvalAw
4aXc/ZsnFxqsq3i6a2Fj1Y4J7gYsNO/HwA0xvKz3loOTqHaJqO/qeow=
-----END CERTIFICATE-----
testing/hosts/winnetou/etc/apache2/conf/ssl/server.key
-27
View File
@@ -1,27 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAwBkz95BmByWVZaEW8cDbeuGr4C1caGAj4QPmuwaIriK+7XqX
uh16Ahe3S5vZF56WhUSvMDOIyULckKH84oSa3Jx/SCz0g7X42x8vZuq92tpsjcP/
u7BlyqpBUtLar14qm5wYw/1nQqMcSG3k9MQOQ+e9KgaGqpidxWM/8T4M/41AaFRB
K2gQGBUULo26sjoq3af7Z2jYmWkP/kzj1CHLy9Mgt+UvhKeA+ag5cZnyOG596cqV
jlKyqG7vdggkwW2n+/KDpHNOndYfT7GMFeGXUNzJPkCImWlttic7ssi0mjP3q3Mu
OP3FNHIRMd2HAcNcqT0bgdJHqnNzGv8C0Ei9XQIDAQABAoIBACYiWrCgl8B/c4Lz
Uay4Tlm8hvQ/zQJjY3v93EXwbB21hBV8qrYlt9zGfHqj+5q2vsbB9c0pzdO2VDba
EWueS2fUIWhglEG5VCebrztNCldx2O7jo9bMk8iBt+oLNaJunSK7ACeYHHGcE7dF
KZh1eyd7z4+SMBWZqmhO5ZisasQoHCusVGepcyyMGQNkc3XKJ6resGAsOqrOoq7Q
C4vO5Kkbnk8nnEGmQ/ldD8LwIyq1hzVLDiiqWXZgh6S5l4BEo7Dy3KYrZoZfVcZK
GMVhAI2+uA1ZqY9twpwryT6VZ3eK4DXF/COQntiBW5pLOpaqTOnKqiVmZFwfbo3u
cq8n5jkCgYEA5zgzRLifbM0q34c2HX8pTegh+BH7MGCxtcoU2uRPaXiGkqQObHI9
aItrgUQp+pAmKSBnEWJKgKsOh2Uf5ogjIeNuruGG/AXw/Pw2ORHNueenhDuhu69T
E2I4yxT3PPYbdzJ4ylBElfgm9WTrv7Wi7wSSfgQ6rEFdWukXa5vvsqMCgYEA1K+q
m1Jv9MGVIVc6MxhuOOj2Ym+qcWt/Pjvg78rR8SRsKwHlGTuv1rdWUSXYDr3f2Nf7
6DdbJtaSx5f8gY/UG34yGZx5FFbYV03vcCYBaLXsi/b6H7vb/VW74Y5g6bXqnprv
4mcdVU7xfyNFgdbLPAP9sYVLijPYDwm0Qq3cz/8CgYBKSJz4BBR8AQI4JBl3qoXb
mKtpJmW76iTN0amXlWgJ64XYkMptftpJvxj/w6V08WDBL77NL/XdlpcpWozAJJac
6ZOCrcQPLd15eZH2Dck5Y7pG2l2gjbgz7wdt/0NbG3pBdj6mSNlwEPR7PDwdMD6z
aZWi1LsA4lMaxO4YTVXZ3wKBgQCoFhTNH/+e/YawjNFQJFSn4WUnMn0Pmhc7xfLl
T/NPkqtx6dN3d7ZmCQrMow33yJOqOje5tFXzgc0KtNE4S8Uj3T4XA5SlQGVFyjAa
/85JRM2naA8RGVSpCCKuBeoNilnb8zL2SOvjyboN8oAyNuDzk2vh6ihjFsoASHkP
4XwLXQKBgQC0k6rzt/plIwEiP56XXOqwOxJj6kuE/hx1zGIiGT6lWiOsih20Ym2T
kYegVFvuDIWmSIAxGONWyee1lfnJbEuaHRixWQTnHUpqrU0FSnZTubnR3q/faZat
hrvLDdpa0ydAKoMEn3qUPSrh3CdBfi3KTQAQn2Mlk7bGHh9ICWi3vA==
-----END RSA PRIVATE KEY-----
testing/hosts/winnetou/etc/apache2/modules.d/00_mod_mime.conf
-61
View File
@@ -1,61 +0,0 @@
# DefaultType: the default MIME type the server will use for a document
# if it cannot otherwise determine one, such as from filename extensions.
# If your server contains mostly text or HTML documents, "text/plain" is
# a good value. If most of your content is binary, such as applications
# or images, you may want to use "application/octet-stream" instead to
# keep browsers from trying to display binary files as though they are
# text.
DefaultType text/plain
<IfModule mime_module>
# TypesConfig points to the file containing the list of mappings from
# filename extension to MIME-type.
TypesConfig /etc/mime.types
# AddType allows you to add to or override the MIME configuration
# file specified in TypesConfig for specific file types.
#AddType application/x-gzip .tgz
# AddEncoding allows you to have certain browsers uncompress
# information on the fly. Note: Not all browsers support this.
#AddEncoding x-compress .Z
#AddEncoding x-gzip .gz .tgz
# If the AddEncoding directives above are commented-out, then you
# probably should define those extensions to indicate media types:
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
# AddHandler allows you to map certain file extensions to "handlers":
# actions unrelated to filetype. These can be either built into the server
# or added with the Action directive (see below)
# To use CGI scripts outside of ScriptAliased directories:
# (You will also need to add "ExecCGI" to the "Options" directive.)
AddHandler cgi-script .cgi
# For files that include their own HTTP headers:
#AddHandler send-as-is asis
# For server-parsed imagemap files:
#AddHandler imap-file map
# For type maps (negotiated resources):
AddHandler type-map var
# Filters allow you to process content before it is sent to the client.
#
# To parse .shtml files for server-side includes (SSI):
# (You will also need to add "Includes" to the "Options" directive.)
#AddType text/html .shtml
#AddOutputFilter INCLUDES .shtml
</IfModule>
<IfModule mime_magic_module>
# The mod_mime_magic module allows the server to use various hints from the
# contents of the file itself to determine its type. The MIMEMagicFile
# directive tells the module where the hint definitions are located.
MIMEMagicFile /etc/apache2/magic
</IfModule>
# vim: ts=4 filetype=apache
testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf → testing/hosts/winnetou/etc/apache2/sites-enabled/001-ocsp_vhost
+2
View File
@@ -2,6 +2,8 @@
Listen 8880
AddHandler cgi-script .cgi
<VirtualHost *:8880>
ServerAdmin [email protected]
DocumentRoot /etc/openssl/ocsp
testing/hosts/winnetou/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=winnetou
testing/hosts/winnetou/etc/conf.d/net
-10
View File
@@ -1,10 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_WINNETOU broadcast 192.168.0.255 netmask 255.255.255.0"
"PH_IP6_WINNETOU/16" )
# For setting the default gateway
#
routes_eth0=( "default via 192.168.0.254" )
testing/hosts/winnetou/etc/conf.d/slapd
-8
View File
@@ -1,8 +0,0 @@
# conf.d file for the openldap-2.1 series
#
# To enable both the standard unciphered server and the ssl encrypted
# one uncomment this line or set any other server starting options
# you may desire.
#
# OPTS="-h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'"
OPTS="-4"
testing/hosts/winnetou/etc/init.d/apache2
-121
View File
@@ -1,121 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2007 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="configtest fullstatus graceful gracefulstop modules reload"
depend() {
need net
use mysql dns logger netmount postgresql
after sshd
}
configtest() {
ebegin "Checking Apache Configuration"
checkconfig
eend $?
}
checkconfig() {
SERVERROOT="${SERVERROOT:-/usr/lib/apache2}"
if [ ! -d ${SERVERROOT} ]; then
eerror "SERVERROOT does not exist: ${SERVERROOT}"
return 1
fi
CONFIGFILE="${CONFIGFILE:-/etc/apache2/httpd.conf}"
[ "${CONFIGFILE#/}" = "${CONFIGFILE}" ] && CONFIGFILE="${SERVERROOT}/${CONFIGFILE}"
if [ ! -r "${CONFIGFILE}" ]; then
eerror "Unable to read configuration file: ${CONFIGFILE}"
return 1
fi
APACHE2_OPTS="${APACHE2_OPTS} -d ${SERVERROOT}"
APACHE2_OPTS="${APACHE2_OPTS} -f ${CONFIGFILE}"
[ -n "${STARTUPERRORLOG}" ] && APACHE2_OPTS="${APACHE2_OPTS} -E ${STARTUPERRORLOG}"
APACHE2="/usr/sbin/apache2"
${APACHE2} ${APACHE2_OPTS} -t 1>/dev/null 2>&1
ret=$?
if [ $ret -ne 0 ]; then
eerror "Apache2 has detected a syntax error in your configuration files:"
${APACHE2} ${APACHE2_OPTS} -t
fi
return $ret
}
start() {
checkconfig || return 1
ebegin "Starting apache2"
[ -f /var/log/apache2/ssl_scache ] && rm /var/log/apache2/ssl_scache
start-stop-daemon --start --exec ${APACHE2} -- ${APACHE2_OPTS} -k start
eend $?
}
stop() {
checkconfig || return 1
ebegin "Stopping apache2"
start-stop-daemon --stop --retry -TERM/5/-KILL/5 --exec ${APACHE2} --pidfile /var/run/apache2.pid
eend $?
}
reload() {
RELOAD_TYPE="${RELOAD_TYPE:-graceful}"
checkconfig || return 1
if [ "${RELOAD_TYPE}" = "restart" ]; then
ebegin "Restarting apache2"
start-stop-daemon --stop --oknodo --signal HUP --exec ${APACHE2} --pidfile /var/run/apache2.pid
eend $?
elif [ "${RELOAD_TYPE}" = "graceful" ]; then
ebegin "Gracefully restarting apache2"
start-stop-daemon --stop --oknodo --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid
eend $?
else
eerror "${RELOAD_TYPE} is not a valid RELOAD_TYPE. Please edit /etc/conf.d/apache2"
fi
}
graceful() {
checkconfig || return 1
ebegin "Gracefully restarting apache2"
start-stop-daemon --stop --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid
eend $?
}
gracefulstop() {
checkconfig || return 1
# zap!
if service_started "${myservice}"; then
mark_service_stopped "${myservice}"
fi
ebegin "Gracefully stopping apache2"
# 28 is SIGWINCH
start-stop-daemon --stop --signal 28 --exec ${APACHE2} --pidfile /var/run/apache2.pid
eend $?
}
modules() {
checkconfig || return 1
${APACHE2} ${APACHE2_OPTS} -M 2>&1
}
status() {
LYNX="${LYNX:-lynx -dump}"
STATUSURL="${STATUSURL:-http://localhost/server-status}"
${LYNX} ${STATUSURL} | awk ' /process$/ { print; exit } { print } '
}
fullstatus() {
LYNX="${LYNX:-lynx -dump}"
STATUSURL="${STATUSURL:-http://localhost/server-status}"
${LYNX} ${STATUSURL}
}
testing/hosts/winnetou/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/winnetou/etc/init.d/slapd
-25
View File
@@ -1,25 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/strongswan/testing/hosts/winnetou/etc/init.d/slapd,v 1.2 2005/05/31 14:04:43 as Exp $
depend() {
need net
}
start() {
ebegin "Starting ldap-server"
eval start-stop-daemon --start --quiet --pidfile /var/run/openldap/slapd.pid --exec /usr/lib/openldap/slapd -- -u ldap -g ldap "${OPTS}"
eend $?
if [ ! -e /var/lib/openldap-data/objectClass.bdb ]
then
sleep 5
ldapadd -x -D "cn=Manager, o=Linux strongSwan, c=CH" -w tuxmux -f /etc/openldap/ldif.txt
fi
}
stop() {
ebegin "Stopping ldap-server"
start-stop-daemon --stop --signal 2 --quiet --pidfile /var/run/openldap/slapd.pid
eend $?
}
testing/hosts/winnetou/etc/openldap/ldif.txt → testing/hosts/winnetou/etc/ldap/ldif.txt
+1 -2
View File
@@ -28,7 +28,7 @@ cACertificate;binary:< file:///etc/openssl/research/researchCert.der
dn: ou=Sales, o=Linux strongSwan, c=CH
objectclass: organizationalUnit
ou: Sales
ou: Sales
dn: cn=Sales CA, ou=Sales, o=Linux strongSwan, c=CH
objectClass: organizationalRole
@@ -37,4 +37,3 @@ objectClass: certificationAuthority
authorityRevocationList;binary:< file:///etc/openssl/sales/sales.crl
certificateRevocationList;binary:< file:///etc/openssl/sales/sales.crl
cACertificate;binary:< file:///etc/openssl/sales/salesCert.der
testing/hosts/winnetou/etc/ldap/slapd.conf
+23
View File
@@ -0,0 +1,23 @@
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
moduleload back_bdb.la
include /etc/ldap/schema/core.schema
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
#######################################################################
# BDB database definitions
#######################################################################
database bdb
suffix "o=Linux strongSwan,c=CH"
rootdn "cn=Manager,o=Linux strongSwan,c=CH"
checkpoint 32 30
rootpw tuxmux
directory /var/lib/ldap
index objectClass eq
testing/hosts/winnetou/etc/network/interfaces
+12
View File
@@ -0,0 +1,12 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address PH_IP_WINNETOU
netmask 255.255.255.0
broadcast 192.168.0.255
gateway 192.168.0.254
iface eth0 inet6 static
address PH_IP6_WINNETOU
netmask 16
testing/hosts/winnetou/etc/openldap/slapd.conf
-68
View File
@@ -1,68 +0,0 @@
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /etc/openldap/schema/core.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
# Load dynamic backend modules:
# modulepath /usr/lib/openldap/openldap
# moduleload back_bdb.la
# moduleload back_ldap.la
# moduleload back_ldbm.la
# moduleload back_passwd.la
# moduleload back_shell.la
# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
#######################################################################
# BDB database definitions
#######################################################################
database bdb
suffix "o=Linux strongSwan,c=CH"
rootdn "cn=Manager,o=Linux strongSwan,c=CH"
checkpoint 32 30 # <kbyte> <min>
# Cleartext passwords, especially for the rootdn, should
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw tuxmux
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/lib/openldap-data
# Indices to maintain
index objectClass eq
testing/hosts/winnetou/etc/openssl/generate-crl
+10 -8
View File
@@ -16,30 +16,32 @@
export COMMON_NAME=strongSwan
ROOT=/var/www
cd /etc/openssl
openssl ca -gencrl -crldays 30 -config /etc/openssl/openssl.cnf -out crl.pem
openssl crl -in crl.pem -outform der -out strongswan.crl
cp strongswan.crl /var/www/localhost/htdocs/
cp strongswanCert.pem /var/www/localhost/htdocs/
cp index.html /var/www/localhost/htdocs/
cp strongswan.crl ${ROOT}
cp strongswanCert.pem ${ROOT}
cp index.html ${ROOT}
cd /etc/openssl/research
openssl ca -gencrl -crldays 15 -config /etc/openssl/research/openssl.cnf -out crl.pem
openssl crl -in crl.pem -outform der -out research.crl
cp research.crl /var/www/localhost/htdocs/
cp research.crl ${ROOT}
cd /etc/openssl/sales
openssl ca -gencrl -crldays 15 -config /etc/openssl/sales/openssl.cnf -out crl.pem
openssl crl -in crl.pem -outform der -out sales.crl
cp sales.crl /var/www/localhost/htdocs/
cp sales.crl ${ROOT}
cd /etc/openssl/ecdsa
openssl ca -gencrl -crldays 15 -config /etc/openssl/ecdsa/openssl.cnf -out crl.pem
openssl crl -in crl.pem -outform der -out strongswan_ec.crl
cp strongswan_ec.crl /var/www/localhost/htdocs/
cp strongswan_ec.crl ${ROOT}
cd /etc/openssl/monster
openssl ca -gencrl -crldays 15 -config /etc/openssl/monster/openssl.cnf -out crl.pem
openssl crl -in crl.pem -outform der -out strongswan-monster.crl
cp strongswan-monster.crl /var/www/localhost/htdocs/
cp strongswan-monster.crl ${ROOT}
cd /etc/openssl/rfc3779
openssl ca -gencrl -crldays 15 -config /etc/openssl/rfc3779/openssl.cnf -out crl.pem
openssl crl -in crl.pem -outform der -out strongswan_rfc3779.crl
cp strongswan_rfc3779.crl /var/www/localhost/htdocs/
cp strongswan_rfc3779.crl ${ROOT}
testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
+4 -4
View File
@@ -5,7 +5,7 @@ cd /etc/openssl
echo "Content-type: application/ocsp-response"
echo ""
/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout
cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi
+4 -4
View File
@@ -5,7 +5,7 @@ cd /etc/openssl/research
echo "Content-type: application/ocsp-response"
echo ""
/usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout
cat | /usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi
+4 -4
View File
@@ -5,7 +5,7 @@ cd /etc/openssl/sales
echo "Content-type: application/ocsp-response"
echo ""
/usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout
cat | /usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
testing/hosts/winnetou/etc/runlevels/default/apache2
-121
View File
@@ -1,121 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2007 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="configtest fullstatus graceful gracefulstop modules reload"
depend() {
need net
use mysql dns logger netmount postgresql
after sshd
}
configtest() {
ebegin "Checking Apache Configuration"
checkconfig
eend $?
}
checkconfig() {
SERVERROOT="${SERVERROOT:-/usr/lib/apache2}"
if [ ! -d ${SERVERROOT} ]; then
eerror "SERVERROOT does not exist: ${SERVERROOT}"
return 1
fi
CONFIGFILE="${CONFIGFILE:-/etc/apache2/httpd.conf}"
[ "${CONFIGFILE#/}" = "${CONFIGFILE}" ] && CONFIGFILE="${SERVERROOT}/${CONFIGFILE}"
if [ ! -r "${CONFIGFILE}" ]; then
eerror "Unable to read configuration file: ${CONFIGFILE}"
return 1
fi
APACHE2_OPTS="${APACHE2_OPTS} -d ${SERVERROOT}"
APACHE2_OPTS="${APACHE2_OPTS} -f ${CONFIGFILE}"
[ -n "${STARTUPERRORLOG}" ] && APACHE2_OPTS="${APACHE2_OPTS} -E ${STARTUPERRORLOG}"
APACHE2="/usr/sbin/apache2"
${APACHE2} ${APACHE2_OPTS} -t 1>/dev/null 2>&1
ret=$?
if [ $ret -ne 0 ]; then
eerror "Apache2 has detected a syntax error in your configuration files:"
${APACHE2} ${APACHE2_OPTS} -t
fi
return $ret
}
start() {
checkconfig || return 1
ebegin "Starting apache2"
[ -f /var/log/apache2/ssl_scache ] && rm /var/log/apache2/ssl_scache
start-stop-daemon --start --exec ${APACHE2} -- ${APACHE2_OPTS} -k start
eend $?
}
stop() {
checkconfig || return 1
ebegin "Stopping apache2"
start-stop-daemon --stop --retry -TERM/5/-KILL/5 --exec ${APACHE2} --pidfile /var/run/apache2.pid
eend $?
}
reload() {
RELOAD_TYPE="${RELOAD_TYPE:-graceful}"
checkconfig || return 1
if [ "${RELOAD_TYPE}" = "restart" ]; then
ebegin "Restarting apache2"
start-stop-daemon --stop --oknodo --signal HUP --exec ${APACHE2} --pidfile /var/run/apache2.pid
eend $?
elif [ "${RELOAD_TYPE}" = "graceful" ]; then
ebegin "Gracefully restarting apache2"
start-stop-daemon --stop --oknodo --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid
eend $?
else
eerror "${RELOAD_TYPE} is not a valid RELOAD_TYPE. Please edit /etc/conf.d/apache2"
fi
}
graceful() {
checkconfig || return 1
ebegin "Gracefully restarting apache2"
start-stop-daemon --stop --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid
eend $?
}
gracefulstop() {
checkconfig || return 1
# zap!
if service_started "${myservice}"; then
mark_service_stopped "${myservice}"
fi
ebegin "Gracefully stopping apache2"
# 28 is SIGWINCH
start-stop-daemon --stop --signal 28 --exec ${APACHE2} --pidfile /var/run/apache2.pid
eend $?
}
modules() {
checkconfig || return 1
${APACHE2} ${APACHE2_OPTS} -M 2>&1
}
status() {
LYNX="${LYNX:-lynx -dump}"
STATUSURL="${STATUSURL:-http://localhost/server-status}"
${LYNX} ${STATUSURL} | awk ' /process$/ { print; exit } { print } '
}
fullstatus() {
LYNX="${LYNX:-lynx -dump}"
STATUSURL="${STATUSURL:-http://localhost/server-status}"
${LYNX} ${STATUSURL}
}
testing/hosts/winnetou/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff