#!/bin/sh
#automated update script for Gentoo linux
 
to="login@isp.com" #FIXME
from="root@localhost"
subject="[PKG-UPDATES]"
smtp="smtp.your-isp.com" #FIXME
log="/root/update.log"
 
emerge --sync
emerge -Dvp world | grep "ebuild" > $log
emerge -D world
env-update >> $log
rm -rf /usr/portage/distfiles/*
rm -rf /var/tmp/portage/*
rm -f /root/dead.letter
sendEmail -f $from -s $smtp -t $to -u $subject -m "`cat $log`"
rm -f $log
updatedb
eupdatedb

#!/bin/sh
 
#######################   ENVIRONNEMENT   ##############################
 
#le chemin ou se trouve iptables
IPT=/sbin/iptables
 
#l'interface du modem
IF_NET=eth0
#l'interface du reseau local
IF_LAN=eth1
IF_WIFI=ra0
 
#IP de la passerelle (statique)
FAI_IP=`ifconfig $IF_NET | grep inet | cut -d: -f2 | cut -d' ' -f1`
 
TRUSTED=82.228.xxxxxx
#plage d'adresses du reseau local
LAN_IP=192.168.0.0/24
WIFI_IP=192.168.1.0/24
 
#un peu de faineantise ca fait pas de mal
NER="--state NEW,ESTABLISHED,RELATED"
ER="--state ESTABLISHED,RELATED"
N="--state NEW"
E="--state ESTABLISHED"
NE="--state NEW,ESTABLISHED"
LIM="--limit 5/minute"
 
######################   INITIALISATION  ###############################
 
#remise a zero et definition des politiques par défaut
$IPT -F
$IPT -X
$IPT -Z
 
$IPT -t filter -P INPUT   DROP
$IPT -t filter -P FORWARD DROP
$IPT -t filter -P OUTPUT  DROP
 
#on autorise le trafic et le forwarding sur la machine locale
 
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
$IPT -A FORWARD -i lo -j ACCEPT
$IPT -A FORWARD -o lo -j ACCEPT
 
$IPT -A INPUT -i $IF_LAN -j ACCEPT
$IPT -A OUTPUT -o $IF_LAN -j ACCEPT
$IPT -A FORWARD -i $IF_LAN -j ACCEPT
$IPT -A FORWARD -o $IF_LAN -j ACCEPT
 
$IPT -A INPUT -i $IF_WIFI -j ACCEPT
$IPT -A OUTPUT -o $IF_WIFI -j ACCEPT
$IPT -A FORWARD -i $IF_WIFI -j ACCEPT
$IPT -A FORWARD -o $IF_WIFI -j ACCEPT
 
##################### PARTAGE DE CONNEXION ############################
 
#partage reseau local
$IPT -A FORWARD -i $IF_LAN -o $IF_NET -s $LAN_IP -m state $NER -j ACCEPT
$IPT -A FORWARD -i $IF_NET -o $IF_LAN -d $LAN_IP -m state $ER -j ACCEPT
$IPT -t nat -A POSTROUTING -o $IF_NET -s $LAN_IP -j MASQUERADE
 
$IPT -A FORWARD -i $IF_WIFI -o $IF_NET -s $WIFI_IP -m state $NER -j ACCEPT
$IPT -A FORWARD -i $IF_NET -o $IF_WIFI -d $WIFI_IP -m state $ER -j ACCEPT
$IPT -t nat -A POSTROUTING -o $IF_NET -s $WIFI_IP -j MASQUERADE
 
###################### DROP SALETES ##################################
 
#drop des attaques de vers, messenger spams et autres pour pas pourrir les logs
DROP_PORTS="80 135 137 139 445 1433 1434 1025:1032 65535"
for port in $DROP_PORTS; do
    $IPT -A INPUT -p tcp --dport $port -j DROP
    $IPT -A INPUT -p udp --dport $port -j DROP
done
 
#drop des paquets avec un ttl < 5
$IPT -A INPUT -i $IF_NET -m ttl --ttl-lt 5 -j DROP
 
#####################  REGLES CLIENTS  ###############################
 
#on ouvre tout en sortie
 
$IPT -A OUTPUT -o $IF_NET -p tcp -m state $NER -j ACCEPT
$IPT -A OUTPUT -o $IF_NET -p udp -m state $NER -j ACCEPT
 
# 1863 => MSN
# 6891 => MSN file transfer
# 5050 => Yahoo
# 5190 => ICQ
TCP_PORTS="ftp ssh smtp domain nicname www pop3 ntp https rsync imaps 1863 5050 5190 6891 6667"
 
for port in $TCP_PORTS; do
    $IPT -A INPUT -i $IF_NET -p tcp --sport $port -m state $ER -j ACCEPT
done
 
UDP_PORTS="domain ntp"
 
for port in $UDP_PORTS; do
    $IPT -A INPUT -i $IF_NET -p udp --sport $port -m state $ER -j ACCEPT
done
 
###################### SERVEUR SSH ######################################
 
#on accepte les connexions des IP de confiance
$IPT -A INPUT -i $IF_NET -s $TRUSTED -p tcp --dport ssh -m state $NE -j ACCEPT
 
#au bout de 5 essais rates en une minute, on bloque les futures tentatives
$IPT -A INPUT -i $IF_NET -p tcp --dport ssh -m recent --update --seconds 60 --hitcount 5 --name SSH -j LOG --log-prefix "SSH brute-force"
$IPT -A INPUT -i $IF_NET -p tcp --dport ssh -m recent --update --seconds 60 --hitcount 5 --name SSH -j DROP
$IPT -A INPUT -i $IF_NET -p tcp --dport ssh -m recent --set --name SSH
$IPT -A INPUT -i $IF_NET -p tcp --dport ssh -m state $NE -j ACCEPT
 
 
####################### PING ###########################################
 
#on bloque les pings entrants
$IPT -A OUTPUT -o $IF_NET -p ICMP --icmp-type echo-reply -j ACCEPT
$IPT -A OUTPUT -o $IF_NET -p ICMP --icmp-type echo-request -j ACCEPT
$IPT -A OUTPUT -o $IF_NET -p ICMP --icmp-type destination-unreachable -j ACCEPT
$IPT -A INPUT  -i $IF_NET -p ICMP --icmp-type echo-reply -j ACCEPT
$IPT -A INPUT  -i $IF_NET -p ICMP --icmp-type destination-unreachable -j ACCEPT
 
 
##################### LOGS ############################
 
#règle de log de tous les paquets rejetés
$IPT -N OUT_DROP
$IPT -A OUT_DROP -j LOG --log-prefix "DROP-OUT "
$IPT -A OUT_DROP -j DROP
 
$IPT -N IN_DROP
$IPT -A IN_DROP -j LOG --log-prefix "DROP-IN "
$IPT -A IN_DROP -j DROP
 
#SI le paquet ne matche aucune des regles precedentes, on loggue et on drop
 
$IPT -A INPUT -j IN_DROP
$IPT -A OUTPUT -j OUT_DROP

peyo@KL:~$ cat .bash_logout && echo EOF
#------------------------------------------------------------------------------
# When leaving the console clear the screen to increase privacy.
# Also clear the scroll-back buffer by switching to tty63 and back.
#------------------------------------------------------------------------------
case "$(tty)" in
  /dev/tty[0-9])
    t=$(v=`tty` ; echo ${v##*ty})
    clear
    chvt 63; chvt "$t"
  ;;
 
  /dev/tty[0-9][0-9])
    t=$(v=`tty` ; echo ${v##*ty})
    clear
    chvt 63; chvt "$t"
  ;;
 
  *)
  ;;
esac
EOF

peyo@KL:~$ cat .bashrc && echo EOF
export PS1='\u@\h:\w\$ '
alias ls='ls --color=auto'
alias l="ls -lh"
alias la="ls -lha"
alias emacs="emacs -nw"
alias clean="rm -f *~ ; rm -f \#*"  #ici, on supprime tous les fichiers se terminant par ~ et tous les fichiers commencant par # (les *scratch* du cher emacs)
 
if [ `id -u` -eq 0 ]; then
    PS1='\[\033[0;31m\]\u@\h:\w \$ \[\033[0;37m\] '
else
    PS1='\u@\h:\w \$ '
fi
export PS1
EOF

peyo@KL:~ $ cat .fluxbox/startup && echo EOF
# fluxbox startup-script:
#
 
fbsetbg -l
xset -b
xset r rate 195 35
root-tail /var/log/messages --justify -g 1200x190+10+0 --minspace --update -f --reload 15
dclock -date '%A, %B %dth %Y' -miltime &
fbpager &
wmpiki &
wmmisc &
kopete &
xmodmap -e "remove Lock = Caps_Lock"
# And last but not least we start fluxbox.
# Because it is the last app you have to run it with ''exec'' before it.
exec /usr/X11R6/bin/fluxbox
EOF