From: Frank Brehm Date: Thu, 25 Feb 2016 14:46:12 +0000 (+0000) Subject: Current state X-Git-Url: https://git.uhu-banane.net/?a=commitdiff_plain;h=e42486d012f992f087fe1c193829b3b94df6ed51;p=config%2Fns2%2Fetc.git Current state --- diff --git a/aliases b/aliases new file mode 100644 index 0000000..a0f99a5 --- /dev/null +++ b/aliases @@ -0,0 +1,49 @@ +# See man 5 aliases for format +MAILER-DAEMON: postmaster +postmaster: root +root: frank + +# General redirections for pseudo accounts. +adm: root +bin: root +daemon: root +exim: root +lp: root +mail: root +named: root +nobody: root +postfix: root + +# Well-known aliases -- these should be filled in! +# root: +# operator: + +# Standard RFC2142 aliases +abuse: postmaster +ftp: root +hostmaster: root +news: usenet +noc: root +security: root +usenet: root +uucp: root +webmaster: root +www: webmaster + +# trap decode to catch security attacks +# decode: /dev/null + +# Persönliche Aliase + +# Frank Brehm +frank: frank@brehm-online.com +fbr: frank +brehm: frank +fbrehm: frank +f.brehm: frank +f-brehm: frank +frank.brehm: frank +frank-brehm: frank + + + diff --git a/aliases.db b/aliases.db new file mode 100644 index 0000000..20cbdfe Binary files /dev/null and b/aliases.db differ diff --git a/alternatives/Mail b/alternatives/Mail new file mode 120000 index 0000000..3d47966 --- /dev/null +++ b/alternatives/Mail @@ -0,0 +1 @@ +/usr/bin/heirloom-mailx \ No newline at end of file diff --git a/alternatives/Mail.1.gz b/alternatives/Mail.1.gz new file mode 120000 index 0000000..1917ecf --- /dev/null +++ b/alternatives/Mail.1.gz @@ -0,0 +1 @@ +/usr/share/man/man1/heirloom-mailx.1.gz \ No newline at end of file diff --git a/alternatives/figlet b/alternatives/figlet new file mode 120000 index 0000000..28ec836 --- /dev/null +++ b/alternatives/figlet @@ -0,0 +1 @@ +/usr/bin/figlet-figlet \ No newline at end of file diff --git a/alternatives/figlet.6.gz b/alternatives/figlet.6.gz new file mode 120000 index 0000000..550fbfc --- /dev/null +++ b/alternatives/figlet.6.gz @@ -0,0 +1 @@ +/usr/share/man/man6/figlet-figlet.6.gz \ No newline at end of file diff --git a/alternatives/mail b/alternatives/mail new file mode 120000 index 0000000..3d47966 --- /dev/null +++ b/alternatives/mail @@ -0,0 +1 @@ +/usr/bin/heirloom-mailx \ No newline at end of file diff --git a/alternatives/mail.1.gz b/alternatives/mail.1.gz new file mode 120000 index 0000000..1917ecf --- /dev/null +++ b/alternatives/mail.1.gz @@ -0,0 +1 @@ +/usr/share/man/man1/heirloom-mailx.1.gz \ No newline at end of file diff --git a/alternatives/mailx b/alternatives/mailx new file mode 120000 index 0000000..3d47966 --- /dev/null +++ b/alternatives/mailx @@ -0,0 +1 @@ +/usr/bin/heirloom-mailx \ No newline at end of file diff --git a/alternatives/mailx.1.gz b/alternatives/mailx.1.gz new file mode 120000 index 0000000..1917ecf --- /dev/null +++ b/alternatives/mailx.1.gz @@ -0,0 +1 @@ +/usr/share/man/man1/heirloom-mailx.1.gz \ No newline at end of file diff --git a/apm/event.d/01chrony b/apm/event.d/01chrony new file mode 100755 index 0000000..df52908 --- /dev/null +++ b/apm/event.d/01chrony @@ -0,0 +1,17 @@ +#!/bin/sh + +# Placed in /etc/apm/event.d by the chrony package at the instruction of +# the apmd maintainer. If you don't have apm and don't intend to install +# apmd you may remove it. It needs to run after 00hwclock but before any +# other scripts. + + +[ -x /usr/sbin/chronyd ] || exit 0 + +if [ "$1" = suspend ]; then + invoke-rc.d chrony stop +elif [ "$1" = standby ]; then + invoke-rc.d chrony stop +elif [ "$1" = resume ]; then + invoke-rc.d chrony start +fi diff --git a/apt/SALTSTACK-GPG-KEY.pub b/apt/SALTSTACK-GPG-KEY.pub new file mode 100644 index 0000000..919f272 --- /dev/null +++ b/apt/SALTSTACK-GPG-KEY.pub @@ -0,0 +1,31 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v2.0.22 (GNU/Linux) + +mQENBFOpvpgBCADkP656H41i8fpplEEB8IeLhugyC2rTEwwSclb8tQNYtUiGdna9 +m38kb0OS2DDrEdtdQb2hWCnswxaAkUunb2qq18vd3dBvlnI+C4/xu5ksZZkRj+fW +tArNR18V+2jkwcG26m8AxIrT+m4M6/bgnSfHTBtT5adNfVcTHqiT1JtCbQcXmwVw +WbqS6v/LhcsBE//SHne4uBCK/GHxZHhQ5jz5h+3vWeV4gvxS3Xu6v1IlIpLDwUts +kT1DumfynYnnZmWTGc6SYyIFXTPJLtnoWDb9OBdWgZxXfHEcBsKGha+bXO+m2tHA +gNneN9i5f8oNxo5njrL8jkCckOpNpng18BKXABEBAAG0MlNhbHRTdGFjayBQYWNr +YWdpbmcgVGVhbSA8cGFja2FnaW5nQHNhbHRzdGFjay5jb20+iQE4BBMBAgAiBQJT +qb6YAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAOCKFJ3le/vhkqB/0Q +WzELZf4d87WApzolLG+zpsJKtt/ueXL1W1KA7JILhXB1uyvVORt8uA9FjmE083o1 +yE66wCya7V8hjNn2lkLXboOUd1UTErlRg1GYbIt++VPscTxHxwpjDGxDB1/fiX2o +nK5SEpuj4IeIPJVE/uLNAwZyfX8DArLVJ5h8lknwiHlQLGlnOu9ulEAejwAKt9CU +4oYTszYM4xrbtjB/fR+mPnYh2fBoQO4d/NQiejIEyd9IEEMd/03AJQBuMux62tjA +/NwvQ9eqNgLw9NisFNHRWtP4jhAOsshv1WW+zPzu3ozoO+lLHixUIz7fqRk38q8Q +9oNR31KvrkSNrFbA3D89uQENBFOpvpgBCADJ79iH10AfAfpTBEQwa6vzUI3Eltqb +9aZ0xbZV8V/8pnuU7rqM7Z+nJgldibFk4gFG2bHCG1C5aEH/FmcOMvTKDhJSFQUx +uhgxttMArXm2c22OSy1hpsnVG68G32Nag/QFEJ++3hNnbyGZpHnPiYgej3FrerQJ +zv456wIsxRDMvJ1NZQB3twoCqwapC6FJE2hukSdWB5yCYpWlZJXBKzlYz/gwD/Fr +GL578WrLhKw3UvnJmlpqQaDKwmV2s7MsoZogC6wkHE92kGPG2GmoRD3ALjmCvN1E +PsIsQGnwpcXsRpYVCoW7e2nW4wUf7IkFZ94yOCmUq6WreWI4NggRcFC5ABEBAAGJ +AR8EGAECAAkFAlOpvpgCGwwACgkQDgihSd5Xv74/NggA08kEdBkiWWwJZUZEy7cK +WWcgjnRuOHd4rPeT+vQbOWGu6x4bxuVf9aTiYkf7ZjVF2lPn97EXOEGFWPZeZbH4 +vdRFH9jMtP+rrLt6+3c9j0M8SIJYwBL1+CNpEC/BuHj/Ra/cmnG5ZNhYebm76h5f +T9iPW9fFww36FzFka4VPlvA4oB7ebBtquFg3sdQNU/MmTVV4jPFWXxh4oRDDR+8N +1bcPnbB11b5ary99F/mqr7RgQ+YFF0uKRE3SKa7a+6cIuHEZ7Za+zhPaQlzAOZlx +fuBmScum8uQTrEF5+Um5zkwC7EXTdH1co/+/V/fpOtxIg4XO4kcugZefVm5ERfVS +MA== +=dtMN +-----END PGP PUBLIC KEY BLOCK----- diff --git a/apt/apt.conf.d/01autoremove-kernels b/apt/apt.conf.d/01autoremove-kernels index 4c86c0a..f2faef1 100644 --- a/apt/apt.conf.d/01autoremove-kernels +++ b/apt/apt.conf.d/01autoremove-kernels @@ -2,14 +2,25 @@ APT::NeverAutoRemove { "^linux-image-3\.16\.0-4-amd64$"; + "^linux-image-4\.3\.0-0\.bpo\.1-amd64$"; "^linux-headers-3\.16\.0-4-amd64$"; + "^linux-headers-4\.3\.0-0\.bpo\.1-amd64$"; "^linux-image-extra-3\.16\.0-4-amd64$"; + "^linux-image-extra-4\.3\.0-0\.bpo\.1-amd64$"; "^linux-signed-image-3\.16\.0-4-amd64$"; + "^linux-signed-image-4\.3\.0-0\.bpo\.1-amd64$"; "^kfreebsd-image-3\.16\.0-4-amd64$"; + "^kfreebsd-image-4\.3\.0-0\.bpo\.1-amd64$"; "^kfreebsd-headers-3\.16\.0-4-amd64$"; + "^kfreebsd-headers-4\.3\.0-0\.bpo\.1-amd64$"; "^gnumach-image-3\.16\.0-4-amd64$"; + "^gnumach-image-4\.3\.0-0\.bpo\.1-amd64$"; "^.*-modules-3\.16\.0-4-amd64$"; + "^.*-modules-4\.3\.0-0\.bpo\.1-amd64$"; "^.*-kernel-3\.16\.0-4-amd64$"; + "^.*-kernel-4\.3\.0-0\.bpo\.1-amd64$"; "^linux-backports-modules-.*-3\.16\.0-4-amd64$"; + "^linux-backports-modules-.*-4\.3\.0-0\.bpo\.1-amd64$"; "^linux-tools-3\.16\.0-4-amd64$"; + "^linux-tools-4\.3\.0-0\.bpo\.1-amd64$"; }; diff --git a/apt/sources.list.d/salt.list b/apt/sources.list.d/salt.list new file mode 100644 index 0000000..398af39 --- /dev/null +++ b/apt/sources.list.d/salt.list @@ -0,0 +1 @@ +deb http://repo.saltstack.com/apt/debian/8/amd64/latest jessie main diff --git a/apt/trusted.gpg b/apt/trusted.gpg new file mode 100644 index 0000000..a9079ba Binary files /dev/null and b/apt/trusted.gpg differ diff --git a/apticron/apticron.conf b/apticron/apticron.conf new file mode 100644 index 0000000..f6c2db9 --- /dev/null +++ b/apticron/apticron.conf @@ -0,0 +1,100 @@ +# apticron.conf +# +# set EMAIL to a space separated list of addresses which will be notified of +# impending updates +# +EMAIL="root" + +# +# Set DIFF_ONLY to "1" to only output the difference of the current run +# compared to the last run (ie. only new upgrades since the last run). If there +# are no differences, no output/email will be generated. By default, apticron +# will output everything that needs to be upgraded. +# +# DIFF_ONLY="1" + +# +# Set LISTCHANGES_PROFILE if you would like apticron to invoke apt-listchanges +# with the --profile option. You should add a corresponding profile to +# /etc/apt/listchanges.conf +# +# LISTCHANGES_PROFILE="apticron" + +# +# From hostname manpage: "Displays all FQDNs of the machine. This option +# enumerates all configured network addresses on all configured network inter‐ +# faces, and translates them to DNS domain names. Addresses that cannot be +# translated (i.e. because they do not have an appro‐ priate reverse DNS +# entry) are skipped. Note that different addresses may resolve to the same +# name, therefore the output may contain duplicate entries. Do not make any +# assumptions about the order of the output." +# +# ALL_FQDNS="1" + +# +# Set SYSTEM if you would like apticron to use something other than the output +# of "hostname -f" for the system name in the mails it generates. This option +# overrides the ALL_FQDNS above. +# +# SYSTEM="foobar.example.com" + +# +# Set IPADDRESSNUM if you would like to configure the maximal number of IP +# addresses apticron displays. The default is to display 1 address of each +# family type (inet, inet6), if available. +# +# IPADDRESSNUM="1" + +# +# Set IPADDRESSES to a whitespace separated list of reachable addresses for +# this system. By default, apticron will try to work these out using the +# "ip" command +# +# IPADDRESSES="192.0.2.1 2001:db8:1:2:3::1" + +# +# Set NOTIFY_HOLDS="0" if you don't want to be notified about new versions of +# packages on hold in your system. The default behavior is downloading and +# listing them as any other package. +# +# NOTIFY_HOLDS="0" + +# +# Set NOTIFY_NEW="0" if you don't want to be notified about packages which +# are not installed in your system. Yes, it's possible! There are some issues +# related to systems which have mixed stable/unstable sources. In these cases +# apt-get will consider for example that packages with "Priority: +# required"/"Essential: yes" in unstable but not in stable should be installed, +# so they will be listed in dist-upgrade output. Please take a look at +# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=531002#44 +# +# NOTIFY_NEW="0" + +# +# Set NOTIFY_NO_UPDATES="0" if you don't want to be notified when there is no +# new versions. Set to 1 could assure you that apticron works well. +# +# NOTIFY_NO_UPDATES="0" + +# +# Set CUSTOM_SUBJECT if you want to replace the default subject used in +# the notification e-mails. This may help filtering/sorting client-side e-mail. +# If you want to use internal vars please use single quotes here. Ex: +# $CUSTOM_SUBJECT='[apticron] $SYSTEM: $NUM_PACKAGES package update(s)' +# +# CUSTOM_SUBJECT="" + +# Set CUSTOM_NO_UPDATES_SUBJECT if you want to replace the default subject used +# in the no update notification e-mails. This may help filtering/sorting +# client-side e-mail. +# If you want to use internal vars please use single quotes here. Ex: +# $CUSTOM_NO_UPDATES_SUBJECT='[apticron] $SYSTEM: no updates' +# +# CUSTOM_NO_UPDATES_SUBJECT="" + +# +# Set CUSTOM_FROM if you want to replace the default sender by changing the +# 'From:' field used in the notification e-mails. Your default sender will +# be something like root@ns2. +# +# CUSTOM_FROM="" diff --git a/bash_completion.d/fail2ban b/bash_completion.d/fail2ban new file mode 100644 index 0000000..7a42bd1 --- /dev/null +++ b/bash_completion.d/fail2ban @@ -0,0 +1,149 @@ +# fail2ban bash-completion -*- shell-script -*- +# +# This file is part of Fail2Ban. +# +# Fail2Ban is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Fail2Ban is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Fail2Ban; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + +__fail2ban_jails () { + "$1" status 2>/dev/null | awk -F"\t+" '/Jail list/{print $2}' | sed 's/, / /g' +} + +_fail2ban () { + local cur prev words cword + _init_completion || return + + case $prev in + -V|--version|-h|--help) + return 0 # No further completion valid + ;; + -c) + _filedir -d # Directories + return 0 + ;; + -s|-p) + _filedir # Files + return 0 + ;; + *) + if [[ "$cur" == "-"* ]];then + COMPREPLY=( $( compgen -W \ + "$( _parse_help "$1" --help 2>/dev/null) -V" \ + -- "$cur") ) + return 0 + fi + ;; + esac + + if [[ "$1" == *"fail2ban-regex" ]];then + _filedir + return 0 + elif [[ "$1" == *"fail2ban-client" ]];then + local cmd jail + case $prev in + "$1") + COMPREPLY=( $( compgen -W \ + "$( "$1" --help 2>/dev/null | awk '/^ [a-z]+/{print $1}')" \ + -- "$cur") ) + return 0 + ;; + start|reload|stop|status) + COMPREPLY=( $(compgen -W "$(__fail2ban_jails "$1")" -- "$cur" ) ) + return 0 + ;; + set|get) + COMPREPLY=( $( compgen -W \ + "$( "$1" --help 2>/dev/null | awk '/^ '$prev' [^<]/{print $2}')" \ + -- "$cur") ) + COMPREPLY+=( $(compgen -W "$(__fail2ban_jails "$1")" -- "$cur" ) ) + return 0 + ;; + *) + if [[ "${words[$cword-2]}" == "add" ]];then + COMPREPLY=( $( compgen -W "auto polling gamin pyinotify" -- "$cur" ) ) + return 0 + elif [[ "${words[$cword-2]}" == "set" || "${words[$cword-2]}" == "get" ]];then + cmd="${words[cword-2]}" + # Handle in section below + elif [[ "${words[$cword-3]}" == "set" || "${words[$cword-3]}" == "get" ]];then + cmd="${words[$cword-3]}" + jail="${words[$cword-2]}" + # Handle in section below + fi + ;; + esac + + if [[ -z "$jail" && -n "$cmd" ]];then + case $prev in + loglevel) + if [[ "$cmd" == "set" ]];then + COMPREPLY=( $( compgen -W "0 1 2 3 4" -- "$cur" ) ) + fi + return 0 + ;; + logtarget) + if [[ "$cmd" == "set" ]];then + COMPREPLY=( $( compgen -W "STDOUT STDERR SYSLOG" -- "$cur" ) ) + _filedir # And files + fi + return 0 + ;; + *) # Jail name + COMPREPLY=( $( compgen -W \ + "$( "$1" --help 2>/dev/null | awk '/^ '${cmd}' /{print $3}')" \ + -- "$cur") ) + return 0 + ;; + esac + elif [[ -n "$jail" && "$cmd" == "set" ]];then + case $prev in + addlogpath) + _filedir + return 0 + ;; + dellogpath|delignoreip) + COMPREPLY=( $( compgen -W \ + "$( "$1" get "$jail" "${prev/del/}" 2>/dev/null | awk -F- '{print $2}')" \ + -- "$cur" ) ) + if [[ -z "$COMPREPLY" && "$prev" == "dellogpath" ]];then + _filedir + fi + return 0 + ;; + delfailregex|delignoregex) + COMPREPLY=( $( compgen -W \ + "$( "$1" get "$jail" "${prev/del/}" 2>/dev/null | awk -F"[][]" '{print $2}')" \ + -- "$cur" ) ) + return 0 + ;; + unbanip) + COMPREPLY=( $( compgen -W \ + "$( "$1" status "$jail" 2>/dev/null | awk -F"\t+" '/IP list:/{print $2}')" \ + -- "$cur" ) ) + return 0 + ;; + idle) + COMPREPLY=( $( compgen -W "on off" -- "$cur" ) ) + return 0 + ;; + usedns) + COMPREPLY=( $( compgen -W "yes no warn" -- "$cur" ) ) + return 0 + ;; + esac + fi + + fi # fail2ban-client +} && +complete -F _fail2ban fail2ban-client fail2ban-server fail2ban-regex diff --git a/bash_completion.d/isoquery b/bash_completion.d/isoquery new file mode 100644 index 0000000..c27ed05 --- /dev/null +++ b/bash_completion.d/isoquery @@ -0,0 +1,45 @@ +# /etc/bash_completion.d/isoquery +# Programmable Bash command completion for the ‘isoquery’ command. + +shopt -s progcomp + +_isoquery_completion () { + local cur prev opts + + COMPREPLY=() + cur="${COMP_WORDS[COMP_CWORD]}" + prev="${COMP_WORDS[COMP_CWORD-1]}" + + opts="-h --help -v --version" + opts="${opts} -i --iso -x --xmlfile -l --locale -0 --null" + opts="${opts} -n --name -o --official_name -c --common_name" + + case "${prev}" in + -i|--iso) + local standards=(639 639-3 639-5 3166 3166-2 4217 15924) + COMPREPLY=( $(compgen -W "${standards[*]}" -- ${cur}) ) + ;; + + -x|--xmlfile) + COMPREPLY=( $(compgen -A file -- ${cur}) ) + ;; + + -l|--locale) + local locale_names=$(locale --all-locales) + COMPREPLY=( $(compgen -W "${locale_names}" -- ${cur}) ) + ;; + + *) + COMPREPLY=($(compgen -W "${opts}" -- ${cur})) + ;; + esac +} + +complete -F _isoquery_completion isoquery + + +# Local variables: +# coding: utf-8 +# mode: shell-script +# End: +# vim: fileencoding=utf-8 filetype=bash : diff --git a/chrony/chrony.conf b/chrony/chrony.conf new file mode 100644 index 0000000..50d0c34 --- /dev/null +++ b/chrony/chrony.conf @@ -0,0 +1,95 @@ +# This the default chrony.conf file for the Debian chrony package. After +# editing this file use the command 'invoke-rc.d chrony restart' to make +# your changes take effect. John Hasler 1998-2008 + +# See www.pool.ntp.org for an explanation of these servers. Please +# consider joining the project if possible. If you can't or don't want to +# use these servers I suggest that you try your ISP's nameservers. We mark +# the servers 'offline' so that chronyd won't try to connect when the link +# is down. Scripts in /etc/ppp/ip-up.d and /etc/ppp/ip-down.d use chronyc +# commands to switch it on when a dialup link comes up and off when it goes +# down. Code in /etc/init.d/chrony attempts to determine whether or not +# the link is up at boot time and set the online status accordingly. If +# you have an always-on connection such as cable omit the 'offline' +# directive and chronyd will default to online. +# +# Note that if Chrony tries to go "online" and dns lookup of the servers +# fails they will be discarded. Thus under some circumstances it is +# better to use IP numbers than host names. + +server 0.debian.pool.ntp.org offline minpoll 8 +server 1.debian.pool.ntp.org offline minpoll 8 +server 2.debian.pool.ntp.org offline minpoll 8 +server 3.debian.pool.ntp.org offline minpoll 8 + + +# Look here for the admin password needed for chronyc. The initial +# password is generated by a random process at install time. You may +# change it if you wish. + +keyfile /etc/chrony/chrony.keys + +# Set runtime command key. Note that if you change the key (not the +# password) to anything other than 1 you will need to edit +# /etc/ppp/ip-up.d/chrony, /etc/ppp/ip-down.d/chrony, /etc/init.d/chrony +# and /etc/cron.weekly/chrony as these scripts use it to get the password. + +commandkey 1 + +# I moved the driftfile to /var/lib/chrony to comply with the Debian +# filesystem standard. + +driftfile /var/lib/chrony/chrony.drift + +# Comment this line out to turn off logging. + +log tracking measurements statistics +logdir /var/log/chrony + +# Stop bad estimates upsetting machine clock. + +maxupdateskew 100.0 + +# Dump measurements when daemon exits. + +dumponexit + +# Specify directory for dumping measurements. + +dumpdir /var/lib/chrony + +# Let computer be a server when it is unsynchronised. + +local stratum 10 + +# Allow computers on the unrouted nets to use the server. + +allow 10/8 +allow 192.168/16 +allow 172.16/12 + +# This directive forces `chronyd' to send a message to syslog if it +# makes a system clock adjustment larger than a threshold value in seconds. + +logchange 0.5 + +# This directive defines an email address to which mail should be sent +# if chronyd applies a correction exceeding a particular threshold to the +# system clock. + +# mailonchange root@localhost 0.5 + +# This directive tells chrony to regulate the real-time clock and tells it +# Where to store related data. It may not work on some newer motherboards +# that use the HPET real-time clock. It requires enhanced real-time +# support in the kernel. I've commented it out because with certain +# combinations of motherboard and kernel it is reported to cause lockups. + +# rtcfile /var/lib/chrony/chrony.rtc + +# If the last line of this file reads 'rtconutc' chrony will assume that +# the CMOS clock is on UTC (GMT). If it reads '# rtconutc' or is absent +# chrony will assume local time. The line (if any) was written by the +# chrony postinst based on what it found in /etc/default/rcS. You may +# change it if necessary. +# rtconutc diff --git a/chrony/chrony.keys b/chrony/chrony.keys new file mode 100644 index 0000000..e99f8aa --- /dev/null +++ b/chrony/chrony.keys @@ -0,0 +1 @@ +1 2DiH7BB# diff --git a/colordiffrc b/colordiffrc new file mode 100644 index 0000000..4bcb02d --- /dev/null +++ b/colordiffrc @@ -0,0 +1,29 @@ +# Example colordiffrc file for dark backgrounds +# +# Set banner=no to suppress authorship info at top of +# colordiff output +banner=no +# By default, when colordiff output is being redirected +# to a file, it detects this and does not colour-highlight +# To make the patch file *include* colours, change the option +# below to 'yes' +color_patches=no +# Sometimes it can be useful to specify which diff command to +# use: that can be specified here +diff_cmd=diff +# +# available colours are: white, yellow, green, blue, +# cyan, red, magenta, black, +# darkwhite, darkyellow, darkgreen, +# darkblue, darkcyan, darkred, +# darkmagenta, darkblack +# +# Can also specify 'none', 'normal' or 'off' which are all +# aliases for the same thing, namely "don't colour highlight +# this, use the default output colour" +# +plain=off +newtext=blue +oldtext=red +diffstuff=magenta +cvsstuff=green diff --git a/cron.d/apticron b/cron.d/apticron new file mode 100644 index 0000000..5c90274 --- /dev/null +++ b/cron.d/apticron @@ -0,0 +1,3 @@ +# cron entry for apticron + +28 * * * * root if test -x /usr/sbin/apticron; then /usr/sbin/apticron --cron; else true; fi diff --git a/default/fail2ban b/default/fail2ban new file mode 100644 index 0000000..35bb377 --- /dev/null +++ b/default/fail2ban @@ -0,0 +1,39 @@ +# This file is part of Fail2Ban. +# +# Fail2Ban is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Fail2Ban is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Fail2Ban; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# +# Author: Cyril Jaquier +# +# $Revision$ + +# Command line options for Fail2Ban. Refer to "fail2ban-client -h" for +# valid options. +FAIL2BAN_OPTS="" + +# Run fail2ban as a different user. If not set, fail2ban +# will run as root. +# +# The user is not created automatically. +# The user can be created e.g. with +# useradd --system --no-create-home --home-dir / --groups adm fail2ban +# Log files are readable by group adm by default. Adding the fail2ban +# user to this group allows it to read the logfiles. +# +# Another manual step that needs to be taken is to allow write access +# for fail2ban user to fail2ban log files. The /etc/init.d/fail2ban +# script will change the ownership when starting fail2ban. Logrotate +# needs to be configured separately, see /etc/logrotate.d/fail2ban. +# +# FAIL2BAN_USER="fail2ban" diff --git a/default/haveged b/default/haveged new file mode 100644 index 0000000..77b6941 --- /dev/null +++ b/default/haveged @@ -0,0 +1,5 @@ +# Configuration file for haveged + +# Options to pass to haveged: +# -w sets low entropy watermark (in bits) +DAEMON_ARGS="-w 1024" diff --git a/default/rsync b/default/rsync new file mode 100644 index 0000000..13780c2 --- /dev/null +++ b/default/rsync @@ -0,0 +1,41 @@ +# defaults file for rsync daemon mode + +# start rsync in daemon mode from init.d script? +# only allowed values are "true", "false", and "inetd" +# Use "inetd" if you want to start the rsyncd from inetd, +# all this does is prevent the init.d script from printing a message +# about not starting rsyncd (you still need to modify inetd's config yourself). +RSYNC_ENABLE=false + +# which file should be used as the configuration file for rsync. +# This file is used instead of the default /etc/rsyncd.conf +# Warning: This option has no effect if the daemon is accessed +# using a remote shell. When using a different file for +# rsync you might want to symlink /etc/rsyncd.conf to +# that file. +# RSYNC_CONFIG_FILE= + +# what extra options to give rsync --daemon? +# that excludes the --daemon; that's always done in the init.d script +# Possibilities are: +# --address=123.45.67.89 (bind to a specific IP address) +# --port=8730 (bind to specified port; default 873) +RSYNC_OPTS='' + +# run rsyncd at a nice level? +# the rsync daemon can impact performance due to much I/O and CPU usage, +# so you may want to run it at a nicer priority than the default priority. +# Allowed values are 0 - 19 inclusive; 10 is a reasonable value. +RSYNC_NICE='' + +# run rsyncd with ionice? +# "ionice" does for IO load what "nice" does for CPU load. +# As rsync is often used for backups which aren't all that time-critical, +# reducing the rsync IO priority will benefit the rest of the system. +# See the manpage for ionice for allowed options. +# -c3 is recommended, this will run rsync IO at "idle" priority. Uncomment +# the next line to activate this. +# RSYNC_IONICE='-c3' + +# Don't forget to create an appropriate config file, +# else the daemon will not start. diff --git a/dhcp/dhclient-enter-hooks.d/nodnsupdate b/dhcp/dhclient-enter-hooks.d/nodnsupdate new file mode 100644 index 0000000..9f5c98d --- /dev/null +++ b/dhcp/dhclient-enter-hooks.d/nodnsupdate @@ -0,0 +1,6 @@ +#!/bin/sh + +# Don't overwrite /etc/resolv.conf +make_resolv_conf() { + : +} diff --git a/fail2ban/action.d/apf.conf b/fail2ban/action.d/apf.conf new file mode 100644 index 0000000..5c4a261 --- /dev/null +++ b/fail2ban/action.d/apf.conf @@ -0,0 +1,25 @@ +# Fail2Ban configuration file +# https://www.rfxn.com/projects/advanced-policy-firewall/ +# +# Note: APF doesn't play nicely with other actions. It has been observed to +# remove bans created by other iptables based actions. If you are going to use +# this action, use it for all of your jails. +# +# DON'T MIX APF and other IPTABLES based actions +[Definition] + +actionstart = +actionstop = +actioncheck = +actionban = apf --deny "banned by Fail2Ban " +actionunban = apf --remove + +[Init] + +# Name used in APF configuration +# +name = default + +# DEV NOTES: +# +# Author: Mark McKinstry diff --git a/fail2ban/action.d/badips.conf b/fail2ban/action.d/badips.conf new file mode 100644 index 0000000..4a5c0f9 --- /dev/null +++ b/fail2ban/action.d/badips.conf @@ -0,0 +1,19 @@ +# Fail2ban reporting to badips.com +# +# Note: This reports and IP only and does not actually ban traffic. Use +# another action in the same jail if you want bans to occur. +# +# Set the category to the appropriate value before use. +# +# To get see register and optional key to get personalised graphs see: +# http://www.badips.com/blog/personalized-statistics-track-the-attackers-of-all-your-servers-with-one-key + +[Definition] + +actionban = curl --fail --user-agent "fail2ban v0.8.12" http://www.badips.com/add// + +[Init] + +# Option: category +# Notes.: Values are from the list here: http://www.badips.com/get/categories +category = diff --git a/fail2ban/action.d/blocklist_de.conf b/fail2ban/action.d/blocklist_de.conf new file mode 100644 index 0000000..d4170ca --- /dev/null +++ b/fail2ban/action.d/blocklist_de.conf @@ -0,0 +1,86 @@ +# Fail2Ban configuration file +# +# Author: Steven Hiscocks +# +# + +# Action to report IP address to blocklist.de +# Blocklist.de must be signed up to at www.blocklist.de +# Once registered, one or more servers can be added. +# This action requires the server 'email address' and the assoicate apikey. +# +# From blocklist.de: +# www.blocklist.de is a free and voluntary service provided by a +# Fraud/Abuse-specialist, whose servers are often attacked on SSH-, +# Mail-Login-, FTP-, Webserver- and other services. +# The mission is to report all attacks to the abuse deparments of the +# infected PCs/servers to ensure that the responsible provider can inform +# the customer about the infection and disable them +# +# IMPORTANT: +# +# Reporting an IP of abuse is a serious complaint. Make sure that it is +# serious. Fail2ban developers and network owners recommend you only use this +# action for: +# * The recidive where the IP has been banned multiple times +# * Where maxretry has been set quite high, beyond the normal user typing +# password incorrectly. +# * For filters that have a low likelyhood of receiving human errors +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = curl --fail --data-urlencode 'server=' --data 'apikey=' --data 'service=' --data 'ip=' --data-urlencode 'logs=' --data 'format=text' --user-agent "fail2ban v0.8.12" "https://www.blocklist.de/en/httpreports.html" + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = + +[Init] + +# Option: email +# Notes server email address, as per blocklise.de account +# Values: STRING Default: None +# +#email = + +# Option: apikey +# Notes your user blocklist.de user account apikey +# Values: STRING Default: None +# +#apikey = + +# Option: service +# Notes service name you are reporting on, typically aligns with filter name +# see http://www.blocklist.de/en/httpreports.html for full list +# Values: STRING Default: None +# +#service = diff --git a/fail2ban/action.d/bsd-ipfw.conf b/fail2ban/action.d/bsd-ipfw.conf new file mode 100644 index 0000000..1285361 --- /dev/null +++ b/fail2ban/action.d/bsd-ipfw.conf @@ -0,0 +1,83 @@ +# Fail2Ban configuration file +# +# Author: Nick Munger +# Modified by: Ken Menzel +# Daniel Black (start/stop) +# Fabian Wenk (many ideas as per fail2ban users list) +# +# Ensure firewall_enable="YES" in the top of /etc/rc.conf +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = ipfw show | fgrep -q 'table()' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e
else exit b }'; num=$?; ipfw -q add $num from table\(
\) to me ; echo $num > "" ) + + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = [ ! -f ] || ( read num < ""
ipfw -q delete $num
rm "" ) + + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +# requires an ipfw rule like "deny ip from table(1) to me" +actionban = ipfw table
add + + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = ipfw table
delete + +[Init] +# Option: table +# Notes: The ipfw table to use. If a ipfw rule using this table already exists, +# this action will not create a ipfw rule to block it and the following +# options will have no effect. +# Values: NUM +table = 1 + +# Option: port +# Notes.: Specifies port to monitor. Blank indicate block all ports. +# Values: [ NUM | STRING ] +# +port = + +# Option: startstatefile +# Notes: A file to indicate that the table rule that was added. Ensure it is unique per table. +# Values: STRING +startstatefile = /var/run/fail2ban/ipfw-started-table_
+ +# Option: block +# Notes: This is how much to block. +# Can be "ip", "tcp", "udp" or various other options. +# Values: STRING +block = ip + +# Option: blocktype +# Notes.: How to block the traffic. Use a action from man 5 ipfw +# Common values: deny, unreach port, reset +# ACTION defination at the top of man ipfw for allowed values. +# Values: STRING +# +blocktype = unreach port diff --git a/fail2ban/action.d/complain.conf b/fail2ban/action.d/complain.conf new file mode 100644 index 0000000..c017583 --- /dev/null +++ b/fail2ban/action.d/complain.conf @@ -0,0 +1,94 @@ +# Fail2Ban configuration file +# +# Author: Russell Odom , Daniel Black +# Sends a complaint e-mail to addresses listed in the whois record for an +# offending IP address. +# This uses the https://abusix.com/contactdb.html to lookup abuse contacts. +# +# DEPENDANCIES: +# This requires the dig command from bind-utils +# +# You should provide the in the jail config - lines from the log +# matching the given IP address will be provided in the complaint as evidence. +# +# WARNING +# ------- +# +# Please do not use this action unless you are certain that fail2ban +# does not result in "false positives" for your deployment. False +# positive reports could serve a mis-favor to the original cause by +# flooding corresponding contact addresses, and complicating the work +# of administration personnel responsible for handling (verified) legit +# complains. +# +# Please consider using e.g. sendmail-whois-lines.conf action which +# would send the reports with relevant information to you, so the +# report could be first reviewed and then forwarded to a corresponding +# contact if legit. +# + + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs} + IP= + if [ ! -z "$ADDRESSES" ]; then + (printf %%b "\n"; date '+Note: Local timezone is %%z (%%Z)'; grep -E '(^|[^0-9])([^0-9]|$)' ) | "Abuse from " ${ADDRESSES//,/\" \"} + fi + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = + +[Init] +message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban.\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n + +# Path to the log files which contain relevant lines for the abuser IP +# +logpath = /dev/null + +# Option: mailcmd +# Notes.: Your system mail command. Is passed 2 args: subject and recipient +# Values: CMD +# +mailcmd = mail -s + +# Option: mailargs +# Notes.: Additional arguments to mail command. e.g. for standard Unix mail: +# CC reports to another address: +# -c me@example.com +# Appear to come from a different address - the '--' indicates +# arguments to be passed to Sendmail: +# -- -f me@example.com +# Values: [ STRING ] +# +mailargs = + diff --git a/fail2ban/action.d/dshield.conf b/fail2ban/action.d/dshield.conf new file mode 100644 index 0000000..a004198 --- /dev/null +++ b/fail2ban/action.d/dshield.conf @@ -0,0 +1,204 @@ +# Fail2Ban configuration file +# +# Author: Russell Odom +# Submits attack reports to DShield (http://www.dshield.org/) +# +# You MUST configure at least: +# (the port that's being attacked - use number not name). +# +# You SHOULD also provide: +# (your public IP address, if it's not the address of eth0) +# (your DShield userID, if you have one - recommended, but reports will +# be used anonymously if not) +# (the protocol in use - defaults to tcp) +# +# Best practice is to provide and in jail.conf like this: +# action = dshield[port=1234,protocol=tcp] +# +# ...and create "dshield.local" with contents something like this: +# [Init] +# myip = 10.0.0.1 +# userid = 12345 +# +# Other useful configuration values are (you can use for specifying +# a different sender address for the report e-mails, which should match what is +# configured at DShield), and // (to +# configure how often the buffer is flushed). +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = if [ -f .buffer ]; then + cat .buffer | "FORMAT DSHIELD USERID TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" + date +%%s > .lastsent + fi + rm -f .buffer .first + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +# See http://www.dshield.org/specs.html for more on report format/notes +# +# Note: We are currently using