#!/bin/bash # # .---. . . # | | | # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-' # ' ' --' --' -' - -' ' ' -' -' -' ' - --' # # Freedom in the Cloud # # License # ======= # # Copyright (C) 2015 Bob Mottram # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . CURR_USER=$USER # Version number of this script VERSION="1.01" WIFI_CHANNEL=2 # B.A.T.M.A.N settings BATMAN_CELLID='02:BA:00:00:03:01' ESSID='mesh' # Babel BABEL_PORT=6696 # ssh (from https://stribika.github.io/2015/01/04/secure-secure-shell.html) SSH_CIPHERS="chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr" SSH_MACS="hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com" SSH_KEX="curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256" SSH_HOST_KEY_ALGORITHMS="ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-ed25519,ssh-rsa" # see https://stribika.github.io/2015/01/04/secure-secure-shell.html function ssh_remove_small_moduli { sudo awk '$5 > 2000' /etc/ssh/moduli > /home/$CURR_USER/moduli sudo mv /home/$CURR_USER/moduli /etc/ssh/moduli } function configure_ssh_client { #sudo sed -i 's/# PasswordAuthentication.*/ PasswordAuthentication no/g' /etc/ssh/ssh_config #sudo sed -i 's/# ChallengeResponseAuthentication.*/ ChallengeResponseAuthentication no/g' /etc/ssh/ssh_config sudo sed -i "s/# HostKeyAlgorithms.*/ HostKeyAlgorithms $SSH_HOST_KEY_ALGORITHMS/g" /etc/ssh/ssh_config sudo sed -i "s/# Ciphers.*/ Ciphers $SSH_CIPHERS/g" /etc/ssh/ssh_config sudo sed -i "s/# MACs.*/ MACs $SSH_MACS/g" /etc/ssh/ssh_config if ! grep -q "HostKeyAlgorithms" /etc/ssh/ssh_config; then sudo echo " HostKeyAlgorithms $SSH_HOST_KEY_ALGORITHMS" >> /etc/ssh/ssh_config fi sudo sed -i "s/Ciphers.*/Ciphers $SSH_CIPHERS/g" /etc/ssh/ssh_config if ! grep -q "Ciphers " /etc/ssh/ssh_config; then sudo echo " Ciphers $SSH_CIPHERS" >> /etc/ssh/ssh_config fi sudo sed -i "s/MACs.*/MACs $SSH_MACS/g" /etc/ssh/ssh_config if ! grep -q "MACs " /etc/ssh/ssh_config; then sudo echo " MACs $SSH_MACS" >> /etc/ssh/ssh_config fi # Create ssh keys if [ ! -f /home/$CURR_USER/.ssh/id_ed25519 ]; then ssh-keygen -t ed25519 -o -a 100 fi if [ ! -f /home/$CURR_USER/.ssh/id_rsa ]; then ssh-keygen -t rsa -b 4096 -o -a 100 fi ssh_remove_small_moduli echo '' echo 'Copy the following into a file called /home/username/.ssh/authorized_keys on the Freedombone server' echo '' echo $(cat /home/$CURR_USER/.ssh/id_rsa.pub) echo $(cat /home/$CURR_USER/.ssh/id_ed25519.pub) echo '' } function mesh_babel { sudo apt-get -y install babeld babel_script=/tmp/babel echo '#!/bin/sh' > $babel_script echo 'IFACE=wlan0' >> $babel_script echo 'IFACE_EXISTS=$(grep "$IFACE" /proc/net/dev)' >> $babel_script echo '' >> $babel_script echo 'if [[ ! $IFACE_EXISTS || $1 == "stop" ]]; then' >> $babel_script echo ' echo "Interface $IFACE was not found"' >> $babel_script echo ' ifconfig $IFACE down' >> $babel_script echo ' pkill babeld' >> $babel_script echo ' if [ -f /bin/systemctl ]; then' >> $batman_script echo ' systemctl restart networking' >> $batman_script echo ' else' >> $batman_script echo ' service networking restart' >> $batman_script echo ' fi' >> $batman_script echo ' exit 1' >> $babel_script echo 'fi' >> $babel_script echo '' >> $babel_script echo 'if [ -f /bin/systemctl ]; then' >> $batman_script echo ' systemctl stop networking' >> $batman_script echo 'else' >> $batman_script echo ' service networking stop' >> $batman_script echo 'fi' >> $batman_script echo 'ifconfig $IFACE down' >> $babel_script echo -n 'iwconfig $IFACE mode ad-hoc channel ' >> $babel_script echo "$WIFI_CHANNEL essid \"$ESSID\"" >> $babel_script echo 'ifconfig $IFACE up' >> $babel_script echo 'avahi-autoipd $IFACE' >> $babel_script echo -n 'ifconfig $IFACE:avahi ' >> $babel_script echo -n "$LOCAL_NETWORK_STATIC_IP_ADDRESS netmask " >> $babel_script echo '255.255.255.0 broadcast 192.168.13.255' >> $babel_script echo -n 'babeld -D $IFACE:avahi -p ' >> $babel_script echo "$BABEL_PORT -d 5 wlan0" >> $babel_script echo 'exit 0' >> $babel_script chmod +x $babel_script sudo mv $babel_script /usr/bin/babel } function mesh_batman { sudo apt-get -y install iproute bridge-utils libnetfilter-conntrack3 batctl sudo apt-get -y install python-dev libevent-dev ebtables python-pip sudo apt-get -y install wireless-tools rfkill batman_script=/tmp/batman echo '#!/bin/sh' > $batman_script echo '' >> $batman_script echo '# Mesh definition' >> $batman_script echo "ESSID=$ESSID" >> $batman_script echo "CELLID=$BATMAN_CELLID" >> $batman_script echo "CHANNEL=$WIFI_CHANNEL" >> $batman_script echo '' >> $batman_script echo '# Ethernet bridge definition (bridged do bat0)' >> $batman_script echo 'BRIDGE=br-mesh' >> $batman_script echo 'IFACE=wlan0' >> $batman_script echo 'EIFACE=eth0' >> $batman_script echo 'IFACE_EXISTS=$(grep "$IFACE" /proc/net/dev)' >> $batman_script echo '' >> $batman_script echo 'if [ -e /etc/default/batctl ]; then' >> $batman_script echo ' . /etc/default/batctl' >> $batman_script echo 'fi' >> $batman_script echo '' >> $batman_script echo 'start() {' >> $batman_script echo ' if [ -z "$IFACE" ] ; then' >> $batman_script echo ' echo "error: unable to find wifi interface, not enabling batman-adv mesh"' >> $batman_script echo ' return' >> $batman_script echo ' fi' >> $batman_script echo ' echo "info: enabling batman-adv mesh network $ESSID on $IFACE"' >> $batman_script echo ' if [ -f /bin/systemctl ]; then' >> $batman_script echo ' systemctl stop networking' >> $batman_script echo ' else' >> $batman_script echo ' service networking stop' >> $batman_script echo ' fi' >> $batman_script echo ' sleep 5' >> $batman_script echo '' >> $batman_script echo ' # Might have to re-enable wifi' >> $batman_script echo ' rfkill unblock $(rfkill list|awk -F: "/phy/ {print $1}") || true' >> $batman_script echo '' >> $batman_script echo ' ifconfig $IFACE down' >> $batman_script echo ' ifconfig $IFACE mtu 1528' >> $batman_script echo ' iwconfig $IFACE enc off' >> $batman_script echo ' iwconfig $IFACE mode ad-hoc essid $ESSID channel $CHANNEL' >> $batman_script echo ' sleep 1' >> $batman_script echo ' iwconfig $IFACE ap $CELLID' >> $batman_script echo '' >> $batman_script echo ' modprobe batman-adv' >> $batman_script echo ' batctl if add $IFACE' >> $batman_script echo ' ifconfig $IFACE up' >> $batman_script echo ' ifconfig bat0 up promisc' >> $batman_script echo '' >> $batman_script echo ' #Use persistent HWAddr' >> $batman_script echo ' ether_new=$(ifconfig eth0 | grep HWaddr | sed -e "s/.*HWaddr //")' >> $batman_script echo ' if [ ! -f /var/lib/mesh-node/bat0 ]' >> $batman_script echo ' then' >> $batman_script echo ' mkdir /var/lib/mesh-node' >> $batman_script echo ' echo "${ether_new}" > /var/lib/mesh-node/bat0' >> $batman_script echo ' else' >> $batman_script echo ' ether=$(cat /var/lib/mesh-node/bat0)' >> $batman_script echo ' ifconfig bat0 hw ether ${ether}' >> $batman_script echo ' fi' >> $batman_script echo '' >> $batman_script echo ' if [ "$EIFACE" ] ; then' >> $batman_script echo ' ifconfig $EIFACE up promisc' >> $batman_script echo ' brctl addbr $BRIDGE' >> $batman_script echo ' brctl addif $BRIDGE bat0' >> $batman_script echo ' brctl addif $BRIDGE $EIFACE' >> $batman_script echo ' ifconfig $BRIDGE up' >> $batman_script echo ' fi' >> $batman_script echo '}' >> $batman_script echo '' >> $batman_script echo 'stop() {' >> $batman_script echo ' if [ -z "$IFACE" ] ; then' >> $batman_script echo ' echo "error: unable to find wifi interface, not enabling batman-adv mesh"' >> $batman_script echo ' return' >> $batman_script echo ' fi' >> $batman_script echo ' if [ "$EIFACE" ] ; then' >> $batman_script echo ' brctl delif $BRIDGE bat0' >> $batman_script echo ' brctl delif $BRIDGE $EIFACE' >> $batman_script echo ' ifconfig $BRIDGE down || true' >> $batman_script echo ' brctl delbr $BRIDGE' >> $batman_script echo ' ifconfig $EIFACE down -promisc' >> $batman_script echo ' fi' >> $batman_script echo '' >> $batman_script echo ' ifconfig bat0 down -promisc' >> $batman_script echo '' >> $batman_script echo ' batctl if del $IFACE' >> $batman_script echo ' rmmod batman-adv' >> $batman_script echo ' ifconfig $IFACE mtu 1500' >> $batman_script echo ' ifconfig $IFACE down' >> $batman_script echo ' iwconfig $IFACE mode managed' >> $batman_script echo '' >> $batman_script echo ' if [ -f /bin/systemctl ]; then' >> $batman_script echo ' systemctl restart networking' >> $batman_script echo ' else' >> $batman_script echo ' service networking restart' >> $batman_script echo ' fi' >> $batman_script echo '}' >> $batman_script echo '' >> $batman_script echo 'if [ ! $IFACE_EXISTS ]; then' >> $batman_script echo ' echo "Interface $IFACE was not found"' >> $batman_script echo ' stop' >> $batman_script echo ' exit 1' >> $batman_script echo 'fi' >> $batman_script echo '' >> $batman_script echo 'case "$1" in' >> $batman_script echo ' start|stop)' >> $batman_script echo ' $1' >> $batman_script echo ' ;;' >> $batman_script echo ' *)' >> $batman_script echo ' echo "error: invalid parameter $1"' >> $batman_script echo ' echo "usage: $0 {start|stop}"' >> $batman_script echo ' exit 2' >> $batman_script echo ' ;;' >> $batman_script echo 'esac' >> $batman_script echo 'exit 0' >> $batman_script chmod +x $batman_script sudo mv $batman_script /usr/bin/batman } function show_help { echo '' echo 'freedombone-client' echo '' exit 0 } while [[ $# > 1 ]] do key="$1" case $key in -h|--help) show_help ;; *) # unknown option ;; esac shift done echo 'Configuring client' configure_ssh_client mesh_batman mesh_babel echo 'Configuration complete' exit 0