2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2022 IPFire Team <info@ipfire.org> #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
25 # Set PATH to find our own executables
26 export PATH
=/usr
/local
/sbin
:/usr
/local
/bin
:${PATH}
28 # Exoscale only supports a MTU of 1500
34 wget
-qO - "http://metadata.exoscale.com/latest/${file}"
37 import_exoscale_configuration
() {
38 local instance_id
="$(get meta-data/instance-id)"
40 boot_mesg
"Importing Exoscale configuration for instance ${instance_id}..."
43 echo "${instance_id}" > /var
/run
/exoscale-instance-id
45 # Initialise system settings
46 local hostname
=$
(get meta-data
/local-hostname
)
49 if ! grep -q "^HOSTNAME=" /var
/ipfire
/main
/settings
; then
50 echo "HOSTNAME=${hostname%%.*}" >> /var
/ipfire
/main
/settings
54 if ! grep -q "^DOMAINNAME=" /var
/ipfire
/main
/settings
; then
55 local domainname
="localdomain"
57 # If the hostname contains a dot we strip the last
58 # part and use it as our domain name
59 if [[ ${hostname} =~
"\." ]]; then
60 domainname
="${hostname#*.}"
63 echo "DOMAINNAME=${domainname}" >> /var
/ipfire
/main
/settings
67 if ! getent passwd setup
&>/dev
/null
; then
68 useradd setup
-s /usr
/bin
/run-setup
-g nobody
-m
74 # Import SSH key for setup user
75 local key
=$
(get
"meta-data/public-keys")
76 if [ -n "${key}" ] && ! grep -q "^${key}$" "/home/setup/.ssh/authorized_keys" 2>/dev
/null
; then
77 mkdir
-p "/home/setup/.ssh"
78 chmod 700 "/home/setup/.ssh"
79 chown setup.nobody
"/home/setup/.ssh"
81 echo "${key}" >> "/home/setup/.ssh/authorized_keys"
82 chmod 600 "/home/setup/.ssh/authorized_keys"
83 chown setup.nobody
"/home/setup/.ssh/authorized_keys"
86 # Import any previous settings for the local interfaces
87 eval $
(/usr
/local
/bin
/readhash
<(grep -E "^(GREEN|ORANGE)_.*=" /var
/ipfire
/ethernet
/settings
2>/dev
/null
))
89 # Import network configuration
90 # After this, no network connectivity will be available from this script due to the
91 # renaming of the network interfaces for which they have to be shut down
93 : > /var
/ipfire
/ethernet
/settings
96 for device
in /sys
/class
/net
/*; do
97 # Fetch the interface index
98 local ifindex
="$(<${device}/ifindex)"
99 local address
="$(<${device}/address)"
107 # The first interface will always be the public-facing one (i.e. RED)
112 echo "RED_MACADDR=${address}"
113 echo "RED_DESCRIPTION='${ifindex}'"
115 ) >> /var
/ipfire
/ethernet
/settings
120 # Set some sensible defaults for GREEN
121 if [ -z "${GREEN_ADDRESS}" ]; then
122 GREEN_ADDRESS
="10.0.0.1"
123 GREEN_NETMASK
="255.255.255.0"
124 GREEN_NETADDRESS
="10.0.0.0"
128 echo "GREEN_DEV=green0"
129 echo "GREEN_MACADDR=${address}"
130 echo "GREEN_DESCRIPTION='${ifindex}'"
131 echo "GREEN_ADDRESS=${GREEN_ADDRESS}"
132 echo "GREEN_NETMASK=${GREEN_NETMASK}"
133 echo "GREEN_NETADDRESS=${GREEN_NETADDRESS}"
134 echo "GREEN_MTU=${DEFAULT_MTU}"
135 ) >> /var
/ipfire
/ethernet
/settings
142 # Set some sensible defaults for ORANGE
143 if [ -z "${ORANGE_ADDRESS}" ]; then
144 ORANGE_ADDRESS
="10.0.1.1"
145 ORANGE_NETMASK
="255.255.255.0"
146 ORANGE_NETADDRESS
="10.0.1.0"
150 echo "ORANGE_DEV=orange0"
151 echo "ORANGE_MACADDR=${address}"
152 echo "ORANGE_DESCRIPTION='${ifindex}'"
153 echo "ORANGE_ADDRESS=${ORANGE_ADDRESS}"
154 echo "ORANGE_NETMASK=${ORANGE_NETMASK}"
155 echo "ORANGE_NETADDRESS=${ORANGE_NETADDRESS}"
156 echo "ORANGE_MTU=${DEFAULT_MTU}"
157 ) >> /var
/ipfire
/ethernet
/settings
163 echo "CONFIG_TYPE=${config_type}" >> /var
/ipfire
/ethernet
/settings
165 # Actions performed only on the very first start
166 if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
167 # Disable using ISP nameservers
168 sed -e "s/^USE_ISP_NAMESERVERS=.*/USE_ISP_NAMESERVERS=off/" -i /var
/ipfire
/dns
/settings
171 sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var
/ipfire
/remote
/settings
173 # Disable SSH password authentication
174 sed -e "s/^ENABLE_SSH_PASSWORDS=.*/ENABLE_SSH_PASSWORDS=off/" -i /var
/ipfire
/remote
/settings
176 # Enable SSH key authentication
177 sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var
/ipfire
/remote
/settings
180 /usr
/local
/bin
/sshctrl
182 # Mark SSH to start immediately (but not right now)
183 touch /var
/ipfire
/remote
/enablessh
184 chown nobody
:nobody
/var
/ipfire
/remote
/enablessh
186 # Firewall rules for SSH and WEBIF
188 echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
189 echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
190 ) >> /var
/ipfire
/firewall
/input
193 local user_data
="$(get user-data)"
195 # Save user-data script to be executed later
196 if [ "${user_data:0:2}" = "#!" ]; then
197 echo "${user_data}" > /tmp
/user-data.
script
198 chmod 700 /tmp
/user-data.
script
200 # Run the user-data script
201 local now
="$(date -u +"%s
")"
202 /tmp
/user-data.
script &>/var
/log
/user-data.log.
${now}
204 # Delete the script right away
205 rm /tmp
/user-data.
script
208 # This script has now completed the first steps of setup
209 touch /var
/ipfire
/main
/firstsetup_ok
218 # Bring up the interface
219 ip link
set "${interface}" up
222 BOUND|RENEW|REBIND|REBOOT
)
223 # Remove any previous IP addresses
224 ip addr flush dev
"${interface}"
226 # Add (or re-add) the new IP address
227 ip addr add
"${new_ip_address}/${new_subnet_mask}" dev "${interface}"
229 # Add the default route
230 ip route add default via
"${new_routers}"
233 for domain_name_server
in ${new_domain_name_servers}; do
234 echo "nameserver ${domain_name_server}"
235 done > /etc
/resolv.conf
237 # The system is online now
238 touch /var
/ipfire
/red
/active
240 # Import Exoscale configuration
241 import_exoscale_configuration
244 EXPIRE|FAIL|RELEASE|STOP
)
245 # The system is no longer online
246 rm -f /var
/ipfire
/red
/active
248 # Remove all IP addresses
249 ip addr flush dev
"${interface}"
251 # Shut down the interface
252 ip link
set "${interface}" down
256 echo "Unhandled reason: ${reason}" >&2