./0040755000000000000000000000000007710042476007724 5ustar rootroot./etc/0040755000000000000000000000000007710042476010477 5ustar rootroot./etc/rc.d/0040755000000000000000000000000007710042476011325 5ustar rootroot./etc/rc.d/rc.M0100755000000000000000000001466207534725137012066 0ustar rootroot#!/bin/sh # # This file is executed by init(8) when the system is being # initialized for one of the "multi user" run levels (i.e. # levels 1 through 6). # # /etc/rc.d/rc.M: # Tell the viewers what's going to happen: echo -en "\\033[1;36m" echo "Going multiuser..." sleep 1 echo -en "\\033[1;37m" # Remove stale dhcpcd network pid if system crash. if [ -s /etc/dhcpc/dhcpcd-eth*.pid ]; then /bin/rm /etc/dhcpc/dhcpcd-eth*.pid fi # Screen blanks after 0-60 minutes idle time. # To turn speaker beep off: -bfreq 0 if [ -x /bin/setterm ]; then /bin/setterm -blank 60 -powersave on fi # Look for a CD-ROM in a CD-ROM drive, if one is found # mount it under /mnt/cdrom. #if [ -x /etc/rc.d/rc.cdrom ]; then # /etc/rc.d/rc.cdrom #fi # If there's no /etc/HOSTNAME, fall back on this default: if [ ! -s /etc/HOSTNAME ]; then echo "Peanut-Linux" > /etc/HOSTNAME fi # Set the hostname from the /etc/HOSTNAME file. if [ -x /bin/hostname ]; then /bin/hostname `cat /etc/HOSTNAME | cut -f1 -d .` fi # Initialize the NET subsystem. if [ -x /etc/rc.d/rc.inet1 ]; then . /etc/rc.d/rc.inet1 fi if [ -x /etc/rc.d/rc.inet2 ]; then . /etc/rc.d/rc.inet2 fi if [ -x /usr/sbin/syslogd ]; then echo "Starting system log daemon: syslogd" /usr/sbin/syslogd -m 0 sleep 1 # Prevents a race condition with SMP kernels # '-c 3' displays level 'error' or higher messages on the console echo "Starting kernel log daemon: klogd" /usr/sbin/klogd -c 3 fi # Start lpd daemon: if [ -x /usr/sbin/lpd ]; then echo "Starting printer daemon: lpd" /usr/sbin/lpd fi # Start printer daemon: if [ -x /usr/sbin/cupsd ]; then echo "Starting printer daemon: cupsd" /usr/sbin/cupsd fi # Start netatalk. (a file/print server for Macs using Appletalk) #if [ -x /etc/rc.d/rc.atalk ]; then # /etc/rc.d/rc.atalk #fi # Start crond (Dillon's crond): # If you want cron to actually log activity to /var/adm/cron, then change # -l10 to -l8 to increase the logging level. if [ -x /usr/sbin/crond ]; then echo "Starting cron daemon: crond " /usr/sbin/crond -l8 >>/var/adm/cron 2>&1 fi # Start atd (manages jobs scheduled with 'at'): if [ -x /usr/sbin/atd ]; then echo "Starting at daemon: atd " /usr/sbin/atd -b 15 -l 1 fi # Remove stale files (must be done after mount -a!) /bin/rm -f /var/lock/LCK* /var/spool/uucp/LCK* /bin/rm -rf 2>/dev/null /tmp/.* /tmp/* /var/tmp/.* /var/tmp/* # Create /tmp directory if it doesn't exist. if [ ! -d /tmp ]; then mkdir /tmp fi # Ensure basic filesystem permissions sanity. chmod 755 / 2>/dev/null chmod 1777 /tmp /var/tmp 2>/dev/null # Update all the shared library links automatically /sbin/ldconfig # Slackware-Mini-Quota-HOWTO: # To really activate quotas, you'll need to add 'usrquota' to the appropriate # partitions as listed in /etc/fstab. Here's an example: # /dev/hda2 /home ext2 defaults,usrquota 1 1 # You'll then need to setup initial quota files at the top of the partitions # to support quota, like this: # touch /home/quota.user /home/quota.group # chmod 600 /home/quota.user /home/quota.group # Then, reboot to activate the system. # To edit user quotas, use 'edquota'. See 'man edquota'. Also, the # official Quota Mini-HOWTO has lots of useful information. That can be found # here: ftp://ftp.cdrom.com/pub/linux/slackware/docs/mini/Quota # Check quotas and then turn quota system on: if grep -F quota /etc/fstab 1> /dev/null 2> /dev/null ; then if [ -x /sbin/quotacheck ]; then echo "Checking filesystem quotas..." /sbin/quotacheck -avug fi if [ -x /sbin/quotaon ]; then echo "Activating filesystem quotas..." /sbin/quotaon -avug fi fi # Start the sendmail daemon: #if [ -x /usr/sbin/sendmail ]; then # echo "Starting sendmail daemon: sendmail -bd -q15m" # /usr/sbin/sendmail -bd -q15m #fi # Start Gfcc FireWall services if [ -x /usr/share/gfcc/rules/export_shell_script.sh ]; then echo "Starting FireWall/Masquerading: export_shell_script.sh" /usr/share/gfcc/rules/export_shell_script.sh fi # Start WallEye FireWall/IDS services if [ -x /etc/rc.d/init.d/rc.firewall ]; then echo "Starting Walleye FireWall/IDS services" /etc/rc.d/init.d/rc.firewall fi # Typematic Rate: if [ -x /sbin/kbdrate ]; then /sbin/kbdrate -r 30.0 -d 250 fi # Start the 'XFS' X 4.2.x Font Server if [ -x /usr/X11R6/bin/xfs ]; then echo "Starting XFree86 4.2.x font daemon: xfs" /usr/X11R6/bin/xfs -config /etc/X11/fs/config -daemon fi # Start the 'XFSTT' True Type Font Server. if [ -x /usr/X11R6/bin/xfstt ]; then echo "Starting true type font daemon: xfstt" /usr/X11R6/bin/xfstt & /usr/X11R6/bin/xfstt --sync fi # Start APM daemon 'apmd' for laptop computers. #if [ -f /proc/apm -a -x /usr/sbin/apmd ]; then #echo "Starting apm daemon: apmd" #/usr/sbin/apmd #fi # Load a custom screen font if the user has an rc.font script. if [ -x /etc/rc.d/rc.font ]; then . /etc/rc.d/rc.font fi # Load a custom keymap if the user has an rc.keymap script. if [ -x /etc/rc.d/rc.keymap ]; then . /etc/rc.d/rc.keymap fi # iBCS Emulation for Linux # The Intel Binary Compatibility Specification, or iBCS, specifies the # interfaces between application programs and the surrounding operating # system environment for i386 based systems. There are however several # flavours of iBCS in use - SVR4, SVR3 plus several vendor specific # extensions to SVR3 which are slightly different and incompatible. The # iBCS emulator for Linux supports all flavours known so far. if [ -x /etc/rc.d/rc.ibcs2 ]; then . /etc/rc.d/rc.ibcs2 fi # Start Web server: #if [ -x /etc/rc.d/rc.httpd ]; then # . /etc/rc.d/rc.httpd #fi # Start Samba (a file/print server for Win95/NT machines): #if [ -x /etc/rc.d/rc.samba ]; then # . /etc/rc.d/rc.samba #fi # Start GPM mouse driver. # If you have a ps2 mouse put: -t ps2 -r 30 #if [ -x /usr/bin/gpm ]; then #echo "Starting mouse driver: gpm" #/usr/bin/gpm -t ms -r 30 #fi # If there are SystemV init scripts for this runlevel, run them. if [ -x /etc/rc.d/rc.sysvinit ]; then . /etc/rc.d/rc.sysvinit fi # Start the FTP/HTTP Daemon(s). Telnet Daemon is started by /etc/inetd.conf. if [ -x /home/xitami ]; then echo "*******xitami****************" echo "* F T P - D A E M O N *" echo "* H T T P - D A E M O N *" echo "*****************************" cd /home /home/xitami -s &>/dev/null fi echo # Start the local setup procedure. if [ -x /etc/rc.d/rc.local ]; then . /etc/rc.d/rc.local fi # Starts the Linux logo. Try leaving this file as the last startup command. if [ -x /usr/bin/ty2h9 ];then /usr/bin/ty2h9 -c -n fi # All done. ./etc/rc.d/init.d/0040755000000000000000000000000007710042476012512 5ustar rootroot./etc/rc.d/init.d/rc.firewall0100755000175000001440000001670407535105544015244 0ustar mysqlusers#! /bin/sh # Galen Thurber (galen@flightsimhq.org) # Walleye - stealth firewall and IDS series for IPCHAIN KERNELS 2.1-2.2 # GPL # 16 new version style number to reflectsub version in RPM - Sep 2, 2002 # 16 RPM rc.d added # 1.5.1 version for RPM - Aug 30, 2002 named Walleye # 1.4 COL version for ppp0 20010705 # 1.3 2000/12/23 fix port 0, make it DENY solo # 1.2 2000/12/12 merge tricks from Robert L. Ziegler, repair his script errors # 1.1 2000/12/11 added sbin and moved to rc.firewall # changed --dport to 0.0.0.0/0 # 1.0 2000/11/27 released # notes: # COMMENT OUT all lines in your /etc/inetd.conf [except PPP-envoy] # user must customize to allow your ISP DNS to your machine, use it's ip# # this firewall is set for ppp0 [dialup], use text editor # INSTALL # be sure this file is saved in UNIX text format # 1. save it to rc.firewall in /etc/rc.d/init.d # 2. change file permissions to allow execute echo "Starting Firewall IDS 'WallEye'... " echo "Flushing ipchains " /sbin/ipchains -F /sbin/ipchains -F input /sbin/ipchains -F output /sbin/ipchains -F forward echo "Enforcing Policies " /sbin/ipchains -P forward DENY /sbin/ipchains -P input ACCEPT /sbin/ipchains -P output ACCEPT # Some definitions for easy maintenance. # EDIT THESE TO SUIT YOUR SYSTEM AND ISP. # ppp0 or ETH0 # NOTE : variables do not work with COL only RH MDK #EXTERNAL_INTERFACE="ppp0" # Internet connected interface #LOOPBACK_INTERFACE="lo" # or your local naming convention #IPADDR=$(/sbin/ifconfig | /bin/grep P-t-P | /usr/bin/cut -c 21-35) #ANYWHERE="any/0" # match any IP address #DHCP_SERVER="any/0" #NAMESERVER_1="any/0" # everyone must have at least one #LOOPBACK="127.0.0.0/8" # reserved loopback address range #CLASS_A="10.0.0.0/8" # class A private networks #CLASS_B="172.16.0.0/12" # class B private networks #CLASS_C="192.168.0.0/16" # class C private networks #BROADCAST_SRC="0.0.0.0" # broadcast source address #BROADCAST_DEST="255.255.255.255" # broadcast destination address #PRIVPORTS="1:1023" # well known, privileged port range #UNPRIVPORTS="1024:65535" # unprivileged port range # ------------------------------------------ # ---------------------------------------------- # section works for RH MDK only # Enable TCP SYN Cookie Protection # echo 1 > /proc/sys/net/ipv4/tcp_syncookies # Enable always defragging Protection # echo 1 > /proc/sys/net/ipv4/ip_always_defrag # Enable broadcast echo Protection # echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Enable bad error message Protection # echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses # Enable IP spoofing protection # turn on Source Address Verification # for f in /proc/sys/net/ipv4/conf/*/rp_filter; do # echo 1 > $f # done # Disable ICMP Redirect Acceptance # for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do # echo 0 > $f # done # Disable Source Routed Packets # for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do # echo 0 > $f # done # Log Spoofed Packets, Source Routed Packets, Redirect Packets # for f in /proc/sys/net/ipv4/conf/*/log_martians; do # echo 1 > $f # done # RH MDK section end ## ping stealth echo "Switching to Surfing Stealth Mode " /sbin/ipchains -A input -s 0.0.0.0/0 0 -p icmp -i ppp0 -j ACCEPT /sbin/ipchains -A input -s 0.0.0.0/0 3 -p icmp -i ppp0 -j ACCEPT /sbin/ipchains -A input -s 0.0.0.0/0 11 -p icmp -i ppp0 -j ACCEPT /sbin/ipchains -A input -l -s 0.0.0.0/0 8 -p icmp -i ppp0 -j DENY echo "DENY ping exploits and probing [logged] " ## ACCEPT SECTION =================== # allow your ISP DNS in #/sbin/ipchains -A input -p UDP -s 24.222.0.33 53 -i ppp0 -j ACCEPT #/sbin/ipchains -A input -p UDP -s 24.222.0.33 67 -i ppp0 -j ACCEPT #echo DNS ISP allowed # allow ISP proxy traffic #/sbin/ipchains -A input -p TCP -s 24.222.0.32 -i ppp0 -j ACCEPT #echo ISP PROXY allowed # ISP gateway TCP or UDP? #/sbin/ipchains -A input -p UDP -l -s 24.222.39.255 631 -i ppp0 -j ACCEPT #/sbin/ipchains -A input -p UDP -l -d 24.222.39.255 631 -i ppp0 -j ACCEPT #echo ISP gateway allow # local ok ipchains -A input -i lo -j ACCEPT echo "ACCEPT local traffic" ## DENY SECTION ====================== # port 0 must be by itself /sbin/ipchains -A input -l -p TCP -d 0.0.0.0/0 0 -i ppp0 -j DENY /sbin/ipchains -A input -l -p UDP -d 0.0.0.0/0 0 -i ppp0 -j DENY echo "PORT 0 protection [logged] " # IDENT some services need a response, so use REJECT not deny /sbin/ipchains -A input -l -d 0.0.0.0/0 113 -i ppp0 -p tcp -j REJECT echo "REJECT ident scans [logged] " # windows exploits /sbin/ipchains -A input -l -d 0.0.0.0/0 135 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 135 -i ppp0 -p udp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 139 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 139 -i ppp0 -p udp -j DENY #/sbin/ipchains -A input -l -d 0.0.0.0/0 1024:1029 -i ppp0 -p tcp -j DENY echo "DENY incoming MS WINDOWS scans/ exploits [logged] " # linux exploits /sbin/ipchains -A input -l -d 0.0.0.0/0 111 -i ppp0 -p tcp -j DENY # rpc 111 /sbin/ipchains -A input -l -d 0.0.0.0/0 515 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 631 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 902 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 2049 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 2049 -i ppp0 -p udp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 5432 -i ppp0 -p tcp -j DENY # sql 5432 # /sbin/ipchains -A input -l -d 0.0.0.0/0 6000:6063 -i ppp0 -p tcp -j DENY # /sbin/ipchains -A input -l -d 0.0.0.0/0 6000:6063 -i ppp0 -p udp -j DENY echo "DENY incoming LINUX services / scans / exploits [logged] " echo "DENY incoming high port popular trojan scans [background noise logged] " # if you want lots of attention switch deny to accept /sbin/ipchains -A input -l -d 0.0.0.0/0 1243 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 2140 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 3150 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 5000 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 6611:6771 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 12345 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 20034 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 21544 -i ppp0 -p tcp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 31337:31339 -i ppp0 -p tcp -j DENY # UDP /sbin/ipchains -A input -l -d 0.0.0.0/0 27444 -i ppp0 -p udp -j DENY /sbin/ipchains -A input -l -d 0.0.0.0/0 31335:31339 -i ppp0 -p udp -j DENY ## low ports stealth # --dport will block out as well? /sbin/ipchains -A input -l -p TCP --dport 1:1023 -i ppp0 -j DENY /sbin/ipchains -A input -l -p UDP --dport 1:1023 -i ppp0 -j DENY echo "DENY LOW ports scans [logged] " # remove -l function for smaller log files and fewer alerts /sbin/ipchains -A input -p TCP -l -y echo "Logging incoming SYN requests as possible stealth scan attempts " ## end # /sbin/ipchains -L echo "FIREWALL ENABLED" echo "INTRUSION DETECTION LOGGING = HIGH" echo "SECURITY LEVEL = HIGH" echo " please monitor /var/log/messages" # end sleep 2./install/0040755000000000000000000000000007710042476011372 5ustar rootroot./install/doinst.sh0100644000000000000000000000000007710042476013211 0ustar rootroot