#!/bin/bash
######系統配合
#下載ISO檔
#https://ftp.ubuntu-tw.org/ubuntu-releases/26.04.1/ 安裝
######鄭亮星 jls@mail.jls.idv.tw , jls550225@gmail.com , jls@acfs.tw
##安裝防火牆及基本功能 如:mrtg dhcpd snmpd tftpd ...
ETH0=$(ls /proc/net/dev_snmp6 |awk '{ print $1 }' |sed -n '1p')
ETH1=$(ls /proc/net/dev_snmp6 |awk '{ print $1 }' |sed -n '2p')
IP=$(ifconfig $ETH0  |grep 'inet ' |awk '{print $2}')
DATE=$(date "+%Y%m%d%H")
. /root/setup.txt
sync
#find /bin/firewall.sh -type f -exec perl -i -pe s/'EXT_IF="eth0"'/'EXT_IF="$ETH0"'/g {} \;
#find /bin/firewall.sh -type f -exec perl -i -pe s/'INT_IF="eth0"'/'INT_IF="$ETH0"'/g {} \;
cp -arf /etc/phpsysinfo/phpsysinfo.ini /etc/phpsysinfo/phpsysinfo.ini-$DATE
sed -e 's/DEFAULT_LANG="en"/DEFAULT_LANG="tw"/' -i /etc/phpsysinfo/phpsysinfo.ini
sed -e 's/DATETIME_FORMAT="UTC"/DATETIME_FORMAT="locale"/' -i /etc/phpsysinfo/phpsysinfo.ini

sed 's/EXT_IF=.*/EXT_IF="'$(ls /proc/net/dev_snmp6 |awk '{ print $1 }' |sed -n '1p')'"/' ./firewall.sh > /tmp/tmp1.txt
if [ "$ETH1" != "" ] && [ "$ETH1" != "lo" ]; then
        sed 's/INT_IF=.*/INT_IF="'$(ls /proc/net/dev_snmp6 |awk '{ print $1 }' |sed -n '2p')'"/' /tmp/tmp1.txt > /tmp/tmp2.txt
   else
        sed 's/INT_IF=.*/INT_IF="'$(ls /proc/net/dev_snmp6 |awk '{ print $1 }' |sed -n '1p')'"/' /tmp/tmp1.txt > /tmp/tmp2.txt
fi
mv /tmp/tmp2.txt /bin/firewall.sh
if [ "$(ifconfig |grep ppp0 |awk -F":" '{ print $1 }')" = "ppp0" ]; then
        sed 's/EXT_IF=.*/EXT_IF="ppp0"/' /bin/firewall.sh > /tmp/ppp0.txt
                if [ "$ETH1" != "" ] && [ "$ETH1" != "lo" ]; then
                        sed 's/INT_IF=.*/INT_IF="'$(ls /proc/net/dev_snmp6 |awk '{ print $1 }' |sed -n '2p')'"/' /tmp/ppp0.txt > /tmp/ppp1.txt
                   else
                        sed 's/INT_IF=.*/INT_IF="ppp0"/' /tmp/ppp0.txt > /tmp/ppp1.txt
                fi
      mv /tmp/ppp1.txt /bin/firewall.sh
fi

chmod +x /bin/firewall.sh

cat > /usr/lib/systemd/system/load.system.service << EOF
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

# This unit gets pulled automatically into multi-user.target by
# load.system.service if /usr/sbin/load.system is executable.
[Unit]
Description=/usr/sbin/load.system.service Compatibility
ConditionFileIsExecutable=/usr/sbin/load.system.service

[Service]
Type=forking
ExecStart=/usr/sbin/load.system.service start
TimeoutSec=0
StandardOutput=tty
RemainAfterExit=yes
SysVStartPriority=99

[Install]
WantedBy=multi-user.target

EOF
cat > /usr/sbin/load.system.service << EOF
#!/bin/sh -e
sleep 20
/usr/sbin/load.system >/dev/null 2>&1 &
EOF
cat > /usr/sbin/load.system << EOF
#!/bin/bash
env LANG=C /usr/bin/mrtg
EOF
chmod +x /usr/sbin/load.system.service
chmod +x /usr/sbin/load.system

if [ "$ETH1" != "" ] && [ "$ETH1" != "lo" ]; then
cp -arf /etc/default/isc-dhcp-server /etc/default/isc-dhcp-server-$DATE	
cat > /etc/default/isc-dhcp-server << EOF
# Defaults for isc-dhcp-server (sourced by /etc/init.d/isc-dhcp-server)

# Path to dhcpd's config file (default: /etc/dhcp/dhcpd.conf).
#DHCPDv4_CONF=/etc/dhcp/dhcpd.conf
#DHCPDv6_CONF=/etc/dhcp/dhcpd6.conf

# Path to dhcpd's PID file (default: /var/run/dhcpd.pid).
#DHCPDv4_PID=/var/run/dhcpd.pid
#DHCPDv6_PID=/var/run/dhcpd6.pid

# Additional options to start dhcpd with.
#       Don't use options -cf or -pf here; use DHCPD_CONF/ DHCPD_PID instead
#OPTIONS=""

# On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
#       Separate multiple interfaces with spaces, e.g. "eth0 eth1".
INTERFACESv4="$ETH1"
INTERFACESv6="$ETH1"
EOF
fi

cp -arf /etc/dhcp/dhcpd.conf /etc/dhcp/dhcpd.conf-$DATE
cat > /etc/dhcp/dhcpd.conf << EOF
option domain-name "dhcp.server";
default-lease-time 43200;
max-lease-time 86400;
ddns-update-style                       none;
authoritative;
log-facility local7;
allow booting;
allow bootp;
server-name                             tftp;
#filename = "pxelinux.0";
filename = "grldr";

subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.10 192.168.1.250;
    option subnet-mask 255.255.255.0;
    option routers 192.168.1.1;
    next-server 192.168.1.1;
    option broadcast-address 192.168.1.255;
    option domain-name-servers 1.1.1.1,168.95.192.1,168.95.1.1,8.8.8.8;

#       host test1 {
#               #copy the id corresponding to the card
#               hardware ethernet 00:50:04:87:41:3B;
#               fixed-address 192.168.1.130;
#               option host-name "test1";
#               ddns-hostname "sunlight";
#       }

}

#ddns-update-style interim;

EOF

cp -arf /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf-$DATE
cat > /etc/snmp/snmpd.conf << EOF
rocommunity     public
com2sec notConfigUser  default       public
group   notConfigGroup v1           notConfigUser
group   notConfigGroup v2c           notConfigUser
view    systemview    included   .1.3.6.1.2.1.1
view    systemview    included   .1.3.6.1.2.1.25.1.1
access  notConfigGroup ""      any       noauth    exact  systemview none none
syslocation     Ubuntu 24.04 System
syscontact      $HostName ($Email)
dontLogTCPWrappersConnects yes
EOF

systemctl restart snmpd.service
cat > /bin/install-mrtg.sh << EOF
#!/bin/bash
cfgmaker public@$IP > /etc/mrtg/mrtg.cfg
echo "WorkDir: /var/www/mrtg/" >> /etc/mrtg/mrtg.cfg
echo "Options[_]: growright, bits" >>/etc/mrtg/mrtg.cfg
echo "Language: big5" >>/etc/mrtg/mrtg.cfg
env LANG=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg
env LANG=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg
env LANG=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg
indexmaker /etc/mrtg/mrtg.cfg > /var/www/mrtg/index.html

EOF
mkdir -p /etc/mrtg
mkdir -p /var/www/mrtg
/bin/bash /bin/install-mrtg.sh
env LANG=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg
env LANG=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg
env LANG=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg
env LANG=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg
env LANG=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg
env LANG=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg
sync
echo "*/5 * * * * root LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_1 --confcache-file /var/lib/mrtg/mrtg.ok" > /etc/cron.d/mrtg 
sync
ln -sf /var/www/mrtg /var/www/html/mg

tar xvf mod-cband-0.9.7.5.tar
cd mod-cband-0.9.7.5
./configure
make
make install
cd ..
useradd -m jls
#############TFTPD Server Config
echo "/home/jls/tftpboot 192.168.1.*(rw,async,no_root_squash,no_subtree_check)" >> /etc/exports
tar zxvf tftpboot.tgz -C /home/jls
#chown root:nogroup /home/jls/tftpboot -R
mkdir -p /home/jls/tftpboot/acfs-tw
chown jls:jls -R /home/jls/tftpboot
cat > /etc/default/tftpd-hpa << EOF

TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/home/jls/tftpboot"
TFTP_ADDRESS=":69"
TFTP_OPTIONS="--secure"
EOF

sync
sync
echo "sshd:ALL" >> /etc/hosts.deny
echo 'sshd:192.168., 172.20., 220.133.122.131, 220.134.94.12, 163.23., .jls.idv.tw,:spawn=(echo -e "登入日期時間：`date`\n登入的IP來源：%a 以 %d 登入\n顯示最近登入的前十筆資料：\n`last -10`" | mail -s "有人成功登入您(%N)的伺服器!!" '$Email')&' >> /etc/hosts.allow

sync
echo "/bin/firewall.sh" >> /usr/sbin/load.system
echo "systemctl start bandwidthd.service" >> /usr/sbin/load.system
systemctl daemon-reload
systemctl enable load.system.service
systemctl restart load.system.service