#!/bin/bash

# TrinityOS-security.sh
VER="v03/14/04"

# Part of the copyrighted and trademarked TrinityOS document.
# http://www.ecst.csuchico.edu/~dranch
#
# Written and Maintained by David A. Ranch
# dranch@trinnet.net
#
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# This is NOT the most elegant script but I thought having SOMETHING is
# better than nothing.  If you have time to make refinements, etc, please
# email them to me!!
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#
# This script is intended for RH6.x / Mandrake6.x machines.  Redhat 5.x
# users should review this file and un-# out the required lines.
#
# Key:
# ----
# AutoFIX means the script does it for you..
#
# UserFIX means that the user needs to edit the file as recommended by
#	      TrinityOS
#
#
# ChangeLOG
# ---------
#   ** Please see the END of this script file for the ChangeLOG errata
#
#

#-----------------------------------------------------------------------------
# Header section:

# Where backup configs and listings go:
BACKUP=pre-script-backup

#-----------------------------------------------------------------------------

function intro
{
clear
echo -e "TrinityOS-security.sh"
echo -e "$VER"
echo -e "\nWelcome to the semi-automated TrinityOS-security script!\n"
echo -e "\nPlease understand that this script is in an ALPHA stage and needs extensive"
echo -e "testing.  Because of this, please backup ALL data on your machine before"
echo -e "running this script.\n"

echo -e "You should also know that this script is intended to be run while you are"
echo -e "following along in the TrinityOS document.  Make sure you have a copy of "
echo -e "TrinityOS available when you run this script so you know what to do at"
echo -e "each stage of this script.\n"

echo -e "This script is intended for RH6.x / Mandrake6.x machines. Redhat 5.x users"
echo -e "should review this file and un-# out the required lines.\n"
echo -e "NOTE: This script might automatically impliment permissions or changes that"
echo -e "      you might NOT WANT!  Though all pre-script file permissions, etc."
echo -e "      are recorded in $BACKUP, YOU'VE BEEN WARNED!!"
perl wait-for-key

clear
echo -e "\nAlso note that this script CAN be stopped and then be rerun"
echo -e "at a later time.  Though the script CAN jump to a given section"
echo -e "it cannot resume exactly where you left off.  It should also be"
echo -e "noted that currently, once you jump to a section and complete that"
echo -e "section, the script will terminate.  I'm working on getting this"
echo -e "resolved but if you have any ideas, let me know."

echo -e "\n\nIf you want to EXIT, please hit CONTROL-C now.  If not,"
echo "1" > .last
perl wait-for-key
}


function section-7
{
clear
echo -e "\nSection 7"
echo "----------"

echo -e "\n\nSection 7.1"
echo -e "\nAutoFix cron permissions"
echo -e   "------------------------"
ls -laR /etc/cron* > $BACKUP/etc/cron-pre-`date +'%m%d%y'`-`date +%S`
chmod -R 750 /etc/cron.daily
chmod -R 750 /etc/cron.daily/*
chmod -R 750 /etc/cron.hourly
chmod -R 750 /etc/cron.hourly/*
chmod -R 750 /etc/cron.weekly
chmod -R 750 /etc/cron.weekly/*
chmod -R 750 /etc/cron.monthly
chmod -R 750 /etc/cron.monthly/*
echo -e "\nIf there were any errors, don't worry about it."
perl wait-for-key
clear

echo -e "\n\nSection 7.2"
echo -e "\nUserFix: Add the Minicom variable & edit the umask for default file
perms"
echo -e   "--------------------------------------------------------------------------"
perl wait-for-key
vi /etc/profile
clear

#Fix for Redhat 5.2
#echo -e "\nUserFix: Add /etc/localhosts"
#echo -e   "----------------------------"
#perl wait-for-key
#vi /etc/localhosts
#clear

echo -e "\n\nSection 7.3"
#replace broken ftpconversions file
echo -e "\nAutoFix: Fix the compress line in  /etc/ftpconversions"
echo -e   "------------------------------------------------------"
mv /etc/ftpconversions $BACKUP/etc/ftpconversions.orig
cp etc/ftpconversions.trinityos /etc/ftpconversions
perl wait-for-key
clear

echo -e "\n\nSection 7.4"
echo -e "\nAutoFix: Fix /etc/rc.d/init.d permissions"
echo -e   "-----------------------------------------"
ls -laR /etc/rc.d/init.d/* > $BACKUP/etc/rc.d/init.d/init.d-pre-`date +'%m%d%y'`-`date +%S`
chmod 770 /etc/rc.d/init.d/*
echo "7" > .last
perl wait-for-key
}

function section-8
{
clear
echo -e "\n\nSection 8.1"
echo -e "-----------"

echo -e "AutoFix: make the /tmp dir to be sticky"
echo -e "---------------------------------------"
chmod 1777 /tmp
perl wait-for-key
clear

echo -e "\n\nSection 8.2"
echo -e "\nUserFix: /etc/inittab to remove cntl-alt-del"
echo -e   "--------------------------------------------"
perl wait-for-key
vi /etc/inittab
clear
echo -e "\nRestarting init"
echo "---------------"
init q
perl wait-for-key
clear

echo -e "\n\nSection 8.3"
echo -e "\nAutoFix:  disabling most default network daemons. If you receive"
echo "          any errors, ignore them since that service probably isn't "
echo "          installed anyway."
echo -e "\nIf you DON'T want to disable any daemons, hit CONTROL-C now!!"
echo -e "\n** All current daemon settings will be saved in $BACKUP **"
echo "---------------------------------------------------------------------"
perl wait-for-key
clear

echo -e "\nSaving current state of daemons..(SysV)"
ls -laR /etc/rc.d > $BACKUP/etc/rc.d/daemons.pre.lst-`date +'%m%d%y'`-`date +%S`

echo -e "\nDisabling: "

#Disable automounters
echo -e "amd, "
chkconfig --level 2345 amd off

#Disable unless this is a laptop
echo -e "apmd, "
chkconfig --level 2345 apmd off

#Disable unless you want to run batch programs within certain loads
echo -e "atd, "
chkconfig --level 2345 atd off

#Disable unless you want emails of EVERY ARP on your network segment
echo -e "arpwatch, "
chkconfig --level 2345 arpwatch off

#Disable unless you want boot diskless workstations
echo -e "bootparamd, "
chkconfig --level 2345 bootparamd off

#Disable unless this machine will be a DHCP *SERVER*
echo -e "dhcpd, "
chkconfig --level 2345 dhcpd off

#Disable unless this machine will be a full blown router
echo -e "gated, "
chkconfig --level 2345 gated off

#Disable unless this machine will be a WWW server
echo -e "httpd, "
chkconfig --level 2345 httpd off

#Disable unless this machine uses a modularized kernel
#  NOTE:  Not needed for 2.2.x+ kernels
#echo -e "kerneld, "
#chkconfig --level 2345 kerneld off	

#Disable unless you really want to configure remote machines via Linuxconf
echo -e "linuxconf, "
chkconfig --level 2345 linuxconf off

#Disable unless this machine will be a print server 
#(for the local or remote machine)
echo -e "lpd, "
chkconfig --level 2345 lpd off

#Disable unless you really need the proprietary MC server
echo -e "mcserv, "
chkconfig --level 2345 mcserv off

#Disable unless this machine will be a database server
echo -e "mysql, "
chkconfig --level 2345 mysql off

#Disable unless this machine will be a caching or full blown DNS server
echo -e "named, "
chkconfig --level 2345 named off

#Disable unless this machine will be a NFS server
echo -e "nfs, "
chkconfig --level 2345 nfs off
			
#Disable unless this machine is a laptop or the PC has PCMCIA cards
echo -e "pcmcia, "
chkconfig --level 2345 pcmcia off

#Disable unless this machine will be an NFS server or needs RPC tools
echo -e "portmap, "
chkconfig --level 2345 portmap off

#Disable all R-cmds
echo -e "rusersd, "
chkconfig --level 2345 rusersd off
echo -e "rwalld, "
chkconfig --level 2345 rwalld off
echo -e "rwhod, "
chkconfig --level 2345 rwhod off

#Disable unless this machine is a email server
echo -e "sendmail, "
chkconfig --level 345 sendmail off

#Disable unless this machine is a Samba (MS File&Print) server
echo -e "smb, "
chkconfig --level 345 smb off

#Disable unless this machine is to support SNMP
echo -e "snmpd, "
chkconfig --level 2345 snmpd off

#Disable unless this machine is a local/remote HTTP proxy server
echo -e "squid, "
chkconfig --level 2345 squid off

#Disable unless this machine will be running X-windows
echo -e "xfs, "
chkconfig --level 2345 xfs off

#Disable unless this machine will be an NTP server
echo -e "xntpd, "
chkconfig --level 2345 xntpd off

#Disable unless this machine will be part of a NIS/YP domain
echo -e "ypbind, "
chkconfig --level 2345 ypbind off
echo -en "yppadsswdd, "
chkconfig --level 2345 yppasswdd off

#Disable unless this machine will be a NIS/YP server
echo -e "ypserv"
chkconfig --level 2345 ypserv off
perl wait-for-key
clear

echo -e "\n\nSection 8.4"
#Disable most unneeded stuff in /etc/inetd.conf
#If using finger, change it to run as "nobody"
echo -e "\n\nUserFix: of shutting down services in /etc/inetd.conf"
echo        "-----------------------------------------------------"
perl wait-for-key
vi /etc/inetd.conf
clear
echo "Restarting inetd"
echo "----------------"
kill -HUP `ps aux | grep inetd | grep -v -e grep | awk '{print $2}'`
perl wait-for-key
clear

echo -e "\n\nSection 8.5a"
#Shut down access to remote machines via TCP wrappers
echo -e "\nUserFix: Shut down access to only known servers via TCPd"
echo      "--------------------------------------------------------"
perl wait-for-key
vi /etc/hosts.deny
clear
echo -e "\n\nSection 8.5b"
echo -e "\nUserFix: Allow access to only known servers via TCPd"
echo      "----------------------------------------------------"
perl wait-for-key
vi /etc/hosts.allow
clear

echo -e "\n\nSection 8.6"
echo -e "\nUserFix: Disable anonymous FTP:"
echo      "-------------------------------"
perl wait-for-key
vi /etc/ftpaccess
clear

#echo -e "\n\nSection 8.7"
#For Redhat 5.x users
#echo -e "\nAutoFix: Convert to a shadow password system"
#echo      "--------------------------------------------"
#perl wait-for-key
#pwconv
#echo "UserFix: Add in support for shadow passwd files"
#echo "-----------------------------------------------"
#perl wait-for-key
#vi /etc/pam.d/passwd
#clear

echo -e "\n\nSection 8.8"
echo -e "\nUserFix: Confirm the system only allows console root logins"
echo      "-----------------------------------------------------------"
perl wait-for-key
vi /etc/securetty
clear

echo -e "\n\nSection 8.9"
echo -e "\nUserFix: Make sure that root and other accounts CANNOT login via FTP"
echo      "--------------------------------------------------------------------"
perl wait-for-key
vi /etc/ftpusers
clear

echo -e "\n\nSection 8.10"
echo -e "\nAutoFix: Disable any non-required CRON jobs.  If you see any errors"
echo "         don't worry.  That means that the specific cron job weren't there."
echo      "-------------------------------------------------------------------"
echo -e "\n"
mkdir -m700 /etc/cron.disabled 2> /dev/null
mkdir -m700 /etc/cron.disabled/cron.hourly 2> /dev/null
mkdir -m700 /etc/cron.disabled/cron.daily 2> /dev/null
mv /etc/cron.hourly/inn-cron-nntpsend /etc/cron.disabled/cron.hourly
mv /etc/cron.daily/inn-cron-expire /etc/cron.disabled/cron.daily
mv /etc/cron.daily/inn-cron-rnews /etc/cron.disabled/cron.daily
mv /etc/cron.daily/tetex.cron /etc/cron.disabled/cron.daily
perl wait-for-key
clear

echo -e "\n\nSection 8.11"
echo -e "\nAutoFix: Change system permissions for only root and admin groups"
echo "         If you see errors, that probably means that the package "
echo "         wasn't installed."
echo -e "\n** All current daemon settings will be saved in $BACKUP **"
echo      "-----------------------------------------------------------------"
perl wait-for-key
clear
ls -laR /bin > $BACKUP/bin/bin.lst-`date +'%m%d%y'`-`date +%S`
echo -e "\nFiles in /bin "
echo -e   "-------------"
echo "Bru is a commercial backup program but some Linux distros come with it"
chmod 750 /bin/bru
chmod 750 /bin/linuxconf
chmod 750 /bin/mount
chmod 750 /bin/mt
chmod 750 /bin/rpm
chmod 750 /bin/setserial
chmod 4750 /bin/su
chgrp adm /bin/su
chmod 750 /bin/umount
echo -e "\n/sbin"
echo -e "-----"
ls -laR /sbin > $BACKUP/sbin/sbin.lst-`date +'%m%d%y'`-`date +%S`
chmod 750 /sbin/accton
chmod 750 /sbin/badblocks
chmod 750 /sbin/ctrlaltdel
chmod 750 /sbin/chkconfig
chmod 750 /sbin/chkraid
chmod 750 /sbin/debugfs
chmod 750 /sbin/depmod
chmod 750 /sbin/dhcpcd
chmod 750 /sbin/dump*
chmod 750 /sbin/fdisk
chmod 750 /sbin/fsck*
chmod 750 /sbin/ftl*
chmod 750 /sbin/getty
chmod 750 /sbin/halt
chmod 750 /sbin/hdparm
chmod 750 /sbin/hwclock
chmod 750 /sbin/ide_info
chmod 750 /sbin/if*
chmod 750 /sbin/init
chmod 750 /sbin/insmod
echo "IPFWADM is only installed for v2.0 kernels"
chmod 750 /sbin/ipfwadm
chmod 750 /sbin/ipx*
chmod 750 /sbin/isapnp
#For 2.0.x kernels
chmod 750 /sbin/kerneld
chmod 750 /sbin/killall*
echo -e "This is the new location for klogd."
echo -e "Please disregard any errors if this doesn't work.\n"
chmod 750 /sbin/klogd
chmod 750 /sbin/lilo
chmod 750 /sbin/mgetty
chmod 750 /sbin/mingetty
chmod 750 /sbin/mk*
chmod 750 /sbin/mod*
chmod 750 /sbin/netreport
chmod 750 /sbin/pam*
chmod 750 /sbin/pcinitrd
chmod 750 /sbin/pnpdump
chmod 750 /sbin/portmap
chmod 750 /sbin/quotaon
chmod 750 /sbin/raidadd
chmod 750 /sbin/restore
chmod 750 /sbin/runlevel
chmod 750 /sbin/stinit
echo -e "This is the NEW location for sys/klogd."
echo -e "Please disregard any errors if this doesn't work.\n"
chmod 750 /sbin/syslogd
chmod 750 /sbin/swapon
chmod 750 /sbin/tune2fs
chmod 750 /sbin/uugetty
chmod 750 /sbin/vgetty
echo -e "\n/usr/bin"
echo -e   "--------"
ls -laR /usr/bin > $BACKUP/usr/bin/usr-bin.lst-`date +'%m%d%y'`-`date +%S`
chmod 750 /usr/bin/control-panel
chmod 750 /usr/bin/comanche
chmod 750 /usr/bin/eject
chmod 750 /usr/bin/glint
chmod 750 /usr/bin/gnome*
chmod 750 /usr/bin/gpasswd
chmod 750 /usr/bin/ipx*
chmod 750 /usr/bin/kernelcfg
chmod 755 /usr/bin/lp*
chmod 4755 /usr/bin/lpr
chmod 750 /usr/bin/mformat
chmod 750 /usr/bin/minicom
chmod 750 /usr/bin/mtools
chmod 750 /usr/bin/netcfg
chmod 750 /usr/bin/rusers
chmod 750 /usr/bin/rwall
chmod 750 /usr/bin/uucp
echo -e "\n/usr/sbin"
echo -e   "---------"
ls -laR /usr/sbin > $BACKUP/usr/sbin/usr-sbin.lst-`date +'%m%d%y'`-`date +%S`
chmod 750 /usr/sbin/am*
chmod 750 /usr/sbin/at*
chmod 750 /usr/sbin/automount
chmod 750 /usr/sbin/bootp*
chmod 750 /usr/sbin/crond
chmod 750 /usr/sbin/dhc*
chmod 750 /usr/sbin/dip
chmod 750 /usr/sbin/dump*
chmod 750 /usr/sbin/edquota
chmod 750 /usr/sbin/exportfs
chmod 750 /usr/sbin/fixmount
chmod 750 /usr/sbin/ftpshut
chmod 750 /usr/sbin/gated
chmod 750 /usr/sbin/group*
chmod 750 /usr/sbin/grp*
chmod 750 /usr/sbin/imapd
chmod 750 /usr/sbin/in.*
chmod 750 /usr/sbin/inetd
chmod 750 /usr/sbin/ipop*
echo "This is the old location for klogd."
echo -e "Please disregard any errors if this doesn't work.\n"
chmod 750 /usr/sbin/klogd
chmod 750 /usr/sbin/logrotate
chmod 750 /usr/sbin/lp*
chmod 755 /usr/sbin/lsof
chmod 750 /usr/sbin/makemap
chmod 750 /usr/sbin/mk-amd-map
chmod 750 /usr/sbin/mouseconfig
chmod 750 /usr/sbin/named*
chmod 750 /usr/sbin/nmbd
chmod 750 /usr/sbin/newusers
chmod 750 /usr/sbin/ntp*
chmod 750 /usr/sbin/ntsysv
chmod 750 /usr/sbin/pppd
chmod 750 /usr/sbin/pnpprobe
chmod 750 /usr/sbin/pw*
chmod 750 /usr/sbin/quota*
chmod 750 /usr/sbin/rdev
chmod 750 /usr/sbin/rdist
chmod 750 /usr/sbin/repquota
chmod 750 /usr/sbin/rhbackup
chmod 750 /usr/sbin/rotatelogs
chmod 750 /usr/sbin/rpc*
chmod 750 /usr/sbin/rwhod
chmod 750 /usr/sbin/samba
chmod 750 /usr/sbin/setup
chmod 750 /usr/sbin/showmount
chmod 750 /usr/sbin/smb*
chmod 750 /usr/sbin/sndconfig
chmod 750 /usr/sbin/snmp*
chmod 750 /usr/sbin/squid
echo "This is the OLD location for sysklogd."
echo -e "Please disregard any errors if this doesn't work.\n"
chmod 750 /usr/sbin/syslogd
chmod 750 /usr/sbin/taper
chmod 750 /usr/sbin/tcpd*
chmod 750 /usr/sbin/time*
chmod 750 /usr/sbin/tmpwatch
chmod 750 /usr/sbin/tunelp
chmod 750 /usr/sbin/user*
chmod 750 /usr/sbin/uu*
chmod 750 /usr/sbin/vi*
chmod 750 /usr/sbin/wire-test
chmod 750 /usr/sbin/xntp*
perl wait-for-key
clear

echo -e "\n\nSection 8.12"
echo -e "\nAutoFix: Store a SUID list in /etc/info. This will take a while.."
echo -e "\n  ** Please disregard any /proc errors"
echo      "-----------------------------------------------------------------"
mkdir -m 700 /etc/info 2> /dev/null
echo -e "\nWorking..(time depends on performance of CPU and DISK I/O)\n"
find / -type f \( -perm -04000 -o -perm -02000 \) -ls > /etc/info/suid-results
echo -e "\nUserFix: Review SUID files and delete all files that should NOT be SUID"
echo "---------------------------------------------------------------------------"
vi /etc/info/suid-results
echo -e "Renaming and moving file to /etc/info/suid-results-checked"
mv /etc/info/suid-results /etc/info/suid-results-checked
chmod 600 /etc/info/suid-results-checked
perl wait-for-key
clear

echo -e "\n\nSection 8.13"
echo -e "\nAutoFix: Store a rhosts list in /etc/info. This will take a while.."
echo "         NOTE: There might not be ANY rhosts files."
echo "------------------------------------------------------------------------"
echo -e "\nWorking..(time depends on performance of CPU and DISK I/O)\n"
find / | grep -e ".rhosts" -e "hosts.equiv" > /etc/info/rcmd-results
echo -e "\nUserFix: Review rhosts list and delete all files that should NOT be SUID"
echo "----------------------------------------------------------------------------"
vi /etc/info/rcmd-results
echo -e "Renaming and moving file to /etc/info/rcmd-results-checked"
mv /etc/info/rcmd-results /etc/info/rcmd-results-checked
chmod 600 /etc/info/rcmd-results-checked
perl wait-for-key
clear

echo -e "\n\nSection 8.14"
echo -e "\nAutoFix: Store a RPM list in /etc/info. This will take a while.."
echo "------------------------------------------------------------------------"
echo -e "\nWorking..(time depends on performance of CPU and DISK I/O)\n"
/bin/rpm -Va > /etc/info/rpm-results-checked
chmod 600 /etc/info/rpm-results-checked
perl wait-for-key
clear

echo -e "\n\nSection 8.15"
echo -e "\nAutofix: clean up XFree files and set the sticky bit"
echo      "----------------------------------------------------"
rm -rf /tmp/.X11-unix
mkdir -p -m 777 /tmp/.X11-unix
chmod o+t /tmp/.X11-unix
echo "8" > .last
perl wait-for-key
}

function section-9
{
clear
echo -e "\nSection 9"
echo "----------"
echo -e "\n\nSection 9.1"
echo "AutoFix:  Making a backup of /etc/syslog.conf and replacing it with "
echo "          a copy that has additional logging and also impliments"
echo "          logging to TTY7 and TTY8"
echo "--------------------------------------------------------------------"
mv /etc/syslog.conf $BACKUP/etc/syslog.conf.orig
cp etc/syslog.conf.trinityos /etc/syslog.conf
perl wait-for-key
clear
echo -e "\nCreate new log files and fix both new and exists log file perms"
echo "-------------------------------------------------------------------"
touch /var/log/syslog
touch /var/log/loginlog
touch /var/log/kernel
chmod 600 /var/log/syslog
chmod 600 /var/log/loginlog
chmod 600 /var/log/kernel

chmod 600 /var/log/messages
chmod 600 /var/log/loginlog
chmod 600 /var/log/kernel
chmod 600 /etc/syslog.conf
chmod 600 /var/log/cron
echo -e "\nIgnore any errors encountered if you don't have httpd installed or running"
chmod 700 /var/log/httpd
chmod 600 /var/log/httpd/*
chmod 600 /var/log/maillog
chmod 600 /var/log/messages
echo -e "\nIgnore any errors encountered if you don't have mysql installed or running"
chmod 600 /var/log/mysql
chmod 600 /var/log/netconf.log
echo -e "\nIgnore any errors encountered if you don't have Samba installed or running"
chmod 700 /var/log/samba
chmod 600 /var/log/samba/*
chmod 600 /var/log/secure
chmod 600 /var/log/sendmail.st
chmod 600 /var/log/spooler
echo -e "\nIgnore any errors encountered if you don't have squid installed or running"
chmod 700 /var/log/squid
chmod 600 /var/log/squid/*
chmod 600 /var/log/xferlog
perl wait-for-key
clear
echo -e "\nRestarting syslog"
echo      "-----------------"
kill -HUP `ps aux | grep syslogd | grep -v -e grep | awk '{print $2}'`
perl wait-for-key
clear


echo -e "\n\nSection 9.2"
echo -e "\nUserFix: Update logrotate.d to rotate the new syslog files"
echo      "----------------------------------------------------------"
perl wait-for-key
vi /etc/logrotate.d/syslog
clear

echo -e "\n\nSection 9.3"
echo "UserFix: Enable log compression"
echo "-------------------------------"
perl wait-for-key
vi /etc/logrotate.conf
clear

echo -e "\n\nSection 9.4"
echo "UserFix: Enable log compression for specific logs"
echo "-------------------------------------------------"
perl wait-for-key
vi /etc/logrotate.d/ftpd
clear
vi /etc/logrotate.d/linuxconf
clear
vi /etc/logrotate.d/sendfax
clear


echo -e "\n\nSection 9.5"
echo "AutoFix: Disable log rotation for unused logs"
echo "-------------------------------------------------"
perl wait-for-key
mkdir -m 700 /etc/logrotate.d.disabled 2> /dev/null
mv /etc/logrotate.d/mysql /etc/logrotate.d.disabled
mv /etc/logrotate.d/squid /etc/logrotate.d.disabled
clear

echo -e "\n\nSection 9.6"
echo "AutoFix: Make a backup of /etc/rc.d/rc.local and clean it up"
echo -e "\nNote: this new copy has the dmesg option in it as well:"
echo "------------------------------------------------------------"
mv /etc/rc.d/rc.local /etc/rc.d/rc.local.orig
cp etc/rc.d/rc.local.trinityos /etc/rc.d/rc.local
chmod 700 /etc/rc.d/rc.local
perl wait-for-key
clear

echo -e "\n\nSection 9.7"
echo "AutoFix: Clean up the issue stuff from the stock install"
echo "--------------------------------------------------------"
rm -f /etc/issue
rm -f /etc/issue.net
touch /etc/issue
touch /etc/issue.net
chmod 400 /etc/issue
chmod 400 /etc/issue.net
perl wait-for-key
clear

echo -e "\n\nSection 9.8"
echo "AutoFix: Send a copy of dmesg to /etc/info/dmesg"
echo "------------------------------------------------"
echo  "This is already put into your /etc/rc.d/rc.local file."
perl wait-for-key
clear

echo -e "\n\nSection 9.9"
echo "AutoFix:  Making a backup of /etc/syslog.conf and replacing it with "
echo "          a copy that has additional logging and also impliments"
echo "          logging to TTY7 and TTY8"
echo "------------------------------------------------"
echo  "This is already put into your /etc/syslog.conf."
perl wait-for-key
clear

echo -e "\n\nSection 9.10"
echo "AutoFix: Copy the logit script to /root"
echo "---------------------------------------"
cp root/logit /root
perl wait-for-key
clear

echo -e "\n\nSection 9.11"
echo "UserFix: Add some colors to the default prompt for ALL users"
echo "------------------------------------------------------------"
perl wait-for-key
vi /etc/bashrc
clear

echo -e "\n\nSection 9.12"
echo "AutoFix: Make sure that apropos has a new database"
echo "--------------------------------------------------"
echo "This will run in the background for some time and the HD will"
echo "    be running for a while.  No worries.  This is expected."
makewhatis -w &
perl wait-for-key
clear

echo -e "\n\nSection 9.13"
echo "AutoFix: Copy over the sendlogs script and have it auto run"
echo "-----------------------------------------------------------"
cp usr/local/sbin/sendlogs.trinityos /usr/local/sbin/sendlogs
cp etc/cron.daily/a-sendlogs.trinityos /etc/cron.daily/a-sendlogs
echo "9" > .last
perl wait-for-key
clear
}

function section-10
{
clear
echo -e "\nSection 10"
echo "----------"

echo -e "\n\nSection 10.1"
echo "UserFix: Edit the rc.firewall to fix your needs.."
echo "-------------------------------------------------"
cp etc/rc.d/rc.firewall-trinityos /etc/rc.d/rc.firewall
chmod 700 /etc/rc.d/rc.firewall
cp etc/rc.d/init.d/firewall /etc/rc.d/init.d/firewall
perl wait-for-key
vi /etc/rc.d/rc.firewall
clear

echo -e "\n\nSection 10.2"
echo "UserFix: Edit the rc.sysinit file to disable the automatic run of rc.firewall"
echo "-----------------------------------------------------------------------------"
vi /etc/rc.d/rc.sysinit
perl wait-for-key
clear

echo -e "\n\nSection 10.3"
echo "UserFix: Sets the /etc/rc.d/rc.firewall ruleset to load just after the network comes up.  
echo "----------------------------------------------------------------------------------------"
If you run DHCP on your external interface, you will STILL want to run this command or if you get the SAME IP address as you had before reboot, the /etc/rc.d/rc.firewall ruleset will NOT be loaded."
perl wait-for-key
clear
echo "Regardless of running DHCP on your external interface, you should run the following command:"
echo -e "'chkconfig --level=345 firewall on'.  Type "exit" after you are done.\n\n"
/bin/bash
echo "10" > .last
clear

echo -e "\n\nSection 10.4"
echo "AutoFix: Move the firewall-confirm over"
echo "---------------------------------------"
mv usr/local/sbin/firewall-confirmed.trinityos /usr/local/sbin/
chmod 700 /usr/local/sbin/firewall-confirmed
perl wait-for-key
vi /etc/rc.d/rc.firewall
clear

}

function section-11
{
clear
echo -e "\nSection 11"
echo "----------"
echo "Skipped due to the fact its for 2.0.x kernels: IPPORTFW"
echo "-------------------------------------------------------"
echo "11" > .last
perl wait-for-key
}

function section-12
{
clear
echo -e "\nSection 12"
echo "----------"
echo "Skipped due to the fact its too complicated to script: KERNEL"
echo "-------------------------------------------------------------"
echo "12" > .last
perl wait-for-key
}

function section-13
{
clear
echo -e "\nSection 13"
echo "----------"
echo "Skipped due to the fact its too complicated to script: PPPd"
echo "-----------------------------------------------------------"
perl wait-for-key
}

function section-14
{
clear
echo -e "\nSection 14"
echo "----------"
echo "Create the kernel building script"
echo "---------------------------------"
cp usr/src/kernel/build-it.trinityos /usr/src/kernel/build-it
perl wait-for-key
}


function section-15
{
clear
echo -e "\nSection 15"
echo "----------"
echo -e "\n\nSection 15.1"
echo "UserFix: Edit /etc/lilo.conf and secure the boot loader."
echo "-----------------------------------------------------------"
perl wait-for-key
vi /etc/lilo.conf
clear
echo "Now the script will rerun LILO for the changes to take effect".
perl wait-for-key
chmod 700 /etc/lilo.conf
/sbin/lilo
perl wait-for-key
}

function section-16
{
clear
echo -e "\nSection 16"
echo "----------"
echo -e "\n\nSection 16.1"
echo "AutoFix: Copy over the rc.serial file but DON'T activate it unless needed"
echo "-------------------------------------------------------------------------"
cp etc/rc.d/rc.serial-trinityos /etc/rc.d/rc.serial-trinityos
echo -e "\n\n"
echo "UserFix: Tune the RWIN on the NICs.."
echo "------------------------------------"
perl wait-for-key
vi /sbin/ifup
}

function section-17
{
clear
echo -e "\nSection 17"
echo "----------"
echo "Skipped due to the fact its for 2.0.x kernels: IPFWADM"
echo "------------------------------------------------------"
perl wait-for-key
}


function section-18
{
clear
echo -e "\nSection 18"
echo "----------"
echo -e "\n\nSection 18.1"
echo "Add primary user to get all of root's email"
echo -e "\n NOTE:  This is editing for the new Sendmail 8.10.x file location"
echo "----------------------------------------------------------------------"
perl wait-for-key
vi /etc/mail/aliases
echo -e "\n\n"
newaliases
perl wait-for-key
}

function section-19
{
clear
echo -e "\nSection 19"
echo "----------"
echo -e "\n\nSection 19.1"
echo "Technically.. you should reboot now with your new kernel.  But"
echo "   this script cannot resume from where you left off yet."
echo "----------------------------------------------------------------"
perl wait-for-key
}


function section-20
{
clear
echo -e "\nSection 20"
echo "----------"
echo -e "\n\nSection 20.1"
echo "Verify that your required IP Masq modules have loaded"
echo "-------------------------------------------"
/sbin/lsmod
perl wait-for-key
}

function section-21
{
clear
echo -e "\nSection 21"
echo "----------"
echo -e "\n\nSection 21.1"
echo "Install TCPDUMP.  This TrinityOS section will be soon deleted since"
echo "     all modern Linux distros install it by default"
echo "-------------------------------------------------------------------"
perl wait-for-key
}

function section-22
{
clear
echo -e "\nSection 22"
echo "----------"
echo -e "\n\nSection 22.1"
echo "AutoFix: Setting up initial PPP files"
echo "-------------------------------------"
if [ -f /etc/ppp/options ]; then
	mv /etc/ppp/options /etc/ppp/options.orig;
fi
perl wait-for-key
clear

echo -e "\n\nSection 22.2"
echo "UserFix: Configure the options file"
echo "-----------------------------------"
cp etc/ppp/options-trinityos /etc/ppp/options
perl wait-for-key
vi /etc/ppp/options
clear

echo -e "\n\nSection 22.3"
echo "UserFix: Configure the options file"
echo "-----------------------------------"
cp etc/ppp/chat.your-ppp-isp.trinityos /etc/ppp/chat.your-ppp-isp
perl wait-for-key
vi /etc/ppp/chat.your-ppp-isp
clear
echo -e "\n\nSection 22.4"
echo "UserFix: Configure the options file"
echo "-----------------------------------"
cp etc/ppp/pap-secrets.trinityos /etc/ppp/pap-secrets
perl wait-for-key
vi /etc/ppp/pap-secrets
clear
echo -e "\n\nSection 22.5"
echo "UserFix: Configure the startppp file"
echo "------------------------------------"
cp usr/local/sbin/startppp.trinityos /usr/local/sbin/startppp
perl wait-for-key
vi /usr/local/sbin/startppp
clear
echo -e "\n\nSection 22.6"
echo "UserFix: Configure the stopppp file"
echo "-----------------------------------"
cp usr/local/sbin/stopppp.trinityos /usr/local/sbin/stopppp
perl wait-for-key
vi /usr/local/sbin/stopppp
clear
}

function section-23
{
echo -e "\nSection 23"
echo "----------"
echo "Setting up Diald is currently skipped since the section needs to be"
echo "   updated."
echo "-------------------------------------------------------------------"
perl wait-for-key
}

function section-24
{
echo -e "\nSection 24.5"
echo "------------"

echo "AutoFix: Creating the various DNS group and user directories.."
groupadd -g 120 chroot-dns-ext
groupadd -g 121 chroot-dns-int
useradd -u 120 -g 120 chroot-dns-ext
useradd -u 121 -g 121 chroot-dns-int

echo "AutoFix: Fixing directory perms"
chmod 750 /home/chroot-dns-ext
chmod 750 /home/chroot-dns-int

echo "AutoFix: Making sub-directories for ext"
mkdir -p /home/chroot-dns-ext/etc
mkdir -p /home/chroot-dns-ext/lib 
mkdir -p /home/chroot-dns-ext/dev 
mkdir -p /home/chroot-dns-ext/usr/sbin 
mkdir -p /home/chroot-dns-ext/var/named 
mkdir -p /home/chroot-dns-ext/var/run
chmod -R 750 /home/chroot-dns-ext
echo "AutoFix: Making dev/null device for ext"
mknod -m 666 /home/chroot-dns-ext/dev/null c 1 3
mknod -m 666 /home/chroot-dns-ext/dev/zero c 1 5
mknod -m 666 /home/chroot-dns-ext/dev/random c 1 8

echo "AutoFix: Making sub-directories for int"
mkdir -p /home/chroot-dns-int/etc
mkdir -p /home/chroot-dns-int/lib 
mkdir -p /home/chroot-dns-int/dev 
mkdir -p /home/chroot-dns-int/usr/sbin 
mkdir -p /home/chroot-dns-int/var/named 
mkdir -p /home/chroot-dns-int/var/run
chmod -R 750 /home/chroot-dns-int
echo "AutoFix: Making dev/null device for int"
mknod -m 666 /home/chroot-dns-int/dev/null c 1 3
mknod -m 666 /home/chroot-dns-int/dev/zero c 1 5
mknod -m 666 /home/chroot-dns-int/dev/random c 1 8

echo "AutoFix: Copy over the required libraries"
cp -f /lib/libc.so.6 /home/chroot-dns-ext/lib
cp -f /lib/libc.so.6 /home/chroot-dns-int/lib
cp -f /lib/ld-linux.so.2 /home/chroot-dns-ext/lib
cp -f /lib/ld-linux.so.2 /home/chroot-dns-int/lib

echo "AutoFix: Copy and finally MOVE over the named binaries"
cp -f /usr/sbin/named* /home/chroot-dns-ext/usr/sbin
chmod 750 /home/chroot-dns-ext/usr/sbin/named*

mv -f /usr/sbin/named* /home/chroot-dns-int/usr/sbin
chmod 750 /home/chroot-dns-int/usr/sbin/named*


echo -e "\n\nSection 24.6"
echo "Move over the example INTERNAL Zone files and edit them"
cp home/chroot-dns-int/etc/named.conf.trinityos /home/chroot-dns-int/etc/named.conf
perl wait-for-key
vi /home/chroot-dns-int/etc/named.conf
chmod 640 /home/chroot-dns-int/etc/named.conf

#Start out with .2 since .1 is the root.hints file

echo -e "\n\nSection 24.7.2"
echo "UserFix: Now make the required changes to the /home/chroot-dns-int/var/named/127.0.0.db zone file"
echo "--------------------------------------------------------------------------------------------"
cp home/chroot-dns-int/var/named/root.hints.db.trinityos /home/chroot-dns-int/var/named/root.hints.db
cp home/chroot-dns-int/var/named/127.0.0-in.addr.db.trinityos /home/chroot-dns-int/var/named/127.0.0-in.addr.db
perl wait-for-key
vi /home/chroot-dns-int/var/named/127.0.0-in.addr.db
clear


echo -e "\n\nSection 24.7.3"
echo "UserFix: Now make the required changes to the /home/chroot-dns-int/var/named/192.168.0.db file"
echo "----------------------------------------------------------------------------------------------"
cp home/chroot-dns-int/var/named/acme123-int.com.db.trinityos /home/chroot-dns-int/var/named/acme123-int.com.db
perl wait-for-key
vi /home/chroot-dns-int/var/named/acme123-int.com.db
clear

echo -e "\n\nSection 24.7.4"
echo "UserFix: Now make the required changes to the /home/chroot-dns-int/var/named/192.168.0-in.addr.db file"
echo "------------------------------------------------------------------------------------------------------"
cp home/chroot-dns-int/var/named/192.168.0-in.addr.db.trinityos /home/chroot-dns-int/var/named/192.168.0-in.addr.db
perl wait-for-key
vi /home/chroot-dns-int/var/named/192.168.0-in.addr.db
clear


echo "Move over the example EXTERNAL Zone files and edit them"
cp home/chroot-dns-ext/etc/named.conf.trinityos /home/chroot-dns-ext/etc/named.conf

echo -e "\n\nSection 24.8"
echo "UserFix: Now make the required changes to the /home/chroot-dns-ext/etc/named.conf file"
echo "--------------------------------------------------------------------------------------"
perl wait-for-key
vi /home/chroot-dns-ext/etc/named.conf
chmod 640 /home/chroot-dns-ext/etc/named.conf
clear

echo -e "\n\nSection 24.9.2"
echo "UserFix: Now make the required changes to the /home/chroot-dns-ext/var/named/acme123.com.db file"
echo "------------------------------------------------------------------------------------------------"
cp home/chroot-dns-ext/var/named/root.hints.db.trinityos /home/chroot-dns-ext/var/named/root.hints.db
cp home/chroot-dns-ext/var/named/acme123.com.db.trinityos /home/chroot-dns-ext/var/named/acme123.com.db
perl wait-for-key
vi /home/chroot-dns-ext/var/named/acme123.com.db
clear


echo -e "\n\nSection 24.9.3"
echo "UserFix: Now make the required changes to the /home/chroot-dns-ext/var/named/212.0.200.100.db file"
echo "----------------------------------------------------------------------------------------------"
cp home/chroot-dns-ext/var/named/100.200.0.212-in.addr.db.trinityos /home/chroot-dns-ext/var/named/100.200.0.212-in.addr.db
perl wait-for-key
vi /home/chroot-dns-ext/var/named/100.200.0.212-in.addr.db
clear


echo -e "\n\nSection 24.10"
echo "AutoFix: Fix the file permissions"
chown -R chroot-dns-int.chroot-dns-int /home/chroot-dns-int
chown -R chroot-dns-ext.chroot-dns-ext /home/chroot-dns-ext

# ===MOVE===
echo -e "\n\nSection 24.11"
echo "UserFix: Now make the required changes to the /home/chroot-dns-int/etc/rc.d/init.d/named file"
echo "---------------------------------------------------------------------------------------------"
perl wait-for-key
mv /etc/rc.d/init.d/named /etc/rc.d/init.d/named.orig
cp etc/rc.d/init.d/named /etc/rc.d/init.d/named
perl wait-for-key
$EDITOR /etc/rc.d/init.d/named
clear

echo -e "\n\nSection 24.13.1"
echo "UserFix: Now make the required changes to the /etc/rc.d/init.d/syslog script"
echo "----------------------------------------------------------------------------"
perl wait-for-key
vi /etc/rc.d/init.d/syslog
clear

echo "AutoFix: Restart syslog.."
/etc/rc.d/init.d/syslog stop
/etc/rc.d/init.d/syslog start

echo -e "\n\nSection 24.13.2"
echo "UserFix: Edit the /etc/resolv.conf file"
perl wait-for-key
vi /etc/resolv.conf
clear

echo -e "\n\nSection 24.13.3"
echo "UserFix: Edit the /etc/nsswitch.conf file"
perl wait-for-key
vi /etc/nsswitch.conf
clear

echo -e "\n\nSection 24.18"
echo "Autofix: Setting up the /var/named root-hints update files for DNS"
echo "------------------------------------------------------------------"
cp usr/local/sbin/root-hints-update.trinityos /usr/local/sbin/root-hints-update
ln -s /usr/local/sbin/root-hints-update /etc/cron.monthly/root-hints-update
perl wait-for-key
}

function section-25
{
clear
echo -e "\nSection 25"
echo "----------"

echo -e "\n\nSection 25.1"
echo "Skipped: Move your Sendmail documentation to the correct spot"
echo "------------------------------------------------------------"
echo "This step is skipped as I have no way to know where you put the"
echo "Sendmail sources"
perl wait-for-key
clear

echo -e "\n\nSection 25.2"
echo "UserFix: Set your domain namemail"
echo " "
echo "NOTE:  This assumes you are running Sendmail 8.10.x or newer"
echo "------------------------------------------------------------"
cp etc/mail/local-host-names.trinityos /etc/mail/local-host-names
perl wait-for-key
vi /etc/mail/local-host-names
clear

echo -e "\n\nSection 25.3"
echo "AutoFix: Fix various Sendmail file and path permissions"
echo "-------------------------------------------------------"
chmod go-w / /etc /etc/mail /usr /var /var/spool /var/spool/mqueue
chown root / /etc /etc/mail /usr /var /var/spool /var/spool/mqueue
perl wait-for-key
clear

echo -e "\n\nSection 25.4"
echo "UserFix: Set your sendmail.mc file"
echo "----------------------------------"
cp usr/lib/sendmail-cf/cf/trinityos.mc /usr/lib/sendmail-cf/cf/trinityos.mc
perl wait-for-key
vi /usr/lib/sendmail-cf/cf/trinityos.mc
clear

export CFDIR="/usr/lib/sendmail-cf"
cd /usr/lib/sendmail-cf
m4 ${CFDIR}/m4/cf.m4 ${CFDIR}/cf/trinityos.mc > ${CFDIR}/cf/trinityos.cf
cp ${CFDIR}/cf/trinityos.cf /etc/mail/sendmail.cf
cd -

echo -e "\n\nSection 25.5"
echo "UserFix: Tune your sendmail.cf file"
echo "-----------------------------------"
perl wait-for-key
vi /etc/sendmail.cf
clear

echo -e "\n\nSection 25.6"
echo "UserFix: which FQDNs should be able email thought this server"
echo "-------------------------------------------------------------"
perl wait-for-key
vi /etc/mail/relay-domains
perl wait-for-key
}

function section-26
{
clear
echo -e "\nSection 26"
echo "----------"
echo -e "\n\nSection 26.1"
echo "UserFix: Using the 60-minute xntp method.  Set your NTP servers"
echo "---------------------------------------------------------------"
cp usr/local/sbin/set-clock.trinityos /usr/local/sbin/set-clock
perl wait-for-key
vi /usr/local/sbin/set-clock
clear
ln -s /usr/local/sbin/set-clock /etc/cron.hourly/set-clock
perl wait-for-key
}

function section-27
{
clear
echo -e "\nSection 27"
echo "----------"
echo -e "\n\nSection 27.1"
echo "UserFix: Setting up the DHCP broadcast."
echo "---------------------------------------"
perl wait-for-key
vi /etc/rc.d/init.d/dhcpd
clear
cp etc/dhcpd.conf /etc/dhcpd.conf
echo -e "\n\nSection 27.2"
echo "UserFix: Setup your DHCP scopes"
echo "-------------------------------"
perl wait-for-key
vi /etc/dhcpd.conf
clear
touch /etc/dhcpd.leases
echo -e "\n\nSection 27.3"
echo "Make sure DHCP is in the /etc/services file."
echo "--------------------------------------------"
perl wait-for-key
vi /etc/services
clear
echo -e "\n\nSection 27.4"
echo "Enabling DHCPd upon boot"
echo "------------------------"
chkconfig --level 2345 dhcpd on
perl wait-for-key
}

function section-28
{
clear
echo -e "\nSection 28"
echo "----------"
echo "POP-3 mail.  No changes needed.  It is recommended to use IMAP."
echo "---------------------------------------------------------------"
perl wait-for-key
}

function section-29
{
clear
echo -e "\nSection 29"
echo "----------"
echo "HD backup: copying over the backup-to-disk script"
cp home/root/backup-to-disk.trinity /root
echo -e "\nTape Backup: BRU is Commercial product.  This section will be updated in the"
echo "            future with a non-commerical product"
echo "--------------------------------------------------------------------"
perl wait-for-key
}

function section-30
{
clear
echo -e "\nSection 30"
echo "----------"
echo -e "\n\nSection 30.1"
echo "UserFIX: Compile SSH per TrinityOS and now edit the rc.local file"
echo "---------------------------------------------------------------------"
perl wait-for-key
vi /etc/rc.d/rc.local
clear
echo -e "\n\nSection 30.2"
echo "Make sure SSH is in /etc/services"
echo "---------------------------------"
perl wait-for-key
vi /etc/services
clear
echo -e "\n\nSection 30.3"
echo "Configure SSH2 server"
echo "---------------------"
perl wait-for-key
vi /etc/ssh2/sshd2_config
clear
echo -e "\n\nSection 30.4"
echo "Configure SSH server"
echo "--------------------"
perl wait-for-key
vi /etc/sshd_config
clear
echo -e "\n\nSection 30.5"
echo "Configure SSH2 client"
echo "---------------------"
perl wait-for-key
vi /etc/ssh2/ssh2_config
clear
echo -e "\n\nSection 30.6"
echo "Set the SSH alias"
echo "-----------------"
perl wait-for-key
vi /etc/bashrc
clear
echo -e "\n\nSection 30.7"
echo "Start up the SSH server"
echo "-----------------------"
/usr/local/sbin/sshd &
perl wait-for-key
}

function section-31
{
clear
echo -e "\nSection 31"
echo "----------"
echo "Software RAID:  This section will be updated soon."
echo "--------------------------------------------------"
perl wait-for-key
}

function section-32
{
clear
echo -e "\nSection 32"
echo "----------"
echo "CDROM Changer:  Since most people don't have these so I'll leave it out"
echo "-----------------------------------------------------------------------"
perl wait-for-key
}

function section-33
{
clear
echo -e "\nSection 33"
echo "----------"
echo -e "\n\nSection 33.1"
echo "UserFix: Edit the /etc/smb.conf file."
echo "-------------------------------------"
perl wait-for-key
cp etc/smb.conf /etc/smb.conf
vi /etc/smb.conf
clear
echo "AutoFix: make sure the smb.conf file is ok."
echo "-------------------------------------------"
perl wait-for-key
clear
testparm
perl wait-for-key
/etc/rc.d/init.d/smb start
echo "Convert the users in /etc/passwd to /etc/smbpasswd"
echo "--------------------------------------------------"
cat /etc/passwd | mksmbpasswd.sh >/etc/smbpasswd
chmod 500 /etc/smbpasswd
echo "In a differnet TTY, run smbpasswd "your-user-name" replacing this"
echo "   latter string including the quotes with the username that should"
echo "   be able to access the Samba serivce"
echo "---------------------------------------------------------------------"
perl wait-for-key
}

function section-34
{
clear
echo -e "\nSection 34"
echo "----------"
echo "PCMCIA: This is too system specific.  Please do this section manually"
echo "---------------------------------------------------------------------"
perl wait-for-key
}

function section-35
{
clear
echo -e "\nSection 35"
echo "----------"
echo "DHCPcd: This setup isn't that common. Please do this section manually"
echo "---------------------------------------------------------------------"
perl wait-for-key
}

function section-36
{
clear
echo -e "\nSection 36"
echo "----------"
echo "APC UPSs: This setup isn't that common. Please do this section manually"
echo "-----------------------------------------------------------------------"
perl wait-for-key
}

function section-37
{
clear
echo -e "\nSection 37"
echo "----------"
echo "HTTPd: There isn't much to change in here. Skipped"
echo "--------------------------------------------------"
perl wait-for-key
}

function section-38
{
clear
echo -e "\nSection 38"
echo "----------"
echo "Tripwire: This section isn't complete yet. Skipped"
echo "--------------------------------------------------"
perl wait-for-key
}

function section-39
{
clear
echo -e "\nSection 39"
echo "----------"
echo "Backup to a CDR: This setup isn't that common. Skipped"
echo "------------------------------------------------------"
perl wait-for-key
}

function section-40
{
clear
echo -e "\nSection 40"
echo "----------"
echo "NFS: This setup isn't that common. Skipped"
echo "------------------------------------------"
perl wait-for-key
}

function section-41
{
clear
echo -e "\nSection 41"
echo "----------"
echo -e "\n\nSection 41.1"
echo "EXT2 tuning: UserFix:  Add the 10 minute cron entry."
echo "----------------------------------------------------"
perl wait-for-key
vi /etc/crontab
clear
mkdir /etc/cron.10min
echo "sync" > /etc/cron.10min/re-sync 
chmod 700 /etc/cron.10min/re-sync
/etc/rc.d/init.d/crond restart
perl wait-for-key
}

function section-42
{
clear
echo -e "\nSection 42"
echo "----------"
echo "Dial-in service: This setup isnt that common.  Skipped."
echo "--------------------------------------------------------"
perl wait-for-key
}

function section-43
{
clear
echo -e "\nSection 43"
echo "----------"
echo "RPM Tools: UserFix: Installation is system specific.  Do that now"
echo "-----------------------------------------------------------------"
perl wait-for-key
}

function section-44
{
clear
echo -e "\nSection 44"
echo "----------"
echo "Skipped:  This section was removed from TrinityOS."
echo "---------------------------------------------------"
perl wait-for-key
}

function section-45
{
clear
echo -e "\nSection 45"
echo "----------"
echo "Nmap: UserFix: Installation is system specific. Skipped."
echo "--------------------------------------------------------"
perl wait-for-key
}

function section-46
{
clear
echo -e "\nSection 46"
echo "----------"
echo "Hacked?: This is a reactive chapter to having your system broken into."
echo "----------------------------------------------------------------------"
perl wait-for-key
}

function section-47
{
clear
echo -e "\nSection 47"
echo "----------"
echo "LPR: This section is system specific and requires the code to be installed first.  Skipped."
echo "-------------------------------------------------------------------------------------------"
perl wait-for-key
}


function main
{
  intro
  section-7
  section-8
  section-9
  section-10
  section-11
  section-12
  section-13
  section-14
  section-15
  section-16
  section-17
  section-18
  section-19
  section-20
  section-21
  section-22
  section-23
  section-24
  section-25
  section-26
  section-27
  section-28
  section-29
  section-30
  section-31
  section-32
  section-33
  section-34
  section-35
  section-36
  section-37
  section-38
  section-39
  section-40
  section-41
  section-42
  section-43
  section-44
  section-45
  section-46
  section-47
}

# Beginnging of mainline code
# ---------------------------

#Debug
#echo "You have started the TrinityOS-archive script with the following command line: $1"
#perl wait-for-key

#Put all original OS configuration file listings in here

if [ -d $BACKUP ]; then
  clear
  echo -e "Previous version of $BACKUP exists.  Renaming.."
  mv $BACKUP $BACKUP-`date +'%m%d%y'`-`date +%S`
fi

mkdir $BACKUP 2> /dev/null
mkdir $BACKUP/etc 2> /dev/null
mkdir $BACKUP/etc/rc.d 2> /dev/null
mkdir $BACKUP/etc/rc.d/init.d 2> /dev/null
mkdir $BACKUP/bin 2> /dev/null
mkdir $BACKUP/sbin 2> /dev/null
mkdir $BACKUP/usr 2> /dev/null
mkdir $BACKUP/usr/bin 2> /dev/null
mkdir $BACKUP/usr/sbin 2> /dev/null

case $1 in
  1)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    intro
	;;
  7)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  8)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  9)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  10)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  11)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  12)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  13)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  14)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  15)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  16)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  17)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  18)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  19)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  20)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  21)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  22)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  23)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  24)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  25)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  26)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  27)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  28)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  29)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  30)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  31)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  32)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  33)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  34)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  35)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  36)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  37)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  38)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  39)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  40)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  41)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  42)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  43)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  44)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  45)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  46)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  47)
    clear
    echo -e "\nWelcome to the TrinityOS-archive script ver: $VER\n\n"
    echo -e "Jumping to Section $1.."
    perl wait-for-key
    clear
    section-$1
	;;
  *)
    main
	;;
esac


echo "Thats it!  The rest is just informational.  If you have ideas on how"
echo "           to improve this script, please let me know!"
echo -e "\n\n\n"


# *************************************************************************
# ChangeLOG:
# **********
#
# 03/14/04   - Added the backup-to-disk script
#
# 07/09/03   - Updated the kernel build-it script
#
# 11/25/02   - Added the /dev/zero and random special files to the DNS
#              chroot jails
#
# 07/06/02   - Added the cp "-f" or force flag when coping the libary files
#              but NOT for zone files.
#
# 11/23/01   - Fix a permission issue where /bin/su needs to be 4750 and
#              not 750.
#
# 10/04/01   - Moved /usr/src/build-it to /usr/src/kernel/build-it
#
# 09/09/01   - Added permission and group ownership changes to /bin/su
#
# 09/03/01   - Added /etc/mail/aliases.trinityos to the archive
#
# 05/28/01   - Updated the DNS section to reflect the more correct
#              zone file names:
#                 internal:  acme123-int.comdb vs. 192.168.0.db
#                 external: 100.200.0.212-in.addr.db vs. 212.0.200.100-in.addr.db)
#            - Updated both of the internal and external named.conf files 
#            - Fixed a IP address mistake in the external reverse zone that
#              was pointing to 102.200.0.25 instead of 100.200.0.212
#            - Also notice that I've added the following comment to the
#              internal acme123-int.com.db zone file:
#            ; 
#            ; note - If you wish to directly resolve any acme123.com hosts 
#            ;        that are currently only defined in the EXTERNAL zone 
#            ;        files (say www.acme123.com), you MUST list them here 
#            ;        as well since the internal zone assumes that it is 
#            ;        authoritative for acme123.com zone and thus would never 
#            ;        contact the external server for any other 
#            ;        acme123.com queries.
# 
#            - Both internal and external forward zone files had a MX 
#              record pointing to a CNAME called mail.  Redefined "mail" as 
#              a "A" record.  Doh!  Sorry about that!
#
# 03/05/01   - Updated section 24 to support Bind9
#              - Updated the TrinityOS-security chapter #s
#              - Reordered things a bit to better follow the doc
#
# 02/04/01   - Fixed a critical typo where the script wasn't
#			   copying over the right rc.firewall file.
#			   
# 10/08/00   - Added the initial processing of the RPM database for
#              the Sendlog script
#            [Section 8]
#            - Added the new firewall-confirmed script
#            [Section 10]
#            - Added the new Sendmail 8.10.x file and PATH permissions
#            - Re-arranged the trinityos.mc file to make sure that the
#              SMTP option comes before the PROCMAIL option
#            [Section 24]
#
#
# 10/07/00   * Cleaned up a LOT formatting issues and made the entire script a
#              LOT more enjoyable to use
#            - Made the intro fit in a 80x25 screen
#            - Make the section pause text a little prettier.
#            - Added a HEADER section so users can change the destination
#              of the "pre-script-backup" directory
#            * When changes are made to permissions, daemons, etc,
#              the OLD state is now saved in the "pre-script-backup" 
#              directory before they are executed.
#
#            - noted that kerneld is for 2.0.x kernels only
#            - added comments for both old and new locations of syslogd
#            - Added the text "working.." when generating the SUID file list
#            - Added the missing UserFix vi statements to get the SUID and RCMD
#              files
#            - Added a comment if httpd logs are not found
#            [Section 8]
#
#            - Added an additional section to edit the /etc/rc.d/rc.sysinit
#            script to make sure the /etc/rc.d/rc.firewall script isn't
#            executed automatically
#            [Section 10]
#
#            - Changed the editing of the named init script from UserFix to AutoFix.
#            * Added the new /etc/rc.d/init.d/named script to start/shut
#              the internal and external name servers.
#            [Section 24]
#
#            * Updated the Sendmail section to use Sendmail 8.10.x filenames
#            [Section 25]
#
# ------------
#
# 09/10/00   * The TrinityOS-archive script now SUPPORTS the jumping of
#              the script to different sections.  To do this, simply
#              add the section number at the command line. I.e.:
#
#                  ./TrinityOS-archive 12
#
#              This will jump to section 12.
#
# 07/25/00   - Overhauled the script to now allow the running from a last
#              state or a specific section
#
# 07/13/00   - Changed the perms of the /etc/rc.d/rc.firewall ruleset in the
#              tgz archive so its browsable from the Inet.  Because of this,
#              the TrinityOS-security script changes the final version on your
#              machine to 700 to ensure security.
#
# 07/12/00   - Updated the rc.firewall rule set to v3.70 with MANY substantial
#              changes.
#
# 07/05/00   - Fixed an issue where in Section 41, the script was restarting
#              syslogd and NOT crond
#
#            - Updated the rc.firewall script to use newer methods to get EXTIP
#              and EXTBROAD.
#
# 07/03/00   -  Added some headers to the NTP scripts and also 
#               added some inline comments for users who want to set the
#               date/time via NTP but save the results in UTC format.
#
# 07/02/00   - Updated the rc.firewall to v3.60:
#            # - Added port 445 for Windows2000 CIFS / SMB filtering for
#            #   both INPUT and OUTPUT
#            # - Also enhanced the informational section to explain what each 
#            #   port does
#            # - Added EXTENSIVE INPUT and OUTPUT filters for the the IANA 
#            #   reserved
#            #   TCP/IP addressing scheme
#            # - Added explicit though disabled Multicast filtering on the 
#            #   extnernal interface per many users requests.
#
#            Ouch!  The TrinityOS-security.sh script was using a significantly 
#            out of date /usr/local/sbin/root-hints-update script.  They are
#            now both synced at v2.1.  Many of the changes are critical for a
#            proper split DNS setup to update properly.
#
# 06/25/00   - Updated the rc.firewall to v3.60 to reflect the need to run at
#              least kernel version 2.2.16 and added the sysctl to DISABLE
#              LooseUDP.
# 
# 06/19/00	 - Fixed two typos where the path for 212.0.200.100.db and
#			   192.168.0.db were pointing to chroot-ext and chroot-int
#			   instead of chroot-dns-ext and chroot-dns-int
#            - Also fixed some chroot-dns-* UID/GID issues since I wasnt
#              traversing ALL the directories.
#
# 05/28/00   - Updated the rc.firewall ruleset to v3.59 to fix a commented
#			   SQUID proxy and AOL SMTP filter typos.
#
#            - Updated the external in.addr zone for a typo and added some
#			   missing "chown" statements for the external zone directories.
#
# 04/23/00   - TrinityOS has now been ported to SGML thus versions are
#			   now directly available in HTML, PDF, PS, etc.  Thanks to
#			   ian.crow@compass-res.demon.co.uk for his hard work in
#			   writing a TrinityOS ASCII to SGML converter!
#
# 04/15/00   - Added a few echos to make sure that people know that they
#              should run this script while following along in TrinityOS
#			 - Updated the sendlogs scripts to use the $HOST variable
#            - Updated the rc.firewall to v3.58
#
# 04/09/00   - Completely revamped the DNS section to operate in both a 
#              CHROOTed jail and have split zone files.
#			 - Updated and moved the root-hints-update script to reflect
#			   the new changes AND now be in /usr/local/sbin
#
# 04/08/00   - Updated some of the /etc/cron.* permissions
#            - Added an EXPORT line for "minicom"
#			 - moved the permissions fixes of /bin/rpm to the main
#			   permission section
#			 - moved the permissions for klogd and added some more
#			   comments in the file permission section.
#			 - Added an Autofix section to disable log rotation of
#			   of the squid and mysql.
#			 - Added an Autofix for create the apropos database
#			 - Changed the comment to enable the rc.firewall rule set
#              to use a different chkconfig syntax.
#			 - Added a UserFix section to secure LILO
#
#			 - Fixed a typo where the /etc/dhcpd.leases had an
#			   extra "A" at the end of it.
#
# 03/26/00   - Had to reverse the whole dhcpcd issue.  The reason for
#              this is that the the firewall script file WON'T be executed 
#			   if the old IP address for the machine was the same after 
#              reboot.  So, you DO need to have the rc.firewall ruleset load
#              via /etc/rc.d/init.d/firewall.  
#
# 03/19/00   - Changed the default from turning on /etc/rc.d/init.d/firewall 
#              to a "Userfix" since people who use DHCP should NOT enable 
#              this INIT script.
#              The reason for this is that with DHCP, this script will be
#              executed once via the "dhcpcd.exe" file and then be re-run 
#              with the /etc/rc.d/init.d/firewall script.  This is BAD.
#
# 03/18/00	 - Fixed the issue where the script was adding "network"
#			   instead of "firewall" to the various /etc/rc.d/rcX.d
#			   directories.
#
#            - Fixed the permissions location of klogd and syslogd 
#			   for newer distros
#
#			 - Updated the /etc/rc.d/init.d/firewall script to be 
#			   compatible with Linuxconf.
#			   Thanks to frost@engen.com for this one.
#
#			 - Updated the firewall to v3.52

# 02/26/00   - Fixed a missing "fi" statement after the PPP section.
#              Thanks to ken@loki.stockton.edu for the sharp eye.
#
#		       Updated the rc.firewall script to v3.50.  It fixed
#			   a extra /24 error for the commented out Diald example

# 02/21/00	 - Fixed a bug where the senlogs script wasn't being renamed
#              properly.  Thanks to mackd@nova.org for that one.
#
#            - Doh!  When I made the sendlogs fix on 1/17/00, I blew it and
#              now realize we DO need the spaces between %b and %d
#
#            - updated the /etc/rc.d/init.d/firewall script to include
#			   "restart" in the help text.
#
#			 - updated the firewall to v3.49 to add some error checking 
#			   where if the EXTIP variable is not properly set, the 
#			   firewall ruleset will abort.  Also updated the rp_filter
#			   setting to "2" for the highest level of anti-spoof 
#			   protection.
#
#
# 02/15/00	 - Updated the firewall ruleset to v3.48 to include some
# 			   better SMB comments
#
# 01/17/00   - Updated the sendlogs script to fix all the "date" issues.  
#              Date now uses %d over %e and doesn't use any spaces.
#
# 01/03/00	 - Fixed the rc.local script that had a typo of "dmesh" vs. 
#			   "dmesg"
#
# 01/02/00   - Fixed a missing ending " on line 566 and the path on line
#			   569 was missing a "rc.d".  Thanks to loren@siebert.org for
#			   the heads up.
#
# 12/23/99   - Added a little more verbage to the intro screen telling users
#			   that this script is for Redhat/Mandrake 6/x users.
#			 - Updated the rc.firewall to v3.43
#               - Updated the syntax for DHCPcd
#            - Updated the TrinityOS-security.sh script.  The script
#              now has the init.d sources in the right place.
#
# 12/19/99   - Updates the rc.firewall script to v3.42
#               - Fixed a HUGE error of the text above the /bin/sh line
#               - Cleaned up and added a few more ECHO lines
#            - Change the firewall to load after the network comes up via the 
#              Redhat method of /etc/rc.d/init.d/firewall
#               
# 12/18/99   - Updated the rc.firewall script to v3.41
#				- Added a commented section on setting the TOS bits
#         		- Added a recommendation for ICQ users to change the 
#				  UDP timeout
#
# 12/16/99   - Fixed a typo in the sendlogs script for sending the RCMD
#			   results
#
# 12/14/99 - Updated rc.firewall to v3.40
#			 - Added filters for Trinoo
#            - Fixed typos in commented ECHO lines in the rc.firewall ruleset
#
#
#  12/01/99 - Fixed a missing space for the tetex cron job
#
#  12/21/01 - Updated the Sendmail trinityos.mc file to better filter out
#             SPAM.
#
