iankelling.org
/
git
/
automated-distro-installer
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
32aa53e
)
persistent ssh host keys, ipv6 ssh, whitespace
author
Ian Kelling
<iank@fsf.org>
Wed, 15 May 2019 22:15:40 +0000
(18:15 -0400)
committer
Ian Kelling
<iank@fsf.org>
Wed, 15 May 2019 22:15:40 +0000
(18:15 -0400)
wrt-setup
patch
|
blob
|
history
wrt-setup-local
patch
|
blob
|
history
diff --git
a/wrt-setup
b/wrt-setup
index 96a25647ae7eaee8c64b611db7bcf9c1bdcbf684..9ac518afca061bf9f20a3928eb4c557f26f2e25e 100755
(executable)
--- a/
wrt-setup
+++ b/
wrt-setup
@@
-49,7
+49,7
@@
echo "$0: host=$h"
cat ~/.ssh/home.pub | ssh $h dd of=/etc/dropbear/authorized_keys 2>/dev/null
scp /a/work/libremanage/libremanage /a/bin/fai/wrt-setup-local /a/bin/cedit/cedit $h:/usr/bin
# relay is built for openwrt 18.06.2, r7676-cddd7b4c77
cat ~/.ssh/home.pub | ssh $h dd of=/etc/dropbear/authorized_keys 2>/dev/null
scp /a/work/libremanage/libremanage /a/bin/fai/wrt-setup-local /a/bin/cedit/cedit $h:/usr/bin
# relay is built for openwrt 18.06.2, r7676-cddd7b4c77
-sudo scp /q/root/shadow/router \
+sudo scp /q/root/shadow/router
/p/c/machine_specific/wrt/etc/dropbear/dropbear_rsa_host_key
\
/a/opt/openwrt/source/bin/packages/mips_24kc/mypackages/relay_1.0-1_mips_24kc.ipk $h:
ssh $h <<EOF
set -x
/a/opt/openwrt/source/bin/packages/mips_24kc/mypackages/relay_1.0-1_mips_24kc.ipk $h:
ssh $h <<EOF
set -x
diff --git
a/wrt-setup-local
b/wrt-setup-local
index 8b7e4c98bcce3e4092f8ae247e8bc0e4555692a5..b0635a1856ac2f58bb3a84500f0092d1a04f288c 100755
(executable)
--- a/
wrt-setup-local
+++ b/
wrt-setup-local
@@
-256,6
+256,10
@@
EOF
uset dropbear.@dropbear[0].PasswordAuth 0
uset dropbear.@dropbear[0].RootPasswordAuth 0
uset dropbear.@dropbear[0].Port 2220
uset dropbear.@dropbear[0].PasswordAuth 0
uset dropbear.@dropbear[0].RootPasswordAuth 0
uset dropbear.@dropbear[0].Port 2220
+if ! cmp -s /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key; then
+ cp /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key
+ dropbear_restart=true
+fi
wireless_restart=false
key=pictionary49
wireless_restart=false
key=pictionary49
@@
-312,84
+316,103
@@
v cedit /etc/config/firewall <<EOF || firewall_restart=true
config redirect
config redirect
-
option name ssh
-
option src wan
-
option src_dport 22
-
option dest_ip $l.8
-
option dest lan
+ option name ssh
+ option src wan
+ option src_dport 22
+ option dest_ip $l.8
+ option dest lan
config rule
config rule
-
option src wan
-
option target ACCEPT
-
option dest_port 22
+ option src wan
+ option target ACCEPT
+ option dest_port 22
config redirect
config redirect
-
option name sshalt
-
option src wan
-
option src_dport 2222
-
option dest_port 22
-
option dest_ip $l.3
-
option dest lan
+ option name sshalt
+ option src wan
+ option src_dport 2222
+ option dest_port 22
+ option dest_ip $l.3
+ option dest lan
config rule
config rule
-
option src wan
-
option target ACCEPT
-
option dest_port 2222
+ option src wan
+ option target ACCEPT
+ option dest_port 2222
config rule
config rule
-
option src wan
-
option target ACCEPT
-
option dest_port 2220
+ option src wan
+ option target ACCEPT
+ option dest_port 2220
config redirect
config redirect
-
option src wan
-
option src_dport 443
-
option dest lan
-
option dest_ip $l.8
-
option proto tcp
+ option src wan
+ option src_dport 443
+ option dest lan
+ option dest_ip $l.8
+ option proto tcp
config rule
config rule
-
option src wan
-
option target ACCEPT
-
option dest_port 443
-
option proto tcp
+ option src wan
+ option target ACCEPT
+ option dest_port 443
+ option proto tcp
config redirect
config redirect
-
option src wan
-
option src_dport 1196
-
option dest lan
-
option dest_ip $l.8
-
option proto udp
+ option src wan
+ option src_dport 1196
+ option dest lan
+ option dest_ip $l.8
+ option proto udp
config rule
config rule
-
option src wan
-
option target ACCEPT
-
option dest_port 1196
-
option proto udp
+ option src wan
+ option target ACCEPT
+ option dest_port 1196
+ option proto udp
config redirect
config redirect
-
option src wan
-
option src_dport 80
-
option dest lan
-
option dest_ip $l.8
-
option proto tcp
+ option src wan
+ option src_dport 80
+ option dest lan
+ option dest_ip $l.8
+ option proto tcp
config rule
config rule
-
option src wan
-
option target ACCEPT
-
option dest_port 80
-
option proto tcp
+ option src wan
+ option target ACCEPT
+ option dest_port 80
+ option proto tcp
config redirect
config redirect
-
option name syncthing
-
option src wan
-
option src_dport 22001
-
option dest_ip $l.8
-
option dest lan
+ option name syncthing
+ option src wan
+ option src_dport 22001
+ option dest_ip $l.8
+ option dest lan
config rule
config rule
- option src wan
- option target ACCEPT
- option dest_port 22001
+ option src wan
+ option target ACCEPT
+ option dest_port 22001
+
+config rule
+ option name ssh-ipv6
+ option src wan
+ option dest lan
+ # note, using mac transform, we could allow all traffic to a host like this,
+ # replacing 1 as appropriate
+ #option dest_ip ::111:11ff:fe11:1111/::ffff:ffff:ffff:ffff
+ option dest_port 22
+ option target ACCEPT
+ option family ipv6
+config rule
+ option name mail-ipv6
+ option src wan
+ option dest lan
+ option dest_port 25
+ option target ACCEPT
+ option family ipv6
+
EOF
EOF
@@
-524,6
+547,7
@@
EOF
uset network.lan.ipaddr $l.$lanip
uset network.lan.netmask $mask
uset dhcp.wan.ignore $dev2 # default is false
uset network.lan.ipaddr $l.$lanip
uset network.lan.netmask $mask
uset dhcp.wan.ignore $dev2 # default is false
+uset dhcp.lan.ignore $dev2 # default is false
if $dev2; then
uset network.lan.gateway $l.1
uset network.wan.proto none
if $dev2; then
uset network.lan.gateway $l.1
uset network.wan.proto none