rebasing .git

install/apt.sh

@@ -4,6 +4,9 @@
 #curl -fsS https://dl.brave.com/install.sh | sh
 
 
+apt install -y git
+apt install -y ip
+apt install -y setxkbmap
 apt install -y bc
 apt install -y virt-viewer
 apt install -y gawk
@@ -28,6 +31,10 @@ apt install -y pip
 apt install -y curl
 apt install -y tree
 apt install -y ffmpeg
+apt install -y ffmpeg
+apt install -y nft
+apt install -y openvpn
+
 #apt install -y vlc
 #apt install -y terminator
 #apt install -y  gimp

install/arch.sh

@@ -12,14 +12,15 @@ fi
 MACHINE_DIR=${1:-"svr"}
 
 bash	tree_cpy.sh $MACHINE_DIR/usr
-# append sources
+source /home/.bashrc
 bash config.sh
 source /home/.bashrc
-bash python.sh
+#bash python.sh
-source /home/.bashrc
+#source /home/.bashrc
 
 bash chmod.sh
 
 bash pacman.sh
+source /home/.bashrc
 
 bash network.sh

install/chmod.sh

@@ -1,13 +1,14 @@
 #!/usr/bin/bash
 
 groupadd $MACHINE
+usermod -aG svr $SUDO_USER
+chmod -R g+s $MACHINE_DIR
 chown -R root $MACHINE_DIR
 chgrp -R $MACHINE $MACHINE_DIR
 chmod -R 771 $MACHINE_DIR/install
 chmod -R 771 $BIN_DIR
 chmod -R 751 $SBIN_DIR
 find $MACHINE_DIR -type d -exec chmod 775 {} \;
-chmod -R g+s $MACHINE_DIR
 
 exit 0
 

install/config.sh

@@ -3,23 +3,21 @@
 #bash tree_cpy.sh ../usr
 
 SKEL=/etc/skel
-
 mkdir $SKEL
 
 FILE=".vimrc"
-echo "source /home/$FILE" > $HOME/$FILE
+echo "source /home/$FILE" > $SUDO_HOME/$FILE
-cat $HOME/$FILE > $SKEL/$FILE
+cat $SUDO_HOME/$FILE > $SKEL/$FILE
 
 FILE=".profile"
-echo "source /home/$FILE" > $HOME/$FILE
+echo "source /home/$FILE" > $SUDO_HOME/$FILE
-cat $HOME/$FILE > $SKEL/$FILE
+cat $SUDO_HOME/$FILE > $SKEL/$FILE
 
 
 FILE=".bashrc"
-echo "source /home/$FILE" > $HOME/$FILE
+echo "source /home/$FILE" > $SUDO_HOME/$FILE
-cat $HOME/$FILE > $SKEL/$FILE
+cat $SUDO_HOME/$FILE > $SKEL/$FILE
 
-source /home/.bashrc
-git config --global user.email "$EMAIL"
-git config --global user.name "$HOST"
 
+groupadd svr
+usermod -aG svr $SUDO_USER

install/debian.sh

@@ -4,17 +4,21 @@ sudo apt-get update
 sudo apt-get upgrade
 sudo apt-get dist-upgrade
 
-
 if [[ $EUID -ne 0 ]]; then
    echo "This script must be run as root"
    exit 1
 fi
 
-./config_install.sh
+MACHINE_DIR=/svr
-#apt instll -y  ulogd
-NETWORKDIR="$MACHINE_DIR/networking"
-#systemctl enable ulogd
-#systemctl start ulogd
-#bash $NETWORKDIR/iptables_script.sh -f $NETWORKDIR/ip_to_ban.txt -r
 
-bash apt_install.sh
+bash	tree_cpy.sh $MACHINE_DIR/usr
+bash config.sh
+source /home/.bashrc
+bash python.sh
+source /home/.bashrc
+
+bash chmod.sh
+
+bash apt.sh
+
+bash network.sh

install/openwrt.sh

@@ -0,0 +1,11 @@
+#copy paste in device terminal
+
+opkg update
+opkg install luci-ssl
+#activate https for LuCI web interface
+uci set uhttpd.main.redirect_https=1
+uci commit uhttpd && service uhttpd reload
+
+#uci set system.@system[0].ttylogin="1"
+#uci commit system
+#service system restart

install/pacman.sh

@@ -4,49 +4,36 @@
 #	echo "This script must be run as root"
 #fi
 
-pacman --noconfirm -Sy git
+pacman --noconfirm -S git
-pacman --noconfirm -Sy makepkg
+pacman --noconfirm -S mtr
-pacman --noconfirm -Sy nftables
+pacman --noconfirm -S traceroute
-pacman --noconfirm -Sy bc
+pacman --noconfirm -S makepkg
-pacman --noconfirm -Sy ctags
+pacman --noconfirm -S nftables
-pacman --noconfirm -Sy firefox
+pacman --noconfirm -S bc
-pacman --noconfirm -Sy unzip
+pacman --noconfirm -S ctags
-pacman --noconfirm -Su vlc
+pacman --noconfirm -S firefox
-pacman --noconfirm -Sy tcpdump
+pacman --noconfirm -S unzip
-pacman --noconfirm -Sy moreutils
+pacman --noconfirm -S vlc
-pacman --noconfirm -Sy net-tools
+pacman --noconfirm -S tcpdump
-pacman --noconfirm -Sy make
+pacman --noconfirm -S moreutils
-pacman --noconfirm -Sy whois
+pacman --noconfirm -S net-tools
-pacman --noconfirm -Sy nmap
+pacman --noconfirm -S make
-pacman --noconfirm -Sy man-db
+pacman --noconfirm -S whois
-pacman --noconfirm -Sy openvpn
+pacman --noconfirm -S nmap
-pacman --noconfirm -Sy bitwarden
+pacman --noconfirm -S man-db
-pacman --noconfirm -Sy wireguard-tools
+pacman --noconfirm -S openvpn
-pacman --noconfirm -Sy proton-vpn-gtk-app
+pacman --noconfirm -S wireguard-tools
-pacman --noconfirm -Sy systemd-resolvconf
+pacman --noconfirm -S proton-vpn-gtk-app
-pacman --noconfirm -Sy cronie
+pacman --noconfirm -S systemd-resolvconf
-pacman --noconfirm -Sy docker
+pacman --noconfirm -S cronie
-pacman --noconfirm -Sy makepkg
+pacman --noconfirm -S docker
-pacman --noconfirm -Sy tree
+pacman --noconfirm -S makepkg
-pacman --noconfirm -Sy vim
+pacman --noconfirm -S tree
-pacman --noconfirm -Sy iwctl
+pacman --noconfirm -S vim
-pacman --noconfirm -Sy pciutils
+pacman --noconfirm -S iwctl
-pacman --noconfirm -Sy git-filter-repo
+pacman --noconfirm -S pciutils
-pacman --noconfirm -Sy xorg-setxkbmap
+pacman --noconfirm -S git-filter-repo
-pacman --noconfirm -Sy xorg-xhost
+pacman --noconfirm -S xorg-setxkbmap
-pacman --noconfirm -Sy bind
+pacman --noconfirm -S xorg-xhost
+pacman --noconfirm -S xorg-xhost
 mandb #rend possible la commande apropos
-
-##git clone https://github.com/Exafunction/codeium.vim ~/.vim/pack/Exafunction/start/codeium.vim
-#sudo -i -u $SUDO_USER bash << EOF
-#
-#git config --global user.email "contact@presko.info"
-#git config --global user.name "prsko_$HOST"
-#EOF
-
-#su $SUDO_USER
-#git clone https://aur.archlinux.org/yay.git
-#cd yay/
-#makepkg -si
-#cd ..
-#rm -rf yay

install/tree_cpy.sh

@@ -4,7 +4,8 @@ USR_DIR=${1:-"no_dir"}
 [[ $USR_DIR == "no_dir" ]] && \
 	echo "usage $0 usr_dir" && \
 	exit 1
+
 USR_DIR=$(realpath $USR_DIR)
-cp -l -p -r $USR_DIR/* /
+
-# cannot hardlink (invaliv cross device)
+#uses ssymbolic link otherwise crossdevice troubles
-ln -s $USR_DIR/home/.* /home
+cp -s -p -r -f -t / $USR_DIR/.

net/blacklist.txt

@@ -1,26 +1,54 @@
 34.0.0.0/8
 35.0.0.0/8
 
-#SKYCA-3#Owner:Fastly
+#OVH
-#151.101.0.0/16
+37.59.32.0/19
+
+#Hetzner (arch install)
+46.62.192.0/22
+
+#Microsoft
+#40.114.177.156 -> lilie.duckdns.org, holland
+40.96.0.0/12
+
+#Staples us (arch install)
+50.74.152.24/29
+
+# apparait apres avoir bloque 2 adresses google intrusives sud firefox
+95.216.0.0/16
 
 #NETBLK Cox
 #98.174.32.0/19
 
 #OVH
 #37.59.32.0/19
+
+#Cloud flare chatgpt
+#104.16.0.0/12
+
 #oman#mobile
 #134.0.192.0/20
 
+#cloudflare eu (arch install)
 # RIPE
 # http addr
 #141.0.0.0/8
 
+#Google
+142.250.0.0/15
+
+#Fastly ip geolocalisation (arch install)
+146.75.0.0/20
+
+#SKYCA-3#Owner:Fastly
 #pip atproto ?
 #151.101.0.0/16
 
-#Cloud flare chatgpt
+#OVH france
-#104.16.0.0/12
+188.165.192.0/18
+
+#Amsterdam, possiblement a Linz il y a quelques annees
+193.0.0.0/20
 
 #Umea ftp archive (debian)
 #194.71.11.0/24
@@ -36,3 +64,8 @@
 #212.227.232.0/24
 
 1.0.0.1
+
+#lancement firefox
+fe80::b08c:e0ff:fe6d:542c/64
+ff02::0/48
+#ff02::1:ffbc:c929/120

net/whitelist.txt

@@ -35,3 +35,62 @@
 185.70.42.0/24
 185.70.41.0/24
 185.70.40.0/24
+##Paypal
+#151.101.129.21
+#
+##microsoft (github)
+##20.0.0.0/11
+#
+##Paypal
+##34.107.221.82
+#
+##ipinfo.io
+#34.117.59.81
+#
+##ifconfig.me
+#34.160.111.145
+#
+##gitea
+#34.217.253.146
+#
+##gitea docker
+#35.91.213.186
+#
+#
+##docker
+#34.107.221.82
+#
+##dns
+#66.28.0.61
+#
+##infomaniac
+#95.216.195.133
+#
+##ChatGpt
+#104.18.32.47
+#
+##openwrt.org
+#151.101.130.132
+#151.101.2.132
+#
+#
+##firefox extentions
+#151.101.1.91
+#
+##sigmanet#codium
+#178.238.223.0/24
+#
+##whois
+#199.212.0.0/24
+#
+##Umea ftp archive (debian)
+#194.71.11.0/24
+#
+##GitHub
+#185.199.111.0/24
+#
+##infomaniac shop
+#142.250.178.136
+#
+##dns
+#209.244.0.3

usr/bin/honey

@@ -0,0 +1,25 @@
+#!/usr/bin/bash
+
+if [ "$#" -lt 1 ] || [ "$#" -gt 3 ]; then
+    echo "Usage: $0 arg1 [arg2] [arg3]"
+    exit 1
+fi
+
+# interactive session check
+if [ -t 0 ]; then
+    echo -n "Delete existing output files? [y/N]: "
+    read ans
+    case "$ans" in
+        y|Y) rm -f *.school ;;
+        *) echo "Aborted"; exit 0 ;;
+    esac
+fi
+
+# process input file
+while IFS= read -r line; do
+    new_f="${line%.*}.school"
+    f > "$new_f"
+done < "$FILE"
+
+exit 0
+

usr/etc/env

@@ -22,3 +22,5 @@ BIN=$MACHINE_DIR/usr/bin
 SBIN_DIR=$MACHINE_DIR/usr/sbin
 BIN_DIR=$BIN
 PY_ENV=$BIN/py-env
+
+VPS=83.228.219.61

usr/etc/openvpn/.pot.swp

@@ -0,0 +1,2 @@
+Gtd5u0nRC3vf1oRt
+RUWJhKHulxLjfg8jDqvDncC5DMq6lZRE

usr/etc/pam.d/login

@@ -0,0 +1,13 @@
+#%PAM-1.0
+
+auth       requisite    pam_nologin.so
+auth       include      system-local-login
+auth       optional     pam_gnome_keyring.so
+
+account    include      system-local-login
+
+session    include      system-local-login
+session    optional     pam_gnome_keyring.so auto_start
+
+password   include      system-local-login
+

usr/etc/resolv.conf

@@ -1,4 +1,5 @@
 nameserver 1.1.1.1
+nameserver 0.0.0.0
 nameserver 8.26.56.26
 nameserver 208.67.222.222
 nameserver 209.244.0.3

usr/etc/systemd/resolved.conf

@@ -18,9 +18,9 @@
 
 [Resolve]
 # Some examples of DNS servers which may be used for DNS= and FallbackDNS=:
-DNS=1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001 #cloudflare-dns.com
+DNS=1.1.1.1  2606:4700:4700::1111 2606:4700:4700::1001
 # Quad9:      9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
-FallbackDNS=193.110.81.0 185.253.5.0 2a0f:fc80:: 2a0f:fc81:: #dns0.eu
+FallbackDNS=185.253.5.0 2a0f:fc80:: 2a0f:fc81::
 #
 # Using DNS= configures global DNS servers and does not suppress link-specific
 # configuration. Parallel requests will be sent to per-link DNS servers
@@ -30,7 +30,7 @@ FallbackDNS=193.110.81.0 185.253.5.0 2a0f:fc80:: 2a0f:fc81:: #dns0.eu
 #DNS=
 #FallbackDNS=9.9.9.9#dns.quad9.net 2620:fe::9#dns.quad9.net 1.1.1.1#cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com 8.8.8.8#dns.google 2001:4860:4860::8888#dns.google
 #Domains=
-DNSSEC=yes
+DNSSEC=allow-downgrade
 DNSOverTLS=yes
 MulticastDNS=yes
 LLMNR=yes

usr/etc/systemd/system/tcpd.service

@@ -4,7 +4,6 @@ After=network-online.target
 
 [Service]
 ExecStart=/bin/bash /etc/systemd/system/tcpd.sh
-After=tcpd-bkup.service
 Type=simple
 
 [Install]

usr/etc/systemd/system/tcpd_bkup.service.legacy

@@ -0,0 +1,11 @@
+[Unit]
+Description=backups tcpd log file, keeping ip adresses only
+
+[Service]
+ExecStart=/bin/bash /etc/systemd/system/tcpd_bkup.sh
+Restart=on-failure
+RestartSec=121s
+Type=oneshot
+
+[Install]
+WantedBy=multi-user.target

usr/etc/systemd/system/tcpd_bkup.sh

@@ -1,21 +1,22 @@
-#!/usr/bin/bash
+#!/bin/bash
 #run from crontab
 
+
 . /home/.bashrc
 
+[ -f "$LOG_CONN" ] || exit 0
+
 . refresh_time
 
-STATUS=ronron
+STATUS=network.conns
 if [ -f $NET_STATUS ] ; then
 	STATUS=$(cat $NET_STATUS)
 fi
 
-DIR=$LOG_CONN_DIR/$STATUS
+DIR="$LOG_CONN_DIR/$STATUS"
 mkdir -p $DIR
-grepip $LOG_CONN > $DIR/${DATE}_${TIME}.conn
+grepip "$LOG_CONN"  > "$DIR/${DATE}_${TIME}.conn"
-mv -f $LOG_CONN $LOG_CONN_DIR/prev.log
+mv -f "$LOG_CONN" "$LOG_CONN_DIR/prev.log"
+
 systemctl restart tcpd
 
-exit 0
-
-

usr/etc/systemd/system/tcpd_bkup.timer.legacy

@@ -0,0 +1,10 @@
+[Unit]
+Description=Run tcpd_bkup.service every 2 minutes
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=2min
+Persistent=true
+
+[Install]
+WantedBy=timers.target

usr/lib/c/curl-homemade.c

@@ -0,0 +1,125 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/socket.h>
+#include <netdb.h>
+
+#define BUFFER_CHUNK 4096
+
+/* ---------------------- URL PARSING ---------------------- */
+void parse_url(const char *input, char *host, size_t hsz, char *path, size_t psz)
+{
+    const char *slash = strchr(input, '/');
+
+    if (slash) {
+        size_t host_len = slash - input;
+        if (host_len >= hsz) host_len = hsz - 1;
+        strncpy(host, input, host_len);
+        host[host_len] = '\0';
+        snprintf(path, psz, "%s", slash);
+    } else {
+        snprintf(host, hsz, "%s", input);
+        snprintf(path, psz, "/");
+    }
+}
+
+/* ---------------------- CONNECT TO HOST ---------------------- */
+int connect_to_host(const char *host)
+{
+    struct addrinfo hints = {0}, *res;
+    hints.ai_family = AF_INET;
+    hints.ai_socktype = SOCK_STREAM;
+
+    getaddrinfo(host, "80", &hints, &res);
+
+
+    int sock = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
+    if (sock < 0) {
+        perror("socket");
+        freeaddrinfo(res);
+        return -1;
+    }
+
+    if (connect(sock, res->ai_addr, res->ai_addrlen) < 0) {
+        perror("connect");
+        close(sock);
+        freeaddrinfo(res);
+        return -1;
+    }
+
+    freeaddrinfo(res);
+    return sock;
+}
+
+/* ---------------------- SEND HTTP GET REQUEST ---------------------- */
+int send_request(int sock, const char *host, const char *path)
+{
+    char req[1024];
+    snprintf(req, sizeof(req),
+             "GET %s HTTP/1.0\r\n"
+             "Host: %s\r\n"
+             "User-Agent: basic-c-client\r\n"
+             "\r\n",
+             path, host);
+
+    return send(sock, req, strlen(req), 0);
+}
+
+/* ---------------------- DOWNLOAD RESPONSE ---------------------- */
+char *download_response(int sock, size_t *out_size)
+{
+    char *filedata = NULL;
+    *out_size = 0;
+
+    char buffer[BUFFER_CHUNK];
+    ssize_t bytes;
+
+    while ((bytes = recv(sock, buffer, sizeof(buffer), 0)) > 0) {
+        char *newbuf = realloc(filedata, *out_size + bytes + 1);
+        if (!newbuf) {
+            fprintf(stderr, "Out of memory\n");
+            free(filedata);
+            return NULL;
+        }
+
+        filedata = newbuf;
+        memcpy(filedata + *out_size, buffer, bytes);
+        *out_size += bytes;
+        filedata[*out_size] = '\0';
+    }
+
+    return filedata;
+}
+
+/* ---------------------- MAIN PROGRAM ---------------------- */
+int main(int argc, char **argv)
+{
+    if (argc < 2) {
+        fprintf(stderr, "Usage: %s <host/path>\n", argv[0]);
+        return 1;
+    }
+
+    char host[256];
+    char path[512];
+    parse_url(argv[1], host, sizeof(host), path, sizeof(path));
+
+    int sock = connect_to_host(host);
+    if (sock < 0) return 1;
+
+    send_request(sock, host, path);
+
+    size_t filesize;
+    char *filedata = download_response(sock, &filesize);
+    close(sock);
+
+    if (!filedata) return 1;
+
+    printf("Received %zu bytes:\n\n%s\n", filesize, filedata);
+	f = open(argv[2], "w");
+	write(f, filedata, filesize);
+
+    free(filedata);
+    return 0;
+}
+

usr/sbin/alpine-qemu-install

@@ -1,63 +0,0 @@
-#!/bin/bash
-set -eux
-
-ISO_URL="https://dl-cdn.alpinelinux.org/alpine/v3.22/releases/x86_64/alpine-virt-3.22.2-x86_64.iso"
-
-# from vm to make a shared folder
-if [ $# -lt 1 ] ; then
-	echo """
-		ISO=${1:-$(basename $ISO_URL)}
-		IMG=${2:-disc_alpine.qcow2}
-		SIZE=${3:-16G}
-		RAM=${4:-2G}
-		CPUS=${5:-2}
-		SHARE=${6:-$PWD/share}
-	"""
-	echo "cheat sheet: mount -t 9p -o trans=virtio hostshare /mnt"
-fi
-
-# --- Configurable defaults ---
-ISO=${1:-$(basename $ISO_URL)}
-IMG=${2:-disc_alpine.qcow2}
-SIZE=${3:-16G}
-RAM=${4:-2G}
-CPUS=${5:-2}
-SHARE=${6:-$PWD/share}
-
-# --- Setup ---
-mkdir -p "$SHARE"
-echo "iso = $ISO"
-[ -f "$ISO" ] || wget "$ISO_URL"
-[ -f "$IMG" ] || qemu-img create -o nocow=on -f qcow2 "$IMG" "$SIZE"
-
-# --- Optional install script ---
-# Drop any file named install.sh in ./share to execute it inside the VM later:
-# e.g. `bash /mnt/share/install.sh` after mounting
-
-
-
-qemu-system-x86_64 \
-	-m $RAM \
-	-boot once=d \
-	-cdrom $ISO \
-	-drive file=$IMG \
-	-device virtio-vga \
-	-enable-kvm \
-	-display default,show-cursor=on \
-	-nic user,hostfwd=tcp::2222-:22 \
-	-virtfs local,id=share,path="$SHARE",security_model=none,mount_tag=hostshare
-
-## --- Run QEMU with graphics + shared folder ---
-#qemu-system-x86_64 \
-#  -enable-kvm \
-#  -m "$RAM" \
-#  -cpu host \
-#  -smp "$CPUS" \
-#  -boot d \
-#  -cdrom "$ISO" \
-#  -drive file="$IMG",format=qcow2 \
-#  -device virtio-vga \
-#  -display default,show-cursor=on \
-#  -nic user,hostfwd=tcp::2222-:22 \
-#  -virtfs local,id=share,path="$SHARE",security_model=none,mount_tag=hostshare
-