Mirrors/ProxMenux
1
0
Fork 0
mirror of https://github.com/MacRimi/ProxMenux.git synced 2025-11-18 11:36:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update auto_post_install.sh

Browse Source
This commit is contained in:
MacRimi
2025-10-25 17:33:05 +02:00
parent 5d4f70e943
commit 48d4836f0a
1 changed files with 33 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
scripts/post_install/auto_post_install.sh
View File

@@ -440,20 +440,20 @@ net.core.rmem_max = 16777216
net.core.wmem_max = 16777216 net.core.wmem_max = 16777216
net.core.somaxconn = 8192 net.core.somaxconn = 8192
# IPv4 # IPv4 hardening
net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.secure_redirects = 0 net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.log_martians = 1 net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.default.secure_redirects = 0 net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.default.log_martians = 1 net.ipv4.conf.default.log_martians = 0
# rp_filter: loose multi-homed/bridges # rp_filter:
net.ipv4.conf.all.rp_filter = 2 net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 2 net.ipv4.conf.default.rp_filter = 2
@@ -473,10 +473,27 @@ net.ipv4.tcp_wmem = 8192 65536 16777216
net.unix.max_dgram_qlen = 4096 net.unix.max_dgram_qlen = 4096
EOF EOF
sysctl --system > /dev/null 2>&1 sysctl --system > /dev/null 2>&1
cat >/etc/systemd/system/proxmenux-fwbr-tune.service <<'EOF'
[Unit]
Description=ProxMenux - Tune rp_filter/log_martians on virtual fw bridges
After=network-online.target
Wants=network-online.target
[Service]
Type=oneshot
ExecStart=/bin/bash -c 'for i in /proc/sys/net/ipv4/conf/*; do n=${i##*/}; case "$n" in fwbr*|fwln*|fwpr*|tap*) echo 0 > /proc/sys/net/ipv4/conf/$n/rp_filter; echo 0 > /proc/sys/net/ipv4/conf/$n/log_martians; esac; done'
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now proxmenux-fwbr-tune.service >/dev/null 2>&1 || true
local interfaces_file="/etc/network/interfaces" local interfaces_file="/etc/network/interfaces"
if ! grep -q 'source /etc/network/interfaces.d/*' "$interfaces_file"; then if ! grep -q 'source /etc/network/interfaces.d/*' "$interfaces_file"; then
echo "source /etc/network/interfaces.d/*" >> "$interfaces_file" echo "source /etc/network/interfaces.d/*" >> "$interfaces_file"
@@ -491,6 +508,7 @@ EOF
# ========================================================== # ==========================================================
customize_bashrc_() { customize_bashrc_() {
msg_info "$(translate "Customizing bashrc for root user...")" msg_info "$(translate "Customizing bashrc for root user...")"