LiveCD Wi-Fi router

Сделано по мотивам старой песни “хочу чтобы работало искаропки”.

Внешний интерфейс – eth0, внутренний – wlan0.

То что помечено FILL IN YOURS – заменить соответствующим образом.

Сборка: sudo livecd-creator –config=livecd-fedora-minimal-cui.ks

Сам ks:

lang en_US.UTF-8
keyboard us
timezone Europe/Moscow --utc
auth --useshadow --enablemd5
#selinux --disabled
#firewall --disabled
part / --size 1024
repo --name=e11 --baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/11/Everything/i386/os/
repo --name=u11 --baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/11/i386/
#%packages --excludedocs --nobase
%packages
glibc
initscripts
chkconfig
system-config-firewall-tui
bash
kernel
passwd
authconfig
rt73usb-firmware
iwl3945-firmware
# cyrillic console
kbd
#X11
#xorg-x11-drivers
#xorg-x11-xinit
#window manager
#metacity
#xterm
#system-config-display
#fonts
#liberation-fonts
#debugging
rpm
yum
strace
vim-minimal
#fedora-logos
#tools
screen
iperf
#networking
iptables
net-tools
dhcp
wireless-tools
tcpdump
wireshark
iw
tree
openssh-clients
openssh-server
%end
%post
cat > /etc/rc.d/init.d/fedora-live << EOF
#!/bin/bash
#
# live: Init script for live image
#
# chkconfig: 345 00 99
# description: Init script for live image.
. /etc/init.d/functions
if ! strstr "\`cat /proc/cmdline\`" liveimg || [ "\$1" != "start" ] || [ -e /.liveimg-configured ] ; then
exit 0
fi
exists() {
which \$1 >/dev/null 2>&1 || return
\$*
}
touch /.liveimg-configured
# mount live image
if [ -b /dev/live ]; then
mkdir -p /mnt/live
mount -o ro /dev/live /mnt/live
fi
# read some variables out of /proc/cmdline
for o in \`cat /proc/cmdline\` ; do
case \$o in
ks=*)
ks="\${o#ks=}"
;;
xdriver=*)
xdriver="--set-driver=\${o#xdriver=}"
;;
esac
done
# if liveinst or textinst is given, start anaconda
if strstr "\`cat /proc/cmdline\`" liveinst ; then
/usr/sbin/liveinst \$ks
fi
if strstr "\`cat /proc/cmdline\`" textinst ; then
/usr/sbin/liveinst --text \$ks
fi
# enable swaps unless requested otherwise
swaps=\`blkid -t TYPE=swap -o device\`
if ! strstr "\`cat /proc/cmdline\`" noswap -a [ -n "\$swaps" ] ; then
for s in \$swaps ; do
action "Enabling swap partition \$s" swapon \$s
done
fi
# configure X, allowing user to override xdriver
exists system-config-display --noui --reconfig --set-depth=24 \$xdriver
# turn off firstboot for livecd boots
echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot
# don't start yum-updatesd for livecd boots
chkconfig --level 345 yum-updatesd off 2>/dev/null
# don't start cron/at as they tend to spawn things which are
# disk intensive that are painful on a live image
chkconfig --level 345 crond off 2>/dev/null
chkconfig --level 345 atd off 2>/dev/null
chkconfig --level 345 anacron off 2>/dev/null
chkconfig --level 345 readahead_early off 2>/dev/null
chkconfig --level 345 readahead_later off 2>/dev/null
# Stopgap fix for RH #217966; should be fixed in HAL instead
touch /media/.hal-mtab
# workaround clock syncing on shutdown that we don't want (#297421)
sed -i -e 's/hwclock/no-such-hwclock/g' /etc/rc.d/init.d/halt
EOF
cat > /etc/resolv.conf << EOF
nameserver ******** FILL IN YOURS ********
EOF
cat > /etc/sysconfig/network << EOF
NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=porky.metropolis
EOF
cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF
DEVICE=eth0
BOOTPROTO=none
IPADDR=******** FILL IN YOURS ********
IPV6INIT=no
NETMASK=******** FILL IN YOURS ********
ONBOOT=yes
GATEWAY=******** FILL IN YOURS ********
MACADDR=******** FILL IN YOURS ********
EOF
cat > /etc/sysconfig/network-scripts/ifcfg-wlan0 << EOF
DEVICE=wlan0
BOOTPROTO=none
IPADDR=192.168.4.1
IPV6INIT=no
NETMASK=255.255.255.0
ONBOOT=yes
ESSID='octofox home'
CHANNEL=2
MODE=Ad-Hoc
TYPE=Wireless
PEERDNS=yes
USERCTL=no
RATE=54Mb
EOF
cat > /etc/sysconfig/network-scripts/keys-wlan0 << EOF
KEY=s:******** FILL IN YOURS ********
EOF
cat > /etc/dhcp/dhcpd.conf << EOF
#
# DHCP Server Configuration file.
# see /usr/share/doc/dhcp*/dhcpd.conf.sample
#
ddns-update-style interim;
ignore client-updates;
subnet 192.168.4.0 netmask 255.255.255.0 {
# --- default gateway
option routers 192.168.4.1;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.4.255;
option domain-name-servers ******** FILL IN YOURS ********;
# option time-offset -18000; # Eastern Standard Time
# option ntp-servers 192.168.4.1;
range dynamic-bootp 192.168.4.128 192.168.4.254;
default-lease-time 21600;
max-lease-time 43200;
}
EOF
sed -i /etc/sysctl.conf -e 's/^net\.ipv4\.ip_forward.*$/net.ipv4.ip_forward = 1/'
cat > /etc/sysconfig/iptables << EOF
# Generated by iptables-save v1.3.5 on Tue Jun 12 01:20:54 2007
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [63194978:62962866872]
:block - [0:0]
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT
-A INPUT -i eth0 -m state --state INVALID,NEW -j DROP
-A INPUT -j block
-A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j ACCEPT
-A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j ACCEPT
-A FORWARD -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT
-A FORWARD -i eth0 -m state --state INVALID,NEW -j DROP
-A FORWARD -j block
-A block -m state --state RELATED,ESTABLISHED -j ACCEPT
-A block -i ! eth0 -m state --state NEW -j ACCEPT
-A block -j DROP
COMMIT
# Completed on Tue Jun 12 01:20:54 2007
# Generated by iptables-save v1.3.5 on Tue Jun 12 01:20:54 2007
*nat
:PREROUTING ACCEPT [5084348:492168658]
:POSTROUTING ACCEPT [47968:9209464]
:OUTPUT ACCEPT [542333:65881197]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Tue Jun 12 01:20:54 2007
EOF
/usr/sbin/useradd porky
mkdir -p ~porky/.ssh
cat > ~porky/.ssh/authorized_keys << EOF
******** FILL IN YOURS ********
EOF
chmod -R go= ~porky/.ssh
chown -R porky:porky ~porky/.ssh
sed -i /etc/shadow -e 's!^porky:.*$!porky:******** FILL IN YOURS ********!'
sed -i /etc/shadow -e 's!^root:.*$!root:******** FILL IN YOURS ********!'
/sbin/chkconfig network on
/sbin/chkconfig dhcpd on
/sbin/chkconfig exim off
/sbin/restorecon /etc/resolv.conf
chmod 755 /etc/rc.d/init.d/fedora-live
/sbin/restorecon /etc/rc.d/init.d/fedora-live
/sbin/chkconfig --add fedora-live
# save a little bit of space at least...
rm -f /boot/initrd*
# make sure there aren't core files lying around
rm -f /core*
%end