mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-05-09 12:52:38 +02:00
Compare commits
4 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 3e49322220 | |||
| ecb92d43fc | |||
| 3b714db0bf | |||
| f17da4e68b |
+61
-2
@@ -745,6 +745,56 @@ configure_network_sensor() {
|
|||||||
return $err
|
return $err
|
||||||
}
|
}
|
||||||
|
|
||||||
|
configure_management_bond() {
|
||||||
|
local bond_name="bond1"
|
||||||
|
local bond_mode=${MBOND_MODE:-active-backup}
|
||||||
|
|
||||||
|
info "Setting up $bond_name management interface with mode $bond_mode"
|
||||||
|
|
||||||
|
if [[ ${#MBNICS[@]} -eq 0 ]]; then
|
||||||
|
error "[ERROR] No management bond NICs were selected."
|
||||||
|
fail_setup
|
||||||
|
fi
|
||||||
|
|
||||||
|
nmcli -t -f NAME con show | grep -Fxq "$bond_name"
|
||||||
|
local found_int=$?
|
||||||
|
|
||||||
|
if [[ $found_int != 0 ]]; then
|
||||||
|
nmcli con add type bond ifname "$bond_name" con-name "$bond_name" mode "$bond_mode" -- \
|
||||||
|
ipv6.method ignore \
|
||||||
|
connection.autoconnect yes >> "$setup_log" 2>&1
|
||||||
|
else
|
||||||
|
nmcli con mod "$bond_name" \
|
||||||
|
bond.options "mode=$bond_mode" \
|
||||||
|
ipv6.method ignore \
|
||||||
|
connection.autoconnect yes >> "$setup_log" 2>&1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local err=0
|
||||||
|
for MBNIC in "${MBNICS[@]}"; do
|
||||||
|
local slave_name="$bond_name-slave-$MBNIC"
|
||||||
|
|
||||||
|
nmcli -t -f NAME con show | grep -Fxq "$slave_name"
|
||||||
|
found_int=$?
|
||||||
|
|
||||||
|
if [[ $found_int != 0 ]]; then
|
||||||
|
nmcli con add type ethernet ifname "$MBNIC" con-name "$slave_name" master "$bond_name" -- \
|
||||||
|
connection.autoconnect yes >> "$setup_log" 2>&1
|
||||||
|
else
|
||||||
|
nmcli con mod "$slave_name" \
|
||||||
|
connection.master "$bond_name" \
|
||||||
|
connection.slave-type bond \
|
||||||
|
connection.autoconnect yes >> "$setup_log" 2>&1
|
||||||
|
fi
|
||||||
|
|
||||||
|
nmcli con up "$slave_name" >> "$setup_log" 2>&1
|
||||||
|
local ret=$?
|
||||||
|
[[ $ret -eq 0 ]] || err=$ret
|
||||||
|
done
|
||||||
|
|
||||||
|
return $err
|
||||||
|
}
|
||||||
|
|
||||||
configure_hyper_bridge() {
|
configure_hyper_bridge() {
|
||||||
info "Setting up hypervisor bridge"
|
info "Setting up hypervisor bridge"
|
||||||
info "Checking $MNIC ipv4.method is auto or manual"
|
info "Checking $MNIC ipv4.method is auto or manual"
|
||||||
@@ -999,6 +1049,11 @@ filter_unused_nics() {
|
|||||||
grep_string="$grep_string\|$BONDNIC"
|
grep_string="$grep_string\|$BONDNIC"
|
||||||
done
|
done
|
||||||
fi
|
fi
|
||||||
|
if [[ $MBNICS ]]; then
|
||||||
|
for BONDNIC in "${MBNICS[@]}"; do
|
||||||
|
grep_string="$grep_string\|$BONDNIC"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
# Finally, set filtered_nics to any NICs we aren't using (and ignore interfaces that aren't of use)
|
# Finally, set filtered_nics to any NICs we aren't using (and ignore interfaces that aren't of use)
|
||||||
filtered_nics=$(ip link | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2}' | grep -vwe "$grep_string" | sed 's/ //g' | sed -r 's/(.*)(\.[0-9]+)@\1/\1\2/g')
|
filtered_nics=$(ip link | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2}' | grep -vwe "$grep_string" | sed 's/ //g' | sed -r 's/(.*)(\.[0-9]+)@\1/\1\2/g')
|
||||||
@@ -1388,7 +1443,7 @@ network_init() {
|
|||||||
title "Initializing Network"
|
title "Initializing Network"
|
||||||
disable_ipv6
|
disable_ipv6
|
||||||
set_hostname
|
set_hostname
|
||||||
if [[ ( $is_iso || $is_desktop_iso ) ]]; then
|
if [[ $is_iso || $is_desktop_iso ]]; then
|
||||||
set_management_interface
|
set_management_interface
|
||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
@@ -2084,8 +2139,12 @@ set_initial_firewall_access() {
|
|||||||
# Set up the management interface on the ISO
|
# Set up the management interface on the ISO
|
||||||
set_management_interface() {
|
set_management_interface() {
|
||||||
title "Setting up the main interface"
|
title "Setting up the main interface"
|
||||||
|
if [[ $MNIC == "bond1" ]]; then
|
||||||
|
configure_management_bond || fail_setup
|
||||||
|
fi
|
||||||
|
|
||||||
if [ "$address_type" = 'DHCP' ]; then
|
if [ "$address_type" = 'DHCP' ]; then
|
||||||
logCmd "nmcli con mod $MNIC connection.autoconnect yes"
|
logCmd "nmcli con mod $MNIC connection.autoconnect yes ipv4.method auto"
|
||||||
logCmd "nmcli con up $MNIC"
|
logCmd "nmcli con up $MNIC"
|
||||||
logCmd "nmcli -p connection show $MNIC"
|
logCmd "nmcli -p connection show $MNIC"
|
||||||
else
|
else
|
||||||
|
|||||||
+83
-2
@@ -845,18 +845,99 @@ whiptail_management_nic() {
|
|||||||
[ -n "$TESTING" ] && return
|
[ -n "$TESTING" ] && return
|
||||||
|
|
||||||
filter_unused_nics
|
filter_unused_nics
|
||||||
|
local management_nic_options=( "${nic_list_management[@]}" )
|
||||||
|
if [[ $is_iso || $is_desktop_iso ]]; then
|
||||||
|
management_nic_options+=( "BOND" "Configure a bonded management interface" )
|
||||||
|
fi
|
||||||
|
|
||||||
MNIC=$(whiptail --title "$whiptail_title" --menu "Please select the NIC you would like to use for management.\n\nUse the arrow keys to move around and the Enter key to select." 20 75 12 "${nic_list_management[@]}" 3>&1 1>&2 2>&3 )
|
MNIC=$(whiptail --title "$whiptail_title" --menu "Please select the NIC you would like to use for management.\n\nUse the arrow keys to move around and the Enter key to select." 20 75 12 "${management_nic_options[@]}" 3>&1 1>&2 2>&3 )
|
||||||
local exitstatus=$?
|
local exitstatus=$?
|
||||||
whiptail_check_exitstatus $exitstatus
|
whiptail_check_exitstatus $exitstatus
|
||||||
|
|
||||||
while [ -z "$MNIC" ]
|
while [ -z "$MNIC" ]
|
||||||
do
|
do
|
||||||
MNIC=$(whiptail --title "$whiptail_title" --menu "Please select the NIC you would like to use for management.\n\nUse the arrow keys to move around and the Enter key to select." 22 75 12 "${nic_list_management[@]}" 3>&1 1>&2 2>&3 )
|
MNIC=$(whiptail --title "$whiptail_title" --menu "Please select the NIC you would like to use for management.\n\nUse the arrow keys to move around and the Enter key to select." 22 75 12 "${management_nic_options[@]}" 3>&1 1>&2 2>&3 )
|
||||||
local exitstatus=$?
|
local exitstatus=$?
|
||||||
whiptail_check_exitstatus $exitstatus
|
whiptail_check_exitstatus $exitstatus
|
||||||
done
|
done
|
||||||
|
|
||||||
|
if [[ $MNIC == "BOND" ]]; then
|
||||||
|
whiptail_management_bond
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
whiptail_management_bond() {
|
||||||
|
|
||||||
|
[ -n "$TESTING" ] && return
|
||||||
|
|
||||||
|
MBOND_MODE=$(whiptail --title "$whiptail_title" --menu \
|
||||||
|
"Choose the bond mode for the management interface.\n\nThe management bond will be created as bond1." 20 75 7 \
|
||||||
|
"active-backup" "One active NIC with failover (recommended)" \
|
||||||
|
"balance-rr" "Round-robin transmit policy" \
|
||||||
|
"balance-xor" "Transmit based on selected hash policy" \
|
||||||
|
"broadcast" "Transmit everything on all slave interfaces" \
|
||||||
|
"802.3ad" "Dynamic link aggregation (requires switch support)" \
|
||||||
|
"balance-tlb" "Adaptive transmit load balancing" \
|
||||||
|
"balance-alb" "Adaptive load balancing" 3>&1 1>&2 2>&3)
|
||||||
|
local exitstatus=$?
|
||||||
|
whiptail_check_exitstatus $exitstatus
|
||||||
|
|
||||||
|
while [ -z "$MBOND_MODE" ]
|
||||||
|
do
|
||||||
|
MBOND_MODE=$(whiptail --title "$whiptail_title" --menu \
|
||||||
|
"Choose the bond mode for the management interface.\n\nThe management bond will be created as bond1." 20 75 7 \
|
||||||
|
"active-backup" "One active NIC with failover (recommended)" \
|
||||||
|
"balance-rr" "Round-robin transmit policy" \
|
||||||
|
"balance-xor" "Transmit based on selected hash policy" \
|
||||||
|
"broadcast" "Transmit everything on all slave interfaces" \
|
||||||
|
"802.3ad" "Dynamic link aggregation (requires switch support)" \
|
||||||
|
"balance-tlb" "Adaptive transmit load balancing" \
|
||||||
|
"balance-alb" "Adaptive load balancing" 3>&1 1>&2 2>&3)
|
||||||
|
local exitstatus=$?
|
||||||
|
whiptail_check_exitstatus $exitstatus
|
||||||
|
done
|
||||||
|
|
||||||
|
whiptail_management_bond_nics
|
||||||
|
MNIC="bond1"
|
||||||
|
|
||||||
|
export MBOND_MODE MNIC
|
||||||
|
}
|
||||||
|
|
||||||
|
whiptail_management_bond_nics() {
|
||||||
|
|
||||||
|
[ -n "$TESTING" ] && return
|
||||||
|
|
||||||
|
MBNICS=()
|
||||||
|
filter_unused_nics
|
||||||
|
|
||||||
|
MBNICS=$(whiptail --title "$whiptail_title" --checklist "Please add NICs to the Management Interface:" 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3)
|
||||||
|
local exitstatus=$?
|
||||||
|
whiptail_check_exitstatus $exitstatus
|
||||||
|
|
||||||
|
while [ -z "$MBNICS" ]
|
||||||
|
do
|
||||||
|
MBNICS=$(whiptail --title "$whiptail_title" --checklist "Please add NICs to the Management Interface:" 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3)
|
||||||
|
local exitstatus=$?
|
||||||
|
whiptail_check_exitstatus $exitstatus
|
||||||
|
done
|
||||||
|
|
||||||
|
MBNICS=$(echo "$MBNICS" | tr -d '"')
|
||||||
|
|
||||||
|
IFS=' ' read -ra MBNICS <<< "$MBNICS"
|
||||||
|
|
||||||
|
for bond_nic in "${MBNICS[@]}"; do
|
||||||
|
for dev_status in "${nmcli_dev_status_list[@]}"; do
|
||||||
|
if [[ $dev_status == "${bond_nic}:unmanaged" ]]; then
|
||||||
|
whiptail \
|
||||||
|
--title "$whiptail_title" \
|
||||||
|
--msgbox "$bond_nic is unmanaged by Network Manager. Please remove it from other network management tools then re-run setup." \
|
||||||
|
8 75
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
done
|
||||||
|
|
||||||
|
export MBNICS
|
||||||
}
|
}
|
||||||
|
|
||||||
whiptail_net_method() {
|
whiptail_net_method() {
|
||||||
|
|||||||
Reference in New Issue
Block a user