Procédure de configuration d'Agathis

# ~/.bashrc: executed by bash(1) for non-login shells.

# Note: PS1 and umask are already set in /etc/profile. You should not
# need this unless you want different defaults for root.
# PS1='${debian_chroot:+($debian_chroot)}\h:\w\$ '
# umask 022

#-----------------------------------------------------------------------------------------------------------#
# GESTION du PROMPT

NORMAL="\\033[0;39m"
VERT="\\033[1;32m"
ROUGE="\\033[1;31m"
ROSE="\\033[1;35m"
BLEU="\\033[1;34m"
BLANC="\\033[0;02m"
BLANCLAIR="\\033[1;08m"
JAUNE="\\033[1;33m"
CYAN="\\033[1;36m"

PS1='${debian_chroot:+($debian_chroot)}\[\033[01;31m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '

#-----------------------------------------------------------------------------------------------------------#
# You may uncomment the following lines if you want `ls' to be colorized:
 export LS_OPTIONS='--color=auto'
 eval "`dircolors`"
 alias ls='ls $LS_OPTIONS'
 alias ll='ls $LS_OPTIONS -l'
 alias l='ls $LS_OPTIONS -lA'

# Some more alias to avoid making mistakes:
 alias rm='rm -i'
 alias cp='cp -i'
 alias mv='mv -i'

# ~/.bashrc: executed by bash(1) for non-login shells.
# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
# for examples

# If not running interactively, don't do anything
[ -z "$PS1" ] && return

# don't put duplicate lines in the history. See bash(1) for more options
# don't overwrite GNU Midnight Commander's setting of `ignorespace'.
HISTCONTROL=$HISTCONTROL${HISTCONTROL+:}ignoredups
# ... or force ignoredups and ignorespace
HISTCONTROL=ignoreboth

# append to the history file, don't overwrite it
shopt -s histappend

# for setting history length see HISTSIZE and HISTFILESIZE in bash(1)

# check the window size after each command and, if necessary,
# update the values of LINES and COLUMNS.
shopt -s checkwinsize

# make less more friendly for non-text input files, see lesspipe(1)
#[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"

# set variable identifying the chroot you work in (used in the prompt below)
if [ -z "$debian_chroot" ] && [ -r /etc/debian_chroot ]; then
    debian_chroot=$(cat /etc/debian_chroot)
fi

# set a fancy prompt (non-color, unless we know we "want" color)
case "$TERM" in
    xterm-color) color_prompt=yes;;
esac

# uncomment for a colored prompt, if the terminal has the capability; turned
# off by default to not distract the user: the focus in a terminal window
# should be on the output of commands, not on the prompt
force_color_prompt=yes

if [ -n "$force_color_prompt" ]; then
    if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
    # We have color support; assume it's compliant with Ecma-48
    # (ISO/IEC-6429). (Lack of such support is extremely rare, and such
    # a case would tend to support setf rather than setaf.)
    color_prompt=yes
    else
    color_prompt=
    fi  
fi

NORMAL="\\033[0;39m"
VERT="\\033[1;32m"
ROUGE="\\033[1;31m"
ROSE="\\033[1;35m"
BLEU="\\033[1;34m"
BLANC="\\033[0;02m"
BLANCLAIR="\\033[1;08m"
JAUNE="\\033[1;33m"
CYAN="\\033[1;36m"
if [ "$color_prompt" = yes ]; then
    PS1='${debian_chroot:+($debian_chroot)}\[\033[1;33m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
else
    PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '
fi
unset color_prompt force_color_prompt

# If this is an xterm set the title to user@host:dir
case "$TERM" in
xterm*|rxvt*)
    PS1="\[\e]0;${debian_chroot:+($debian_chroot)}\u@\h: \w\a\]$PS1"
    ;;
*)
    ;;
esac

# enable color support of ls and also add handy aliases
if [ -x /usr/bin/dircolors ]; then
    test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"
    alias ls='ls --color=auto'
    #alias dir='dir --color=auto'
    #alias vdir='vdir --color=auto'

    #alias grep='grep --color=auto'
    #alias fgrep='fgrep --color=auto'
    #alias egrep='egrep --color=auto'
fi

# some more ls aliases
alias ll='ls -l'
alias la='ls -A'
alias l='ls -Al'

# Alias definitions.
# You may want to put all your additions into a separate file like
# ~/.bash_aliases, instead of adding them here directly.
# See /usr/share/doc/bash-doc/examples in the bash-doc package.

if [ -f ~/.bash_aliases ]; then
    . ~/.bash_aliases
fi

# enable programmable completion features (you don't need to enable
# this, if it's already enabled in /etc/bash.bashrc and /etc/profile
# sources /etc/bash.bashrc).
if [ -f /etc/bash_completion ] && ! shopt -oq posix; then
    . /etc/bash_completion
fi

# ~/.profile: executed by Bourne-compatible login shells.
export LC_ALL="fr_FR.UTF-8"
export LANG="fr_FR.UTF-8"
export LANGUAGE="fr_FR.UTF-8"

if [ "$BASH" ]; then
  if [ -f ~/.bashrc ]; then
    . ~/.bashrc
  fi  
fi

".vimrc
" Nombre d'espaces qu'une tabulation prend.
set tabstop=4
" Empêche vim de créer une sauvegarde avant d'écrire sur un fichier.
set nobk
" Active le surlignage syntaxique de vim.
syntax on
" Oblige vim � ins�rer les tabulations comme des caract�res au lieu d'ins�rer un ensemble d'espaces.
set noexpandtab
" Affiche les numéros de ligne
set nu
" Utiliser des couleurs correctes sur un fond noir.
set background=dark

[*] acpid
[*] atd
[*] bootlogs
[*] console-setup
[*] cron
[*] exim4
[*] kbd
[*] keyboard-setup
[*] module-init-tools
[*] munin-node
[*] mysql
[*] nfs-common
[*] nfs-kernel-server
[*] nginx
[*] php-54-fpm
[*] portmap
[*] procps
[*] rsync
[*] rsyslog
[*] shorewall
[*] ssh
[*] sudo
[*] udev
[*] vsftpd
[*] x11-common
[ ] php-55-fpm
[*] sphinx

#!/bin/bash
source=$1
destination=backup@adansonia:/home/agathis/
rsync -auR --stats --exclude *tmp* -e 'ssh -i /var/backups/.ssh/id_rsa' --delete $source $destination >> $2

#/bin/bash
# Sauvegarde base de donnee dans /home/utilisateur/bases sur 7 jours ...
# Mai 2004 David Delon Inspiration Faq ovh
# Parametres :
# $1 utilisateur
# $2 base (ou liste de bases séparées par des espaces)
# Le mot de passe de l'administrateur de base de donnee est present dans ce
# script en clair, c'est pas bien : faut chmoder en 700 ce truc.
user=$1
/bin/mkdir -p /home/$user/bases/tmp 2>/dev/null
cd /home/$user/bases;
shift
for base in $*
do
# On verifie que la base existe
        /usr/bin/touch tmp/$base.sql
        if [ -d /home/mysql/$base ] ; then
                /usr/local/mysql/bin/mysqldump --add-drop-table -u root $base -f > tmp/$base.sql;
        fi
done
/bin/tar zcf bases-$(/bin/date -I).tar.gz tmp/*.sql --remove-files
/usr/bin/find /home/$user/bases/bases*.gz -mtime +7 -exec /bin/rm -f {} \;
chown $user:$user -R /home/$user/bases

#!/bin/bash
date=`date +"%F"`
log="/tmp/sauve_distant_"$date".log"
debut=`date +"%c"`
echo "------------------------------------------------------------------------" >> $log
echo "Place disponible sur les disques de Agathis :"
df -h >> $log
echo "------------------------------------------------------------------------" >> $log
echo "Debut sauvegarde distante Agathis : $debut" >> $log
echo "------------------------------------------------------------------------" >> $log
echo "Sauvegarde /etc :" >> $log
/usr/local/sbin/backup_dist /etc $log
echo "------------------------------------------------------------------------" >> $log
echo "Sauvegarde /home/admin/www :" >> $log
/usr/local/sbin/backup_dist /home/admin/www $log
echo "------------------------------------------------------------------------" >> $log
echo "Sauvegarde /home/admin/script :" >> $log
/usr/local/sbin/backup_dist /home/admin/script $log
echo "------------------------------------------------------------------------" >> $log
echo "Sauvegarde /home/apitela :" >> $log
/usr/local/sbin/backup_dist /home/apitela $log
echo "------------------------------------------------------------------------" >> $log
fin=`date +"%c"`
echo "Fin sauvegarde distante Agathis  $fin" >> $log
echo "------------------------------------------------------------------------" >> $log
cat $log|mail -s "Sauvegarde Agathis rapport du $fin" david.delon@clapas.net
cat $log|mail -s "Sauvegarde Agathis rapport du $fin" jpm@tela-botanica.org
rm -f $log

#!/bin/bash
/usr/local/sbin/backup_mysql apitela tb_eflore
/usr/local/sbin/backup_mysql apitest tb_eflore_test tb_cel_test tb_del_test tela_prod_v4

; Ajout de l'extension imagick (jpm & mathias) [22-11-2013]
; Elles sont cherchées par défaut dans : /lib64/extensions/no-debug-non-zts-xxx/
extension=imagick.so

; Activation de opcache (mathias) [29-08-2014]
zend_extension=opcache.so
;opcache.memory_consumption=64  
;opcache.max_accelerated_files=2000

# [2014-08-29] (jpm) : Changement des droits du .sock pour accéder au status et ping depuis admin
chown root:admin /var/run/php-54-fpm.sock

; Doc sur les paramètres : http://www.php.net/manual/fr/install.fpm.configuration.php
[apitest]
listen = /var/run/apitest_fpm.sock
listen.owner = apitest
listen.group = apitest
listen.mode = 0660
user = apitest
group = apitest
pm = dynamic
pm.max_children = 16
pm.start_servers = 4
pm.min_spare_servers = 2
pm.max_spare_servers = 6
pm.max_requests = 1000
request_terminate_timeout = 3600s
chdir = /
php_admin_value[session.save_path] = "/home/apitest/_sessions"
php_admin_value[open_basedir] = "/lib/php:/home/apitest:/usr/share/pear:/usr/share/php:/tmp:/usr/local/lib/php:/home/apitest/www/images"
catch_workers_output = yes

user  www-data www-data; # Default: nobody
worker_processes  8; # Default : 1
# Nombre de fichiers ouverts par processeur
worker_rlimit_nofile 100000;

pid /var/run/nginx.pid

# [ debug | info | notice | warn | error | crit ]
error_log  /var/log/nginx-error.log  info;

events {
    worker_connections  4096; # Default : 1024
    # use [ kqueue | rtsig | epoll | /dev/poll | select | poll ] ;
    # use kqueue;
    use epoll;
}

http {
    include  mime.types;
    # include  /etc/nginx/fastcgi.conf;
    index    index.html index.htm index.php;

    default_type  application/octet-stream;

    log_format main   '"$remote_addr" $host [$time_local] '
                                '"$request" $status $body_bytes_sent '
                                '$request_length $bytes_sent "$http_referer" '
                                '"$http_user_agent" $request_time "$gzip_ratio"';

    # La ligne ci-dessous semble inutile puisqu'il faut la redéfinir dans chaque vhost : server {}
    access_log  /var/log/nginx-access.log  main;

    sendfile       on;
    tcp_nopush     on;

    # 1er param : timeout pour les connections keep-alive ; 2ème param : valeur du header "Keep-Alive: timeout=" envoyé en réponse
    keepalive_timeout 30 30;
    # délai d'attente de la réponse de php-fpm : à accorder avec request_terminate_timeout dans la conf de php-fpm
    fastcgi_read_timeout 3600s;

    gzip on;
    gzip_comp_level 9; # 1 <= level <= 9
    gzip_min_length 50; # les fichiers plus petits que 50 octets ne sont pas compressés
    # types de fichiers à compresser
    gzip_types
        text/css
        text/plain
        text/javascript
        application/javascript
        application/json
        application/x-javascript
        application/xml
        application/xml+rss
        application/xhtml+xml
        application/x-font-ttf
        application/x-font-opentype
        application/vnd.ms-fontobject
        image/svg+xml
        image/x-icon
        application/rss+xml
        application/atom_xml;

    # Load all vhosts !
    include /etc/nginx/sites-enabled/*.conf
}

server {
    server_name agathis.tela-botanica.net www.agathis.tela-botanica.net;
    root "/home/admin/www/agathis";

    index index.html;
    client_max_body_size 10m;

    access_log /home/admin/_logs/access.log;
    access_log /var/log/nginx-access.log main;  
    error_log /home/admin/_logs/error.log;

    #################################################################################################
    # BLOCAGE - Bloquer l'accès à certains robots et extracteurs de contenu

    # Bloquer l'accès à certains robots
    if ($http_user_agent ~* (Baiduspider|webalta|nikto|wkito|pikto|scan|acunetix|morfeus|webcollage|youdao) ) { 
        return 401;
    }   
    # Bloquer l'accès aux extracteurs de contenu
    if ($http_user_agent ~* (HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) ) { 
        return 401;
    }   

    #################################################################################################
    # PROTECTION - Éviter l'affichage de fichiers sensibles

    # Éviter l'affichage du contenu des dossiers des gestionnaires de versions
    location ~ "\.(svn|git|hg|bzr|cvs)" {
        return 404;
    }   

    # Eviter l'affichage des fichiers de config en .ini
    location ~ "\.ini$" {
        return 404;
    }   

    # Eviter l'affichage des fichiers senssibles
    location ~ "\.(htaccess|htpasswd)$" {
        return 404;
    }   
    
    ###########################################################################################################
    # TOMCAT    

    # Redirection de port
    location /tomcat {
        rewrite ^/tomcat(.*)$ $1 break;
        #rewrite /tomcat / break;
        proxy_pass http://localhost:8080;
        proxy_redirect default;
        proxy_set_header  X-Real-IP  $remote_addr;
    }   

    ###########################################################################################################
    # STATUTS

    location /nginx_status {
        stub_status on; 
        access_log off;
        allow 127.0.0.1;
        allow 193.54.123.216;
        allow 162.38.234.0/24;
        deny all;
    }

    # Statuts PHP-FPM 5.6
    # ATTENTION : pour voir ces infos, le fichier php-56-fpm.sock doit avoir un droit de lecture pour l'utilisateur "admin"
    location ~ ^/php-56-fpm-(status|ping)$ {
        access_log off;
        include fastcgi_params;
        fastcgi_pass   unix:/var/run/php-56-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
        allow 127.0.0.1;
        allow 193.54.123.216;
        allow 162.38.234.0/24;
        deny all;

    # Statuts PHP-FPM 5.5
    # ATTENTION : pour voir ces infos, le fichier php-55-fpm.sock doit avoir un droit de lecture pour l'utilisateur "admin"
    location ~ ^/php-55-fpm-(status|ping)$ {
        access_log off;
        include fastcgi_params;
        fastcgi_pass   unix:/var/run/php-55-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
        allow 127.0.0.1;
        allow 193.54.123.216;
        allow 162.38.234.0/24;
        deny all;
    }

    # Statuts PHP-FPM 5.4
    # ATTENTION : pour voir ces infos, le fichier php-54-fpm.sock doit avoir un droit de lecture pour l'utilisateur "admin"
    location ~ ^/php-54-fpm-(status|ping)$ {
        access_log off;
        include fastcgi_params;
        fastcgi_pass   unix:/var/run/php-54-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
        allow 127.0.0.1;
        allow 193.54.123.216;
        allow 162.38.234.0/24;
        deny all;
    }

    #################################################################################################
    # Réecritures générales

    location / {
        try_files $uri $uri/ /index.php$uri?$args;
    }

    location ~ "^(.+\.php)($|/)" {
        fastcgi_split_path_info ^(.+\.php)(.*)$;

        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param SCRIPT_NAME $fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param SERVER_NAME $host;

        if ($uri !~ "^/uploads/") {
            fastcgi_pass   unix:/var/run/admin_fpm.sock;
        }
        include fastcgi_params;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
        expires max;
        log_not_found off;
        access_log off;
    }

    location ~* \.(html|htm)$ {
        expires 30m;
    }
}

server {
    server_name api.tela-botanica.org www.api.tela-botanica.org;
    root "/home/apitela/www";

    index index.php;
    client_max_body_size 50m;

    access_log /home/apitela/_logs/access.log;
    access_log /var/log/nginx-access.log main;
    error_log /home/apitela/_logs/error.log;

    if ($http_user_agent ~* (Baiduspider|webalta|nikto|wkito|pikto|scan|acunetix|morfeus|webcollage|youdao) ) { 
        return 401;
    }   

    if ($http_user_agent ~* (HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) ) { 
        return 401;
    }   

    # Éviter l'affichage du contenu des dossiers des gestionnes de versions
    location ~ "\.(svn|git|hg|bzr|cvs)" {
        return 404;
    }

    # Eviter l'affichage des fichiers de config en .ini
    location ~ "\.ini$" {
        return 404;
    }

    location / { 
        try_files $uri $uri/ /index.php$uri?$args;
    }

    # Fichiers pas libres (bouh)
    location ~ "/donnees/(baseflor|baseveg|lion1906|nasa-srtm|nvjfl|osm|plantscan|sophy|tl2|wikipedia)" {
        return 404;
    }

    # CORS dynamique multi-domaines (trop de la boulette)
    set $cors_origine_acceptee "http://www.tela-botanica.org";
    if ($http_origin ~* (www\.tela-botanica\.org|localhost)) {
        set $cors_origine_acceptee "$http_origin";
    }

    # Entêtes pour CORS
    add_header Access-Control-Allow-Origin "$cors_origine_acceptee"; # mode dynamique
    add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
    add_header Access-Control-Allow-Credentials "true";
    add_header Access-Control-Expose-Headers "X-DebugJrest-Data";

    # redéfinition par défaut de la query_string
    set $query_string_api $args;

    location ~ "^(.+\.php)($|/)" {
        fastcgi_split_path_info ^(.+\.php)(.*)$;

        include /etc/nginx/fastcgi.conf;
        fastcgi_pass   unix:/var/run/apitest_fpm.sock;

        # Réecriture des headers pour l'API d'eFlore
        fastcgi_param REQUEST_URI $request_uri_api;
        fastcgi_param QUERY_STRING $query_string_api;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
        expires max;
        log_not_found off;
        access_log off;
    }
    
    location ~* \.(html|htm)$ {
        expires 30m;
    } 
}

server {
    server_name @@HOSTNAME@@ www.@@HOSTNAME@@;
    root "@@PATH@@";

    index index.php;
    client_max_body_size 10m;

    access_log @@LOG_PATH@@/access.log;
    access_log /var/log/nginx-access.log main;
    error_log @@LOG_PATH@@/error.log;
    
    if ($http_user_agent ~* (Baiduspider|webalta|nikto|wkito|pikto|scan|acunetix|morfeus|webcollage|youdao) ) { 
        return 401;
    }   

    if ($http_user_agent ~* (HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) ) { 
        return 401;
    }   

    location / { 
        try_files $uri $uri/ /index.php$uri?$args;
    }   
    
    location ~ "^(.+\.php)($|/)" {
        fastcgi_split_path_info ^(.+\.php)(.*)$;
 
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param SCRIPT_NAME $fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param SERVER_NAME $host;

        if ($uri !~ "^/uploads/") {
            fastcgi_pass   unix:@@SOCKET@@;
        }   
        include        fastcgi_params;
    }   

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
        expires max;
        log_not_found off;
        access_log off;
    }   
    
    location ~* \.(html|htm)$ {
        expires 30m;
    }   
 
    location ~* /\.(ht|git|svn) {
        deny  all;
    }   
}

; Doc sur les paramètres : http://www.php.net/manual/fr/install.fpm.configuration.php
[@@USER@@]
listen = /var/run/@@USER@@_fpm.sock
listen.owner = @@USER@@
listen.group = @@USER@@
listen.mode = 0660
user = @@USER@@
group = @@USER@@
pm = dynamic
pm.max_children = @@MAX_CHILDS@@
pm.start_servers = @@START_SERVERS@@
pm.min_spare_servers = @@MIN_SERVERS@@
pm.max_spare_servers = @@MAX_SERVERS@@
pm.max_requests = 500 
request_terminate_timeout = 30s 
chdir = / 
php_admin_value[session.save_path] = "@@HOME_DIR@@/_sessions"
php_admin_value[open_basedir] = "@@HOME_DIR@@:/usr/share/pear:/usr/share/php:/tmp:/usr/local/lib/php"

# Ajout de l'instance Mysql 5.6 PROD (jpm) [26-11-2013]
[mysql_56_*]
user root
env.mysqlconnection DBI:mysql:mysql;host=127.0.0.1;port=3306
env.mysqladmin /usr/local/mysql/5.6/bin/mysqladmin
env.mysqlopts --defaults-extra-file=/root/.my.cnf

# Ajout de l'instance Mysql 5.6 TEST (jpm) [26-11-2013]
[mysql_56-test_*]
user root
env.mysqlconnection DBI:mysql:mysql;host=127.0.0.1;port=3308
env.mysqladmin /usr/local/mysql/5.6-test/bin/mysqladmin
env.mysqlopts --defaults-extra-file=/root/.my.cnf

# Ajout de la sonde Nginx (jpm) [18-07-2013]
[nginx*]
user root
# La ligne suivante ne semble pas utile
# env.url http://agathis.tela-botanica.org/nginx_status 

[nginx_traffic]
group adm
env.vhosts api.tela-botanica.org agathis.tela-botanica.net munin.agathis.tela-botanica.net sql.agathis.tela-botanica.net
env.logdir /home/log
env.flogfile nginx-access.log 
env.bparam 11
env.aggregate false

# a simple host tree
[Agathis]
    address 127.0.0.1
    use_node_name yes
[Sequoia]
    address 193.54.123.169
    use_node_name yes

# [2014-08-29] (jpm) : Changement des droits du .sock pour accéder au status et ping depuis admin
chown root:admin /var/run/php-55-fpm.sock

location ~ ^/php-55-fpm-(status|ping)$ {
        include fastcgi_params;
        fastcgi_pass   unix:/var/run/php-55-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
        allow 127.0.0.1;
        allow 193.54.123.216;
        allow 162.38.234.0/24;
        deny all;
    }
    
    location ~ ^/php-54-fpm-(status|ping)$ {
        include fastcgi_params;
        fastcgi_pass   unix:/var/run/php-54-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
        allow 127.0.0.1;
        allow 193.54.123.216;
        allow 162.38.234.0/24;
        deny all;
    }

# Example config file /etc/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
#
# Run standalone?  vsftpd can run either from an inetd or as a standalone
# daemon started from an initscript.
listen=YES
#
# Run standalone with IPv6?
# Like the listen parameter, except vsftpd will listen on an IPv6 socket
# instead of an IPv4 one. This parameter and the listen parameter are mutually
# exclusive.
#listen_ipv6=YES
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# If enabled, vsftpd will display directory listings with the time
# in  your  local  time  zone.  The default is to display GMT. The
# times returned by the MDTM FTP command are also affected by this
# option.
use_localtime=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
idle_session_timeout=2000
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
nopriv_user=ftp
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
#
# You may restrict local users to their home directories.  See the FAQ for
# the possible risks in this before using chroot_local_user or
# chroot_list_enable below.
#chroot_local_user=YES
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
chroot_local_user=YES
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
ls_recurse_enable=YES
#
# Debian customization
#
# Some of vsftpd's settings don't fit the Debian filesystem layout by
# default.  These settings are more Debian-friendly.
#
# This option should be the name of a directory which is empty.  Also, the
# directory should not be writable by the ftp user. This directory is used
# as a secure chroot() jail at times vsftpd does not require filesystem
# access.
secure_chroot_dir=/var/run/vsftpd/empty
#
# This string is the name of the PAM service vsftpd will use.
pam_service_name=vsftpd
#
# This option specifies the location of the RSA certificate to use for SSL
# encrypted connections.
rsa_cert_file=/etc/ssl/private/vsftpd.pem

net eth0 detect

#SECTION NEW
ACCEPT          net       $FW           tcp     ssh,www,ftp,4949
ACCEPT          net       $FW           udp     ssh,www
ACCEPT          net       $FW           icmp    8   
# nfs
ACCEPT          net:193.54.123.169 $FW  udp     111 
ACCEPT          net:193.54.123.169 $FW  tcp     111 
ACCEPT          net:193.54.123.169 $FW  tcp     2049
ACCEPT          net:193.54.123.169 $FW  udp     2049
ACCEPT          net:193.54.123.169 $FW  tcp     32764:32769
ACCEPT          net:193.54.123.169 $FW  udp     32764:32769
# sphynx + mysql
ACCEPT          net:193.54.123.169 $FW  tcp     9312,9306,3306
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

$FW     net             ACCEPT
109 net     all             DROP           info
110 all     all             REJECT         info

fw  firewall
net ipv4

startup=1

CATALINA_OPTS="$CATALINA_OPTS -server -Xms256m -Xmx4096m -XX:PermSize=512m -XX:MaxPermSize=512m"