Electric Death Ferret v0.03b
05/22/2000

Copyright (C) 2000 Serge Egelman <serge@guanotronic.com>
----------------------------------------------------------------------------
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
----------------------------------------------------------------------------

ABOUT
------

Electric Death Ferret is a perl daemon which runs in the background and sets up new system accounts and virtual hosts.  If a virtual host is to be setup, you simply go to the webpage (which is protected via IP checking and htaccess authentication), and enter a domain name.  You can then select many options relating to this:  whether or not you want thsi to be setup as an Apache virtual host, whether they get CGI access, suexec, ftp access (currently via ncftpd), and also whether or not to host this domain in the DNS.  If you chose to host in the DNS, you can specify both primary and secondary.  If it is only going in the secondary, then you must enter an IP for the master DNS.  If the domain is going in the primary as well, you must enter some A records.  For all of these options there are defaults, such that you can merely enter a domain name to setup a new virtual host in apache with a ftp account and hosting in the primary and secondary DNS.

Electric Death Ferret also has the ability to add system users.  This feature has been added for use by ISPs to add dialup accounts and mail-only accounts.  A system account is created with a false shell (i.e. /bin/false) to deny shell access, however the user will be able to use RADIUS authentication and also will have a mail account on the system.  If the account is to be a mail-only account, everything is the same except for there is a line added to the RADIUS file to deny the user from gaining dialup access.  A username is entered in the text box, and then a password is entered, as well as the real name (or whatever you want to appear in the text field).  Finally, you have the option to create a mail-only account, add a mail alias for the user (via a sendmail virtual mail table), mail the new user with the account information, and mail a third party with the account information.  You also have the option of creating a new alias without creating a new account, and also the option of converting a full account to a mail-only account.

REQUIREMENTS
-------------

Electric Death Ferret requires the following to be installed:
PHP3
MySQL
Apache
Perl- DBI, DBD::mysql, Mail::Mailer, Net::FTP, POSIX
OPTIONAL: sendmail, ncftpd


INSTALLATION
-------------

Installation is fairly simple.  Put the PHP files somewhere on your webserver (probably in a htaccess protected directory).  You also should change the ips which are allowed access to these files (these are specified at the top of each script, there are tabs separating each ip).  There are some variables for accessing the MySQL database that should be specified as well (username, pass, hostname, database name).

Next, you must create the MySQL database on the system.  Included is a schema for doing this, simply run: cat hosting.schema|mysql

Finally, edit the perl script "hosting" to meet your settings.  This includes email addresses for account and domain notifications, path names, and other such settings.

A script is also included for updating the secondary DNS (since most sane people tend to put their primary and secondary DNS servers on separate machines).  To do this, you need a central location on the main server for the file to reside before it is uploaded (by default this is /etc/hosting), this directory needs to be owned by user nobody.  A cron script needs to be setup on the secondary DNS machine.  This script downloads the file from the name server and then parses through it doing sanity checks and then comparing each entry to the existing named.conf.  All entries that aren't already in the named.conf on the secondary are entered, then a message is sent to the admin reminding them of the changes and telling them to reload the name server via an "ndc reload".  It is advisable to setup an FTP account just for this so that /etc/hosting can be specified as a home directory (thus limiting access).

Whenever changes are made to either the DNS or Apache, a message is sent to the admin specifying the changes.  The changes only take effect one someone restarts them.  This is an extra security measure so that you can preview all changes before they take effect.

WARNING:  Both the "hosting" and "secondary" perl scripts should be setup as owned by "root" and with permissions "700", this is because the MySQL username and passwords are listed here.

TODO
-----

This utility has the basic functionality, however it lacks comments and portability.  There are a lot of hard-coded paths in the perl script which should instead be variables so you can move the script to different systems.  Comments are also a must.  I'll try to add some in the future.  This whole suite was done as a solution for the ISP at which I work, so its fairly specific.  This should change.


QUESTIONS / BUGS
-----------------

Feel free to email the author at serge@guanotronic.com with any questions and concerns.
