chr configuration updates

chr-installer-adv-vpn-en.sh

@@ -27,6 +27,15 @@ generate_wireguard_key() {
     head -c 32 /dev/urandom | base64
 }
 
+# ============================================
+# INPUT SANITIZATION
+# ============================================
+sanitize_input() {
+    local input="$1"
+    # Remove dangerous characters: ; " ' ` $ \ / and newlines
+    echo "$input" | tr -d ';"'\''`$\\/\n\r' | head -c 64
+}
+
 # ============================================
 # CONFIGURATION
 # ============================================
@@ -37,8 +46,8 @@ CHR_IMG="chr-${CHR_VERSION}.img"
 WORK_DIR="/tmp/chr-install"
 MOUNT_POINT="/mnt/chr"
 
-# CHR Settings
+# CHR Settings (password auto-generated if not specified)
-ADMIN_PASSWORD="PASSWORD"
+ADMIN_PASSWORD=""
 DNS_SERVERS="8.8.8.8,8.8.4.4"
 ROUTER_NAME="MikroTik-VPN"
 TIMEZONE="Europe/Moscow"
@@ -56,7 +65,7 @@ WG_SERVER_PRIVATE_KEY=""
 WG_NETWORK="10.10.20.0/24"
 OVPN_PORT="1194"
 OVPN_TCP_PORT="1195"
-SSTP_PORT="443"
+SSTP_PORT="8443"
 
 # Flags
 FORCE_DOWNLOAD=false
@@ -72,7 +81,7 @@ usage() {
     echo "CHR installation script as VPN server with all protocols:"
     echo "  - PPTP (port 1723)"
     echo "  - L2TP/IPsec (port 1701, UDP 500/4500)"
-    echo "  - SSTP (port 443)"
+    echo "  - SSTP (port 8443)"
     echo "  - OpenVPN (port 1194 UDP/TCP, 1195 TCP)"
     echo "  - WireGuard (port 51820)"
     echo ""
@@ -81,7 +90,7 @@ usage() {
     echo "  --yes, -y        No confirmations (automatic mode)"
     echo "  --reboot         Automatic reboot (requires --yes)"
     echo "  --version VER    CHR version (default: $CHR_VERSION)"
-    echo "  --password PASS  Admin password (default: $ADMIN_PASSWORD)"
+    echo "  --password PASS  Admin password (auto-generated)"
     echo "  --name NAME      Router name (default: $ROUTER_NAME)"
     echo "  --timezone TZ    Timezone (default: $TIMEZONE)"
     echo "  --dns SERVERS    DNS servers (default: $DNS_SERVERS)"
@@ -121,35 +130,35 @@ while [[ $# -gt 0 ]]; do
             shift 2
             ;;
         --password)
-            ADMIN_PASSWORD="$2"
+            ADMIN_PASSWORD=$(sanitize_input "$2")
             shift 2
             ;;
         --name)
-            ROUTER_NAME="$2"
+            ROUTER_NAME=$(sanitize_input "$2")
             shift 2
             ;;
         --timezone)
-            TIMEZONE="$2"
+            TIMEZONE=$(sanitize_input "$2")
             shift 2
             ;;
         --dns)
-            DNS_SERVERS="$2"
+            DNS_SERVERS=$(sanitize_input "$2")
             shift 2
             ;;
         --vpn-user)
-            VPN_USER="$2"
+            VPN_USER=$(sanitize_input "$2")
             shift 2
             ;;
         --vpn-pass)
-            VPN_USER_PASSWORD="$2"
+            VPN_USER_PASSWORD=$(sanitize_input "$2")
             shift 2
             ;;
         --vpn-pool)
-            VPN_POOL="$2"
+            VPN_POOL=$(sanitize_input "$2")
             shift 2
             ;;
         --ipsec-secret)
-            IPSEC_SECRET="$2"
+            IPSEC_SECRET=$(sanitize_input "$2")
             shift 2
             ;;
         --wg-port)
@@ -171,6 +180,11 @@ done
 # ============================================
 log_info "Generating keys and passwords..."
 
+if [[ -z "$ADMIN_PASSWORD" ]]; then
+    ADMIN_PASSWORD=$(generate_password 16)
+    log_info "Generated admin password: $ADMIN_PASSWORD"
+fi
+
 if [[ -z "$VPN_USER_PASSWORD" ]]; then
     VPN_USER_PASSWORD=$(generate_password 16)
     log_info "Generated VPN password: $VPN_USER_PASSWORD"
@@ -400,6 +414,12 @@ cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
 # ============================================
 /ppp profile add name=vpn-profile local-address=${VPN_LOCAL_IP} remote-address=vpn-pool dns-server=${DNS_SERVERS} use-encryption=yes
 
+# ============================================
+# VPN - OPENVPN PUSH ROUTES
+# ============================================
+# Default route through VPN (all traffic)
+/ppp profile set vpn-profile push-routes="0.0.0.0/0 ${VPN_LOCAL_IP}"
+
 # ============================================
 # VPN - USER
 # ============================================
@@ -459,9 +479,15 @@ cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
 /ip firewall nat add chain=dstnat protocol=tcp dst-port=${OVPN_TCP_PORT} action=redirect to-ports=${OVPN_PORT} comment="Redirect OpenVPN TCP alt port to main"
 
 # ============================================
-# FIREWALL - SSH BRUTE-FORCE PROTECTION
+# FIREWALL - BASIC RULES (first for performance)
 # ============================================
 /ip firewall filter
+add chain=input connection-state=established,related action=accept comment="Accept established connections"
+add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
+
+# ============================================
+# FIREWALL - SSH BRUTE-FORCE PROTECTION
+# ============================================
 add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop comment="Drop SSH brute force"
 add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w
 add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m
@@ -486,10 +512,8 @@ add chain=input protocol=udp dst-port=53 action=drop comment="Drop external DNS
 add chain=input protocol=tcp dst-port=53 action=drop comment="Drop external DNS TCP queries"
 
 # ============================================
-# FIREWALL - BASIC RULES
+# FIREWALL - ALLOWED SERVICES
 # ============================================
-add chain=input connection-state=established,related action=accept comment="Accept established connections"
-add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
 add chain=input protocol=icmp action=accept comment="Accept ICMP (ping)"
 add chain=input protocol=tcp dst-port=22 action=accept comment="Accept SSH"
 add chain=input protocol=tcp dst-port=8291 action=accept comment="Accept WinBox"
@@ -543,6 +567,11 @@ add chain=forward action=drop comment="Drop all other forward"
 # NAT - MASQUERADE FOR ALL OUTGOING TRAFFIC
 # ============================================
 /ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT for all outgoing traffic"
+
+# ============================================
+# SECURITY - REMOVE AUTORUN AFTER EXECUTION
+# ============================================
+/file remove [find name~"autorun"]
 EOF
 
 sync
@@ -651,6 +680,7 @@ echo -e "${GREEN}        SAVE THIS INFORMATION!${NC}"
 echo -e "${GREEN}═══════════════════════════════════════════${NC}"
 echo ""
 echo "Server:        ${SERVER_IP}"
+echo "Admin password: ${ADMIN_PASSWORD}"
 echo ""
 echo "PPTP/L2TP/SSTP/OpenVPN:"
 echo "  Username:    ${VPN_USER}"

chr-installer-adv-vpn-ru.sh

@@ -27,6 +27,15 @@ generate_wireguard_key() {
     head -c 32 /dev/urandom | base64
 }
 
+# ============================================
+# САНИТИЗАЦИЯ ВХОДНЫХ ДАННЫХ
+# ============================================
+sanitize_input() {
+    local input="$1"
+    # Удаляем опасные символы: ; " ' ` $ \ / и переносы строк
+    echo "$input" | tr -d ';"'\''`$\\/\n\r' | head -c 64
+}
+
 # ============================================
 # КОНФИГУРАЦИЯ
 # ============================================
@@ -37,8 +46,8 @@ CHR_IMG="chr-${CHR_VERSION}.img"
 WORK_DIR="/tmp/chr-install"
 MOUNT_POINT="/mnt/chr"
 
-# Настройки CHR
+# Настройки CHR (пароль генерируется автоматически если не указан)
-ADMIN_PASSWORD="PASSWORD"
+ADMIN_PASSWORD=""
 DNS_SERVERS="8.8.8.8,8.8.4.4"
 ROUTER_NAME="MikroTik-VPN"
 TIMEZONE="Europe/Moscow"
@@ -56,7 +65,7 @@ WG_SERVER_PRIVATE_KEY=""
 WG_NETWORK="10.10.20.0/24"
 OVPN_PORT="1194"
 OVPN_TCP_PORT="1195"
-SSTP_PORT="443"
+SSTP_PORT="8443"
 
 # Флаги
 FORCE_DOWNLOAD=false
@@ -72,7 +81,7 @@ usage() {
     echo "Скрипт установки CHR как VPN-сервера со всеми протоколами:"
     echo "  - PPTP (порт 1723)"
     echo "  - L2TP/IPsec (порт 1701, UDP 500/4500)"
-    echo "  - SSTP (порт 443)"
+    echo "  - SSTP (порт 8443)"
     echo "  - OpenVPN (порт 1194 UDP/TCP, 1195 TCP)"
     echo "  - WireGuard (порт 51820)"
     echo ""
@@ -81,7 +90,7 @@ usage() {
     echo "  --yes, -y        Без подтверждений (автоматический режим)"
     echo "  --reboot         Автоматическая перезагрузка (требует --yes)"
     echo "  --version VER    Версия CHR (по умолчанию: $CHR_VERSION)"
-    echo "  --password PASS  Пароль admin (по умолчанию: $ADMIN_PASSWORD)"
+    echo "  --password PASS  Пароль admin (генерируется автоматически)"
     echo "  --name NAME      Имя роутера (по умолчанию: $ROUTER_NAME)"
     echo "  --timezone TZ    Часовой пояс (по умолчанию: $TIMEZONE)"
     echo "  --dns SERVERS    DNS серверы (по умолчанию: $DNS_SERVERS)"
@@ -121,35 +130,35 @@ while [[ $# -gt 0 ]]; do
             shift 2
             ;;
         --password)
-            ADMIN_PASSWORD="$2"
+            ADMIN_PASSWORD=$(sanitize_input "$2")
             shift 2
             ;;
         --name)
-            ROUTER_NAME="$2"
+            ROUTER_NAME=$(sanitize_input "$2")
             shift 2
             ;;
         --timezone)
-            TIMEZONE="$2"
+            TIMEZONE=$(sanitize_input "$2")
             shift 2
             ;;
         --dns)
-            DNS_SERVERS="$2"
+            DNS_SERVERS=$(sanitize_input "$2")
             shift 2
             ;;
         --vpn-user)
-            VPN_USER="$2"
+            VPN_USER=$(sanitize_input "$2")
             shift 2
             ;;
         --vpn-pass)
-            VPN_USER_PASSWORD="$2"
+            VPN_USER_PASSWORD=$(sanitize_input "$2")
             shift 2
             ;;
         --vpn-pool)
-            VPN_POOL="$2"
+            VPN_POOL=$(sanitize_input "$2")
             shift 2
             ;;
         --ipsec-secret)
-            IPSEC_SECRET="$2"
+            IPSEC_SECRET=$(sanitize_input "$2")
             shift 2
             ;;
         --wg-port)
@@ -171,6 +180,11 @@ done
 # ============================================
 log_info "Генерация ключей и паролей..."
 
+if [[ -z "$ADMIN_PASSWORD" ]]; then
+    ADMIN_PASSWORD=$(generate_password 16)
+    log_info "Сгенерирован пароль admin: $ADMIN_PASSWORD"
+fi
+
 if [[ -z "$VPN_USER_PASSWORD" ]]; then
     VPN_USER_PASSWORD=$(generate_password 16)
     log_info "Сгенерирован пароль VPN: $VPN_USER_PASSWORD"
@@ -400,6 +414,12 @@ cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
 # ============================================
 /ppp profile add name=vpn-profile local-address=${VPN_LOCAL_IP} remote-address=vpn-pool dns-server=${DNS_SERVERS} use-encryption=yes
 
+# ============================================
+# VPN - OPENVPN PUSH ROUTES
+# ============================================
+# Маршрут по умолчанию через VPN (весь трафик)
+/ppp profile set vpn-profile push-routes="0.0.0.0/0 ${VPN_LOCAL_IP}"
+
 # ============================================
 # VPN - ПОЛЬЗОВАТЕЛЬ
 # ============================================
@@ -459,9 +479,15 @@ cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
 /ip firewall nat add chain=dstnat protocol=tcp dst-port=${OVPN_TCP_PORT} action=redirect to-ports=${OVPN_PORT} comment="Redirect OpenVPN TCP alt port to main"
 
 # ============================================
-# ФАЙРВОЛ - ЗАЩИТА ОТ БРУТФОРСА SSH
+# ФАЙРВОЛ - БАЗОВЫЕ ПРАВИЛА (в начале для производительности)
 # ============================================
 /ip firewall filter
+add chain=input connection-state=established,related action=accept comment="Accept established connections"
+add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
+
+# ============================================
+# ФАЙРВОЛ - ЗАЩИТА ОТ БРУТФОРСА SSH
+# ============================================
 add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop comment="Drop SSH brute force"
 add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w
 add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m
@@ -486,10 +512,8 @@ add chain=input protocol=udp dst-port=53 action=drop comment="Drop external DNS
 add chain=input protocol=tcp dst-port=53 action=drop comment="Drop external DNS TCP queries"
 
 # ============================================
-# ФАЙРВОЛ - БАЗОВЫЕ ПРАВИЛА
+# ФАЙРВОЛ - РАЗРЕШЁННЫЕ СЕРВИСЫ
 # ============================================
-add chain=input connection-state=established,related action=accept comment="Accept established connections"
-add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
 add chain=input protocol=icmp action=accept comment="Accept ICMP (ping)"
 add chain=input protocol=tcp dst-port=22 action=accept comment="Accept SSH"
 add chain=input protocol=tcp dst-port=8291 action=accept comment="Accept WinBox"
@@ -543,6 +567,11 @@ add chain=forward action=drop comment="Drop all other forward"
 # NAT - MASQUERADE ДЛЯ ВСЕГО ИСХОДЯЩЕГО ТРАФИКА
 # ============================================
 /ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT for all outgoing traffic"
+
+# ============================================
+# БЕЗОПАСНОСТЬ - УДАЛЕНИЕ AUTORUN ПОСЛЕ ВЫПОЛНЕНИЯ
+# ============================================
+/file remove [find name~"autorun"]
 EOF
 
 sync
@@ -651,6 +680,7 @@ echo -e "${GREEN}        СОХРАНИТЕ ЭТИ ДАННЫЕ!${NC}"
 echo -e "${GREEN}═══════════════════════════════════════════${NC}"
 echo ""
 echo "Сервер:        ${SERVER_IP}"
+echo "Admin пароль:  ${ADMIN_PASSWORD}"
 echo ""
 echo "PPTP/L2TP/SSTP/OpenVPN:"
 echo "  Пользователь: ${VPN_USER}"

chr-installer-base-en.sh

@@ -13,6 +13,20 @@ log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
 log_debug() { echo -e "${CYAN}[DEBUG]${NC} $1"; }
 
+# ============================================
+# PASSWORD GENERATION AND SANITIZATION
+# ============================================
+generate_password() {
+    local length=$1
+    tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$length"
+}
+
+sanitize_input() {
+    local input="$1"
+    # Remove dangerous characters: ; " ' ` $ \ / and newlines
+    echo "$input" | tr -d ';"'\''`$\\/\n\r' | head -c 64
+}
+
 # ============================================
 # CONFIGURATION
 # ============================================
@@ -23,8 +37,8 @@ CHR_IMG="chr-${CHR_VERSION}.img"
 WORK_DIR="/tmp/chr-install"
 MOUNT_POINT="/mnt/chr"
 
-# CHR Settings
+# CHR Settings (password auto-generated if not specified)
-ADMIN_PASSWORD="PASSWORD"
+ADMIN_PASSWORD=""
 DNS_SERVERS="8.8.8.8,8.8.4.4"
 ROUTER_NAME="MikroTik-CHR"
 TIMEZONE="Europe/Moscow"
@@ -52,7 +66,7 @@ usage() {
     echo "  --yes, -y        No confirmations (automatic mode)"
     echo "  --reboot         Automatic reboot (requires --yes)"
     echo "  --version VER    CHR version (default: $CHR_VERSION)"
-    echo "  --password PASS  Admin password (default: $ADMIN_PASSWORD)"
+    echo "  --password PASS  Admin password (auto-generated)"
     echo "  --name NAME      Router name (default: $ROUTER_NAME)"
     echo "  --timezone TZ    Timezone (default: $TIMEZONE)"
     echo "  --dns SERVERS    DNS servers (default: $DNS_SERVERS)"
@@ -87,19 +101,19 @@ while [[ $# -gt 0 ]]; do
             shift 2
             ;;
         --password)
-            ADMIN_PASSWORD="$2"
+            ADMIN_PASSWORD=$(sanitize_input "$2")
             shift 2
             ;;
         --name)
-            ROUTER_NAME="$2"
+            ROUTER_NAME=$(sanitize_input "$2")
             shift 2
             ;;
         --timezone)
-            TIMEZONE="$2"
+            TIMEZONE=$(sanitize_input "$2")
             shift 2
             ;;
         --dns)
-            DNS_SERVERS="$2"
+            DNS_SERVERS=$(sanitize_input "$2")
             shift 2
             ;;
         -h|--help)
@@ -112,6 +126,14 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
+# ============================================
+# PASSWORD GENERATION (if not specified)
+# ============================================
+if [[ -z "$ADMIN_PASSWORD" ]]; then
+    ADMIN_PASSWORD=$(generate_password 16)
+    log_info "Generated admin password: $ADMIN_PASSWORD"
+fi
+
 # ============================================
 # ROOT CHECK
 # ============================================
@@ -319,9 +341,15 @@ cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
 /ip service set winbox disabled=no
 
 # ============================================
-# FIREWALL - SSH BRUTE-FORCE PROTECTION
+# FIREWALL - BASIC RULES (first for performance)
 # ============================================
 /ip firewall filter
+add chain=input connection-state=established,related action=accept comment="Accept established connections"
+add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
+
+# ============================================
+# FIREWALL - SSH BRUTE-FORCE PROTECTION
+# ============================================
 add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop comment="Drop SSH brute force"
 add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w
 add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m
@@ -349,10 +377,8 @@ add chain=input protocol=udp dst-port=53 action=drop comment="Drop external DNS
 add chain=input protocol=tcp dst-port=53 action=drop comment="Drop external DNS TCP queries"
 
 # ============================================
-# FIREWALL - BASIC RULES
+# FIREWALL - ALLOWED SERVICES
 # ============================================
-add chain=input connection-state=established,related action=accept comment="Accept established connections"
-add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
 add chain=input protocol=icmp action=accept comment="Accept ICMP (ping)"
 add chain=input protocol=tcp dst-port=22 action=accept comment="Accept SSH"
 add chain=input protocol=tcp dst-port=8291 action=accept comment="Accept WinBox"
@@ -375,6 +401,11 @@ add chain=input action=drop comment="Drop all other input"
 # NAT - MASQUERADE
 # ============================================
 /ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT for all outgoing traffic"
+
+# ============================================
+# SECURITY - REMOVE AUTORUN AFTER EXECUTION
+# ============================================
+/file remove [find name~"autorun"]
 EOF
 
 sync
@@ -467,6 +498,7 @@ log_info "CHR installation with basic config completed!"
 log_info "=========================================="
 echo ""
 echo "CHR will be available at: ${ADDRESS%/*}"
+echo "Admin password: ${ADMIN_PASSWORD}"
 echo ""
 echo -e "${GREEN}Configured:${NC}"
 echo "  • Router name: $ROUTER_NAME"

chr-installer-base-ru.sh

@@ -13,6 +13,20 @@ log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
 log_debug() { echo -e "${CYAN}[DEBUG]${NC} $1"; }
 
+# ============================================
+# ГЕНЕРАЦИЯ ПАРОЛЕЙ И САНИТИЗАЦИЯ
+# ============================================
+generate_password() {
+    local length=$1
+    tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$length"
+}
+
+sanitize_input() {
+    local input="$1"
+    # Удаляем опасные символы: ; " ' ` $ \ / и переносы строк
+    echo "$input" | tr -d ';"'\''`$\\/\n\r' | head -c 64
+}
+
 # ============================================
 # КОНФИГУРАЦИЯ
 # ============================================
@@ -23,8 +37,8 @@ CHR_IMG="chr-${CHR_VERSION}.img"
 WORK_DIR="/tmp/chr-install"
 MOUNT_POINT="/mnt/chr"
 
-# Настройки CHR
+# Настройки CHR (пароль генерируется автоматически если не указан)
-ADMIN_PASSWORD="PASSWORD"
+ADMIN_PASSWORD=""
 DNS_SERVERS="8.8.8.8,8.8.4.4"
 ROUTER_NAME="MikroTik-CHR"
 TIMEZONE="Europe/Moscow"
@@ -52,7 +66,7 @@ usage() {
     echo "  --yes, -y        Без подтверждений (автоматический режим)"
     echo "  --reboot         Автоматическая перезагрузка (требует --yes)"
     echo "  --version VER    Версия CHR (по умолчанию: $CHR_VERSION)"
-    echo "  --password PASS  Пароль admin (по умолчанию: $ADMIN_PASSWORD)"
+    echo "  --password PASS  Пароль admin (генерируется автоматически)"
     echo "  --name NAME      Имя роутера (по умолчанию: $ROUTER_NAME)"
     echo "  --timezone TZ    Часовой пояс (по умолчанию: $TIMEZONE)"
     echo "  --dns SERVERS    DNS серверы (по умолчанию: $DNS_SERVERS)"
@@ -87,19 +101,19 @@ while [[ $# -gt 0 ]]; do
             shift 2
             ;;
         --password)
-            ADMIN_PASSWORD="$2"
+            ADMIN_PASSWORD=$(sanitize_input "$2")
             shift 2
             ;;
         --name)
-            ROUTER_NAME="$2"
+            ROUTER_NAME=$(sanitize_input "$2")
             shift 2
             ;;
         --timezone)
-            TIMEZONE="$2"
+            TIMEZONE=$(sanitize_input "$2")
             shift 2
             ;;
         --dns)
-            DNS_SERVERS="$2"
+            DNS_SERVERS=$(sanitize_input "$2")
             shift 2
             ;;
         -h|--help)
@@ -112,6 +126,14 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
+# ============================================
+# ГЕНЕРАЦИЯ ПАРОЛЯ (если не задан)
+# ============================================
+if [[ -z "$ADMIN_PASSWORD" ]]; then
+    ADMIN_PASSWORD=$(generate_password 16)
+    log_info "Сгенерирован пароль admin: $ADMIN_PASSWORD"
+fi
+
 # ============================================
 # ПРОВЕРКА ROOT
 # ============================================
@@ -319,9 +341,15 @@ cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
 /ip service set winbox disabled=no
 
 # ============================================
-# ФАЙРВОЛ - ЗАЩИТА ОТ БРУТФОРСА SSH
+# ФАЙРВОЛ - БАЗОВЫЕ ПРАВИЛА (в начале для производительности)
 # ============================================
 /ip firewall filter
+add chain=input connection-state=established,related action=accept comment="Accept established connections"
+add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
+
+# ============================================
+# ФАЙРВОЛ - ЗАЩИТА ОТ БРУТФОРСА SSH
+# ============================================
 add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop comment="Drop SSH brute force"
 add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w
 add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m
@@ -349,10 +377,8 @@ add chain=input protocol=udp dst-port=53 action=drop comment="Drop external DNS
 add chain=input protocol=tcp dst-port=53 action=drop comment="Drop external DNS TCP queries"
 
 # ============================================
-# ФАЙРВОЛ - БАЗОВЫЕ ПРАВИЛА
+# ФАЙРВОЛ - РАЗРЕШЁННЫЕ СЕРВИСЫ
 # ============================================
-add chain=input connection-state=established,related action=accept comment="Accept established connections"
-add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
 add chain=input protocol=icmp action=accept comment="Accept ICMP (ping)"
 add chain=input protocol=tcp dst-port=22 action=accept comment="Accept SSH"
 add chain=input protocol=tcp dst-port=8291 action=accept comment="Accept WinBox"
@@ -375,6 +401,11 @@ add chain=input action=drop comment="Drop all other input"
 # NAT - MASQUERADE
 # ============================================
 /ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT for all outgoing traffic"
+
+# ============================================
+# БЕЗОПАСНОСТЬ - УДАЛЕНИЕ AUTORUN ПОСЛЕ ВЫПОЛНЕНИЯ
+# ============================================
+/file remove [find name~"autorun"]
 EOF
 
 sync
@@ -467,6 +498,7 @@ log_info "Установка CHR с базовой настройкой заве
 log_info "=========================================="
 echo ""
 echo "CHR будет доступен: ${ADDRESS%/*}"
+echo "Admin пароль:  ${ADMIN_PASSWORD}"
 echo ""
 echo -e "${GREEN}Настроено:${NC}"
 echo "  • Имя роутера: $ROUTER_NAME"

chr-installer-en.sh

@@ -13,6 +13,20 @@ log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
 log_debug() { echo -e "${CYAN}[DEBUG]${NC} $1"; }
 
+# ============================================
+# PASSWORD GENERATION AND SANITIZATION
+# ============================================
+generate_password() {
+    local length=$1
+    tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$length"
+}
+
+sanitize_input() {
+    local input="$1"
+    # Remove dangerous characters: ; " ' ` $ \ / and newlines
+    echo "$input" | tr -d ';"'\''`$\\/\n\r' | head -c 64
+}
+
 # ============================================
 # CONFIGURATION
 # ============================================
@@ -23,8 +37,8 @@ CHR_IMG="chr-${CHR_VERSION}.img"
 WORK_DIR="/tmp/chr-install"
 MOUNT_POINT="/mnt/chr"
 
-# CHR Settings
+# CHR Settings (password auto-generated if not specified)
-ADMIN_PASSWORD="PASSWORD"
+ADMIN_PASSWORD=""
 DNS_SERVERS="8.8.8.8,8.8.4.4"
 
 # Flags
@@ -47,7 +61,7 @@ usage() {
     echo "  --yes, -y        No confirmations (automatic mode)"
     echo "  --reboot         Automatic reboot (requires --yes)"
     echo "  --version VER    CHR version (default: $CHR_VERSION)"
-    echo "  --password PASS  Admin password (default: $ADMIN_PASSWORD)"
+    echo "  --password PASS  Admin password (auto-generated)"
     echo "  -h, --help       Show help"
     echo ""
     echo "Examples:"
@@ -87,7 +101,7 @@ while [[ $# -gt 0 ]]; do
             shift 2
             ;;
         --password)
-            ADMIN_PASSWORD="$2"
+            ADMIN_PASSWORD=$(sanitize_input "$2")
             shift 2
             ;;
         -h|--help)
@@ -100,6 +114,14 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
+# ============================================
+# PASSWORD GENERATION (if not specified)
+# ============================================
+if [[ -z "$ADMIN_PASSWORD" ]]; then
+    ADMIN_PASSWORD=$(generate_password 16)
+    log_info "Generated admin password: $ADMIN_PASSWORD"
+fi
+
 # ============================================
 # ROOT CHECK
 # ============================================
@@ -308,6 +330,11 @@ else
 /ip route add gateway=${GATEWAY}
 /user set 0 name=admin password=${ADMIN_PASSWORD}
 /ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT for all outgoing traffic"
+
+# ============================================
+# SECURITY - REMOVE AUTORUN AFTER EXECUTION
+# ============================================
+/file remove [find name~"autorun"]
 EOF
     
     # Sync filesystem before unmounting
@@ -419,6 +446,7 @@ if [[ "$SKIP_AUTORUN" == true ]]; then
 fi
 
 echo "CHR will be available at: ${ADDRESS%/*}"
+echo "Admin password: ${ADMIN_PASSWORD}"
 echo ""
 
 if [[ "$AUTO_YES" == true && "$AUTO_REBOOT" == true ]]; then

chr-installer.sh

@@ -13,6 +13,20 @@ log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
 log_debug() { echo -e "${CYAN}[DEBUG]${NC} $1"; }
 
+# ============================================
+# ГЕНЕРАЦИЯ ПАРОЛЕЙ И САНИТИЗАЦИЯ
+# ============================================
+generate_password() {
+    local length=$1
+    tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$length"
+}
+
+sanitize_input() {
+    local input="$1"
+    # Удаляем опасные символы: ; " ' ` $ \ / и переносы строк
+    echo "$input" | tr -d ';"'\''`$\\/\n\r' | head -c 64
+}
+
 # ============================================
 # КОНФИГУРАЦИЯ
 # ============================================
@@ -23,8 +37,8 @@ CHR_IMG="chr-${CHR_VERSION}.img"
 WORK_DIR="/tmp/chr-install"
 MOUNT_POINT="/mnt/chr"
 
-# Настройки CHR
+# Настройки CHR (пароль генерируется автоматически если не указан)
-ADMIN_PASSWORD="PASSWORD"
+ADMIN_PASSWORD=""
 DNS_SERVERS="8.8.8.8,8.8.4.4"
 
 # Флаги
@@ -47,7 +61,7 @@ usage() {
     echo "  --yes, -y        Без подтверждений (автоматический режим)"
     echo "  --reboot         Автоматическая перезагрузка (требует --yes)"
     echo "  --version VER    Версия CHR (по умолчанию: $CHR_VERSION)"
-    echo "  --password PASS  Пароль admin (по умолчанию: $ADMIN_PASSWORD)"
+    echo "  --password PASS  Пароль admin (генерируется автоматически)"
     echo "  -h, --help       Показать справку"
     echo ""
     echo "Примеры:"
@@ -87,7 +101,7 @@ while [[ $# -gt 0 ]]; do
             shift 2
             ;;
         --password)
-            ADMIN_PASSWORD="$2"
+            ADMIN_PASSWORD=$(sanitize_input "$2")
             shift 2
             ;;
         -h|--help)
@@ -100,6 +114,14 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
+# ============================================
+# ГЕНЕРАЦИЯ ПАРОЛЯ (если не задан)
+# ============================================
+if [[ -z "$ADMIN_PASSWORD" ]]; then
+    ADMIN_PASSWORD=$(generate_password 16)
+    log_info "Сгенерирован пароль admin: $ADMIN_PASSWORD"
+fi
+
 # ============================================
 # ПРОВЕРКА ROOT
 # ============================================
@@ -308,6 +330,11 @@ else
 /ip route add gateway=${GATEWAY}
 /user set 0 name=admin password=${ADMIN_PASSWORD}
 /ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT for all outgoing traffic"
+
+# ============================================
+# БЕЗОПАСНОСТЬ - УДАЛЕНИЕ AUTORUN ПОСЛЕ ВЫПОЛНЕНИЯ
+# ============================================
+/file remove [find name~"autorun"]
 EOF
     
     # Синхронизация ФС перед размонтированием
@@ -419,6 +446,7 @@ if [[ "$SKIP_AUTORUN" == true ]]; then
 fi
 
 echo "CHR будет доступен: ${ADDRESS%/*}"
+echo "Admin пароль:  ${ADMIN_PASSWORD}"
 echo ""
 
 if [[ "$AUTO_YES" == true && "$AUTO_REBOOT" == true ]]; then