История страницы

apt-get update

apt-get install -y nginx fcgiwrap mariadb-server mariadb-client \ 
       postfix mailutils \
       perl libdbd-mysql-perl libdbi-perl \
       libnet-snmp-perl libsnmp-perl librrds-perl rrdtool \
       libcgi-pm-perl libcgi-fast-perl \
       libdate-manip-perl libdate-calc-perl \
       libconfig-inifiles-perl libclass-makemethods-perl \
       libdigest-hmac-perl libdigest-sha-perl \
       libnet-ip-perl libnet-dns-perl \
       libio-socket-ssl-perl libnet-ssleay-perl \
       libjson-perl libjson-xs-perl \
       libxml-simple-perl libxml-libxml-perl \
       libtext-iconv-perl libexpat1 ssl-cert \
       build-essential gcc make libperl-dev libtalloc-dev \
       arping curl wget mc nano htop net-tools \
       git openssl ca-certificates logrotate cron \
       libarchive-zip-perl libmime-base64-perl \
       libemail-valid-perl libmailtools-perl \
       libfile-tail-perl libproc-processtable-perl \
       libsocket6-perl libio-multiplex-perl \
       libnet-server-perl libnet-telnet-perl \
       libterm-readkey-perl libterm-readpassword-perl \
       libtimedate-perl liburi-perl libwww-perl libhtml-parser-perl \
       liblwp-protocol-https-perl \
       libcrypt-rc4-perl libcrypt-des-perl \
       libconvert-binhex-perl libmime-tools-perl \
       libauthen-sasl-perl libnet-smtp-ssl-perl \
       libmath-round-perl libyaml-perl libyaml-libyaml-perl \
       libdb-file-lock-perl libfile-copy-recursive-perl \
       libfile-slurp-perl libfile-which-perl \
       libipc-run-perl libipc-sharelite-perl \
       libparallel-forkmanager-perl libsnmp-session-perl \
       libcrypt-openssl-rsa-perl libcrypt-openssl-random-perl \
       libcrypt-openssl-bignum-perl libnetaddr-ip-perl \
       libtext-csv-perl libtext-csv-xs-perl \
       libspreadsheet-writeexcel-perl libexcel-writer-xlsx-perl \
       libpdf-api2-perl libimage-size-perl libmime-lite-perl \
       libnet-cidr-perl libnet-cidr-lite-perl \
       libsys-syslog-perl libunix-syslog-perl \
       libnet-ssh2-perl libexpect-perl libio-pty-perl libio-stty-perl \
       libterm-readline-gnu-perl libdata-dump-perl libhash-merge-perl \
       libclone-perl libparams-validate-perl libmodule-build-perl \
       liblocal-lib-perl libversion-perl libtry-tiny-perl \
       libsub-exporter-perl libsub-install-perl libsub-name-perl \
       libsub-quote-perl librole-tiny-perl libmoo-perl \
       libnamespace-clean-perl libnamespace-autoclean-perl \
       libstrictures-perl libbareword-filehandles-perl \
       libindirect-perl libmultidimensional-perl libimport-into-perl \
       libmodule-runtime-perl libmodule-implementation-perl \
       libpackage-stash-perl libpackage-stash-xs-perl \
       libclass-method-modifiers-perl libclass-xsaccessor-perl \
       libdevel-globaldestruction-perl libdevel-caller-perl \
       libdevel-lexalias-perl libdevel-stacktrace-perl \
       libvariable-magic-perl libb-hooks-op-check-perl \
       libb-hooks-endofscope-perl libparams-classify-perl \
       libparams-util-perl libparams-check-perl libdata-optlist-perl \
       libdata-section-perl libdata-validate-ip-perl \
       libdata-validate-domain-perl libdata-validate-email-perl \
       libdata-validate-uri-perl libdatetime-perl \
       libdatetime-timezone-perl libdatetime-locale-perl \
       libdatetime-format-strptime-perl libdatetime-format-dateparse-perl \
       libdatetime-format-iso8601-perl libdatetime-format-http-perl \
       libdatetime-format-mail-perl libdatetime-format-mysql-perl \
       libdatetime-format-sqlite-perl libdatetime-format-builder-perl \
       libdatetime-event-cron-perl libdatetime-set-perl \
       libdatetime-event-recurrence-perl libspecio-perl \
       liblog-dispatch-perl liblog-log4perl-perl liblog-any-perl \
       liblog-any-adapter-log4perl-perl liblog-contextual-perl \
       liblog-dispatchouli-perl liblog-report-perl liblog-report-optional-perl \
       libstring-rewriteprefix-perl libstring-formatter-perl \
       libstring-escape-perl libstring-print-perl libstring-shellquote-perl \
       libstring-random-perl libstring-crc32-perl libstring-diff-perl \
       libstring-truncate-perl libstring-util-perl libstring-flogger-perl \
       libstring-tagged-perl libstring-tagged-terminal-perl \
       libstring-trim-perl libstring-trim-more-perl libstring-interpolate-perl \
       libstring-license-perl libstring-copyright-perl libstring-format-perl \
       libstring-errf-perl libio-socket-inet6-perl libio-socket-ip-perl \
       libio-socket-multicast-perl libio-socket-portstate-perl \
       libio-socket-socks-perl libio-socket-timeout-perl libio-string-perl \
       libio-stringy-perl libio-tiecombine-perl libio-compress-perl \
       libio-compress-lzma-perl libio-interactive-perl libio-lockedfile-perl \
       libio-prompt-perl libio-prompt-tiny-perl libio-sessiondata-perl \
       libio-tee-perl libio-tty-perl libio-async-perl \
       libio-async-loop-epoll-perl libio-async-loop-glib-perl \
       libio-async-ssl-perl libio-capture-perl libio-captureoutput-perl \
       libio-compress-brotli-perl libio-digest-perl libio-dirent-perl \
       libio-event-perl libio-fdpass-perl libio-file-withpath-perl \
       libio-handle-util-perl libio-html-perl libio-lcdproc-perl \
       libio-pager-perl libio-pipely-perl libio-prompter-perl \
       libipc-run3-perl libipc-signal-perl libipc-system-simple-perl \
       libipc-run-safehandles-perl libipc-sharedcache-perl \
       libipc-shareable-perl libipc-filter-perl libipc-pubsub-perl \
       libsocket-perl libfile-rsync-perl libtime-hires-perl \
       libgd-perl libauthen-captcha-perl libimager-qrcode-perl \
       libdigest-md4-perl libcrypt-openssl-x509-perl \
       libtext-autoformat-perl libdate-simple-perl libdate-range-perl \
       libauthen-radius-perl libjson-rpc-perl libmail-pop3client-perl

    apt-get install -y freeradius freeradius-mysql freeradius-utils

    ln -sf /usr/sbin/freeradius /usr/sbin/radiusd

    apt-get install -y postfix mailutils

    ls -la /usr/sbin/sendmail
    which mail mailx

    echo 'postfix postfix/main_mailer_type select Local only' | debconf-set-selections
    echo "postfix postfix/mailname string $(hostname -f)" | debconf-set-selections

    postconf -e 'inet_interfaces = loopback-only'
    postconf -e 'mydestination = localhost, localhost.localdomain'

    systemctl enable postfix
    systemctl restart postfix
    systemctl is-active postfix

    printf "To: root@localhost\nFrom: test@localhost\nSubject: test\n\nTest\n" | /usr/sbin/sendmail -t
    mailq

   ss -ltnp | grep ':25 '

 git clone -b master git@git.it39.su:releases/ACP.git /usr/acp

 git clone -b master https://git.it39.su/releases/ACP.git /usr/acp

cd /usr/acp
git fetch --all
git checkout master
git pull origin master

mkdir -p /usr/acp/var/log /usr/acp/var/db/rrd /usr/acp/var/run /usr/acp/var/q /usr/acp/backup /usr/acp/Certs

    for _ld in Abon Accident Acct ACP Api Auth billd Cmd DaDaTa Debug Docs \
               Equipment Extreceipt Intercom Internet ipn Iptv MAX Msgs \
               Nas_logs Paysys Periodic SMS SQL Storage Telegram Update Ureports; do
      mkdir -p /usr/acp/var/log/${_ld}
    done

mkdir -p /usr/acp/var/log/MAX/dialogs

    for _lf in \
        "Debug/acp.log" "Debug/acp.debug" "Debug/bp.log" \
        "SQL/sql_errors" \
        "ACP/acp.log" \
        "Nas_logs/nas.log" \
        "Paysys/paysys_check.log" "Paysys/YKassa.log" "Paysys/TBank.log" "Paysys/user_fn.log" \
        "SMS/sms_sender.log" "SMS/sms_result.log" \
        "Telegram/telegram.log" "Telegram/telegram_debug.log" \
        "Telegram/telegram_api.log" "Telegram/telegram_msgs.log" \
        "MAX/max.log" "MAX/webhook.log" "MAX/script.log" "MAX/menu_debug.log" \
        "MAX/max_dialog_plugins.log" \
        "Msgs/msgs_delivery.log" "Msgs/msgs_autoclose.log" \
        "Accident/accident_push.log" \
        "Extreceipt/extreceipt_request.log" "Extreceipt/extreceipt_answer.log" \
        "Equipment/equipment_mac.log" "Equipment/equipment_mac_grabber.log" \
        "Intercom/manual_mapping_sync.log" "Intercom/manual_mapping_batch.log" \
        "Abon/gitlab.log" \
        "DaDaTa/acp_dadata.log" \
        "event_asterisk.log" "gps_tracker.log" "hotspot.log" \
        "websocket.log" "websocket_internal.log" \
      ; do
      touch /usr/acp/var/log/${_lf}
    done

    chmod -R 777 /usr/acp/var

    chown -R www-data:www-data /usr/acp/cgi-bin
    chown -R www-data:www-data /usr/acp/ACP/templates
    chown -R www-data:www-data /usr/acp/backup

    chmod +x /usr/acp/libexec/billd
    chmod +x /usr/acp/libexec/periodic
    chmod +x /usr/acp/cgi-bin/index.cgi
    chmod +x /usr/acp/cgi-bin/admin/index.cgi

   find /usr/acp/var/log -maxdepth 1 -type d | wc -l # должно быть ~29
   find /usr/acp/var/log -type f | wc -l # должно быть ~70

    mysql -u root -e "CREATE DATABASE IF NOT EXISTS \`acp\` DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci;"
    mysql -u root -e "CREATE USER IF NOT EXISTS 'acp'@'localhost' IDENTIFIED BY 'ВАШ_ПАРОЛЬ_БД';"
    mysql -u root -e "GRANT ALL PRIVILEGES ON \`acp\`.* TO 'acp'@'localhost';"
    mysql -u root -e "FLUSH PRIVILEGES;"

    SECRET_KEY=$(openssl rand -base64 24 | tr -d '/+=' | cut -c1-32)
    echo "SECRET_KEY=$SECRET_KEY"

    cd /usr/acp
    sed "s/test12345678901234567890/${SECRET_KEY}/g" db/acp.sql > /tmp/acp_import.sql
    mysql --default-character-set=utf8 -u acp -p'ВАШ_ПАРОЛЬ_БД' -h localhost acp < /tmp/acp_import.sql
    rm -f /tmp/acp_import.sql

   cp /usr/acp/libexec/config.pl.default /usr/acp/libexec/config.pl

    # --- База данных ---

    $conf{dbhost}='localhost';
    $conf{dbname}='acp';
    $conf{dbuser}='acp';
    $conf{dbpasswd}='ВАШ_ПАРОЛЬ_БД';

    # --- Базовая директория (все пути строятся от неё) ---

    $base_dir='/usr/acp/';

    # --- Секретный ключ кодирования (тот же, что подставили в acp.sql) ---

    $conf{secretkey}="ВАШ_SECRET_KEY";

- $conf{dbpasswd} — в ОДИНАРНЫХ кавычках
- $conf{secretkey} — в ДВОЙНЫХ кавычках

    grep -E '^\$(base_dir|conf\{(dbhost|dbname|dbuser|dbpasswd|secretkey)\})' /usr/acp/libexec/config.pl

  mkdir -p /etc/systemd/system/fcgiwrap.service.d

    [Service]
    Environment=DAEMON_PROCS=100
    ExecStart=
    ExecStart=/usr/sbin/fcgiwrap ${DAEMON_OPTS} -c ${DAEMON_PROCS}

    systemctl daemon-reload
    systemctl enable fcgiwrap.socket
    systemctl restart fcgiwrap.socket
    systemctl is-active fcgiwrap.socket

    ps aux | grep -c '[f]cgiwrap'

apt-get install -y libfcgi-perl

chmod 755 /usr/acp/cgi-bin/fcgi_runner.pl
chown www-data:www-data /usr/acp/cgi-bin/fcgi_runner.pl

cp /usr/acp/cgi-bin/fcgi/acp-fcgi-index.service /etc/systemd/system/
cp /usr/acp/cgi-bin/fcgi/acp-fcgi-admin.service /etc/systemd/system/
systemctl daemon-reload
systemctl enable acp-fcgi-index acp-fcgi-admin
systemctl restart acp-fcgi-index acp-fcgi-admin

ls -l /run/acp-fcgi-index/index.sock /run/acp-fcgi-admin/index.sock
systemctl is-active acp-fcgi-index acp-fcgi-admin

location ~* \.cgi|pm$ { fastcgi_pass unix:/run/systemctl edit acp-fcgi-index.sock; ... }
location /admin/      { fastcgi_pass unix:/run/acp-fcgi-admin.sock; ... }

    mkdir -p /etc/nginx/ssl
    openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
      -keyout /etc/nginx/ssl/nginx-selfsigned.key \
      -out /etc/nginx/ssl/nginx-selfsigned.crt \
      -subj '/C=RU/ST=Kaliningrad/L=Kaliningrad/O=ASR Kazna-39/CN=stat.example.ru'

    mkdir -p /var/log/KTK-39

    %SERVER_NAME% — домен (например stat.example.ru)
    %SERVER_IP% — IP прослушивания (например 10.0.0.1)
    %BASE_DIR% — каталог установки (например /usr/acp)
    %LOG_DIR% — каталог логов nginx (/var/log/KTK-39)
    %SSL_CERT% — путь к сертификату
    %SSL_KEY% — путь к ключу
    %FCGI_INDEX_SOCKET% — сокет FastCGI-пула для клиентского веба (по умолчанию unix:/run/acp-fcgi-index/index.sock, при отсутствии пула — unix:/var/run/fcgiwrap.socket)
    %FCGI_ADMIN_SOCKET% — сокет FastCGI-пула для админки (по умолчанию unix:/run/acp-fcgi-admin/index.sock, при отсутствии пула — unix:/var/run/fcgiwrap.socket)
    %FCGI_PAYSYS_SOCKET% — сокет для платёжных callback (paysys_check.cgi). ВСЕГДА unix:/var/run/fcgiwrap.socket (отдельный FastCGI-пул для платёжных callback НЕ используется)

     cp /usr/acp/misc/nginx/ktkacp-kazna-39.conf.tpl /etc/nginx/sites-available/acp-kazna-39.conf

     # Блок сервера для отклонения запросов с неправильным или отсутствующим Host

      server {
            listen 10.0.0.1:80;
            server_name "";
            return 444;
      }

      # Блок сервера для перенаправления HTTP -> HTTPS

      server {
            if ($host = stat.example.ru) {
                       return 301 https://$host$request_uri;
            }

            listen 10.0.0.1:80;
            access_log off;
            error_log off;
            server_name stat.example.ru;

            location / {
                       add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob:; connect-src 'self' data: blob:; worker-src 'self' data: blob:";
                       try_files $uri $uri/ =404;
                       return 301 https://$host$request_uri;
            }
      }

      # Основной HTTPS сервер с полной конфигурацией безопасности

      server {
            # ВАЖНО: default_server НЕ указываем — иначе конфликтует с другими
            # сайтами nginx на этом же IP (a duplicate default server)
            listen 10.0.0.1:443 ssl;
            http2 on;
            charset utf-8;
            client_max_body_size 20m;

            # Расширенная политика безопасности контента (CSP)

            add_header Content-Security-Policy "
                       default-src 'self';
                       script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob:
                               https://*.yandex.ru https://*.yandex.net
                               https://*.google.com https://*.googleapis.com https://*.gstatic.com
                               https://stackpath.bootstrapcdn.com https://code.jquery.com https://cdn.jsdelivr.net;
                       style-src 'self' 'unsafe-inline'
                               https://*.yandex.ru https://*.yandex.net
                         https://*.google.com https://*.gstatic.com
                               https://stackpath.bootstrapcdn.com;
                       img-src 'self' data:
                               https://*.yandex.ru https://*.yandex.net
                               https://*.google.com https://*.googleapis.com
                               https://*.gstatic.com https://*.maps.yandex.net;
                       connect-src 'self' data: blob:
                               https://*.yandex.ru https://*.yandex.net
                               https://*.google.com https://*.googleapis.com;
                       font-src 'self' data:
                  https:       https://*.gstatic.com;
                       worker-src 'self' data: blob:;
                       frame-src
                               https://*.yandex.ru https://*.yandex.net
                               https://*.google.com https://yoomoney.ru;
                       frame-ancestors 'self' https://yandex.ru https://*.yandex.ru;
                       object-src 'none';
                       base-uri 'self';
                       form-action 'self'";

            # HSTS (HTTP Strict Transport Security)

            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";

            # Безопасные куки

            add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;

            # Защита от MIME-спуфинга

            add_header X-Content-Type-Options "nosniff";

            # Защита от кликджекинга

            add_header X-Frame-Options "SAMEORIGIN";

            # Защита от XSS-атак

            add_header X-XSS-Protection "1; mode=block";

            # Проверка допустимых доменных имен

            if ( $host !~* ^(stat.example.ru|www.stat.example.ru)$ ) {
                       return 444;
            }

            if ( $http_host !~* ^(stat.example.ru|www.stat.example.ru)$ ) {
                       return 444;
            }

            # Настройка параметров Host для FastCGI и прокси

            fastcgi_param HTTP_HOST $http_host;
            proxy_set_header Host $server_name;

            # Страницы ошибок

            error_page 403 /error/403.html;
            error_page 404 /error/404.html;

            # Локация для страниц ошибок

            location ^~ /error/ {
                       internal;
                       root /usr/acp/cgi-bin/;
                       add_header Content-Type text/html;
                       add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
                       add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
            }

            # Корневая директория сервера

            root "/usr/acp/cgi-bin";
            index index.cgi;
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

            # Пути к SSL сертификатам

            ssl_certificate /etc/nginx/ssl/nginx-selfsigned.crt;
            ssl_certificate_key /etc/nginx/ssl/nginx-selfsigned.key;

            # Отключение OCSP Stapling (так как он недоступен)

        ssl_stapling     ssl_stapling off;
            ssl_stapling_verify off;

            # Настройки SSL/TLS

            ssl_protocols TLSv1.2 TLSv1.3;
            ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
            ssl_prefer_server_ciphers on;
            ssl_session_timeout 1d;
            ssl_session_cache shared:SSL:10m;
            ssl_session_tickets off;

            # Пути к лог-файлам

            access_log /var/log/KTK-39/access.log;
            error_log /var/log/KTK-39/error.log;

            # Безопасные общие ускорения (без изменения API-логики/авторизации)

            sendfile on;
            tcp_nopush on;
            tcp_nodelay on;
            keepalive_timeout 65s;
            keepalive_requests 1000;
            reset_timedout_connection on;
            open_file_cache max=10000 inactive=60s;
            open_file_cache_valid 120s;
            open_file_cache_min_uses 2;
            open_file_cache_errors on;

            # Основная локация сервера

            location / {
                       add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
                       add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
                       add_header X-Frame-Options "SAMEORIGIN";
                       add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob: https:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';";
                       root "/usr/acp/cgi-bin/";
                       index index.cgi;
            }

            # Обработка PHP-файлов

            location ~* \.php$ {
             fastcgi_pass 127     fastcgi_pass 127.0.0.1:9000;
                       fastcgi_param NO_BUFFERING 1;
                       fastcgi_index index.php;
                       fastcgi_connect_timeout 60s;
                       fastcgi_read_timeout 120s;
                       fastcgi_send_timeout 120s;
                       include fastcgi_params;
                       fastcgi_param REMOTE_ADDR $remote_addr;
                       fastcgi_buffering off;
                       add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
                       add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
                       add_header X-Frame-Options "SAMEORIGIN";
                       add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob: https:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';";
            }

         # Обработка CGI и Perl файлов

        location ~* \.cgi|pm$ {
            fastcgi_pass unix:/var/run/fcgiwrap.socket;
            fastcgi_param NO_BUFFERING 1;
            fastcgi_index index.cgi;
            fastcgi_pass_header Authorization;
            fastcgi_param HTTP_CGI_AUTHORIZATION $http_authorization;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_connect_timeout 60s;
            fastcgi_read_timeout 120s;
            fastcgi_send_timeout 120s;
            include fastcgi_params;
            fastcgi_param REMOTE_ADDR $remote_addr;
            fastcgi_buffering off;
            fastcgi_param HTTP_HOST $host:$server_port;
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
            add_header X-Frame-Options "ALLOW-FROM https://yandex.ru https://*.yandex.ru https://yandex.net https://*.yandex.net";
        }

        # Локация для стилей

        location /styles/ {
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
            add_header X-Frame-Options "SAMEORIGIN";
            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob: https:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';";
            add_header Last-Modified $date_gmt;
            add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
            if_modified_since off;
            expires off;
            etag off;
            root /usr/acp/cgi-bin/;
        }

        # Локация для изображений калькулятора

        location /img/calculator/ {
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
            add_header X-Frame-Options "SAMEORIGIN";
            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob: https:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';";
            root /usr/acp/cgi-bin/;
        }

        # Административная панель

        location /admin/ {
            # Защита от сканеров уязвимостей и вредоносных ботов
            if ($http_user_agent ~* (nikto|wpscan|sqlmap|dirbuster|acunetix|nessus|metasploit|burpsuite|owasp|zap|nmap|openvas|arachni|w3af|skipfish|netsparker|appscan|havij|hydra|medusa|patator|john|aircrack|sqlsus|sqlninja|darkmysql|absinthe|bbqsql|firesheep|wce|ratproxy|beef|bettercap|yersinia|dsniff|ettercap|kismet|reaver|wash|mdk3|wifite|fern|airgeddon|hak5|pwn|exploit|rce|lfi|xxe|xsrf|xss|brute|force|browserling|browsershots|shodan|censys|zoomeye|masscan|gobuster|ffuf|dirb|dirsearch|wfuzz|amass|sublist3r|knockpy|theharvester|altdns|dnsrecon|dnsenum|fierce|sn1per|recon-ng|maltego|spiderfoot|osmedeus|xsstrike|xsser|weevely|webshell|shellshock|struts|joomscan|drupwn|drupalgeddon|wpseku|wprecon|joomlavs|magescan|sentrymb|umbraco|yaws)) {
                access_log /var/log/KTK-39/blocked_scanners.log;
                return 403;
            }
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header X-Frame-Options "SAMEORIGIN";
            add_header Content-Security-Policy " # Платёжные callback (paysys_check.cgi) — ОТДЕЛЬНЫЙ location на fcgiwrap.
        # ВАЖНО: callback рассчитан на обычный CGI-запуск. При отсутствии совпадений
        # по IP он завершается через exit БЕЗ вывода — fcgiwrap отдаёт это как 200 OK,
        # тогда как FastCGI-пул биллинга (fcgi_runner.pl) превращает пустой ответ в
        # 502 Bad Gateway. Regex-locations проверяются в порядке появления — этот
        # блок ДОЛЖЕН быть ВЫШЕ общего location ~* \.cgi|pm$.

        location ~* ^/paysys_check\.cgi$ {
            fastcgi_pass unix:/var/run/fcgiwrap.socket;
            fastcgi_param NO_BUFFERING 1;
            fastcgi_index index.cgi;
            fastcgi_pass_header Authorization;
            fastcgi_param HTTP_CGI_AUTHORIZATION $http_authorization;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_connect_timeout 60s;
            fastcgi_read_timeout 120s;
            fastcgi_send_timeout 120s;
            include fastcgi_params;
            fastcgi_param REMOTE_ADDR $remote_addr;
            fastcgi_buffering off;
            fastcgi_param HTTP_HOST $host:$server_port;
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
            add_header X-Frame-Options "SAMEORIGIN";
        }

# Обработка CGI и Perl файлов

        location ~* \.cgi|pm$ {
            fastcgi_pass unix:/run/acp-fcgi-index/index.sock;
            fastcgi_param NO_BUFFERING 1;
            fastcgi_index index.cgi;
            fastcgi_pass_header Authorization;
            fastcgi_param HTTP_CGI_AUTHORIZATION $http_authorization;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_connect_timeout 60s;
            fastcgi_read_timeout 120s;
            fastcgi_send_timeout 120s;
            include fastcgi_params;
            fastcgi_param REMOTE_ADDR $remote_addr;
            fastcgi_buffering off;
            fastcgi_param HTTP_HOST $host:$server_port;
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
            add_header X-Frame-Options "ALLOW-FROM https://yandex.ru https://*.yandex.ru https://yandex.net https://*.yandex.net";
        }

        # Локация для стилей

        location /styles/ {
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
            add_header X-Frame-Options "SAMEORIGIN";
            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob: https:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';";
            alias "/usr/acp/cgi-bin/admin/";
            index index.cgi;
            fastcgi_index index.cgi;
            fastcgi_param NO_BUFFERING 1;
            fastcgi_pass_header Authorization;
            fastcgi_param HTTP_CGI_AUTHORIZATION $http_authorization;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_connect_timeout 60s;
            fastcgi_read_timeout 120s;
            fastcgi_send_timeout 120s;
            include fastcgi_params;
            fastcgi_buffering off;
        }

        # API обработчик

        location ^~ /api.cgi {
           add_header Last-Modified $date_gmt;
            add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
            if_modified_since off;
            expires off;
            etag off;
            root /usr/acp/cgi-bin/;
        }

        # Локация для изображений калькулятора

        location /img/calculator/ {
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
                       add_header Set-Cookie "Path=/admin; Secure; HttpOnly; SameSite=StrictLax" always;
                       add_header X-Frame-Options "SAMEORIGIN";
                       add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob: https:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';";
            try_files $uri /api.cgi$is_args$args;
            allow all;
            gzip off;
            fastcgi_param HTTPS on;
            fastcgi_pass unix:/var/run/fcgiwrap.socket;
            fastcgi_index index.cgi;
            fastcgi_param NO_BUFFERING 1;
            fastcgi_param HTTP_CGI_AUTHORIZATION $http_authorization;
            fastcgi_param SCRIPT_FILENAME /usr/acp/cgi-bin$fastcgi_script_name;
            fastcgi_connect_timeout 60s;
            fastcgi_read_timeout 120s;
            fastcgi_send_timeout 120s;
            fastcgi_request_buffering off;
            include fastcgi_params;
            fastcgi_param REMOTE_ADDR $remote_addr;
            fastcgi_buffering off;
        }

        # Обработка изображений

        location ^~ /img/ {
            alias /usr/acp/cgi-bin/img/;

            location /img/logo/ {
                allow all;
                add_header Permissions-Policy "geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()";
                try_files $uri =404;
            }

            location = /img/error.jpg {
                allow all;
                try_files /error.jpg =404;
            }

            location ~* \.(ico|jpg|jpeg|gif|png|webp|css|js|JPG|GIF|PNG)$ {
                allow all;
            }
            deny all;
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
            add_header X-Frame-Options "SAMEORIGIN";
            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob: https:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';";
        }

        # Специальные CGI-скрипты

        location /usr/acp/cgi-bin/(auth|packet|delete_subscription) {
           root /usr/acp/cgi-bin/;
        }

        # Админские CGI — отдельный FastCGI-пул (ВАЖНО: regex-location имеет
        # приоритет над prefix-location /admin/, поэтому этот блок должен идти
        # ВЫШЕ общего location ~* \.cgi|pm$)

        location ~* ^/admin/.*\.cgi$ {
            fastcgi_pass unix:/run/acp-fcgi-admin/index.sock;
            fastcgi_param NO_BUFFERING 1;
            fastcgi_index index.cgi;
            fastcgi_pass_header Authorization;
            fastcgi_param HTTP_CGI_AUTHORIZATION $http_authorization;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_connect_timeout 60s;
            fastcgi_read_timeout 120s;
            fastcgi_send_timeout 120s;
            include fastcgi_params;
            fastcgi_param REMOTE_ADDR $remote_addr;
            fastcgi_buffering off;
            fastcgi_param HTTP_HOST $host:$server_port;
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
            add_header X-Frame-Options "SAMEORIGIN";
        }

        # Административная панель

        location /admin/ {
            # Защита от сканеров уязвимостей и вредоносных ботов
            if ($http_user_agent ~* (nikto|wpscan|sqlmap|dirbuster|acunetix|nessus|metasploit|burpsuite|owasp|zap|nmap|openvas|arachni|w3af|skipfish|netsparker|appscan|havij|hydra|medusa|patator|john|aircrack|sqlsus|sqlninja|darkmysql|absinthe|bbqsql|firesheep|wce|ratproxy|beef|bettercap|yersinia|dsniff|ettercap|kismet|reaver|wash|mdk3|wifite|fern|airgeddon|hak5|pwn|exploit|rce|lfi|xxe|xsrf|xss|brute|force|browserling|browsershots|shodan|censys|zoomeye|masscan|gobuster|ffuf|dirb|dirsearch|wfuzz|amass|sublist3r|knockpy|theharvester|altdns|dnsrecon|dnsenum|fierce|sn1per|recon-ng|maltego|spiderfoot|osmedeus|xsstrike|xsser|weevely|webshell|shellshock|struts|joomscan|drupwn|drupalgeddon|wpseku|wprecon|joomlavs|magescan|sentrymb|umbraco|yaws)) {
                access_log /var/log/KTK-39/blocked_scanners.log;
                return 403;
            }
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header X-Frame-Options "SAMEORIGIN";
            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob: https:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';";
            alias "/usr/acp/cgi-bin/admin/";
            index index.cgi;
        }

        # API обработчик

        location ^~ /api.cgi {
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header Set-Cookie "Path=/admin; Secure; HttpOnly; SameSite=Strict" always;
            add_header X-Frame-Options "SAMEORIGIN";
            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob: https:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';";
            try_files $uri /api.cgi$is_args$args;
            allow all;
            gzip off;
            fastcgi_param HTTPS on;
            fastcgi_pass unix:/var/run/fcgiwrap.socket;
            fastcgi_index index.cgi;
            fastcgi_param NO_BUFFERING 1;
            fastcgi_param HTTP_CGI_AUTHORIZATION $http_authorization;
            fastcgi_param SCRIPT_FILENAME /usr/acp/cgi-bin$fastcgi_script_name;
            fastcgi_connect_timeout 60s;
            fastcgi_read_timeout 120s;
            fastcgi_send_timeout 120s;
            fastcgi_request_buffering off;
            include fastcgi_params;
            fastcgi_param REMOTE_ADDR $remote_addr;
            fastcgi_buffering off;
        }

        # Обработка изображений

        location ^~ /img/ {
            alias /usr/acp/cgi-bin/img/;

            location /img/logo/ {
                allow all;
                add_header Permissions-Policy "geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()";
                try_files $uri =404;
            }

            location = /img/error.jpg {
                allow all;
                try_files /error.jpg =404;
            }

            location ~* \.(ico|jpg|jpeg|gif|png|webp|css|js|JPG|GIF|PNG)$ {
                allow all;
            }
            deny all;
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
            add_header X-Frame-Options "SAMEORIGIN";
            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob: https:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';";
        }

        # Специальные CGI-скрипты

        location /usr/acp/cgi-bin/(auth|packet|delete_subscription) {
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
            add_header X-Frame-Options "SAMEORIGIN";
            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob: https:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';";
            rewrite /get_pl.cgi?$args last;
        }

        # Обработка изображений из ACP templates

        location ^~ /images/ {
            alias /usr/acp/ACP/templates/;

            location ~* \.(jpg|gif|png|css|js|JPG|GIF)$ {
                allow all;
            }
            deny all;
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
                       add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;
                       add_header X-Frame-Options "SAMEORIGIN";
                       add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' data: blob: https:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';";
        }
    }

     ERROR: rmNo -f /etc/freeradius/3.0/mods-enabled/sql
    cp -p /etc/freeradius/3.0/mods-available/sql /etc/freeradius/3.0/mods-enabled/sql

Auth-Type found: rejecting the user via Post-Auth-Type = Reject

    # АСР Казна-39 Freeradius Config #SERVICE_L4R User-Password == "cisco", Auth-Type = Accept
    perl {
            filename = /usr/acp/libexec/rlm_perl.pl
    } 

rm -f /etc/freeradius/3.0/sites-enabled/default

    rmfreeradius -f /etc/freeradius/3.0/sites-enabled/ktk-39XC
    systemctl enable freeradius
    cpsystemctl -prestart /etc/freeradius/3.0/sites-available/ktk-39 /etc/freeradius/3.0/sites-enabled/ktk-39

freeradius

    rmjournalctl -fu /etc/freeradius/3.0/sites-enabled/inner-tunnel

freeradius -n 50 --no-pager | grep 'to global clients list'

+x /etc/cron.daily/acp_kazna_39_periodic_cleanup

    mysql --force --default-character-set=utf8 -u acp -p'ВАШ_ПАРОЛЬ_БД' -h localhost acp < /usr/acp/db/demo_data.sql

    systemctl status nginx fcgiwrap.socket acp-fcgi-index acp-fcgi-admin mariadb billd freeradius
    curl -sk -o /dev/null -w '%{http_code}\n' https://stat.example.ru/

    freeradius -XC
    journalctl -u freeradius -n 30 --no-pager

cd /opt/
wget https://git.it39.su/releases/installer/-/raw/main/install.sh
chmod +x install.sh
./installsh

    cd /usr/acp/misc
    ./move_install.sh