diff options
| author | Silvino Silva <silvino@bk.ru> | 2020-04-20 01:03:12 +0100 |
|---|---|---|
| committer | Silvino Silva <silvino@bk.ru> | 2020-04-20 01:03:12 +0100 |
| commit | 6ca80c0a296cb44bc2b335211df86e8a95383cdf (patch) | |
| tree | 809ca0fc2eee0353d7040539310605d0e113b3d7 /core/conf | |
| parent | fd186246f96768b8398f0ffe32ef136cb895fa21 (diff) | |
| parent | 5eec098c537ed98f76af59c37a54cb45645cc2a6 (diff) | |
| download | doc-6ca80c0a296cb44bc2b335211df86e8a95383cdf.tar.gz | |
Merge branch 'master' into develop
Diffstat (limited to 'core/conf')
34 files changed, 693 insertions, 1061 deletions
diff --git a/core/conf/dracut.conf b/core/conf/dracut.conf new file mode 100644 index 0000000..eda69fd --- /dev/null +++ b/core/conf/dracut.conf @@ -0,0 +1,19 @@ +# PUT YOUR CONFIG IN separate files +# in /etc/dracut.conf.d named "<name>.conf" + +# Equivalent to -H +hostonly="no" + +# Mount / and /usr read-only by default. +ro_mnt="yes" + +# Equivalent to -m "module module module" +dracutmodules+="dash kernel-modules rootfs-block udev-rules usrmount base fs-lib shutdown" + +# Equivalent to -a "module" +add_dracutmodules+="caps debug crypt lvm" + +# Equivalent to -o "module" +omit_dracutmodules+="systemd systemd-bootchart systemd-networkd systemd-initrd" + +# SEE man dracut.conf(5) for options diff --git a/core/conf/fstab b/core/conf/fstab index 99fead9..23dd98c 100644 --- a/core/conf/fstab +++ b/core/conf/fstab @@ -25,6 +25,7 @@ none /sys/kernel/security securityfs defau devpts /dev/pts devpts noexec,nosuid,gid=tty,mode=0620 0 0 shm /dev/shm tmpfs defaults 0 0 tmp /tmp tmpfs defaults,noatime,nosuid,nodev,noexec,size=128M 0 0 + UUID=3b408790-65e1-4638-9591-7ba61f266913 /boot ext4 defaults,ro,noatime 0 2 UUID=962D-0DE1 /boot/efi vfat ro,noauto,umask=0077 0 2 UUID=f2336a56-fbe6-444c-bdbf-f0e6c209c237 /var ext4 defaults,nodev,noexec,nosuid,errors=remount-ro 0 2 diff --git a/core/conf/iptables/blockedip b/core/conf/iptables/blockedip new file mode 100644 index 0000000..714403a --- /dev/null +++ b/core/conf/iptables/blockedip @@ -0,0 +1,182 @@ +52.0.0.0/8 +54.0.0.0/8 +13.48.203.206 +2.21.169.41 +13.115.174.176 +18.182.0.0/16 +23.10.69.56 +104.89.189.238 +195.8.22.40 +195.8.22.41 +2.16.65.168 +2.16.65.152 +88.221.64.239 +195.8.22.138 +195.8.22.152 +23.10.74.160 +195.8.15.224 +195.8.15.209 +23.10.76.42 +88.221.65.114 +195.8.22.40 +195.8.22.48 +2.16.65.147 +2.16.65.171 +88.221.65.13 +195.8.22.64 +195.8.22.40 +195.8.22.152 +195.8.22.138 +23.37.165.98 +23.39.84.7 +23.37.165.98 +195.8.15.224 +195.8.15.209 +2.16.65.152 +2.16.65.168 +13.225.241.27 +13.225.241.212 +13.225.241.199 +13.225.241.79 +18.197.26.211 +3.120.59.84 +18.197.83.103 +3.120.65.125 +3.120.50.86 +18.197.76.109 +3.120.165.77 +18.197.222.92 +35.156.254.127 +35.157.9.106 +35.156.192.89 +35.158.207.255 +3.124.153.99 +3.123.92.221 +35.156.224.167 +35.157.45.201 +54.93.153.201 +35.156.103.70 +18.196.78.8 +35.157.20.203 +18.195.110.84 +18.195.82.208 +18.194.31.225 +52.58.105.233 +3.120.241.69 +52.28.195.9 +13.225.241.212 +13.225.241.79 +13.225.241.27 +13.225.241.199 +13.225.241.79 +13.225.241.199 +13.225.241.212 +13.225.241.79 +13.225.241.199 +13.225.241.79 +13.225.241.27 +13.225.241.199 +13.225.241.79 +13.225.241.199 +13.225.241.27 +13.225.241.212 +18.194.111.172 +18.195.232.16 +18.195.34.196 +18.185.187.153 +18.184.201.126 +18.194.82.205 +18.185.150.188 +18.185.156.16 +13.225.13.61 +72.21.195.65 +13.225.13.61 +52.46.145.112 +52.46.141.49 +54.239.26.255 +54.71.96.255 +34.214.185.21 +52.32.14.1 +35.166.250.92 +54.200.12.154 +52.37.114.192 +13.225.245.72 +13.225.245.65 +13.225.245.18 +13.225.245.33 +35.160.240.60 +52.10.136.27 +54.71.96.255 +54.200.12.154 +52.32.14.1 +34.214.185.21 +35.166.250.92 +35.160.240.60 +13.225.245.65 +13.225.245.33 +13.225.245.72 +13.225.245.18 +18.197.26.211 +3.120.59.84 +18.197.83.103 +3.120.65.125 +3.120.50.86 +18.197.76.109 +3.120.165.77 +18.197.222.92 +35.156.254.127 +35.157.9.106 +35.156.192.89 +35.158.207.255 +3.124.153.99 +3.123.92.221 +35.156.224.167 +35.157.45.201 +54.93.153.201 +35.156.103.70 +18.196.78.8 +35.157.20.203 +18.195.110.84 +18.195.82.208 +18.194.31.225 +52.58.105.233 +3.120.241.69 +52.28.195.9 +13.225.245.65 +13.225.245.33 +13.225.245.72 +13.225.245.18 +54.200.12.154 +52.32.14.1 +34.214.185.21 +35.166.250.92 +54.71.96.255 +54.148.24.227 +52.41.41.102 +13.225.245.18 +13.225.245.65 +13.225.245.72 +13.225.245.33 +13.225.245.18 +13.225.245.33 +13.225.245.72 +13.225.245.65 +54.200.12.154 +34.214.185.21 +52.32.14.1 +54.148.24.227 +54.71.96.255 +35.166.250.92 +35.166.120.35 +13.225.245.18 +13.225.245.72 +13.225.245.65 +13.225.245.33 +18.194.111.172 +18.195.232.16 +18.195.34.196 +18.185.187.153 +18.184.201.126 +18.194.82.205 +18.185.150.188 +18.185.156.16 diff --git a/core/conf/iptables/bridge.v4 b/core/conf/iptables/bridge.v4 deleted file mode 100644 index bea9be0..0000000 --- a/core/conf/iptables/bridge.v4 +++ /dev/null @@ -1,224 +0,0 @@ -# Generated by iptables-save v1.8.2 on Sun Jul 7 23:48:36 2019 -*security -:INPUT ACCEPT [0:0] -:FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [0:0] -COMMIT -# Completed on Sun Jul 7 23:48:36 2019 -# Generated by iptables-save v1.8.2 on Sun Jul 7 23:48:36 2019 -*raw -:PREROUTING ACCEPT [0:0] -:OUTPUT ACCEPT [1:2468] -COMMIT -# Completed on Sun Jul 7 23:48:36 2019 -# Generated by iptables-save v1.8.2 on Sun Jul 7 23:48:36 2019 -*nat -:PREROUTING ACCEPT [0:0] -:INPUT ACCEPT [0:0] -:OUTPUT ACCEPT [0:0] -:POSTROUTING ACCEPT [0:0] -COMMIT -# Completed on Sun Jul 7 23:48:36 2019 -# Generated by iptables-save v1.8.2 on Sun Jul 7 23:48:36 2019 -*mangle -:PREROUTING ACCEPT [0:0] -:INPUT ACCEPT [0:0] -:FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [1:2468] -:POSTROUTING ACCEPT [0:0] -COMMIT -# Completed on Sun Jul 7 23:48:36 2019 -# Generated by iptables-save v1.8.2 on Sun Jul 7 23:48:36 2019 -*filter -:INPUT DROP [0:0] -:FORWARD DROP [0:0] -:OUTPUT DROP [0:0] -:blocker - [0:0] -:cli_dns_in - [0:0] -:cli_dns_out - [0:0] -:cli_ftp_in - [0:0] -:cli_ftp_out - [0:0] -:cli_git_in - [0:0] -:cli_git_out - [0:0] -:cli_gpg_in - [0:0] -:cli_gpg_out - [0:0] -:cli_http_in - [0:0] -:cli_http_out - [0:0] -:cli_https_in - [0:0] -:cli_https_out - [0:0] -:cli_irc_in - [0:0] -:cli_irc_out - [0:0] -:cli_pops_in - [0:0] -:cli_pops_out - [0:0] -:cli_smtps_in - [0:0] -:cli_smtps_out - [0:0] -:cli_ssh_in - [0:0] -:cli_ssh_out - [0:0] -:srv_db_in - [0:0] -:srv_db_out - [0:0] -:srv_dhcp - [0:0] -:srv_dns_in - [0:0] -:srv_dns_out - [0:0] -:srv_git_in - [0:0] -:srv_git_out - [0:0] -:srv_http_in - [0:0] -:srv_http_out - [0:0] -:srv_https_in - [0:0] -:srv_https_out - [0:0] -:srv_icmp - [0:0] -:srv_rip - [0:0] -:srv_ssh_in - [0:0] -:srv_ssh_out - [0:0] --A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT --A INPUT -s 10.0.0.254/32 -d 10.0.0.254/32 -i lo -j ACCEPT --A INPUT -j blocker --A INPUT -d 10.0.0.254/32 -i br0 -p tcp -m tcp --sport 3030 --dport 1024:65535 -j DROP --A INPUT -i br0 -j srv_dhcp --A INPUT -s 10.0.0.0/8 -d 10.0.0.254/32 -i br0 -j srv_dns_in --A INPUT -s 10.0.0.0/8 -d 10.0.0.254/32 -i br0 -j srv_icmp --A INPUT -s 10.0.0.0/8 -d 10.0.0.254/32 -i br0 -j srv_ssh_in --A INPUT -s 212.55.154.174/32 -d 10.0.0.254/32 -i br0 -j cli_dns_in --A INPUT -d 10.0.0.254/32 -i br0 -j cli_https_in --A INPUT -d 10.0.0.254/32 -i br0 -j cli_git_in --A INPUT -d 10.0.0.254/32 -i br0 -j cli_ssh_in --A INPUT -j LOG --log-prefix "iptables: INPUT: " --log-level 7 --A FORWARD -s 10.0.0.0/8 -d 10.0.0.0/8 -i br0 -o br0 -j ACCEPT --A FORWARD -s 0.0.0.0/32 -d 255.255.255.255/32 -i br0 -o br0 -j srv_dhcp --A FORWARD -s 10.0.0.0/8 -i br0 -o br0 -j ACCEPT --A FORWARD -s 212.55.154.174/32 -d 10.0.0.254/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j cli_dns_in --A FORWARD -d 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j srv_http_in --A FORWARD -d 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j srv_https_in --A FORWARD -d 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j srv_ssh_in --A FORWARD -d 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j srv_git_in --A FORWARD -i br0 -o br0 -p tcp -m physdev --physdev-in enp8s0 -m tcp --sport 443 --dport 1024:65535 -j ACCEPT --A FORWARD -d 10.0.0.3/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j cli_http_in --A FORWARD -d 10.0.0.4/32 -i br0 -o br0 -m physdev --physdev-in enp8s0 -j cli_http_in --A FORWARD -i br0 -o br0 -p udp -m udp --sport 520 --dport 519 -j DROP --A FORWARD -i br0 -o br0 -p udp -m udp --sport 520 --dport 520 -j DROP --A FORWARD -j LOG --log-prefix "iptables: FORWARD: " --log-level 7 --A OUTPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -o lo -j ACCEPT --A OUTPUT -s 10.0.0.254/32 -d 10.0.0.254/32 -o lo -j ACCEPT --A OUTPUT -s 10.0.0.254/32 -o br0 -p tcp -m tcp --sport 1024:65535 --dport 3030 -j DROP --A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j srv_dhcp --A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j srv_dns_out --A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j srv_ssh_out --A OUTPUT -s 10.0.0.254/32 -o br0 -j srv_git_out --A OUTPUT -o br0 -j srv_icmp --A OUTPUT -s 10.0.0.254/32 -d 212.55.154.174/32 -o br0 -j cli_dns_out --A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j cli_ssh_out --A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j cli_git_out --A OUTPUT -s 10.0.0.254/32 -d 10.0.0.0/8 -o br0 -j cli_http_out --A OUTPUT -s 10.0.0.254/32 -o br0 -j cli_https_out --A OUTPUT -s 10.0.0.254/32 -o br0 -j cli_git_out --A OUTPUT -s 10.0.0.254/32 -o br0 -j cli_http_out --A OUTPUT -j LOG --log-prefix "iptables: OUTPUT: " --log-level 7 --A blocker -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop sync: " --log-level 7 --A blocker -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP --A blocker -f -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop frag: " --A blocker -f -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop null: " --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP --A blocker -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop syn rst syn rs" --A blocker -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop xmas: " --A blocker -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop fin scan: " --A blocker -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP --A blocker -j RETURN --A cli_dns_in -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT --A cli_dns_in -j RETURN --A cli_dns_out -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT --A cli_dns_out -j RETURN --A cli_ftp_in -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_ftp_in -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A cli_ftp_in -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_ftp_in -j RETURN --A cli_ftp_out -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_ftp_out -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT --A cli_ftp_out -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A cli_ftp_out -j RETURN --A cli_git_in -p tcp -m tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_git_in -j RETURN --A cli_git_out -p tcp -m tcp --sport 1024:65535 --dport 9418 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_git_out -j RETURN --A cli_gpg_in -p tcp -m tcp --sport 11371 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_gpg_in -j RETURN --A cli_gpg_out -p tcp -m tcp --sport 1024:65535 --dport 11371 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_gpg_out -j RETURN --A cli_http_in -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_http_in -p udp -m udp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_http_in -j RETURN --A cli_http_out -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_http_out -p udp -m udp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_http_out -j RETURN --A cli_https_in -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_https_in -p udp -m udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_https_in -j RETURN --A cli_https_out -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_https_out -p udp -m udp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_https_out -j RETURN --A cli_irc_in -p tcp -m tcp --sport 6667 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_irc_in -j RETURN --A cli_irc_out -p tcp -m tcp --sport 1024:65535 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_irc_out -j RETURN --A cli_pops_in -p tcp -m tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_pops_in -j RETURN --A cli_pops_out -p tcp -m tcp --sport 1024:65535 --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_pops_out -j RETURN --A cli_smtps_in -p tcp -m tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_smtps_in -j RETURN --A cli_smtps_out -p tcp -m tcp --sport 1024:65535 --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_smtps_out -j RETURN --A cli_ssh_in -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_ssh_in -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_ssh_in -j RETURN --A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_ssh_out -j RETURN --A srv_db_in -p tcp -m tcp --sport 1024:65535 --dport 5432 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_db_in -j RETURN --A srv_db_out -p tcp -m tcp --sport 5432 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_db_out -j RETURN --A srv_dhcp -p udp -m udp --sport 68 --dport 67 -j ACCEPT --A srv_dhcp -p udp -m udp --sport 67 --dport 68 -j ACCEPT --A srv_dhcp -p udp -m udp --sport 67 --dport 67 -j ACCEPT --A srv_dhcp -j RETURN --A srv_dns_in -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_dns_in -p tcp -m tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_dns_in -j RETURN --A srv_dns_out -p udp -m udp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_dns_out -p tcp -m tcp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_dns_out -j RETURN --A srv_git_in -p tcp -m tcp --sport 1024:65535 --dport 9418 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_git_in -j RETURN --A srv_git_out -p tcp -m tcp --sport 9418 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_git_out -j RETURN --A srv_http_in -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_http_in -j RETURN --A srv_http_out -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_http_out -j RETURN --A srv_https_in -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_https_in -j RETURN --A srv_https_out -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_https_out -j RETURN --A srv_icmp -p icmp -j ACCEPT --A srv_icmp -j RETURN --A srv_rip -p udp -m udp --sport 520 --dport 520 -j ACCEPT --A srv_rip -j RETURN --A srv_ssh_in -p tcp -m tcp --dport 2222 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" --A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP --A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP --A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_in -j RETURN --A srv_ssh_out -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_out -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_out -j RETURN -COMMIT -# Completed on Sun Jul 7 23:48:36 2019 diff --git a/core/conf/iptables/client.v4 b/core/conf/iptables/client.v4 deleted file mode 100644 index 91b564d..0000000 --- a/core/conf/iptables/client.v4 +++ /dev/null @@ -1,211 +0,0 @@ -# Generated by iptables-save v1.8.3 on Thu Jun 20 20:34:21 2019 -*security -:INPUT ACCEPT [0:0] -:FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [0:0] -COMMIT -# Completed on Thu Jun 20 20:34:21 2019 -# Generated by iptables-save v1.8.3 on Thu Jun 20 20:34:21 2019 -*raw -:PREROUTING ACCEPT [0:0] -:OUTPUT ACCEPT [0:0] -COMMIT -# Completed on Thu Jun 20 20:34:21 2019 -# Generated by iptables-save v1.8.3 on Thu Jun 20 20:34:21 2019 -*nat -:PREROUTING ACCEPT [0:0] -:INPUT ACCEPT [0:0] -:OUTPUT ACCEPT [0:0] -:POSTROUTING ACCEPT [0:0] -COMMIT -# Completed on Thu Jun 20 20:34:21 2019 -# Generated by iptables-save v1.8.3 on Thu Jun 20 20:34:21 2019 -*mangle -:PREROUTING ACCEPT [0:0] -:INPUT ACCEPT [0:0] -:FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [0:0] -:POSTROUTING ACCEPT [0:0] -COMMIT -# Completed on Thu Jun 20 20:34:21 2019 -# Generated by iptables-save v1.8.3 on Thu Jun 20 20:34:21 2019 -*filter -:INPUT DROP [0:0] -:FORWARD DROP [0:0] -:OUTPUT DROP [0:0] -:blocker - [0:0] -:cli_dns_in - [0:0] -:cli_dns_out - [0:0] -:cli_ftp_in - [0:0] -:cli_ftp_out - [0:0] -:cli_git_in - [0:0] -:cli_git_out - [0:0] -:cli_gpg_in - [0:0] -:cli_gpg_out - [0:0] -:cli_http_in - [0:0] -:cli_http_out - [0:0] -:cli_https_in - [0:0] -:cli_https_out - [0:0] -:cli_irc_in - [0:0] -:cli_irc_out - [0:0] -:cli_pops_in - [0:0] -:cli_pops_out - [0:0] -:cli_smtps_in - [0:0] -:cli_smtps_out - [0:0] -:cli_ssh_in - [0:0] -:cli_ssh_out - [0:0] -:srv_db_in - [0:0] -:srv_db_out - [0:0] -:srv_dhcp - [0:0] -:srv_dns_in - [0:0] -:srv_dns_out - [0:0] -:srv_git_in - [0:0] -:srv_git_out - [0:0] -:srv_http_in - [0:0] -:srv_http_out - [0:0] -:srv_https_in - [0:0] -:srv_https_out - [0:0] -:srv_icmp - [0:0] -:srv_rip - [0:0] -:srv_ssh_in - [0:0] -:srv_ssh_out - [0:0] --A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT --A INPUT -j blocker --A INPUT -i wlp9s0 -j cli_dns_in --A INPUT -i wlp9s0 -j cli_http_in --A INPUT -i wlp9s0 -j cli_https_in --A INPUT -i wlp9s0 -j cli_git_in --A INPUT -i wlp9s0 -j cli_ssh_in --A INPUT -i wlp9s0 -j srv_icmp --A INPUT -i wlp9s0 -j cli_pops_in --A INPUT -i wlp9s0 -j cli_smtps_in --A INPUT -i wlp9s0 -j cli_irc_in --A INPUT -i wlp9s0 -j cli_ftp_in --A INPUT -i wlp9s0 -j cli_gpg_in --A INPUT -j LOG --log-prefix "iptables: INPUT: " --log-level 7 --A FORWARD -j LOG --log-prefix "iptables: FORWARD: " --log-level 7 --A OUTPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -o lo -j ACCEPT --A OUTPUT -j blocker --A OUTPUT -o wlp9s0 -j cli_dns_out --A OUTPUT -o wlp9s0 -j cli_https_out --A OUTPUT -o wlp9s0 -j cli_ssh_out --A OUTPUT -o wlp9s0 -j cli_git_out --A OUTPUT -o wlp9s0 -j cli_git_out --A OUTPUT -o wlp9s0 -j srv_icmp --A OUTPUT -o wlp9s0 -j cli_pops_out --A OUTPUT -o wlp9s0 -j cli_smtps_out --A OUTPUT -o wlp9s0 -j cli_irc_out --A OUTPUT -o wlp9s0 -j cli_ftp_out --A OUTPUT -o wlp9s0 -j cli_gpg_out --A OUTPUT -o wlp9s0 -p udp -m udp --sport 1024:65511 --dport 1024:65535 -j ACCEPT --A OUTPUT -j LOG --log-prefix "iptables: OUTPUT: " --log-level 7 --A blocker -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop sync: " --log-level 7 --A blocker -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP --A blocker -f -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop frag: " --A blocker -f -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop null: " --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP --A blocker -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop syn rst syn rs" --A blocker -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop xmas: " --A blocker -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop fin scan: " --A blocker -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP --A blocker -j RETURN --A cli_dns_in -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT --A cli_dns_in -j RETURN --A cli_dns_out -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT --A cli_dns_out -j RETURN --A cli_ftp_in -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_ftp_in -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A cli_ftp_in -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_ftp_in -j RETURN --A cli_ftp_out -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_ftp_out -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT --A cli_ftp_out -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A cli_ftp_out -j RETURN --A cli_git_in -p tcp -m tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_git_in -j RETURN --A cli_git_out -p tcp -m tcp --sport 1024:65535 --dport 9418 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_git_out -j RETURN --A cli_gpg_in -p tcp -m tcp --sport 11371 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_gpg_in -j RETURN --A cli_gpg_out -p tcp -m tcp --sport 1024:65535 --dport 11371 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_gpg_out -j RETURN --A cli_http_in -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_http_in -p udp -m udp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_http_in -j RETURN --A cli_http_out -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_http_out -p udp -m udp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_http_out -j RETURN --A cli_https_in -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_https_in -p udp -m udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_https_in -j RETURN --A cli_https_out -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_https_out -p udp -m udp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_https_out -j RETURN --A cli_irc_in -p tcp -m tcp --sport 6667 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_irc_in -j RETURN --A cli_irc_out -p tcp -m tcp --sport 1024:65535 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_irc_out -j RETURN --A cli_pops_in -p tcp -m tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_pops_in -j RETURN --A cli_pops_out -p tcp -m tcp --sport 1024:65535 --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_pops_out -j RETURN --A cli_smtps_in -p tcp -m tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_smtps_in -j RETURN --A cli_smtps_out -p tcp -m tcp --sport 1024:65535 --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_smtps_out -j RETURN --A cli_ssh_in -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_ssh_in -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_ssh_in -j RETURN --A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_ssh_out -j RETURN --A srv_db_in -p tcp -m tcp --sport 1024:65535 --dport 5432 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_db_in -j RETURN --A srv_db_out -p tcp -m tcp --sport 5432 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_db_out -j RETURN --A srv_dhcp -p udp -m udp --sport 68 --dport 67 -j ACCEPT --A srv_dhcp -p udp -m udp --sport 67 --dport 68 -j ACCEPT --A srv_dhcp -p udp -m udp --sport 67 --dport 67 -j ACCEPT --A srv_dhcp -j RETURN --A srv_dns_in -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_dns_in -p tcp -m tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_dns_in -j RETURN --A srv_dns_out -p udp -m udp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_dns_out -p tcp -m tcp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_dns_out -j RETURN --A srv_git_in -p tcp -m tcp --sport 1024:65535 --dport 9418 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_git_in -j RETURN --A srv_git_out -p tcp -m tcp --sport 9418 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_git_out -j RETURN --A srv_http_in -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_http_in -j RETURN --A srv_http_out -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_http_out -j RETURN --A srv_https_in -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_https_in -j RETURN --A srv_https_out -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_https_out -j RETURN --A srv_icmp -p icmp -j ACCEPT --A srv_icmp -j RETURN --A srv_rip -p udp -m udp --sport 520 --dport 520 -j ACCEPT --A srv_rip -j RETURN --A srv_ssh_in -p tcp -m tcp --dport 2222 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" --A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP --A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP --A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_in -j RETURN --A srv_ssh_out -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_out -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_out -j RETURN -COMMIT -# Completed on Thu Jun 20 20:34:21 2019 diff --git a/core/conf/iptables/ipt-bridge.sh b/core/conf/iptables/ipt-bridge.sh index 67b5053..b0f7daa 100644 --- a/core/conf/iptables/ipt-bridge.sh +++ b/core/conf/iptables/ipt-bridge.sh @@ -1,142 +1,92 @@ #!/bin/bash -echo "setting bridge network..." -source ipt-conf.sh -source ipt-firewall.sh -ipt_clear -ipt_tables # Unlimited on loopback -$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT $IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT $IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT -######## NAT Prerouting Chain ###### -#$IPT -t nat -A PREROUTING -i ${WIFI_IF} -p udp --dport 53 --sport 1024:65535 -j DNAT --to 10.0.0.254:53 -##$IPT -t nat -A PREROUTING -i ${WIFI_IF} -p tcp --dport 53 --sport 1024:65535 -j DNAT --to 10.0.0.254:53 -#$IPT -t nat -A PREROUTING -i ${WIFI_IF} -p tcp --dport 443 --sport 1024:65535 -j DNAT --to 10.0.0.4:443 -##$IPT -t nat -A PREROUTING -j LOG --log-level 7 --log-prefix "iptables: PREROUTING: " +######################################################################### +# FORWARD +######################################################################### -######## Forward Chain ###### -#$IPT -A FORWARD -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -#$IPT -A FORWARD -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -# -## Allow all for BR_NET +$IPT -A FORWARD -j blocker +$IPT -A FORWARD -j blockip_in +$IPT -A FORWARD -j blockip_out $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${BR_NET} -d ${BR_NET} -j ACCEPT - -## DHCP +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -p udp --dport 520 --sport 520 -j DROP $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 0.0.0.0 -d 255.255.255.255 -j srv_dhcp - -## Allow access from bridge to gateway wifi interface -#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j cli_http_in -#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j cli_http_out -#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j cli_https_in -#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j cli_https_out -#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j cli_ftp_in -#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j cli_ftp_out - -##$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j srv_dns_in -##$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j srv_dns_out -#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j srv_https_in -#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j srv_https_out - -## allow output from BR_NET to external -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${BR_NET} -j ACCEPT - -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${DNS} -d ${PUB_IP} -j cli_dns_in -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_http_in -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_https_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 212.55.154.174 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 204.140.20.21 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 50.23.197.95 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 50.23.197.94 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 212.55.154.174 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 204.140.20.21 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s 10.0.0.4 -d 50.23.197.94 -j ACCEPT + +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 212.55.154.174 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 204.140.20.21 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 50.23.197.95 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 50.23.197.94 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 212.55.154.174 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 204.140.20.21 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d 10.0.0.4 -s 50.23.197.94 -j ACCEPT + + +$IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-in tap1 --physdev-out ${PUB_IF} -s 10.0.0.3 -j cli_https_out +$IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-in tap1 --physdev-out ${PUB_IF} -s 10.0.0.3 -j cli_http_out +$IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-out tap1 --physdev-in ${PUB_IF} -d 10.0.0.3 -j cli_https_in +$IPT -A FORWARD -i ${BR_IF} -m physdev --physdev-out tap1 --physdev-in ${PUB_IF} -d 10.0.0.3 -j cli_http_in +#####Server $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_ssh_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_ssh_out $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_git_in -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_ntp -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_git_out +#$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_ntp -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.3 -j cli_http_in -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.3 -p tcp --dport 1024:65535 --sport 1024:65535 -j ACCEPT $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j cli_http_in -##Less noise -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -p udp --dport 519 --sport 520 -j DROP -$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -p udp --dport 520 --sport 520 -j DROP +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j cli_http_out +#####HTTP Server +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_http_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_http_out +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_https_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 -s 10.0.0.4 -j srv_https_out -######## Input Chain ###### +######################################################################### +# INPUT +######################################################################### $IPT -A INPUT -j blocker - -##Less noise -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -p tcp --sport 3030 --dport 1024:65535 -j DROP -#$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -p udp --sport 137 --dport 137 -j ACCEPT -#$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -p udp --sport 137 --dport 137 -j ACCEPT -#$IPT -A INPUT -i ${BR_IF} -s ${BR_NET} -d 10.255.255.255 -p udp --sport 520 --dport 520 -j ACCEPT -#$IPT -A INPUT -i ${WIFI_IF} -p udp --sport 137 --dport 137 -j ACCEPT -#$IPT -A INPUT -i ${WIFI_IF} -p udp --sport 138 --dport 138 -j ACCEPT - -$IPT -A INPUT -i ${BR_IF} -j srv_dhcp -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_dns_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_icmp -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in +$IPT -A INPUT -j blockip_in +$IPT -A INPUT -i ${BR_IF} -p udp --dport 520 --sport 520 -j DROP +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -p tcp --sport 3030 -j DROP $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${DNS} -j cli_dns_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_https_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_git_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_ssh_in -$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j srv_ntp - -#$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${WIFI_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_icmp -#$IPT -A INPUT -i ${WIFI_IF} -d ${PUB_IP} -s ${WIFI_NET} -j srv_dns_in -#$IPT -A INPUT -i ${BR_IF} -s ${GW} -d ${PUB_IP} -j srv_dhcp -#$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_http_in -#$IPT -A INPUT -i ${WIFI_IF} -s ${DNS} -j cli_dns_in -#$IPT -A INPUT -i ${WIFI_IF} -j cli_https_in -#$IPT -A INPUT -i ${WIFI_IF} -j cli_http_in -#$IPT -A INPUT -i ${WIFI_IF} -j cli_git_in -#$IPT -A INPUT -i ${WIFI_IF} -j cli_ssh_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in tap2 -s ${BR_NET} -d ${PUB_IP} -j cli_http_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -j cli_http_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -j cli_https_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in tap2 -j cli_https_in +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_ssh_in +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s 10.0.0.4 -j cli_git_in +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_dns_in +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -j srv_dhcp +$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${BR_NET} -j srv_dhcp -## PXE server -#$IPT -A INPUT -i ${BR_IF} -p udp -d ${PUB_IP} -s ${BR_NET} --dport 69 --sport 1024:65535 -j ACCEPT -#$IPT -A INPUT -i ${BR_IF} -p udp -d ${PUB_IP} -s ${BR_NET} --dport 1024:65535 --sport 1024:65535 -j ACCEPT +$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in +#$IPT -A INPUT -j LOG -######## Output Chain ###### +$IPT -A OUTPUT -o ${BR_IF} -p udp --dport 520 --sport 520 -j DROP -##Less noise -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 3030 --sport 1024:65535 -j DROP +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 3030 -j DROP +$IPT -A OUTPUT -o blockip_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j srv_dhcp +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${DNS} -j cli_dns_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j srv_dns_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j srv_ssh_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j srv_git_out -$IPT -A OUTPUT -o ${BR_IF} -j srv_icmp -#$IPT -A OUTPUT -o ${PUB_IF} -j srv_icmp - -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${DNS} -j cli_dns_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_ssh_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_git_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_http_out - +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${GW} -j cli_http_out $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_https_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_git_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_http_out -$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j srv_ntp - -#$IPT -A OUTPUT -o ${WIFI_IF} -d ${DNS} -j cli_dns_out -#$IPT -A OUTPUT -o ${WIFI_IF} -d ${WIFI_NET} -j srv_dns_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j srv_dns_out - -#$IPT -A OUTPUT -o ${WIFI_IF} -j cli_ssh_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j cli_git_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j cli_https_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j cli_http_out -#$IPT -A OUTPUT -o ${WIFI_IF} -j srv_icmp - -## PXE Server -#$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -p udp --dport 1024:65535 --sport 1024:65535 -j ACCEPT - -######## PostRouting Chain ###### -##Less noise -##$IPT -t nat -A POSTROUTING -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -##$IPT -t nat -A POSTROUTING -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -##$IPT -t nat -A POSTROUTING -o ${BR_IF} -s ${PUB_IP} -d ${DNS} -p udp --dport 53 --sport 1024:65535 -j ACCEPT -#$IPT -t nat -A POSTROUTING -o ${WIFI_IF} -j MASQUERADE -##$IPT -t nat -A POSTROUTING -j LOG --log-level 7 --log-prefix "iptables: POSTROUTING: " +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_ssh_out +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d 10.0.0.4 -j cli_git_out +$IPT -A OUTPUT -o ${BR_IF} -d ${BR_NET} -j srv_dhcp +$IPT -A OUTPUT -o ${BR_IF} -d ${BR_NET} -j srv_icmp ## log everything else and drop ipt_log diff --git a/core/conf/iptables/ipt-client.sh b/core/conf/iptables/ipt-client.sh index 77de218..f832c51 100644 --- a/core/conf/iptables/ipt-client.sh +++ b/core/conf/iptables/ipt-client.sh @@ -1,14 +1,25 @@ #!/bin/bash -echo "setting client network..." -source ipt-conf.sh -source ipt-firewall.sh -ipt_clear -ipt_tables +echo "setting dhcp network..." + +if [ "${GW}" == "" ]; then + + $IPT -A INPUT -j srv_icmp + $IPT -A OUTPUT -j srv_icmp + $IPT -A INPUT -j srv_dhcp + $IPT -A OUTPUT -j srv_dhcp -# Unlimited on loopback -$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT + echo "no gateway, wating for one..." + + while [ "${GW}" == "" ] + do + #we wait for a connection + sleep 2; + GW=$(ip route | grep "default via" | cut -d " " -f 3) + done +fi + +echo "setting client network..." ####### Input Chain ###### $IPT -A INPUT -j blocker @@ -19,21 +30,13 @@ $IPT -A INPUT -i ${PUB_IF} -j cli_https_in $IPT -A INPUT -i ${PUB_IF} -j cli_git_in $IPT -A INPUT -i ${PUB_IF} -j cli_ssh_in $IPT -A INPUT -i ${PUB_IF} -j srv_icmp -$IPT -A INPUT -i ${PUB_IF} -j srv_ntp $IPT -A INPUT -i ${PUB_IF} -j cli_pops_in $IPT -A INPUT -i ${PUB_IF} -j cli_smtps_in $IPT -A INPUT -i ${PUB_IF} -j cli_irc_in $IPT -A INPUT -i ${PUB_IF} -j cli_ftp_in $IPT -A INPUT -i ${PUB_IF} -j cli_gpg_in -$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j DROP - -$IPT -A INPUT -p tcp --dport 1024:65535 --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT -$IPT -A INPUT -p udp --dport 1024:65535 --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT +$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j ACCEPT -# allow all established and related -$IPT -A INPUT -p tcp --dport 1024:65535 --sport 1:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT -$IPT -A INPUT -p udp --dport 1024:65535 --sport 1:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT -$IPT -A INPUT -p icmp -j ACCEPT ####### Output Chain ###### $IPT -A OUTPUT -j blocker @@ -44,21 +47,12 @@ $IPT -A OUTPUT -o ${PUB_IF} -j cli_ssh_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out $IPT -A OUTPUT -o ${PUB_IF} -j srv_icmp -$IPT -A OUTPUT -o ${PUB_IF} -j srv_ntp $IPT -A OUTPUT -o ${PUB_IF} -j cli_pops_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_smtps_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_irc_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_ftp_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_gpg_out - -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 1024:65535 -j ACCEPT - -# allow all out (make nmap and others happy) -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 1:65535 -j ACCEPT -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1:65535 -j ACCEPT -$IPT -A OUTPUT -p icmp -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:655335 --dport 1024:65535 -j ACCEPT ## log everything else and drop ipt_log -iptables-save > /etc/iptables/client.v4 diff --git a/core/conf/iptables/ipt-conf.sh b/core/conf/iptables/ipt-conf.sh index dcea837..8d57f5f 100644 --- a/core/conf/iptables/ipt-conf.sh +++ b/core/conf/iptables/ipt-conf.sh @@ -1,27 +1,47 @@ #!/bin/bash IPT="/usr/sbin/iptables" +IPT6="/usr/sbin/ip6tables" -SPAMLIST="blockedip" -SPAMDROPMSG="BLOCKED IP DROP" +SPAMLIST="/etc/iptables/blockedip" +SPAMDROPMSG="BLOCKED IP: " + +#TYPE=bridge +#TYPE=server +#TYPE=open +TYPE=client # bridge interface with interface facing gateway -BR_IF="br0" +#BR_IF="br0" + # bridge ip network address BR_NET="10.0.0.0/8" +#BR_NET="192.0.0.0/8" +# static wifi ip network address +#WIFI_NET="10.0.0.0/8" + # network gateway -GW="10.0.0.1" -# external dns -DNS="212.55.154.174" +#GW="10.0.0.1" +GW=$(ip route | grep "default via" | cut -d " " -f 3) -# static machine ip address -PUB_IP="10.0.0.254" +# external dns +#DNS="10.0.0.254" +#DNS=$(grep -m 1 "nameserver " /etc/resolv.conf | cut -d " " -f 2) +DNS=$(grep -m 1 "^server=" /etc/dnsmasq.conf | cut -d "=" -f 2) # public interface facing gateway -PUB_IF="enp8s0" +#PUB_IF="wlp9s0" +PUB_IF="enp7s0" # wifi interface -WIFI_IF="wlp7s0" +#WIFI_IF="wlp7s0" -# static wifi ip network address -WIFI_NET="10.0.0.0/8" +# static machine ip address +#PUB_IP="10.0.0.4" +# deserve much better :( +PUB_IP=$(ifconfig ${PUB_IF} | grep -m 1 "addr:" | cut -d " " -f 12 | cut -d ":" -f 2) + +echo "GW: ${GW}" +echo "DNS: ${DNS}" +echo "PUB_IF: ${PUB_IF}" +echo "PUB_IP: ${PUB_IP}" diff --git a/core/conf/iptables/ipt-firewall.sh b/core/conf/iptables/ipt-firewall.sh index 086b864..a216fe3 100644 --- a/core/conf/iptables/ipt-firewall.sh +++ b/core/conf/iptables/ipt-firewall.sh @@ -1,63 +1,79 @@ #!/bin/bash +. /etc/iptables/ipt-conf.sh + ipt_clear () { echo "clear all iptables tables" - iptables -F - iptables -X - iptables -t nat -F - iptables -t nat -X - iptables -t mangle -F - iptables -t mangle -X - iptables -t raw -F - iptables -t raw -X - iptables -t security -F - iptables -t security -X - iptables -N blocker - - iptables -N srv_dhcp - iptables -N srv_rip - iptables -N srv_icmp - iptables -N srv_ntp - iptables -N srv_dns_in - iptables -N srv_dns_out - iptables -N srv_http_in - iptables -N srv_http_out - iptables -N srv_https_in - iptables -N srv_https_out - iptables -N srv_ssh_in - iptables -N srv_ssh_out - iptables -N srv_git_in - iptables -N srv_git_out - iptables -N srv_db_in - iptables -N srv_db_out - - - iptables -N cli_dns_in - iptables -N cli_dns_out - iptables -N cli_http_in - iptables -N cli_http_out - iptables -N cli_https_in - iptables -N cli_https_out - iptables -N cli_ssh_in - iptables -N cli_ssh_out - iptables -N cli_pops_in - iptables -N cli_pops_out - iptables -N cli_smtps_in - iptables -N cli_smtps_out - iptables -N cli_irc_in - iptables -N cli_irc_out - iptables -N cli_ftp_in - iptables -N cli_ftp_out - iptables -N cli_git_in - iptables -N cli_git_out - iptables -N cli_gpg_in - iptables -N cli_gpg_out + $IPT -F + $IPT -X + $IPT6 -F + $IPT6 -X + #$PIT4 -Z + #$PIT6 -Z + $IPT -t nat -F + $IPT -t nat -X + $IPT -t mangle -F + $IPT -t mangle -X + $IPT -t raw -F + $IPT -t raw -X + $IPT -t security -F + $IPT -t security -X + $IPT -N blocker + $IPT -N blockip_in + $IPT -N blockip_out + + $IPT -N srv_dhcp + $IPT -N srv_rip + $IPT -N srv_icmp + $IPT -N srv_ntp + $IPT -N srv_dns_in + $IPT -N srv_dns_out + $IPT -N srv_http_in + $IPT -N srv_http_out + $IPT -N srv_https_in + $IPT -N srv_https_out + $IPT -N srv_smtp_in + $IPT -N srv_smtp_out + $IPT -N srv_ssh_in + $IPT -N srv_ssh_out + $IPT -N srv_git_in + $IPT -N srv_git_out + $IPT -N srv_db_in + $IPT -N srv_db_out + + + $IPT -N cli_dns_in + $IPT -N cli_dns_out + $IPT -N cli_http_in + $IPT -N cli_http_out + $IPT -N cli_https_in + $IPT -N cli_https_out + $IPT -N cli_ssh_in + $IPT -N cli_ssh_out + $IPT -N cli_pops_in + $IPT -N cli_pops_out + $IPT -N cli_smtps_in + $IPT -N cli_smtps_out + $IPT -N cli_irc_in + $IPT -N cli_irc_out + $IPT -N cli_ftp_in + $IPT -N cli_ftp_out + $IPT -N cli_git_in + $IPT -N cli_git_out + $IPT -N cli_gpg_in + $IPT -N cli_gpg_out + + # Set Default Rules + $IPT -P INPUT DROP + $IPT -P FORWARD DROP + $IPT -P OUTPUT DROP # Set Default Rules - iptables -P INPUT DROP - iptables -P FORWARD DROP - iptables -P OUTPUT DROP + $IPT6 -P INPUT DROP + $IPT6 -P FORWARD DROP + $IPT6 -P OUTPUT DROP + } ipt_log () { @@ -65,11 +81,27 @@ ipt_log () { $IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " $IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " $IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " -} + $IPT6 -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " + $IPT6 -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " + $IPT6 -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " +} ipt_tables () { echo "start adding tables..." + # Filter out comments and blank lines + # store each ip or subnet in $ip + egrep -v "^#|^$" x | while IFS= read -r ip + do + # Append everything to droplist + #echo "adding ${ip} to blockip" + $IPT -A blockip_in -s $ip -j LOG --log-prefix "${SPAMDROPMSG}" + $IPT -A blockip_in -s $ip -j DROP + $IPT -A blockip_out -d $ip -j LOG --log-prefix "${SPAMDROPMSG}" + $IPT -A blockip_out -d $ip -j DROP + done <"${SPAMLIST}" + + echo "blockip_in and blockip_out added" ####### blocker Chain ###### ## Block google dns @@ -103,6 +135,7 @@ ipt_tables () { #$IPT -A blocker -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP #$IPT -A blocker -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP #$IPT -A blocker -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP + ## Return to caller $IPT -A blocker -j RETURN @@ -123,6 +156,9 @@ ipt_tables () { $IPT -A srv_db_out -j RETURN ####### SSH Server + + $IPT -A srv_ssh_in -p tcp --dport 2222 -s ${BR_NET} -m state --state NEW -j ACCEPT + $IPT -A srv_ssh_in -p tcp --dport 2222 -m state --state NEW -j LOG --log-prefix "iptables: SSH NEW": $IPT -A srv_ssh_in -p tcp --dport 2222 -m state --state NEW -m recent --set --name SSH -j ACCEPT $IPT -A srv_ssh_in -p tcp --dport 2222 -m recent \ @@ -134,22 +170,30 @@ ipt_tables () { $IPT -A srv_ssh_in -p tcp --dport 2222 --sport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - $IPT -A srv_ssh_in -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT + #$IPT -A srv_ssh_in -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT - $IPT -A srv_ssh_in -p tcp --dport 22 -m recent \ - --update --seconds 60 --hitcount 4 --rttl \ - --name SSH -j LOG --log-prefix "${SPAMDROPMSG} SSH" + #$IPT -A srv_ssh_in -p tcp --dport 22 -m recent \ + # --update --seconds 60 --hitcount 4 --rttl \ + # --name SSH -j LOG --log-prefix "${SPAMDROPMSG} SSH" - $IPT -A srv_ssh_in -p tcp --dport 22 -m recent --update --seconds 60 \ - --hitcount 4 --rttl --name SSH -j DROP + #$IPT -A srv_ssh_in -p tcp --dport 22 -m recent --update --seconds 60 \ + # --hitcount 4 --rttl --name SSH -j DROP - $IPT -A srv_ssh_in -p tcp --dport 22 --sport 1024:65535 -m state --state ESTABLISHED -j ACCEPT + #$IPT -A srv_ssh_in -p tcp --dport 22 --sport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A srv_ssh_in -j RETURN + $IPT -A srv_ssh_out -p tcp --sport 2222 --dport 1024:65535 -d ${BR_NET} -m state --state ESTABLISHED -j ACCEPT + $IPT -A srv_ssh_out -p tcp --tcp-flags SYN,ACK SYN,ACK --sport 2222 -j LOG --log-prefix "iptables: SSH OUT": $IPT -A srv_ssh_out -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT - $IPT -A srv_ssh_out -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT + #$IPT -A srv_ssh_out -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A srv_ssh_out -j RETURN + ####### smtp Server + $IPT -A srv_smtp_in -p tcp --dport 25 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT + $IPT -A srv_smtp_in -j RETURN + $IPT -A srv_smtp_out -p tcp --sport 25 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT + $IPT -A srv_smtp_out -j RETURN + ####### HTTP Server $IPT -A srv_http_in -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A srv_http_in -j RETURN @@ -200,8 +244,10 @@ ipt_tables () { $IPT -A cli_ftp_out -j RETURN ######## GIT client + $IPT -A cli_git_in -p tcp --sport 873 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A cli_git_in -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A cli_git_in -j RETURN + $IPT -A cli_git_out -p tcp --dport 873 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A cli_git_out -p tcp --dport 9418 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A cli_git_out -j RETURN @@ -229,6 +275,9 @@ ipt_tables () { $IPT -A cli_ssh_in -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A cli_ssh_in -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A cli_ssh_in -j RETURN + + $IPT -A cli_ssh_out -p tcp -d ${BR_NET} --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT + $IPT -A cli_ssh_out -p tcp --tcp-flags SYN,ACK SYN,ACK --dport 2222 -j LOG --log-prefix "iptables: SSH OUT": $IPT -A cli_ssh_out -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A cli_ssh_out -p tcp --dport 22 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A cli_ssh_out -j RETURN @@ -258,5 +307,3 @@ ipt_tables () { $IPT -A srv_ntp -j RETURN } - - diff --git a/core/conf/iptables/ipt-open.sh b/core/conf/iptables/ipt-open.sh new file mode 100644 index 0000000..be2b86b --- /dev/null +++ b/core/conf/iptables/ipt-open.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +## load client configuration +${IPT} -P INPUT DROP +${IPT} -P FORWARD DROP +${IPT} -P OUTPUT ACCEPT + +${IPT} -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT +${IPT} -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT + +${IPT} -A INPUT -p tcp --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT +${IPT} -A INPUT -p udp --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT + +${IPT} -A OUTPUT -j ACCEPT + +${IPT} -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " +${IPT} -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " diff --git a/core/conf/iptables/ipt-server.sh b/core/conf/iptables/ipt-server.sh index 6a0a9c5..d09d1f4 100644 --- a/core/conf/iptables/ipt-server.sh +++ b/core/conf/iptables/ipt-server.sh @@ -1,51 +1,47 @@ echo "setting server iptables ..." -source ipt-conf.sh -source ipt-firewall.sh -ipt_clear -ipt_tables - -# Unlimited on loopback -$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT -$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT ####### Input Chain ###### $IPT -A INPUT -j blocker +$IPT -A INPUT -i ${PUB_IF} -s ${BR_NET} -p udp --dport 520 -j DROP + $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${DNS} -j cli_dns_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_https_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_ssh_in + +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_http_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_https_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_git_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_smtp_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j cli_https_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j cli_http_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_ssh_in + $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_https_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_http_in +$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_ssh_in $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_git_in -$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_ntp ####### Output Chain ###### $IPT -A OUTPUT -j blocker $IPT -A OUTPUT -o ${PUB_IF} -d ${DNS} -s ${PUB_IP} -j cli_dns_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j cli_http_out +$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j cli_ssh_out + $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_https_out +$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_http_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_ssh_out +$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_smtp_out $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_git_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j cli_https_out -$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j cli_http_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_https_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_http_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_ssh_out $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_git_out -$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_ntp ## log everything else and drop ipt_log - -iptables-save > /etc/iptables/server.v4 diff --git a/core/conf/iptables/ipt-start.sh b/core/conf/iptables/ipt-start.sh new file mode 100644 index 0000000..65b848c --- /dev/null +++ b/core/conf/iptables/ipt-start.sh @@ -0,0 +1,34 @@ +#!/bin/bash + +echo "starting iptables..." + +source /etc/iptables/ipt-firewall.sh + +ipt_clear +ipt_tables + +# Unlimited on loopback +$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT +$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT + +case $TYPE in + bridge) + #ipt_clear + echo 1 > /proc/sys/net/ipv4/ip_forward + source /etc/iptables/ipt-bridge.sh + exit 0 + ;; + server) + #ipt_clear + source /etc/iptables/ipt-server.sh + exit 0 + ;; + client) + source /etc/iptables/ipt-client.sh + exit 0 + ;; + open) + source /etc/iptables/ipt-open.sh + exit 0 + ;; +esac diff --git a/core/conf/iptables/ipt-stop.sh b/core/conf/iptables/ipt-stop.sh new file mode 100644 index 0000000..55af57c --- /dev/null +++ b/core/conf/iptables/ipt-stop.sh @@ -0,0 +1,8 @@ +#!/bin/bash + +echo "blocking network..." + +source /etc/iptables/ipt-firewall.sh + +ipt_clear +ipt_tables diff --git a/core/conf/iptables/server.v4 b/core/conf/iptables/server.v4 deleted file mode 100644 index 678800b..0000000 --- a/core/conf/iptables/server.v4 +++ /dev/null @@ -1,208 +0,0 @@ -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 -*security -:INPUT ACCEPT [0:0] -:FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [0:0] -COMMIT -# Completed on Mon Jul 8 00:42:39 2019 -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 -*raw -:PREROUTING ACCEPT [0:0] -:OUTPUT ACCEPT [1:132] -COMMIT -# Completed on Mon Jul 8 00:42:39 2019 -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 -*nat -:PREROUTING ACCEPT [0:0] -:INPUT ACCEPT [0:0] -:OUTPUT ACCEPT [0:0] -:POSTROUTING ACCEPT [0:0] -COMMIT -# Completed on Mon Jul 8 00:42:39 2019 -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 -*mangle -:PREROUTING ACCEPT [0:0] -:INPUT ACCEPT [0:0] -:FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [1:132] -:POSTROUTING ACCEPT [0:0] -COMMIT -# Completed on Mon Jul 8 00:42:39 2019 -# Generated by iptables-save v1.8.3 on Mon Jul 8 00:42:39 2019 -*filter -:INPUT DROP [0:0] -:FORWARD DROP [0:0] -:OUTPUT DROP [0:0] -:blocker - [0:0] -:cli_dns_in - [0:0] -:cli_dns_out - [0:0] -:cli_ftp_in - [0:0] -:cli_ftp_out - [0:0] -:cli_git_in - [0:0] -:cli_git_out - [0:0] -:cli_gpg_in - [0:0] -:cli_gpg_out - [0:0] -:cli_http_in - [0:0] -:cli_http_out - [0:0] -:cli_https_in - [0:0] -:cli_https_out - [0:0] -:cli_irc_in - [0:0] -:cli_irc_out - [0:0] -:cli_pops_in - [0:0] -:cli_pops_out - [0:0] -:cli_smtps_in - [0:0] -:cli_smtps_out - [0:0] -:cli_ssh_in - [0:0] -:cli_ssh_out - [0:0] -:srv_db_in - [0:0] -:srv_db_out - [0:0] -:srv_dhcp - [0:0] -:srv_dns_in - [0:0] -:srv_dns_out - [0:0] -:srv_git_in - [0:0] -:srv_git_out - [0:0] -:srv_http_in - [0:0] -:srv_http_out - [0:0] -:srv_https_in - [0:0] -:srv_https_out - [0:0] -:srv_icmp - [0:0] -:srv_rip - [0:0] -:srv_ssh_in - [0:0] -:srv_ssh_out - [0:0] --A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT --A INPUT -j blocker --A INPUT -s 10.0.0.254/32 -d 10.0.0.4/32 -i ens3 -j cli_dns_in --A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_https_in --A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_ssh_in --A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j srv_git_in --A INPUT -s 10.0.0.0/8 -d 10.0.0.4/32 -i ens3 -j cli_http_in --A INPUT -d 10.0.0.4/32 -i ens3 -j srv_https_in --A INPUT -d 10.0.0.4/32 -i ens3 -j cli_https_in --A INPUT -d 10.0.0.4/32 -i ens3 -j cli_http_in --A INPUT -d 10.0.0.4/32 -i ens3 -j srv_ssh_in --A INPUT -d 10.0.0.4/32 -i ens3 -j srv_git_in --A INPUT -j LOG --log-prefix "iptables: INPUT: " --log-level 7 --A FORWARD -j LOG --log-prefix "iptables: FORWARD: " --log-level 7 --A OUTPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -o lo -j ACCEPT --A OUTPUT -j blocker --A OUTPUT -s 10.0.0.4/32 -d 10.0.0.254/32 -o ens3 -j cli_dns_out --A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j cli_http_out --A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_https_out --A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_ssh_out --A OUTPUT -s 10.0.0.4/32 -d 10.0.0.0/8 -o ens3 -j srv_git_out --A OUTPUT -s 10.0.0.4/32 -o ens3 -j cli_https_out --A OUTPUT -s 10.0.0.4/32 -o ens3 -j cli_http_out --A OUTPUT -s 10.0.0.4/32 -o ens3 -j srv_https_out --A OUTPUT -d 10.0.0.0/8 -o ens3 -j srv_ssh_out --A OUTPUT -d 10.0.0.0/8 -o ens3 -j srv_git_out --A OUTPUT -j LOG --log-prefix "iptables: OUTPUT: " --log-level 7 --A blocker -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop sync: " --log-level 7 --A blocker -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP --A blocker -f -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop frag: " --A blocker -f -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop null: " --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP --A blocker -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop syn rst syn rs" --A blocker -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop xmas: " --A blocker -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop fin scan: " --A blocker -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP --A blocker -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP --A blocker -j RETURN --A cli_dns_in -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT --A cli_dns_in -j RETURN --A cli_dns_out -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT --A cli_dns_out -j RETURN --A cli_ftp_in -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_ftp_in -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A cli_ftp_in -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_ftp_in -j RETURN --A cli_ftp_out -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_ftp_out -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT --A cli_ftp_out -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A cli_ftp_out -j RETURN --A cli_git_in -p tcp -m tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_git_in -j RETURN --A cli_git_out -p tcp -m tcp --sport 1024:65535 --dport 9418 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_git_out -j RETURN --A cli_gpg_in -p tcp -m tcp --sport 11371 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_gpg_in -j RETURN --A cli_gpg_out -p tcp -m tcp --sport 1024:65535 --dport 11371 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_gpg_out -j RETURN --A cli_http_in -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_http_in -p udp -m udp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_http_in -j RETURN --A cli_http_out -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_http_out -p udp -m udp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_http_out -j RETURN --A cli_https_in -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_https_in -p udp -m udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_https_in -j RETURN --A cli_https_out -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_https_out -p udp -m udp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_https_out -j RETURN --A cli_irc_in -p tcp -m tcp --sport 6667 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_irc_in -j RETURN --A cli_irc_out -p tcp -m tcp --sport 1024:65535 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_irc_out -j RETURN --A cli_pops_in -p tcp -m tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_pops_in -j RETURN --A cli_pops_out -p tcp -m tcp --sport 1024:65535 --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_pops_out -j RETURN --A cli_smtps_in -p tcp -m tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_smtps_in -j RETURN --A cli_smtps_out -p tcp -m tcp --sport 1024:65535 --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_smtps_out -j RETURN --A cli_ssh_in -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_ssh_in -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A cli_ssh_in -j RETURN --A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_ssh_out -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT --A cli_ssh_out -j RETURN --A srv_db_in -p tcp -m tcp --sport 1024:65535 --dport 5432 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_db_in -j RETURN --A srv_db_out -p tcp -m tcp --sport 5432 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_db_out -j RETURN --A srv_dhcp -p udp -m udp --sport 68 --dport 67 -j ACCEPT --A srv_dhcp -p udp -m udp --sport 67 --dport 68 -j ACCEPT --A srv_dhcp -p udp -m udp --sport 67 --dport 67 -j ACCEPT --A srv_dhcp -j RETURN --A srv_dns_in -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_dns_in -p tcp -m tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_dns_in -j RETURN --A srv_dns_out -p udp -m udp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_dns_out -p tcp -m tcp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_dns_out -j RETURN --A srv_git_in -p tcp -m tcp --sport 1024:65535 --dport 9418 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_git_in -j RETURN --A srv_git_out -p tcp -m tcp --sport 9418 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_git_out -j RETURN --A srv_http_in -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_http_in -j RETURN --A srv_http_out -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_http_out -j RETURN --A srv_https_in -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT --A srv_https_in -j RETURN --A srv_https_out -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT --A srv_https_out -j RETURN --A srv_icmp -p icmp -j ACCEPT --A srv_icmp -j RETURN --A srv_rip -p udp -m udp --sport 520 --dport 520 -j ACCEPT --A srv_rip -j RETURN --A srv_ssh_in -p tcp -m tcp --dport 2222 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" --A srv_ssh_in -p tcp -m tcp --dport 2222 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP --A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource -j ACCEPT --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "BLOCKED IP DROP SSH" --A srv_ssh_in -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP --A srv_ssh_in -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_in -j RETURN --A srv_ssh_out -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_out -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT --A srv_ssh_out -j RETURN -COMMIT -# Completed on Mon Jul 8 00:42:39 2019 diff --git a/core/conf/pkg-get.conf b/core/conf/pkg-get.conf index 4825657..7198578 100644 --- a/core/conf/pkg-get.conf +++ b/core/conf/pkg-get.conf @@ -4,7 +4,7 @@ # package repositories (remote) # The first two are remote repoistories, the last is a local one -pkgdir /usr/ports/server|https://hive.gnu.systems/mirror-3.4/packages +pkgdir /usr/ports/server|https://tribu.semdestino.org/mirror/packages #pkgdir /usr/packages/java|http://www.foobar.com/java #pkgdir /usr/packages/games diff --git a/core/conf/pkgmk.conf b/core/conf/pkgmk.conf index 4d689ec..3ae582d 100644 --- a/core/conf/pkgmk.conf +++ b/core/conf/pkgmk.conf @@ -5,30 +5,26 @@ export CFLAGS="-O2 -march=x86-64" export CXXFLAGS="${CFLAGS}" -## ccache settings +# local compile only +export JOBS=$(nproc) +export MAKEFLAGS="-j $JOBS" + +# ccache settings #export PATH="/usr/lib/ccache/:$PATH" #export CCACHE_DIR="/usr/ports/ccache" #export CCACHE_PREFIX="distcc" #export CCACHE_COMPILERCHECK="%compiler% -dumpversion; crux" -# -## compile using ccache and distcc -#export DISTCC_HOSTS="localhost/4 xborg/4" -# -### compile using distcc without ccache + +## compile using distcc without ccache ##export PATH="/usr/lib/distcc/:$PATH" -##export DISTCC_HOSTS="localhost/4,lzo,cpp xborg/4,lzo,cpp" -##export PUMP_BUILD=yes -# -## distcc settings + +# distcc settings +#export DISTCC_HOSTS="localhost/4,lzo,cpp xborg/4,lzo,cpp" #export JOBS=$(/usr/bin/distcc -j 2> /dev/null) #export DISTCC_DIR="/usr/ports/distcc" #export MAKEFLAGS="-j ${JOBS}" #export SCONSFLAGS="$MAKEFLAGS" -# local compile only -export JOBS=$(nproc) -export MAKEFLAGS="-j $JOBS" - case ${PKGMK_ARCH} in "64"|"") ;; @@ -44,7 +40,7 @@ case ${PKGMK_ARCH} in ;; esac -PKGMK_SOURCE_MIRRORS=(https://hive.gnu.systems/mirror-3.4/distfiles/) +PKGMK_SOURCE_MIRRORS=(https://tribu.semdestino.org/mirror/distfiles/ https://tribu.semdestino.org/mirror/archive/distfiles/) # PKGMK_SOURCE_DIR="$PWD" PKGMK_SOURCE_DIR="/usr/ports/distfiles" # PKGMK_PACKAGE_DIR="$PWD" diff --git a/core/conf/ports/contrib.git b/core/conf/ports/contrib.git index 178495d..d485836 100644 --- a/core/conf/ports/contrib.git +++ b/core/conf/ports/contrib.git @@ -1,7 +1,7 @@ # Collection core # NAME=contrib -URL=git://hive.gnu.systems/contrib.git -BRANCH=stable-3.4 +URL=git://tribu.semdestino.org/contrib.git +BRANCH=stable-3.5 destination=/usr/ports/contrib PORTS_DIR="/usr/ports" diff --git a/core/conf/ports/core.git b/core/conf/ports/core.git index c8df2ff..73becef 100644 --- a/core/conf/ports/core.git +++ b/core/conf/ports/core.git @@ -1,7 +1,7 @@ # Collection core # NAME=core -URL=git://hive.gnu.systems/core.git -BRANCH=stable-3.4 +URL=git://tribu.semdestino.org/core.git +BRANCH=stable-3.5 destination=/usr/ports/core PORTS_DIR="/usr/ports" diff --git a/core/conf/ports/kde5.git b/core/conf/ports/kde5.git index 37b5764..fe0f31f 100644 --- a/core/conf/ports/kde5.git +++ b/core/conf/ports/kde5.git @@ -1,7 +1,7 @@ # Collection core # NAME=kde5 -URL=git://hive.gnu.systems/kde5.git -BRANCH=stable-3.4 +URL=git://tribu.semdestino.org/kde5.git +BRANCH=stable-3.5 destination=/usr/ports/kde5 PORTS_DIR="/usr/ports" diff --git a/core/conf/ports/mate.git b/core/conf/ports/mate.git index ded4c12..3532e3d 100644 --- a/core/conf/ports/mate.git +++ b/core/conf/ports/mate.git @@ -1,7 +1,7 @@ # Collection mate # NAME=mate -URL=git://hive.gnu.systems/mate.git -BRANCH=stable-3.4 +URL=git://tribu.semdestino.org/mate.git +BRANCH=stable-3.5 destination=/usr/ports/mate PORTS_DIR="/usr/ports" diff --git a/core/conf/ports/mate.httpup.inactive b/core/conf/ports/mate.httpup.inactive index ada5d63..4b56167 100644 --- a/core/conf/ports/mate.httpup.inactive +++ b/core/conf/ports/mate.httpup.inactive @@ -2,4 +2,4 @@ # File generated by the CRUX portdb https://crux.nu/portdb/ ROOT_DIR=/usr/ports/mate -URL=https://raw.githubusercontent.com/mhoush/crux-mate/stable-3.4/ +URL=https://raw.githubusercontent.com/mhoush/crux-mate/stable-3.5/ diff --git a/core/conf/ports/opt.git b/core/conf/ports/opt.git index c8eca84..a91903f 100644 --- a/core/conf/ports/opt.git +++ b/core/conf/ports/opt.git @@ -1,7 +1,7 @@ # Collection core # NAME=opt -URL=git://hive.gnu.systems/opt.git -BRANCH=stable-3.4 +URL=git://tribu.semdestino.org/opt.git +BRANCH=stable-3.5 destination=/usr/ports/opt PORTS_DIR="/usr/ports" diff --git a/core/conf/ports/ports.git b/core/conf/ports/ports.git index 59d2072..04a0be7 100644 --- a/core/conf/ports/ports.git +++ b/core/conf/ports/ports.git @@ -1,7 +1,7 @@ # Collection Ports Driver # NAME=ports -URL=git://hive.gnu.systems/ports.git -BRANCH=stable-3.4 +URL=git://tribu.semdestino.org/ports.git +BRANCH=stable-3.5 destination=/usr/ports/ports PORTS_DIR="/usr/ports" diff --git a/core/conf/ports/xorg.git b/core/conf/ports/xorg.git index f5511d3..f41211e 100644 --- a/core/conf/ports/xorg.git +++ b/core/conf/ports/xorg.git @@ -1,7 +1,7 @@ # Collection core # NAME=xorg -URL=git://hive.gnu.systems/xorg.git -BRANCH=stable-3.4 +URL=git://tribu.semdestino.org/xorg.git +BRANCH=stable-3.5 destination=/srv/ports/xorg PORTS_DIR="/usr/ports" diff --git a/core/conf/prt-get.conf b/core/conf/prt-get.conf index 8e88333..d248d24 100644 --- a/core/conf/prt-get.conf +++ b/core/conf/prt-get.conf @@ -4,18 +4,31 @@ # note: the order matters: the package found first is used prtdir /usr/ports/core +prtdir /usr/ports/ports prtdir /usr/ports/opt prtdir /usr/ports/xorg +prtdir /usr/ports/contrib +prtdir /usr/ports/mate +#prtdir /usr/ports/kde5 +#prtdir /usr/ports/romster +#prtdir /usr/ports/tb +#prtdir /usr/ports/timcowchip +#prtdir /usr/ports/6c37 +#prtdir /usr/ports/nilp +#prtdir /usr/ports/nullspoon +#prtdir /usr/ports/dbrooke +#prtdir /usr/ports/pitillo + +# 6c37 team provides a collection with freetype-iu, fontconfig-iu +# and cairo-iu ports. +# the following line enables the user maintained contrib collection +# prtdir /usr/ports/6c37-dropin +# prtdir /usr/ports/6c37 + # the following line enables the multilib compat-32 collection #prtdir /usr/ports/compat-32 -# the following line enables the user maintained contrib collection -prtdir /usr/ports/contrib -prtdir /usr/ports/ports -prtdir /usr/ports/mate -prtdir /usr/ports/kde5 - ### use mypackage form local directory # prtdir /home/packages/build:mypackage @@ -23,7 +36,7 @@ prtdir /usr/ports/kde5 writelog enabled # (enabled|disabled) logmode overwrite # (append|overwrite) rmlog_on_success yes # (no|yes) -logfile /usr/ports/pkgbuild/%n.log +logfile /usr/ports/pkgbuild/%n-%v-%r.log # path, %p=path to port dir, %n=port name # %v=version, %r=release @@ -34,7 +47,7 @@ logfile /usr/ports/pkgbuild/%n.log readme verbose # (verbose|compact|disabled) ### prefer higher versions in sysup / diff -preferhigher yes # (yes|no) +preferhigher yes # (yes|no) ### use regexp search # useregex no # (yes|no) @@ -43,10 +56,11 @@ preferhigher yes # (yes|no) ### --install-scripts option runscripts yes # (no|yes) + ### EXPERT SECTION ### ### alternative commands -makecommand sudo -H -u pkgmk fakeroot pkgmk +makecommand sudo -H -u pkgmk -g pkgmk fakeroot pkgmk addcommand sudo pkgadd removecommand sudo pkgrm runscriptcommand sudo sh diff --git a/core/conf/rc.d/fcgiwrap b/core/conf/rc.d/fcgiwrap new file mode 100755 index 0000000..2059848 --- /dev/null +++ b/core/conf/rc.d/fcgiwrap @@ -0,0 +1,41 @@ +#!/bin/sh +# +# /etc/rc.d/bird: start/stop fcgiwrapper +# + +SSD=/sbin/start-stop-daemon +NAME=fcgiwrap +PROG=/usr/bin/spawn-fcgi +USER=www +GROUP=gitolite +PIDFILE=/var/run/spawn_${NAME}.pid +SOCKET=/var/run/fcgiwrap.sock +OPTS="-u $USER -g $GROUP -P $PIDFILE -M 0660 -s $SOCKET -- /usr/sbin/${NAME}" + + +case $1 in + start) + echo "Starting ${NAME}..." + $SSD --background --user $USER --quiet --start --pidfile $PIDFILE --exec $PROG -- $OPTS + ;; +stop) + echo "Stopping ${NAME}..." + $SSD --stop --remove-pidfile --retry 10 --pidfile $PIDFILE + ;; +restart) + echo "Restarting ${NAME}..." + $0 stop + $0 start + ;; +status) + $SSD --status --pidfile $PIDFILE + case $? in + 0) echo "$PROG is running with pid $(cat $PIDFILE )" ;; + 3) echo "$PROG is not running" ;; + 4) echo "Unable to determine the program status" ;; + esac + ;; +*) + echo "usage: $0 [start|stop|restart|status]" + ;; +esac diff --git a/core/conf/rc.d/git-daemon b/core/conf/rc.d/git-daemon new file mode 100755 index 0000000..41793eb --- /dev/null +++ b/core/conf/rc.d/git-daemon @@ -0,0 +1,43 @@ +#!/bin/sh + +SSD=/sbin/start-stop-daemon +NAME=git-daemon +PROG=$(git --exec-path)/${NAME} +USER=gitolite +GROUP=gitolite +PIDFILE=/var/run/git-daemon.pid +REPOS=/srv/gitolite/repositories +OPTS="--verbose --reuseaddr --base-path=${REPOS}" + +case $1 in + start) + echo "Starting ${NAME}..." + $SSD --start \ + --pidfile ${PIDFILE} \ + --exec ${PROG} -- ${OPTS} \ + --detach --pid-file=${PIDFILE} \ + --user=${USER} --group=${GROUP} + + ;; + stop) + echo "Stopping ${NAME}..." + $SSD --stop --quiet --name git-daemon \ + --pidfile ${PIDFILE} + ;; + restart) + echo "Restarting ${NAME}..." + $0 stop + $0 start + ;; + status) + $SSD --status --pidfile $PIDFILE + case $? in + 0) echo "$PROG is running with pid $(cat $PIDFILE )" ;; + 3) echo "$PROG is not running" ;; + 4) echo "Unable to determine the program status" ;; + esac + ;; + *) + echo "usage: $0 [start|stop|restart|status]" + ;; +esac diff --git a/core/conf/rc.d/iptables b/core/conf/rc.d/iptables index f8b7881..44f6bb2 100644 --- a/core/conf/rc.d/iptables +++ b/core/conf/rc.d/iptables @@ -1,96 +1,20 @@ #!/bin/bash -IPT="/usr/sbin/iptables" -#TYPE=bridge -#TYPE=server -TYPE=open -#TYPE=client - -clear_ipt() { - - ${IPT} -F - ${IPT} -X - ${IPT} -t nat -F - ${IPT} -t nat -X - ${IPT} -t mangle -F - ${IPT} -t mangle -X - ${IPT} -t raw -F - ${IPT} -t raw -X - ${IPT} -t security -F - ${IPT} -t security -X - -} - case $1 in start) - case $TYPE in - bridge) - clear_ipt - echo "setting bridge network..." - echo 1 > /proc/sys/net/ipv4/ip_forward - - ## load bridge configuration - iptables-restore /etc/iptables/bridge.v4 - - ;; - server) - clear_ipt - echo "setting server network..." - ## load server configuration - iptables-restore /etc/iptables/server.v4 - - ;; - client) - clear_ipt - echo "setting client network..." - ## load client configuration - iptables-restore /etc/iptables/client.v4 - ;; - open) - clear_ipt - echo "setting open network..." - ## load client configuration - - ${IPT} -P INPUT DROP - ${IPT} -P FORWARD DROP - ${IPT} -P OUTPUT ACCEPT - - ${IPT} -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT - ${IPT} -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT - - ${IPT} -A INPUT -p tcp --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT - ${IPT} -A INPUT -p udp --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT - - ${IPT} -A OUTPUT -j ACCEPT - - ${IPT} -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " - ${IPT} -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " - #${IPT} -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " - - - ;; - esac + echo "clear all iptables tables" + #nohup bash /etc/iptables/ipt-start.sh & + nohup bash /etc/iptables/ipt-start.sh & ;; stop) - echo "clear all iptables tables" - clear_ipt - # Set Default Rules - ${IPT} -P INPUT DROP - ${IPT} -P FORWARD DROP - ${IPT} -P OUTPUT DROP - - ${IPT} -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " - ${IPT} -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " - ${IPT} -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " - - + echo "clear all iptables tables" + nohup bash /etc/iptables/ipt-stop.sh & ;; restart) - clear_ipt - $0 start + $0 start ;; status) - ${IPT} -v + /usr/sbin/iptables -L -n -v ;; *) echo "Usage: $0 [start|stop]" diff --git a/core/conf/rc.d/net b/core/conf/rc.d/net index 07c46a5..a4c566a 100755 --- a/core/conf/rc.d/net +++ b/core/conf/rc.d/net @@ -8,15 +8,20 @@ TYPE="DHCP" # For "static" connections, specify your settings here: # To see your available devices run "ip link". -DEV=enp11s0 +DEV=ens3 ADDR=192.168.1.100 MASK=24 GW=192.168.1.1 # Optional settings: -#DHCPOPTS="-h $(/bin/hostname) -C resolv.conf $DEV" DHCPOPTS="-t 10" +/sbin/ifconfig dummy down > /dev/null 2>&1 +/sbin/ifconfig dummy0 down > /dev/null 2>&1 +/sbin/ifconfig ifb0 down > /dev/null 2>&1 +/sbin/ifconfig ifb1 down > /dev/null 2>&1 +/sbin/ifconfig bond0 down > /dev/null 2>&1 + case $1 in start) if [ "${TYPE}" = "DHCP" ]; then @@ -31,15 +36,9 @@ case $1 in if [ "${TYPE}" = "DHCP" ]; then /sbin/dhcpcd -x else - #/sbin/ip route del default - #/sbin/ip link set ${DEV} down - #/sbin/ip addr del ${ADDR}/${MASK} dev ${DEV} - - /sbin/ip route del default dev ${DEV} - /sbin/ip route flush dev ${DEV} - /sbin/ip link set ${DEV} down - /sbin/ip addr flush dev ${DEV} - + /sbin/ip route del default + /sbin/ip link set ${DEV} down + /sbin/ip addr del ${ADDR}/${MASK} dev ${DEV} fi ;; restart) @@ -52,3 +51,4 @@ case $1 in esac # End of file + diff --git a/core/conf/rc.d/postgresql b/core/conf/rc.d/postgresql new file mode 100755 index 0000000..5f0762a --- /dev/null +++ b/core/conf/rc.d/postgresql @@ -0,0 +1,16 @@ +# +# /etc/rc.d/postgresql: start, stop or restart PostgreSQL server postmaster +# + +PG_DATA=/srv/pgsql/data + +case "$1" in + start|stop|status|restart|reload) + sudo -u postgres pg_ctl -D "$PG_DATA" -l /var/log/postgresql "$1" + ;; + *) + echo "usage: $0 start|stop|restart|reload|status" + ;; +esac + +# End of file diff --git a/core/conf/rc.d/wlan b/core/conf/rc.d/wlan index c9c60ec..9a2f935 100755 --- a/core/conf/rc.d/wlan +++ b/core/conf/rc.d/wlan @@ -3,11 +3,8 @@ # /etc/rc.d/wlan: start/stop wireless interface # -# Connection type: "DHCP" or "static" -#TYPE="DHCP" -TYPE="static" +DEV=wlp3s0 -DEV=wlp7s0 SSD=/sbin/start-stop-daemon PROG_DHCP=/sbin/dhcpcd @@ -18,10 +15,6 @@ PID_WIFI=/var/run/wpa_supplicant.pid OPTS_DHCP="--waitip -h $(/bin/hostname) -z $DEV" OPTS_WIFI="-B -P $PID_WIFI -D nl80211,wext -c /etc/wpa_supplicant.conf -i $DEV" -ADDR=192.168.1.67 -MASK=24 -GW=192.168.1.254 - print_status() { $SSD --status --pidfile $2 @@ -35,37 +28,14 @@ print_status() { case $1 in start) - - if [ "${TYPE}" = "DHCP" ]; then - $SSD --start --pidfile $PID_WIFI --exec $PROG_WIFI -- $OPTS_WIFI && \ - $SSD --start --pidfile $PID_DHCP --exec $PROG_DHCP -- $OPTS_DHCP - RETVAL=$? - else - - /sbin/ip link set ${DEV} up - - $SSD --start --pidfile $PID_WIFI --exec $PROG_WIFI -- $OPTS_WIFI - - RETVAL=$? - - /sbin/ip addr add ${ADDR}/${MASK} dev ${DEV} broadcast + - /sbin/ip route add default via ${GW} - fi + $SSD --start --pidfile $PID_WIFI --exec $PROG_WIFI -- $OPTS_WIFI && \ + $SSD --start --pidfile $PID_DHCP --exec $PROG_DHCP -- $OPTS_DHCP + RETVAL=$? ;; stop) - - if [ "${TYPE}" = "DHCP" ]; then - ( $SSD --stop --retry 10 --pidfile $PID_DHCP - $SSD --stop --retry 10 --pidfile $PID_WIFI ) - RETVAL=$? - else - $SSD --stop --retry 10 --pidfile $PID_WIFI - RETVAL=$? - - /sbin/ip link set ${DEV} down - /sbin/ip route del default - /sbin/ip addr del ${ADDR}/${MASK} dev ${DEV} - fi + ( $SSD --stop --retry 10 --pidfile $PID_DHCP + $SSD --stop --retry 10 --pidfile $PID_WIFI ) + RETVAL=$? ;; restart) $0 stop @@ -83,3 +53,4 @@ esac exit $RETVAL # End of file + diff --git a/core/conf/skel/.bashrc b/core/conf/skel/.bashrc index 55d1c78..f562e3c 100644 --- a/core/conf/skel/.bashrc +++ b/core/conf/skel/.bashrc @@ -55,9 +55,9 @@ gloga () { alias tmux="tmux -2" # Virtual Crux machine -alias c1.ank="ssh c1.ank -t tmux a" -alias c2.ank="ssh c2.ank -t tmux a" -alias c9.ank="ssh c9.ank -t tmux a" +alias c1.ank="ssh c1 -t tmux a" +alias c2.ank="ssh c2 -t tmux a" +alias c9.ank="ssh c9 -t tmux a" alias pkg_mirror="pkg_bin -f /usr/ports/mirror_bin_db" alias pkg_update="pkg_bin -r /usr/ports/mirror_bin_db" diff --git a/core/conf/skel/.profile b/core/conf/skel/.profile index 1c8aa8b..7e15d10 100644 --- a/core/conf/skel/.profile +++ b/core/conf/skel/.profile @@ -11,7 +11,8 @@ function start_agent { echo succeeded chmod 600 "${SSH_ENV}" . "${SSH_ENV}" > /dev/null - /usr/bin/ssh-add; + # KEY_NAME with default key to load + /usr/bin/ssh-add ~/.ssh/KEY_NAME; } # Source SSH settings, if applicable diff --git a/core/conf/sysctl.conf b/core/conf/sysctl.conf index 3cc54d1..2a8723b 100644 --- a/core/conf/sysctl.conf +++ b/core/conf/sysctl.conf @@ -34,6 +34,8 @@ kernel.kptr_restrict = 2 # net.core.bpf_jit_enable = 0 +# harden all code +net.core.bpf_jit_harden = 2 # Increase Linux auto tuning TCP buffer limits # min, default, and max number of bytes to use @@ -54,13 +56,13 @@ net.ipv6.conf.default.disable_ipv6 = 1 net.ipv6.conf.lo.disable_ipv6 = 1 # Tuen IPv6 -#net.ipv6.conf.default.router_solicitations = 0 -#net.ipv6.conf.default.accept_ra_rtr_pref = 0 -#net.ipv6.conf.default.accept_ra_pinfo = 0 -#net.ipv6.conf.default.accept_ra_defrtr = 0 -#net.ipv6.conf.default.autoconf = 0 -#net.ipv6.conf.default.dad_transmits = 0 -#net.ipv6.conf.default.max_addresses = 0 +net.ipv6.conf.default.router_solicitations = 0 +net.ipv6.conf.default.accept_ra_rtr_pref = 0 +net.ipv6.conf.default.accept_ra_pinfo = 0 +net.ipv6.conf.default.accept_ra_defrtr = 0 +net.ipv6.conf.default.autoconf = 0 +net.ipv6.conf.default.dad_transmits = 0 +net.ipv6.conf.default.max_addresses = 0 # Avoid a smurf attack, ping scanning net.ipv4.icmp_echo_ignore_broadcasts = 1 @@ -140,4 +142,3 @@ net.ipv4.tcp_keepalive_time = 1800 net.ipv4.tcp_synack_retries = 3 # End of file - |