about summary refs log tree commit diff stats
path: root/core
diff options
context:
space:
mode:
Diffstat (limited to 'core')
-rw-r--r--core/apparmor.html4
-rw-r--r--core/conf/iptables/ipt-bridge.sh6
-rw-r--r--core/conf/iptables/ipt-client.sh20
-rw-r--r--core/conf/iptables/ipt-firewall.sh6
-rw-r--r--core/conf/iptables/ipt-server.sh23
-rw-r--r--core/conf/sudoers36
6 files changed, 67 insertions, 28 deletions
diff --git a/core/apparmor.html b/core/apparmor.html
index c567df8..ee8de54 100644
--- a/core/apparmor.html
+++ b/core/apparmor.html
@@ -52,7 +52,7 @@
 
 	<p>Profiles are located at /etc/apparmor.d/ and
         /usr/share/apparmor/extra-profiles contain profiles
-        that require testing;
+        that require testing;</p>
 
         <pre>
         # cp -r /usr/share/apparmor/extra-profiles/* /etc/apparmor.d/
@@ -135,7 +135,7 @@
         <p>Once profile rules become well defined enable profile in
         enforce mode with aa-enforce;</p>
 
-        <p>Monitor logs with aa-notify;</a>
+        <p>Monitor logs with aa-notify;</p>
 
 
         <h3 id="man_profiles">Create profile manually</h3>
diff --git a/core/conf/iptables/ipt-bridge.sh b/core/conf/iptables/ipt-bridge.sh
index 694c22f..67b5053 100644
--- a/core/conf/iptables/ipt-bridge.sh
+++ b/core/conf/iptables/ipt-bridge.sh
@@ -48,9 +48,12 @@ $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.
 $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_https_in
 $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_ssh_in
 $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_git_in
+$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j srv_ntp
 $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -j ACCEPT
 
 $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.3 -j cli_http_in
+$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.3 -p tcp --dport 1024:65535 --sport 1024:65535 -j ACCEPT
+$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} -d 10.0.0.4 -j cli_http_in
 ##Less noise
 $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF}  -p udp --dport 519 --sport 520 -j DROP
 $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF}  -p udp --dport 520 --sport 520 -j DROP
@@ -70,11 +73,13 @@ $IPT -A INPUT -i ${BR_IF} -j srv_dhcp
 $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_dns_in
 $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_icmp
 $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in
+$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in
 
 $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${DNS} -j cli_dns_in
 $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_https_in
 $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_git_in
 $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_ssh_in
+$IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j srv_ntp
 
 #$IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${WIFI_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_icmp
 #$IPT -A INPUT -i ${WIFI_IF} -d ${PUB_IP} -s ${WIFI_NET} -j srv_dns_in
@@ -110,6 +115,7 @@ $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_http_out
 $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_https_out
 $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_git_out
 $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_http_out
+$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j srv_ntp
 
 #$IPT -A OUTPUT -o ${WIFI_IF} -d ${DNS} -j cli_dns_out
 #$IPT -A OUTPUT -o ${WIFI_IF} -d ${WIFI_NET} -j srv_dns_out
diff --git a/core/conf/iptables/ipt-client.sh b/core/conf/iptables/ipt-client.sh
index 65df9e4..77de218 100644
--- a/core/conf/iptables/ipt-client.sh
+++ b/core/conf/iptables/ipt-client.sh
@@ -19,13 +19,21 @@ $IPT -A INPUT -i ${PUB_IF} -j cli_https_in
 $IPT -A INPUT -i ${PUB_IF} -j cli_git_in
 $IPT -A INPUT -i ${PUB_IF} -j cli_ssh_in
 $IPT -A INPUT -i ${PUB_IF} -j srv_icmp
+$IPT -A INPUT -i ${PUB_IF} -j srv_ntp
 $IPT -A INPUT -i ${PUB_IF} -j cli_pops_in
 $IPT -A INPUT -i ${PUB_IF} -j cli_smtps_in
 $IPT -A INPUT -i ${PUB_IF} -j cli_irc_in
 $IPT -A INPUT -i ${PUB_IF} -j cli_ftp_in
 $IPT -A INPUT -i ${PUB_IF} -j cli_gpg_in
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j ACCEPT
+$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j DROP
 
+$IPT -A INPUT -p tcp --dport 1024:65535 --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
+$IPT -A INPUT -p udp --dport 1024:65535 --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# allow all established and related
+$IPT -A INPUT -p tcp --dport 1024:65535 --sport 1:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
+$IPT -A INPUT -p udp --dport 1024:65535 --sport 1:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
+$IPT -A INPUT -p icmp -j ACCEPT
 
 ####### Output Chain ######
 $IPT -A OUTPUT -j blocker
@@ -36,12 +44,20 @@ $IPT -A OUTPUT -o ${PUB_IF} -j cli_ssh_out
 $IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out
 $IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out
 $IPT -A OUTPUT -o ${PUB_IF} -j srv_icmp
+$IPT -A OUTPUT -o ${PUB_IF} -j srv_ntp
 $IPT -A OUTPUT -o ${PUB_IF} -j cli_pops_out
 $IPT -A OUTPUT -o ${PUB_IF} -j cli_smtps_out
 $IPT -A OUTPUT -o ${PUB_IF} -j cli_irc_out
 $IPT -A OUTPUT -o ${PUB_IF} -j cli_ftp_out
 $IPT -A OUTPUT -o ${PUB_IF} -j cli_gpg_out
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:655335 --dport 1024:65535 -j ACCEPT
+
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT
+$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 1024:65535 -j ACCEPT
+
+# allow all out (make nmap and others happy)
+$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 1:65535 -j ACCEPT
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1:65535 -j ACCEPT
+$IPT -A OUTPUT -p icmp -j ACCEPT
 
 ## log everything else and drop
 ipt_log
diff --git a/core/conf/iptables/ipt-firewall.sh b/core/conf/iptables/ipt-firewall.sh
index 12c3834..086b864 100644
--- a/core/conf/iptables/ipt-firewall.sh
+++ b/core/conf/iptables/ipt-firewall.sh
@@ -18,6 +18,7 @@ ipt_clear () {
     iptables -N srv_dhcp
     iptables -N srv_rip
     iptables -N srv_icmp
+    iptables -N srv_ntp
     iptables -N srv_dns_in
     iptables -N srv_dns_out
     iptables -N srv_http_in
@@ -251,6 +252,11 @@ ipt_tables () {
     ####### ICMP Server
     $IPT -A srv_icmp -p icmp -j ACCEPT
     $IPT -A srv_icmp -j RETURN
+
+    ####### NTP Client and Server
+    $IPT -A srv_ntp -p udp --sport 123 --dport 123 -j ACCEPT
+    $IPT -A srv_ntp -j RETURN
+
 }
 
 
diff --git a/core/conf/iptables/ipt-server.sh b/core/conf/iptables/ipt-server.sh
index e557193..6a0a9c5 100644
--- a/core/conf/iptables/ipt-server.sh
+++ b/core/conf/iptables/ipt-server.sh
@@ -7,8 +7,8 @@ ipt_tables
 # Unlimited on loopback
 $IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
 $IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
-#$IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT
-#$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT
+$IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT
+$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT
 
 ####### Input Chain ######
 $IPT -A INPUT -j blocker
@@ -17,28 +17,33 @@ $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${DNS} -j cli_dns_in
 $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_https_in
 $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in
 $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_git_in
-#$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in
+$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_http_in
 
-
-$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_https_in
 $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j cli_https_in
+$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j cli_http_in
 $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_ssh_in
+$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_https_in
+$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_http_in
 $IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_git_in
+$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j srv_ntp
 
 ####### Output Chain ######
 $IPT -A OUTPUT -j blocker
 
 $IPT -A OUTPUT -o ${PUB_IF} -d ${DNS} -s ${PUB_IP} -j cli_dns_out
-#$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j cli_http_out
+$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j cli_http_out
 $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_https_out
 $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_ssh_out
 $IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_git_out
 
 $IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j cli_https_out
-$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_https_out
+$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j cli_http_out
 
-$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -j srv_ssh_out
-$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -j srv_git_out
+$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_https_out
+$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_http_out
+$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_ssh_out
+$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_git_out
+$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j srv_ntp
 
 ## log everything else and drop
 ipt_log
diff --git a/core/conf/sudoers b/core/conf/sudoers
index 3b35ea9..78146d7 100644
--- a/core/conf/sudoers
+++ b/core/conf/sudoers
@@ -25,49 +25,51 @@
 ## Cmnd alias specification
 ##
 ## Groups of commands.  Often used to group related commands together.
-# Cmnd_Alias	PROCESSES = /usr/bin/nice, /bin/kill, /usr/bin/renice, \
-# 			    /usr/bin/pkill, /usr/bin/top
-# Cmnd_Alias	REBOOT = /sbin/halt, /sbin/reboot, /sbin/poweroff
+Cmnd_Alias	PROCESSES = /usr/bin/nice, /bin/kill, /usr/bin/renice, \
+ 			    /usr/bin/pkill, /usr/bin/top
+Cmnd_Alias	REBOOT = /sbin/halt, /sbin/reboot, /sbin/poweroff
 
 ##
 ## Defaults specification
 ##
+Defaults editor=/usr/bin/rvim
+
 ## You may wish to keep some of the following environment variables
 ## when running commands via sudo.
 ##
 ## Locale settings
-# Defaults env_keep += "LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET"
+Defaults env_keep += "LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET"
 ##
 ## Run X applications through sudo; HOME is used to find the
 ## .Xauthority file.  Note that other programs use HOME to find   
 ## configuration files and this may lead to privilege escalation!
-# Defaults env_keep += "HOME"
+Defaults env_keep += "HOME"
 ##
 ## X11 resource path settings
-# Defaults env_keep += "XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH"
+Defaults env_keep += "XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH"
 ##
 ## Desktop path settings
-# Defaults env_keep += "QTDIR KDEDIR"
+Defaults env_keep += "QTDIR KDEDIR"
 ##
 ## Allow sudo-run commands to inherit the callers' ConsoleKit session
-# Defaults env_keep += "XDG_SESSION_COOKIE"
+Defaults env_keep += "XDG_SESSION_COOKIE"
 ##
 ## Uncomment to enable special input methods.  Care should be taken as
 ## this may allow users to subvert the command being run via sudo.
-# Defaults env_keep += "XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER"
+Defaults env_keep += "XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER"
 ##
 ## Uncomment to use a hard-coded PATH instead of the user's to find commands
-# Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 ##
 ## Uncomment to send mail if the user does not enter the correct password.
-# Defaults mail_badpass
+Defaults mail_badpass
 ##
 ## Uncomment to enable logging of a command's output, except for
 ## sudoreplay and reboot.  Use sudoreplay to play back logged sessions.
-# Defaults log_output
-# Defaults!/usr/bin/sudoreplay !log_output
-# Defaults!/usr/local/bin/sudoreplay !log_output
-# Defaults!REBOOT !log_output
+Defaults log_output
+Defaults!/usr/bin/sudoreplay !log_output
+Defaults!/usr/local/bin/sudoreplay !log_output
+Defaults!REBOOT !log_output
 
 ##
 ## Runas alias specification
@@ -92,6 +94,10 @@ root ALL=(ALL) ALL
 # Defaults targetpw  # Ask for the password of the target user
 # ALL ALL=(ALL) ALL  # WARNING: only use this together with 'Defaults targetpw'
 
+%users	ALL = NOPASSWD: REBOOT
+
+druid ALL=(postgres:postgres) NOPASSWD:ALL
+
 ## Read drop-in files from /etc/sudoers.d
 ## (the '#' here does not indicate a comment)
 #includedir /etc/sudoers.d
generated by cgit-pink 1.4.1-2-gfad0 (git 2.36.2.497.gbbea4dcf42) at 2024-11-17 08:17:43 +0000