in den letzten Tagen habe ich ein kleines Skript zusammengebastelt. Jetzt wollte ich fragen, ob das so in Ordnung geht.
Ob die Regeln für Samba tun, weiß ich nicht, weil ich sie noch nicht testen konnte. Was mir noch Sorgen macht, sind ping-flood und syn-flood. Was kann man noch am Skript machen, um den Server sicher zu bekommen?
Code: Select all
#!/bin/bash
LOOP=127.0.0.1
ADDRESS=xxx.xxx.233.240
NETWORK=xxx.xxx.233.0/24
DNS0=xxx.xxx.100.126
DNS1=xxx.xxx.210.127
start() {
echo "Starting iptables."
# loading needed modules
modprobe ip_tables
modprobe ip_conntrack
modprobe ip_conntrack_irc
modprobe ip_conntrack_ftp
modprobe ipt_state
modprobe ipt_LOG
modprobe ipt_limit
# don't log to consoles
#dmesg -n 2
# setting default policies
iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
# don't disturb the loopback device
iptables -A INPUT -i lo -s $LOOP -d $LOOP -j ACCEPT
iptables -A OUTPUT -o lo -s $LOOP -d $LOOP -j ACCEPT
###############
# input chain #
###############
# dns
iptables -A INPUT -p udp -s $DNS0 --sport 53 -j ACCEPT
iptables -A INPUT -p tcp -s $DNS0 --sport 53 -j ACCEPT
iptables -A INPUT -p udp -s $DNS1 --sport 53 -j ACCEPT
iptables -A INPUT -p tcp -s $DNS1 --sport 53 -j ACCEPT
# ssh
iptables -A INPUT -m tcp -p tcp -d $ADDRESS --dport 22
-m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m tcp -p tcp -s $NETWORK
-d $ADDRESS --dport 22 -j ACCEPT
iptables -A INPUT -m tcp -p tcp -d $ADDRESS --dport 22
-m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
iptables -A INPUT -m tcp -p tcp -d $ADDRESS --dport 22 -j DROP
# local ssh client to some server
iptables -A INPUT -m tcp -p tcp -d $ADDRESS --sport 22
-m state --state ESTABLISHED,RELATED -j ACCEPT
# allow samba shares
iptables -A INPUT -p tcp -s $NETWORK -d $ADDRESS
--dport 137:139 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp -s $NETWORK -d $ADDRESS
--dport 445 -m state --state NEW -j ACCEPT
iptables -A INPUT -p udp -s $NETWORK -d $ADDRESS
--dport 137:139 -m state --state NEW -j ACCEPT
iptables -A INPUT -p udp -s $NETWORK -d $ADDRESS
--dport 445 -m state --state NEW -j ACCEPT
# http
iptables -A INPUT -p tcp -d $ADDRESS --sport 80 -j ACCEPT
iptables -A INPUT -p tcp -d $ADDRESS --dport 80 -j ACCEPT
# ping
iptables -A INPUT -p icmp -d $ADDRESS -j ACCEPT
################
# output chain #
################
# dns
iptables -A OUTPUT -p udp --sport 1024: --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024: --dport 53 -j ACCEPT
# ssh
iptables -A OUTPUT -p tcp -s $ADDRESS --sport 22 -j ACCEPT
# local ssh client to some server
iptables -A OUTPUT -p tcp -s $ADDRESS --dport 22 -j ACCEPT
# allow samba shares
iptables -A OUTPUT -p tcp -s $ADDRESS --sport 137:139 -d $NETWORK
-m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -s $ADDRESS --sport 445 -d $NETWORK
-m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -s $ADDRESS --sport 137:139 -d $NETWORK
-m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -s $ADDRESS --sport 445 -d $NETWORK
-m state --state NEW -j ACCEPT
# http
iptables -A OUTPUT -p tcp -s $ADDRESS --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -s $ADDRESS --sport 80 -j ACCEPT
# ping
iptables -A OUTPUT -p icmp -s $ADDRESS -j ACCEPT
###########
# logging #
###########
iptables -A INPUT -d $ADDRESS -m state --state NEW,INVALID
-j LOG --log-prefix "firewall-in "
iptables -A OUTPUT -s $ADDRESS -m state --state NEW,INVALID
-j LOG --log-prefix "firewall-out "
}
stop() {
echo "Stopping iptables."
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
}
status() {
iptables -L -vn
}
case "$1" in
start)
start
;;
stop)
stop
;;
restart)
stop
start
;;
status)
status
;;
*)
echo "Usage: $0 start|stop|restart|status"
exit 1
;;
esac
exit 0
