mirror of
https://git.valherun.com/valherun/pxe_boot_alma.git
synced 2026-10-15 22:22:03 -04:00
andersenandClaude Fable 5
6d398b826a
- restructure boot/kickstarts/scripts/docs into homelab/ - docs: alma9->10 breaking changes, CIS hardening, kickstart changes - add find_cron_entries.sh helper and codex running memory notes Co-Authored-By: Claude Fable 5 <[email protected]>
379 lines
10 KiB
Bash
379 lines
10 KiB
Bash
#!/bin/sh
|
|
#
|
|
# This is automatically generated file. DO NOT MODIFY !
|
|
#
|
|
# Firewall Builder fwb_ipt v3.0.7-1477
|
|
#
|
|
# Generated Wed Dec 9 10:14:36 2009 EST by wia
|
|
#
|
|
# files: * probe-4P-041.fw
|
|
#
|
|
#
|
|
# Compiled for iptables (any version)
|
|
#
|
|
#
|
|
#
|
|
#
|
|
#
|
|
|
|
|
|
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"
|
|
export PATH
|
|
|
|
LSMOD="/sbin/lsmod"
|
|
MODPROBE="/sbin/modprobe"
|
|
IPTABLES="/sbin/iptables"
|
|
IP6TABLES="/sbin/ip6tables"
|
|
IPTABLES_RESTORE="/sbin/iptables-restore"
|
|
IP6TABLES_RESTORE="/sbin/ip6tables-restore"
|
|
IP="/sbin/ip"
|
|
LOGGER="/usr/bin/logger"
|
|
|
|
|
|
log() {
|
|
echo "$1"
|
|
test -x "$LOGGER" && $LOGGER -p info "$1"
|
|
}
|
|
|
|
check_file() {
|
|
test -r "$2" || {
|
|
echo "Can not find file $2 referenced by AddressTable object $1"
|
|
exit 1
|
|
}
|
|
}
|
|
|
|
va_num=1
|
|
add_addr() {
|
|
addr=$1
|
|
nm=$2
|
|
dev=$3
|
|
|
|
type=""
|
|
aadd=""
|
|
|
|
L=`$IP -4 link ls $dev | head -n1`
|
|
if test -n "$L"; then
|
|
OIFS=$IFS
|
|
IFS=" /:,<"
|
|
set $L
|
|
type=$4
|
|
IFS=$OIFS
|
|
if test "$type" = "NO-CARRIER"; then
|
|
type=$5
|
|
fi
|
|
|
|
L=`$IP -4 addr ls $dev to $addr | grep inet | grep -v :`
|
|
if test -n "$L"; then
|
|
OIFS=$IFS
|
|
IFS=" /"
|
|
set $L
|
|
aadd=$2
|
|
IFS=$OIFS
|
|
fi
|
|
fi
|
|
if test -z "$aadd"; then
|
|
if test "$type" = "POINTOPOINT"; then
|
|
$IP -4 addr add $addr dev $dev scope global label $dev:FWB${va_num}
|
|
va_num=`expr $va_num + 1`
|
|
fi
|
|
if test "$type" = "BROADCAST"; then
|
|
$IP -4 addr add $addr/$nm dev $dev brd + scope global label $dev:FWB${va_num}
|
|
va_num=`expr $va_num + 1`
|
|
fi
|
|
fi
|
|
}
|
|
|
|
getInterfaceVarName() {
|
|
echo $1 | sed 's/\./_/'
|
|
}
|
|
|
|
getaddr() {
|
|
dev=$1
|
|
name=$2
|
|
L=`$IP -4 addr show dev $dev | grep inet | grep -v :`
|
|
test -z "$L" && {
|
|
eval "$name=''"
|
|
return
|
|
}
|
|
OIFS=$IFS
|
|
IFS=" /"
|
|
set $L
|
|
eval "$name=$2"
|
|
IFS=$OIFS
|
|
}
|
|
|
|
getaddr6() {
|
|
dev=$1
|
|
name=$2
|
|
L=`$IP -6 addr show dev $dev | grep inet6 | grep -v :`
|
|
test -z "$L" && {
|
|
eval "$name=''"
|
|
return
|
|
}
|
|
OIFS=$IFS
|
|
IFS=" /"
|
|
set $L
|
|
eval "$name=$2"
|
|
IFS=$OIFS
|
|
}
|
|
|
|
|
|
getinterfaces() {
|
|
NAME=$1
|
|
$IP link show | grep ": $NAME" | while read L; do
|
|
OIFS=$IFS
|
|
IFS=" :"
|
|
set $L
|
|
IFS=$OIFS
|
|
echo $2
|
|
done
|
|
}
|
|
|
|
|
|
# increment ip address
|
|
incaddr()
|
|
{
|
|
n1=$4
|
|
n2=$3
|
|
n3=$2
|
|
n4=$1
|
|
|
|
vn1=`eval "echo \\$$n1"`
|
|
|
|
R=`expr $vn1 \< 255`
|
|
if test $R = "1"; then
|
|
eval "$n1=`expr $vn1 + 1`"
|
|
else
|
|
eval "$n1=0"
|
|
incaddr XX $n4 $n3 $n2
|
|
fi
|
|
}
|
|
|
|
|
|
prolog_commands() {
|
|
echo "Running prolog script"
|
|
|
|
}
|
|
|
|
epilog_commands() {
|
|
echo "Running epilog script"
|
|
|
|
}
|
|
|
|
run_epilog_and_exit() {
|
|
epilog_commands
|
|
exit $1
|
|
}
|
|
|
|
if $IP link ls >/dev/null 2>&1; then
|
|
echo;
|
|
else
|
|
echo "iproute not found"
|
|
exit 1
|
|
fi
|
|
|
|
prolog_commands
|
|
|
|
|
|
MODULES_DIR="/lib/modules/`uname -r`/kernel/net/"
|
|
MODULES=`find $MODULES_DIR -name '*conntrack*'|sed -e 's/^.*\///' -e 's/\([^\.]\)\..*/\1/'`
|
|
for module in $MODULES; do
|
|
if $LSMOD | grep ${module} >/dev/null; then continue; fi
|
|
$MODPROBE ${module} || exit 1
|
|
done
|
|
|
|
|
|
# Using 0 address table files
|
|
|
|
|
|
INTERFACES="eth0 lo eth1 eth2 eth3 "
|
|
for i in $INTERFACES ; do
|
|
$IP link show "$i" > /dev/null 2>&1 || {
|
|
log "Interface $i does not exist"
|
|
exit 1
|
|
}
|
|
done
|
|
|
|
|
|
# Configure interfaces
|
|
getaddr eth0 i_eth0
|
|
getaddr6 eth0 i_eth0_v6
|
|
getaddr eth1 i_eth1
|
|
getaddr6 eth1 i_eth1_v6
|
|
getaddr eth2 i_eth2
|
|
getaddr6 eth2 i_eth2_v6
|
|
getaddr eth3 i_eth3
|
|
getaddr6 eth3 i_eth3_v6
|
|
|
|
# Add virtual addresses for NAT rules
|
|
|
|
|
|
log 'Activating firewall script generated Wed Dec 9 10:14:36 2009 by wia'
|
|
|
|
|
|
|
|
# ================ IPv4
|
|
|
|
|
|
# ================ Table 'filter', automatic rules
|
|
$IPTABLES -P OUTPUT DROP
|
|
$IPTABLES -P INPUT DROP
|
|
$IPTABLES -P FORWARD DROP
|
|
|
|
cat /proc/net/ip_tables_names | while read table; do
|
|
$IPTABLES -t $table -L -n | while read c chain rest; do
|
|
if test "X$c" = "XChain" ; then
|
|
$IPTABLES -t $table -F $chain
|
|
fi
|
|
done
|
|
$IPTABLES -t $table -X
|
|
done
|
|
|
|
|
|
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
# ================ Table 'filter', rule set Policy
|
|
# Policy compiler errors and warnings:
|
|
#
|
|
#
|
|
# Rule 0 (lo)
|
|
#
|
|
echo "Rule 0 (lo)"
|
|
#
|
|
# Allow anything on loopback
|
|
#
|
|
$IPTABLES -A INPUT -i lo -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o lo -m state --state NEW -j ACCEPT
|
|
#
|
|
# Rule 1 (global)
|
|
#
|
|
echo "Rule 1 (global)"
|
|
#
|
|
# Anti-spoofing rule
|
|
#
|
|
$IPTABLES -N In_RULE_1
|
|
test -n "$i_eth0" && $IPTABLES -A INPUT -s $i_eth0 -j In_RULE_1
|
|
test -n "$i_eth1" && $IPTABLES -A INPUT -s $i_eth1 -j In_RULE_1
|
|
test -n "$i_eth2" && $IPTABLES -A INPUT -s $i_eth2 -j In_RULE_1
|
|
test -n "$i_eth3" && $IPTABLES -A INPUT -s $i_eth3 -j In_RULE_1
|
|
test -n "$i_eth0" && $IPTABLES -A FORWARD -i + -s $i_eth0 -j In_RULE_1
|
|
test -n "$i_eth1" && $IPTABLES -A FORWARD -i + -s $i_eth1 -j In_RULE_1
|
|
test -n "$i_eth2" && $IPTABLES -A FORWARD -i + -s $i_eth2 -j In_RULE_1
|
|
test -n "$i_eth3" && $IPTABLES -A FORWARD -i + -s $i_eth3 -j In_RULE_1
|
|
$IPTABLES -A In_RULE_1 -j LOG --log-level warning --log-prefix "FW-RULE 1 -- DENY " --log-tcp-options --log-ip-options
|
|
$IPTABLES -A In_RULE_1 -j DROP
|
|
#
|
|
# Rule 2 (eth0,eth1)
|
|
#
|
|
echo "Rule 2 (eth0,eth1)"
|
|
#
|
|
# Allow services on eth0
|
|
#
|
|
$IPTABLES -A INPUT -i eth0 -p tcp -m tcp --dport 8001:8010 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -i eth0 -p tcp -m tcp -m multiport --dports 7,5432,53 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -i eth0 -p udp -m udp -m multiport --dports 53,123 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -i eth1 -p tcp -m tcp --dport 8001:8010 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -i eth1 -p tcp -m tcp -m multiport --dports 7,5432,53 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -i eth1 -p udp -m udp -m multiport --dports 53,123 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth0 -p tcp -m tcp --dport 8001:8010 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth0 -p tcp -m tcp -m multiport --dports 7,5432,53 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth0 -p udp -m udp -m multiport --dports 53,123 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth1 -p tcp -m tcp --dport 8001:8010 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth1 -p tcp -m tcp -m multiport --dports 7,5432,53 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth1 -p udp -m udp -m multiport --dports 53,123 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth0 -p tcp -m tcp --dport 8001:8010 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth0 -p tcp -m tcp -m multiport --dports 7,5432,53 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth0 -p udp -m udp -m multiport --dports 53,123 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth1 -p tcp -m tcp --dport 8001:8010 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth1 -p tcp -m tcp -m multiport --dports 7,5432,53 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth1 -p udp -m udp -m multiport --dports 53,123 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth0 -p tcp -m tcp --dport 8001:8010 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth0 -p tcp -m tcp -m multiport --dports 7,5432,53 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth0 -p udp -m udp -m multiport --dports 53,123 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth1 -p tcp -m tcp --dport 8001:8010 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth1 -p tcp -m tcp -m multiport --dports 7,5432,53 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth1 -p udp -m udp -m multiport --dports 53,123 -m state --state NEW -j ACCEPT
|
|
#
|
|
# Rule 3 (global)
|
|
#
|
|
echo "Rule 3 (global)"
|
|
#
|
|
# Allow services in
|
|
#
|
|
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 8/0 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 11/0 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 11/1 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 0/0 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 3 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -p tcp -m tcp -m multiport --dports 22,1306 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -p udp -m udp -m multiport --dports 162,514,161,9991 -m state --state NEW -j ACCEPT
|
|
#
|
|
# Rule 6 (global)
|
|
#
|
|
echo "Rule 6 (global)"
|
|
#
|
|
# Allow services out
|
|
#
|
|
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 11/0 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 11/1 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 0/0 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 3 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 8/0 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -p tcp -m tcp --dport 1:9999 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -p udp -m udp --dport 1:9999 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -p udp -m udp --dport 33434:33524 -m state --state NEW -j ACCEPT
|
|
#
|
|
# Rule 7 (global)
|
|
#
|
|
echo "Rule 7 (global)"
|
|
#
|
|
# Let the DNCS talk
|
|
#
|
|
$IPTABLES -A INPUT -s 10.253.0.1 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -s 192.168.2.1 -m state --state NEW -j ACCEPT
|
|
#
|
|
# Rule 8 (global)
|
|
#
|
|
echo "Rule 8 (global)"
|
|
#
|
|
# Ignore customer incoming broadcasts
|
|
#
|
|
$IPTABLES -A INPUT -d 255.255.255.255 -j DROP
|
|
#
|
|
# Rule 9 (global)
|
|
#
|
|
echo "Rule 9 (global)"
|
|
#
|
|
# Ignore chatty stuff
|
|
#
|
|
$IPTABLES -A INPUT -p tcp -m tcp --dport 139 -j DROP
|
|
$IPTABLES -A INPUT -p udp -m udp -m multiport --dports 138,137,6157,68,5757,67 -j DROP
|
|
#
|
|
# Rule 10 (global)
|
|
#
|
|
echo "Rule 10 (global)"
|
|
#
|
|
# Ignore multicast
|
|
#
|
|
$IPTABLES -A INPUT -d 224.0.0.0/4 -j DROP
|
|
#
|
|
# Rule 11 (global)
|
|
#
|
|
echo "Rule 11 (global)"
|
|
#
|
|
# Deny and log catch all
|
|
#
|
|
$IPTABLES -N RULE_11
|
|
$IPTABLES -A OUTPUT -j RULE_11
|
|
$IPTABLES -A INPUT -j RULE_11
|
|
$IPTABLES -A FORWARD -j RULE_11
|
|
$IPTABLES -A RULE_11 -j LOG --log-level info --log-prefix "FW-RULE 11 -- DENY " --log-tcp-options --log-ip-options
|
|
$IPTABLES -A RULE_11 -j DROP
|
|
|
|
epilog_commands
|
|
|
|
|
|
|