crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[firewall] Ouverture des ports nécessaires au NFS

Browse source 
Les ports ouverts sont :
 - portmap (111)
 - NFS (2049)
 - statd (32765, 32766)
 - mountd (32767)
 - quotad (32768)

Pour forcer les ports, on utilise sur fx les instructions de http://wiki.debian.org/SecuringNFS

darcs-hash:20100302153259-ffbb2-3a33f9d302ed2af1c2bc884c5e468f6a3384bf7f.gz
This commit is contained in:
Nicolas Dandrimont 2010-03-02 16:32:59 +01:00
parent 454a2776f5
commit 293870c436
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
gestion/gen_confs/firewall.py
View file

@ -1058,6 +1058,7 @@ class firewall_zamok(firewall_crans) :
# interfaces physiques
eth_pub = "crans"
eth_adm = "crans.2"
nfs_ports = ["111", "2049", "32765:32769"]
def serv_out_adm(self) :
self.anim = anim('\tOutput vers VLAN adm', len(adm_users))
@ -1077,8 +1078,9 @@ class firewall_zamok(firewall_crans) :
iptables("-A SERV_OUT_ADM -p udp --dport domain -j ACCEPT")
# Pour le nfs (le paquet à laisser passer n'a pas d'owner)
iptables("-A SERV_OUT_ADM -d nfs.adm.crans.org -m owner ! --uid-owner 0 -j REJECT --reject-with icmp-net-prohibited")
iptables("-A SERV_OUT_ADM -d nfs.adm.crans.org -j ACCEPT")
for port in self.nfs_ports:
iptables("-A SERV_OUT_ADM -p tcp --dport %s -d fx.adm.crans.org -j ACCEPT" % port)
iptables("-A SERV_OUT_ADM -p udp --dport %s -d fx.adm.crans.org -j ACCEPT" % port)
# Rien d'autre ne passe
iptables("-A SERV_OUT_ADM -j REJECT --reject-with icmp-net-prohibited")