crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

On laisse un ttl plus faible pour le forwarding en ssh

Browse source
This commit is contained in:
Pierre-Elliott Bécue 2015-06-06 01:15:54 +02:00
parent a70205526f
commit 6740e96610
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
gestion/gen_confs/firewall4/komaz.py
View file

@ -116,7 +116,7 @@ class firewall(base.firewall_routeur):
self.add(table, chain, '-j %s' % self.connexion_appartement(table)) self.add(table, chain, '-j %s' % self.connexion_appartement(table))
self.add(table, chain, '-j %s' % self.connexion_wififederez(table)) self.add(table, chain, '-j %s' % self.connexion_wififederez(table))
self.add(table, chain, '-j %s' % self.ingress_filtering(table)) self.add(table, chain, '-j %s' % self.ingress_filtering(table))
self.add(table, chain, '-j %s' % self.limit_ssh_connexion(table)) self.add(table, chain, '-j %s' % self.limit_ssh_connexion(table, ttl=30))
self.add(table, chain, '-i %s -j %s' % (dev['out'], self.filtrage_ports(table))) self.add(table, chain, '-i %s -j %s' % (dev['out'], self.filtrage_ports(table)))
self.add(table, chain, '-o %s -j %s' % (dev['out'], self.filtrage_ports(table))) self.add(table, chain, '-o %s -j %s' % (dev['out'], self.filtrage_ports(table)))
return return
@ -151,13 +151,13 @@ class firewall(base.firewall_routeur):
self.apply(table, chain) self.apply(table, chain)
return chain return chain
def limit_ssh_connexion(self, table=None, apply=False): def limit_ssh_connexion(self, table=None, apply=False, ttl=120):
chain = 'LIMIT-SSH-CONNEXION' chain = 'LIMIT-SSH-CONNEXION'
if table == 'filter': if table == 'filter':
pretty_print(table, chain) pretty_print(table, chain)
self.add(table, chain, '-i %s -p tcp --dport ssh -m state --state NEW -m recent --name SSH --set' % dev['out']) self.add(table, chain, '-i %s -p tcp --dport ssh -m state --state NEW -m recent --name SSH --set' % dev['out'])
self.add(table, chain, '-i %s -p tcp --dport ssh -m state --state NEW -m recent --name SSH --update --seconds 120 --hitcount 10 --rttl -j DROP' % dev['out']) self.add(table, chain, '-i %s -p tcp --dport ssh -m state --state NEW -m recent --name SSH --update --seconds %s --hitcount 10 --rttl -j DROP' % (dev['out'], ttl))
print OK print OK
if apply: if apply: