crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[./gestion/gen_confs/firewall.py] On evite le ssh-bruteforcing

Browse source 
darcs-hash:20091002225256-8fbb1-6adea8206e8971f754cd042fa86378e29e81b80f.gz
This commit is contained in:
Olivier Huber 2009-10-03 00:52:56 +02:00
parent ea2ff81b38
commit e06b757c1b
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
gestion/gen_confs/firewall.py
View file

@ -867,6 +867,12 @@ class firewall_komaz(firewall_crans) :
if not self.build_chaine('EXT_VERS_SERVEURS', self.__ext_vers_serveurs) :
self.anim.reinit()
print OK
# Attention les règles sont à l'envers. Hint '-I'
iptables("-I EXT_VERS_SERVEURS -p tcp --dport ssh -m state --state NEW -j ACCEPT")
iptables("-I EXT_VERS_SERVEURS -p tcp --dport ssh -m state --state NEW\
-m recent --name SSH --update --seconds 60 --hitcount 4 --rttl -j DROP")
iptables("-I EXT_VERS_SERVEURS -p tcp --dport ssh -m state --state NEW\
-m recent --name SSH --set")
def crans_vers_ext(self) :
""" Reconstruit la chaîne CRANS_VERS_EXT """
@ -875,6 +881,12 @@ class firewall_komaz(firewall_crans) :
def ext_vers_crans(self) :
""" Reconstruit la chaîne EXT_VERS_CRANS """
self.build_chaine_adherent('EXT_VERS_CRANS',self.__ext_vers_crans)
# Attention les règles sont à l'envers. Hint '-I'
iptables("-I EXT_VERS_CRANS -p tcp --dport ssh -m state --state NEW -j ACCEPT")
iptables("-I EXT_VERS_CRANS -p tcp --dport ssh -m state --state NEW\
-m recent --name SSH --update --seconds 60 --hitcount 4 --rttl -j DROP")
iptables("-I EXT_VERS_CRANS -p tcp --dport ssh -m state --state NEW\
-m recent --name SSH --set")
def admin_vlan(self) :
""" Reconstruit la chaîne ADMIN_VLAN """