summaryrefslogtreecommitdiffstats
path: root/roles/common
diff options
context:
space:
mode:
Diffstat (limited to 'roles/common')
-rwxr-xr-xroles/common/files/usr/local/sbin/update-firewall.sh199
-rw-r--r--roles/common/handlers/main.yml5
-rw-r--r--roles/common/tasks/firewall.yml14
3 files changed, 126 insertions, 92 deletions
diff --git a/roles/common/files/usr/local/sbin/update-firewall.sh b/roles/common/files/usr/local/sbin/update-firewall.sh
index a1589de..ed0649b 100755
--- a/roles/common/files/usr/local/sbin/update-firewall.sh
+++ b/roles/common/files/usr/local/sbin/update-firewall.sh
@@ -1,169 +1,211 @@
#!/bin/bash
#
# Create iptables (v4 and v6) rules. Unless one of [-f] or [-c] is
# given, a confirmation is asked after loading the new rulesets; if the
# user answers No or doesn't answer, the old ruleset is restored. If the
# user answer Yes (or if the flag [-f] is given), the new ruleset is
-# made persistent using iptables-persistent.
+# then stored under /etc/iptables/rules.v[46].
#
# The [-c] flag switch to dry-run (check) mode. The rulesets are not
# applied, but merely checked against the existing ones. If they differ
# the return value is one, and 0 otherwise.
#
# This firewall is only targeted towards end-servers, not gateways. In
# particular, there is no NAT'ing at the moment.
#
# Dependencies: netmask(1)
#
# Copyright 2013 Guilhem Moulin <guilhem@fripost.org>
#
# Licensed under the GNU GPL version 3 or higher.
#
set -ue
PATH=/usr/sbin:/usr/bin:/sbin:/bin
timeout=10
force=0
check=0
usage() {
echo "Usage: $0 [-c|-f]" >&2
exit 1
}
-[ $# -le 1 ] || usage
-case "${1:-}" in
- -f) force=1;;
- -c) check=1;;
- ?*) usage
-esac
-
-[ "${1:-}" = -f ] && force=1
-if ! /usr/bin/tty -s && [ $force -eq 0 ]; then
- echo "Error: Not a TTY. Try with -f (at your own risks)!" >&2
+log() {
+ /usr/bin/logger -st firewall -p syslog.info -- "$@"
+}
+fatal() {
+ /usr/bin/logger -st firewall -p syslog.err -- "$@"
exit 1
-fi
-
-getInteface() {
- /sbin/ip -f "$1" route | sed -nr 's/^default via .*dev (\S+).*/\1/p' | head -1
}
-WAN=$( getInteface inet )
-WAN6=$(getInteface inet6)
-
-oldv4table=$(mktemp)
-newv4table=$(mktemp)
-
-oldv6table=$(mktemp)
-newv6table=$(mktemp)
+getInterface() {
+ # Get the default interface associated with an address family
+ /bin/ip -f "$1" route show to default scope "${2:-global}" \
+ | sed -nr '/^default via \S+ dev (\S+).*/ {s//\1/p;q}'
+}
iptables() {
- [ -z "$WAN" ] || { echo "$@" >> "$newv4table"; }
+ # Fake iptables(8); use the more efficient iptables-restore(8) instead
+ [ -z "$WAN" ] || { echo "$@" >> "$newv4"; }
}
ip6tables() {
- [ -z "$WAN6" ] || { echo "$@" >> "$newv6table"; }
+ # Fake ip6tables(8); use the more efficient ip6tables-restore(8) instead
+ [ -z "$WAN6" ] || { echo "$@" >> "$newv6"; }
}
tgrep() {
- [ -z "$WAN" ] || { /bin/grep -E -- "$@" "$oldv4table" >> "$newv4table" || true; }
- [ -z "$WAN6" ] || { /bin/grep -E -- "$@" "$oldv6table" >> "$newv6table" || true; }
+ # Grep some rules from the old rulesets and add them to each new ruleset.
+ [ -z "$WAN" ] || { grep -E -- "$@" "$oldv4" >> "$newv4" || true; }
+ [ -z "$WAN6" ] || { grep -E -- "$@" "$oldv6" >> "$newv6" || true; }
}
-log() {
- /usr/bin/logger -st firewall -p syslog.info -- "$@"
+
+ipt-trim() {
+ # Remove dynamic chain/rules from the input stream, as they are
+ # automatically included by third-party servers (such as strongSwan
+ # or fail2ban). The output is ready to be made persistent.
+ grep -Ev -e '^:fail2ban-\S' \
+ -e "$IPSec_re" \
+ -e '-j fail2ban-\S+$' \
+ -e "$fail2ban_re"
}
-fatal() {
- /usr/bin/logger -st firewall -p syslog.err -- "$@"
- exit 1
+
+ipt-reset-counters() {
+ # Reset the counters. They are not useful for comparing and/or
+ # storing persistent ruleset.
+ sed -ri -e '/^:/ s/\[[0-9]+:[0-9]+\]$/[0:0]/' \
+ -e 's/^\[[0-9]+:[0-9]+\]\s+//' \
+ "$@"
}
-save() {
- mkdir -p /etc/iptables
- /sbin/iptables-save > /etc/iptables/rules.v4
- /sbin/ip6tables-save > /etc/iptables/rules.v6
-
- # Ignore the counters
- sed -ri 's/^(:.*)\[[0-9]+:[0-9]+\]$/\1[0:0]/' \
- /etc/iptables/rules.v4 /etc/iptables/rules.v6
+ipt-save() {
+ # Make the current ruleset persistent. (Requires a pre-up hook
+ # script to load the rules before the network is configured.)
+
+ [ -d /etc/iptables ] || mkdir /etc/iptables
+ /sbin/iptables-save -t filter | ipt-trim > /etc/iptables/rules.v4
+ /sbin/ip6tables-save -t filter | ipt-trim > /etc/iptables/rules.v6
+
+ chmod 0600 /etc/iptables/rules.v4 /etc/iptables/rules.v6
+ ipt-reset-counters /etc/iptables/rules.v4 /etc/iptables/rules.v6
+}
+
+ipt-diff() {
+ /usr/bin/diff -qI '^#' "$1" "$2" >/dev/null
}
-iptdiff() {
- local v="$1" old="$2" new="$3" rv1=0 rv2=0
+isOK() {
+ # Check the difference between the persistent, current, and new
+ # rulesets (but only if the interface is defined). The current
+ # ruleset is trimmed before checking whether it's persistent.
+ local v="$1" old="$2" new="$3" if="${4:-}"
+ local rv1=0 rv2=0 persistent=/etc/iptables/rules.$v
- diff -qI '^#' "$old" "$new" >/dev/null || rv1=$?
- if [ -f /etc/iptables/rules.$v ]; then
- diff -qI '^#' "$old" /etc/iptables/rules.$v >/dev/null || rv2=$?
- else
+ ipt-reset-counters "$old"
+ [ -z "$if" ] || ipt-diff "$old" "$new" || rv1=$?
+
+ if ! [ -f "$persistent" -a -x /etc/network/if-pre-up.d/iptables ]; then
rv2=1
+ elif [ -n "$if" ]; then
+ # Ignore persistency check if the address family is not of
+ # globally scoped.
+ ipt-trim < "$old" | ipt-diff - "$persistent" || rv2=$?
fi
- [ $rv1 -eq 0 ] || log "WARN: The IP$v firewall is not up to date! Please run '$0'."
- [ $rv2 -eq 0 ] || log "WARN: The current IP$v firewall is not persistent! Please run '$0'."
+ local update="Please run '${0##*/}'."
+ [ $rv1 -eq 0 ] || log "WARN: The IP$v firewall is not up to date! $update"
+ [ $rv2 -eq 0 ] || log "WARN: The current IP$v firewall is not persistent! $update"
return $(( $rv1 | $rv2 ))
}
+
+[ $# -le 1 ] || usage
+case "${1:-}" in
+ -f) force=1;;
+ -c) check=1;;
+ ?*) usage
+esac
+
+[ "${1:-}" = -f ] && force=1
+if ! /usr/bin/tty -s && [ $force -eq 0 ]; then
+ echo "Error: Not a TTY. Try with -f (at your own risks)!" >&2
+ exit 1
+fi
+
+WAN=$( getInterface inet )
+WAN6=$(getInterface inet6)
+
+oldv4=$(mktemp)
+newv4=$(mktemp)
+
+oldv6=$(mktemp)
+newv6=$(mktemp)
+
[ -n "$WAN" -o -n "$WAN6" ] || fatal "Error: couldn't find a network interface"
+IPSec_re=' -m policy --dir (in|out) --pol ipsec .* --proto esp -j ACCEPT$'
+fail2ban_re='^(\[[0-9]+:[0-9]+\]\s+)?-A fail2ban-\S'
+
# Store the existing table
-/sbin/iptables-save -t filter > "$oldv4table"
-/sbin/ip6tables-save -t filter > "$oldv6table"
+/sbin/iptables-save -ct filter > "$oldv4"
+/sbin/ip6tables-save -ct filter > "$oldv6"
# The usual chains in filter, along with the desired default policies.
-cat > "$newv4table" <<- EOF
+cat > "$newv4" <<- EOF
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:fail2ban - [0:0]
EOF
-cp -f "$newv4table" "$newv6table"
+cp -f "$newv4" "$newv6"
-# Also, keep fail2ban chains
-tgrep ':fail2ban-'
+# Keep fail2ban chains, traps, and existing rules.
+tgrep ':fail2ban-\S'
+tgrep ' -j fail2ban-\S+$'
+tgrep "$fail2ban_re"
# (Host-to-host) IPSec tunnels come first. TODO: test IPSec on IPv6.
-tgrep ' -m policy --dir (in|out) --pol ipsec .* --proto esp -j ACCEPT$'
+tgrep "$IPSec_re"
# Allow any IPsec ESP protocol packets to be sent and received.
iptables -A INPUT -i $WAN -p esp -j ACCEPT
iptables -A OUTPUT -o $WAN -p esp -j ACCEPT
ip6tables -A INPUT -i $WAN6 -p esp -j ACCEPT
ip6tables -A OUTPUT -o $WAN6 -p esp -j ACCEPT
-# Then we have the fail2ban traps
-tgrep ' -j fail2ban-\S+$'
-
-
##################################################################################
# DROP all RFC1918 addresses, martian networks, multicasts, ...
# Credits to http://newartisans.com/2007/09/neat-tricks-with-iptables/
# http://baldric.net/loose-iptables-firewall-for-servers/
if [ -n "$WAN" ]; then
# Private-use networks (RFC 1918) and link local (RFC 3927)
- MyNetwork=$( /bin/ip addr show "$WAN" \
- | sed -nr "s/^\s+inet\s(\S+).*\bscope global ($WAN)?$/\1/p")
+ MyNetwork=$( /bin/ip -4 addr show dev "$WAN" scope global \
+ | sed -nr 's/^\s+inet\s(\S+).*/\1/p')
[ -n "$MyNetwork" ] && \
for ip in 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16; do
+ # Don't lock us out if we are behind a NAT ;-)
[ "$ip" = "$(/usr/bin/netmask -nc $ip $MyNetwork | sed 's/ //g')" ] \
|| iptables -A INPUT -i $WAN -s "$ip" -j DROP
done
# Other martian packets: "This" network, multicast, broadcast (RFCs
# 1122, 3171 and 919).
for ip in 0.0.0.0/8 224.0.0.0/4 240.0.0.0/4 255.255.255.255/32; do
iptables -A INPUT -i $WAN -s "$ip" -j DROP
iptables -A INPUT -i $WAN -d "$ip" -j DROP
done
fi
# Martian IPv6 packets: ULA (RFC 4193) and site local addresses (RFC
# 3879).
for ip6 in fc00::/7 fec0::/10
do
ip6tables -A INPUT -i $WAN6 -s "$ip6" -j DROP
ip6tables -A INPUT -i $WAN6 -d "$ip6" -j DROP
done
@@ -184,41 +226,41 @@ ip6tables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
# Prepare fail2ban. We make fail2ban insert its rules in a dedicated
# chain, so that it doesn't mess up the existing rules.
# XXX: As of Wheezy, fail2ban is IPv4 only. See
# https://github.com/fail2ban/fail2ban/issues/39 for the current
# state of the art.
iptables -A INPUT -i $WAN -j fail2ban
# Allow all input/output to/from the loopback interface.
iptables -A INPUT -i lo -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT
iptables -A OUTPUT -o lo -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT
ip6tables -A INPUT -i lo -s ::1/128 -d ::1/128 lo -j ACCEPT
ip6tables -A OUTPUT -o lo -s ::1/128 -d ::1/128 lo -j ACCEPT
# Allow only ICMP of type 0, 3 and 8. The rate-limiting is done directly
# by the kernel (net.ipv4.icmp_ratelimit and net.ipv4.icmp_ratemask
# runtime options). See icmp(7).
-for type in echo-reply destination-unreachable echo-request; do
+for type in 'echo-reply' 'destination-unreachable' 'echo-request'; do
iptables -A INPUT -i $WAN -p icmp -m icmp --icmp-type $type -j ACCEPT
iptables -A OUTPUT -o $WAN -p icmp -m icmp --icmp-type $type -j ACCEPT
done
ip6tables -A INPUT -i $WAN6 -p icmpv6 -j ACCEPT
##################################################################################
# ACCEPT new connections to the services we provide, or to those we want
# to connect to.
sed -re 's/#.*//; /^\s*$/d' -e 's/^(in|out|inout)\b(.*)/\14\2\n\16\2/' \
/etc/iptables/services | \
while read dir proto dport sport; do
# We add two entries per config line: we need to accept the new
# connection, and latter the reply.
stNew=NEW,ESTABLISHED
stEst=ESTABLISHED
# In-Out means full-duplex
[[ "$dir" =~ ^inout ]] && stEst="$stNew"
@@ -237,73 +279,70 @@ while read dir proto dport sport; do
?*) optsNew+=" --sport $sport"
optsEst+=" --dport $sport";;
esac
case "$dir" in
in[46]|inout[46]) iptNew="-A INPUT -i"; iptEst="-A OUTPUT -o";;
out[46]) iptNew="-A OUTPUT -o"; iptEst="-A INPUT -i";;
*) fatal "Error: Unknown direction: '$dir'."
esac
case "$dir" in
*4) ipt="iptables"; if=$WAN;;
*6) ipt="ip6tables"; if=$WAN6;;
esac
$ipt $iptNew $if -p $proto $optsNew -m state --state $stNew -j ACCEPT
$ipt $iptEst $if -p $proto $optsEst -m state --state $stEst -j ACCEPT
done
##################################################################################
-# And last come the fail2ban rules.
-tgrep '^-[AI] fail2ban-\S+ '
-echo COMMIT >> "$newv4table"
-echo COMMIT >> "$newv6table"
+echo COMMIT >> "$newv4"
+echo COMMIT >> "$newv6"
netns=
innetns=
if [ $check -eq 1 ]; then
# Create an alternative net namespace in which we apply the ruleset,
# so we can easily get a normalized version we can compare latter.
# See http://bugzilla.netfilter.org/show_bug.cgi?id=790
netns="ipt-firewall-test-$$"
/bin/ip netns add $netns
innetns="/bin/ip netns exec $netns"
fi
-/usr/bin/uniq "$newv4table" | $innetns /sbin/iptables-restore
-/usr/bin/uniq "$newv6table" | $innetns /sbin/ip6tables-restore
+/usr/bin/uniq "$newv4" | $innetns /sbin/iptables-restore
+/usr/bin/uniq "$newv6" | $innetns /sbin/ip6tables-restore
rv=0
if [ $check -eq 1 ]; then
- $innetns /sbin/iptables-save > "$newv4table"
- $innetns /sbin/ip6tables-save > "$newv6table"
+ # Normalize the new rulesets
+ $innetns /sbin/iptables-save -t filter > "$newv4"
+ $innetns /sbin/ip6tables-save -t filter > "$newv6"
/bin/ip netns del $netns
- # Reset the counters, they are not relevant here
- sed -ri 's/^(:.*)\[[0-9]+:[0-9]+\]$/\1[0:0]/' "$oldv4table" "$oldv6table"
- iptdiff v4 "$oldv4table" "$newv4table" || rv=$(( $rv | $? ))
- iptdiff v6 "$oldv6table" "$newv6table" || rv=$(( $rv | $? ))
+ isOK v4 "$oldv4" "$newv4" $WAN || rv=$(( $rv | $? ))
+ isOK v6 "$oldv6" "$newv6" $WAN6 || rv=$(( $rv | $? ))
elif [ $force -eq 1 ]; then
# At the user's own risks...
- save
+ ipt-save
else
echo "Try now to establish NEW connections to the machine."
read -n1 -t$timeout \
-p "Are you sure you want to use the new ruleset? (y/N) " \
ret 2>&1 || { [ $? -gt 128 ] && echo -n "Timeout..."; }
case "${ret:-N}" in
- [yY]*) echo; save
+ [yY]*) echo; ipt-save
;;
- *) log "Reverting to old ruleset... "; echo
- /sbin/iptables-restore -c < "$oldv4table"
- /sbin/ip6tables-restore -c < "$oldv6table"
+ *) echo; log "Reverting to old ruleset... "
+ /sbin/iptables-restore -c < "$oldv4"
+ /sbin/ip6tables-restore -c < "$oldv6"
rv=1
;;
esac
fi
-rm -f "$oldv4table" "$newv4table" "$oldv6table" "$newv6table"
+rm -f "$oldv4" "$newv4" "$oldv6" "$newv6"
exit $rv
diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml
index 2ef3253..a64a236 100644
--- a/roles/common/handlers/main.yml
+++ b/roles/common/handlers/main.yml
@@ -1,26 +1,21 @@
---
- name: Refresh hostname
service: name=hostname.sh state=restarted
- name: apt-get update
apt: update_cache=yes
-- name: Unsafe firewall update
- fail: msg="The firewall has been updated, but not activated yet; an unsafe
- update may lock you and others out! Please log in to '{{ ansible_fqdn }}' and
- manually run 'sudo update-firewall.sh'."
-
- name: Reload samhain
service: name=samhain state=reloaded
- name: Update rkhunter's data file
command: /usr/bin/rkhunter --propupd
- name: Restart fail2ban
service: name=fail2ban state=restarted
- name: Missing IPSec certificate
fail: msg="strongswan IPsec is lacking public or private keys on '{{ ansible_fqdn }}'."
- name: Restart IPSec
service: name=ipsec state=restarted
diff --git a/roles/common/tasks/firewall.yml b/roles/common/tasks/firewall.yml
index d15384a..b1cd9b1 100644
--- a/roles/common/tasks/firewall.yml
+++ b/roles/common/tasks/firewall.yml
@@ -6,32 +6,32 @@
- bsdutils
- name: Create directory /etc/iptables
file: path=/etc/iptables
owner=root group=root
state=directory
mode=0755
- name: Generate /etc/iptables/services
template: src=etc/iptables/services.j2
dest=/etc/iptables/services
owner=root group=root
mode=0600
- name: Copy /usr/local/sbin/update-firewall.sh
copy: src=usr/local/sbin/update-firewall.sh
dest=/usr/local/sbin/update-firewall.sh
owner=root group=root
mode=0755
-- name: Ensure the firewall is up to date
- command: /usr/local/sbin/update-firewall.sh -c
- register: rv
- changed_when: rv.rc
- notify:
- - Unsafe firewall update
-
- name: Make the iptable ruleset persistent
copy: src=etc/network/if-pre-up.d/iptables
dest=/etc/network/if-pre-up.d/iptables
owner=root group=root
mode=0755
+
+- name: Ensure the firewall is up to date
+ command: /usr/local/sbin/update-firewall.sh -c
+ register: rv
+ # A non-zero return value will make ansible stop and show stderr. This
+ # is what we want.
+ changed_when: rv.rc
generated by cgit v1.2.3 (git 2.25.1) at 2025-09-24 15:33:08 +0000