Splitting from dev_urandom

2 files changed, 239 insertions, 0 deletions

diff --git a/firewall b/firewall
new file mode 100644
index 0000000..d19f0ce
--- /dev/null
+++ b/firewall
@@ -0,0 +1,179 @@
+# Make sure we have all the commands to continue
+if [[ ! `which iptables` || ! `which ifconfig` || ! `which grep` || ! `which sed` ]]; then
+        echo 'Essential commands are missing. Can not continue.'
+        exit 1
+fi
+
+# Check for root
+if [[ $UID != 0 ]]; then
+        echo 'You are not root.'
+        exit 1
+fi
+
+# First set LC_ALL to en to avoid l10n problems when awk-ing IPs etc.
+export LC_ALL="en"
+
+# Source our configuration file
+source /etc/firewall.conf
+
+# Go into lockdown mode while we setup the rules
+iptables -P INPUT   DROP
+iptables -P OUTPUT  DROP
+iptables -P FORWARD DROP
+
+# Flush all existing chains and erase personal chains
+CHAINS=`cat /proc/net/ip_tables_names 2>/dev/null`
+for i in $CHAINS; do
+        iptables -t $i -F
+        iptables -t $i -X
+done
+echo 1 > /proc/sys/net/ipv4/tcp_syncookies
+echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
+
+# Source Address Verification
+for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
+        echo 1 > $f
+done
+
+# Disable IP source routing and ICMP redirects
+for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
+        echo 0 > $f
+done
+for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
+        echo 0 > $f
+done
+echo 1 > /proc/sys/net/ipv4/ip_forward
+
+# Determine the IP/Broadcast/Netmask for the outside interface
+# dynamically by grepping ifconfig commands
+#
+# Due to absence of EXTBC in ifconfig output I manually set it 
+# to 255.255.255.255 this hopefully will serve the same purpose
+EXTIP="`ifconfig $EXTIF|grep addr:|sed 's/.*addr:\([^ ]*\) .*/\1/'`"
+EXTBC="255.255.255.255"
+EXTMSK="`ifconfig $EXTIF|grep Mask:|sed 's/.*Mask:\([^ ]*\)/\1/'`"
+EXTNET="$EXTIP/$EXTMSK"
+echo "EXTIP=$EXTIP EXTBC=$EXTBC EXTMSK=$EXTMSK EXTNET=$EXTNET"
+
+# Determine the IP/Broadcast/Netmask for the outside interface
+# dynamically by grepping ifconfig commands
+INTIP="`ifconfig $INTIF|grep addr:|sed 's/.*addr:\([^ ]*\) .*/\1/'`"
+INTBC="`ifconfig $INTIF|grep Bcast:|sed 's/.*Bcast:\([^ ]*\) .*/\1/'`"
+INTMSK="`ifconfig $INTIF|grep Mask:|sed 's/.*Mask:\([^ ]*\)/\1/'`"
+INTNET="$INTIP/$INTMSK"
+echo "INTIP=$INTIP INTBC=$INTBC INTMSK=$INTMSK INTNET=$INTNET"
+
+# We are now going to create a few custom chains that will result in
+# logging of dropped packets. This will enable us to avoid having to
+# enter a log command prior to every drop we wish to log. The
+# first will be first log drops the other will log rejects.
+# Do not complain if chain already exists (so restart is clean)
+iptables -N DROPl   2> /dev/null
+iptables -A DROPl   -j LOG --log-prefix 'DROPl:'
+iptables -A DROPl   -j DROP
+iptables -N REJECTl 2> /dev/null
+iptables -A REJECTl -j LOG --log-prefix 'REJECTl:'
+iptables -A REJECTl -j REJECT
+
+# Now we are going to accpet all traffic from our loopback device
+# if the IP matches any of our interfaces.
+iptables -A INPUT   -i $LPDIF -s   $LPDIP  -j ACCEPT
+iptables -A INPUT   -i $LPDIF -s   $EXTIP  -j ACCEPT
+iptables -A INPUT   -i $LPDIF -s   $INTIP  -j ACCEPT
+
+# Blocking Broadcasts
+iptables -A INPUT   -i $EXTIF -d   $EXTBC -j DROPl
+iptables -A INPUT   -i $INTIF -d   $INTBC -j DROPl
+iptables -A OUTPUT  -o $EXTIF -d   $EXTBC -j DROPl
+iptables -A OUTPUT  -o $INTIF -d   $INTBC -j DROPl
+iptables -A FORWARD -o $EXTIF -d   $EXTBC -j DROPl
+iptables -A FORWARD -o $INTIF -d   $INTBC -j DROPl
+
+# Block WAN access to internal network
+#
+# This also stops nefarious crackers from using our network as a
+# launching point to attack other people
+iptables -A INPUT   -i $EXTIF -d ! $EXTIP  -j DROPl
+
+# Now we will block internal addresses originating from anything but our
+# two predefined interfaces... just remember that if you jack your
+# your laptop or another pc into one of these NIC's directly, you'll need
+# to ensure that they either have the same ip or that you add a line explicitly
+# for that IP as well
+iptables -A INPUT   -i $INTIF -s ! $INTNET -j DROPl
+iptables -A OUTPUT  -o $INTIF -d ! $INTNET -j DROPl
+iptables -A FORWARD -i $INTIF -s ! $INTNET -j DROPl
+iptables -A FORWARD -o $INTIF -d ! $INTNET -j DROPl
+
+# An additional Egress check
+iptables -A OUTPUT  -o $EXTIF -s ! $EXTNET -j DROPl
+
+# Block outbound ICMP (except for PING)
+iptables -A OUTPUT  -o $EXTIF -p icmp --icmp-type ! 8 -j DROPl
+iptables -A FORWARD -o $EXTIF -p icmp --icmp-type ! 8 -j DROPl
+
+# Explicitly block TCP ports
+for i in $TCPBLOCK; do
+  iptables -A INPUT   -p tcp --dport $i  -j DROPl
+  iptables -A OUTPUT  -p tcp --dport $i  -j DROPl
+  iptables -A FORWARD -p tcp --dport $i  -j DROPl
+done
+
+# Explicitly block UDP ports
+for i in $UDPBLOCK; do
+  iptables -A INPUT   -p udp --dport $i  -j DROPl
+  iptables -A OUTPUT  -p udp --dport $i  -j DROPl
+  iptables -A FORWARD -p udp --dport $i  -j DROPl
+done
+
+# Open inbound service ports
+for i in $INPORTS; do 
+        iptables -A INPUT -p tcp --dport $i -j ACCEPT   
+done
+
+iptables -A FORWARD -t filter -o $EXTIF -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+iptables -A FORWARD -t filter -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+
+# Opening up ftp connection tracking
+MODULES="ip_nat_ftp ip_conntrack_ftp"
+for i in $MODULES; do
+        modprobe $i
+done
+
+# Allow inside systems to use external services
+for i in $TCPSERV; do
+  iptables -A OUTPUT  -o $EXTIF  -p tcp -s $EXTIP   --dport $i --syn -m state --state NEW -j ACCEPT
+  iptables -A FORWARD -i $INTIF -p tcp -s $INTNET --dport $i --syn -m state --state NEW -j ACCEPT
+done
+
+for i in $UDPSERV; do
+  iptables -A OUTPUT  -o $EXTIF  -p udp -s $EXTIP   --dport $i -m state --state NEW -j ACCEPT
+  iptables -A FORWARD -i $INTIF -p udp -s $INTNET --dport $i -m state --state NEW -j ACCEPT
+done
+
+# Allow to ping out
+iptables -A OUTPUT  -o $EXTIF  -p icmp -s $EXTIP   --icmp-type 8 -m state --state NEW -j ACCEPT
+iptables -A FORWARD -i $INTIF -p icmp -s $INTNET --icmp-type 8 -m state --state NEW -j ACCEPT
+
+# Allow firewall to ping internal systems
+iptables -A OUTPUT  -o $INTIF -p icmp -s $INTNET --icmp-type 8 -m state --state NEW -j ACCEPT
+
+# Allow a few services internally
+iptables -A OUTPUT  -o $INTIF -p tcp -s $INTNET --dport 80 -m state --state NEW -j ACCEPT
+iptables -A OUTPUT  -o $INTIF -p tcp -s $INTNET --dport 443 -m state --state NEW -j ACCEPT
+iptables -A INPUT   -i $INTIF -p tcp --dport 22 --syn -m state --state NEW -j ACCEPT
+
+# Setup dynamic NAT
+iptables -t nat -A PREROUTING  -j ACCEPT
+iptables -t nat -A POSTROUTING -o $EXTIF -s $INTNET -j MASQUERADE
+iptables -t nat -A POSTROUTING -j ACCEPT
+iptables -t nat -A OUTPUT -j ACCEPT
+iptables -A INPUT -p tcp --dport auth --syn -m state --state NEW -j ACCEPT
+iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
+iptables -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
+iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# Block and log what me may have forgot
+iptables -A INPUT   -j DROPl
+iptables -A OUTPUT  -j REJECTl
+iptables -A FORWARD -j DROPl
\ No newline at end of file
diff --git a/firewall.conf b/firewall.conf
new file mode 100644
index 0000000..78f873b
--- /dev/null
+++ b/firewall.conf
@@ -0,0 +1,60 @@
+EXTIF=eth1 # External interface
+INTIF=eth0 # Internal interface
+
+# Loop device/localhost
+LPDIF=lo
+LPDIP=127.0.0.1
+LPDMSK=255.0.0.0
+LPDNET="$LPDIP/$LPDMSK"
+
+# Defining some common chat clients. Remove these from your accepted list for better security.
+# ICQ and AOL are 5190
+# MSN is 1863
+# Y! is 5050
+# Jabber is 5222
+# Y! and Jabber ports not added by author and therefore left out of the script
+IRC='ircd'
+MSN=1863
+ICQ=5190
+YIM=5050
+AIM=5190
+NFS='sunrpc'
+PORTAGE='rsync'
+OpenPGP_HTTP_Keyserver=11371
+
+# All services ports are read from /etc/services
+TCPSERV="domain ssh http https ftp ftp-data mail pop3 pop3s time $PORTAGE $YIM $AIM"
+UDPSERV="domain time"
+
+INPORTS="ssh http"
+
+# COMmon ports:
+# 0 is tcpmux; SGI had vulnerability, 1 is common attack
+# 13 is daytime
+# 98 is Linuxconf
+# 111 is sunrpc (portmap)
+# 137:139, 445 is Microsoft
+# SNMP: 161,2
+# Squid flotilla: 3128, 8000, 8008, 8080
+# 1214 is Morpheus or KaZaA
+# 2049 is NFS
+# 3049 is very virulent Linux Trojan, mistakable for NFS
+# Common attacks: 1999, 4329, 6346
+# Common Trojans 12345 65535
+COMBLOCK="0:1 13 98 111 113 137:139 161:162 445 1214 1999 2049 3049 4329 6346 3128 8000 8008 8080 12345 65535"
+
+# TCP ports:
+# 98 is Linuxconf
+# 512-515 is rexec, rlogin, rsh, printer(lpd)
+#   [very serious vulnerabilities; attacks continue daily]
+# 1080 is Socks proxy server
+# 6000 is X (NOTE X over SSH is secure and runs on TCP 22)
+# Block 6112 (Sun's/HP's CDE)
+TCPBLOCK="$COMBLOCK 98 512:515 1080 3330 1128 3054 6000:6009 6112"
+
+# UDP ports:
+# 161:162 is SNMP
+# 520 is RIP
+# 9000 is Sangoma
+# 517:518 are talk and ntalk (more annoying than anything)
+UDPBLOCK="$COMBLOCK 161:162 520 123 517:518 1427 9000"
\ No newline at end of file