-
Notifications
You must be signed in to change notification settings - Fork 0
/
1_firewall.sh
73 lines (49 loc) · 1.19 KB
/
1_firewall.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
#!/bin/bash
echo ""
echo "*** Setup Firewall"
echo ""
# Read config file
. ./setup.cfg
echo "* Creating rules file"
cat <<EOF > /etc/iptables.rules
*filter
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport $ssh_port -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j DROP
-A FORWARD -j REJECT
COMMIT
EOF
echo "* Creating Boot Script for Firewall"
cat <<EOF > /etc/network/if-pre-up.d/iptables
#!/bin/sh
iptables-restore < /etc/iptables.rules
EOF
chmod +x /etc/network/if-pre-up.d/iptables
echo ""
echo ""
echo "*** Update SSH Port"
echo ""
# Remove if file present
if [ -f "sshd_config" ]; then
echo "* Removing temp sshd_config file"
rm sshd_config
fi
touch sshd_config
while read line; do
# Replace line containing port
if [[ $line =~ ^Port* ]]
then
line="Port $ssh_port"
fi
# Append
echo $line >> sshd_config
done < /etc/ssh/sshd_config
# Move and replate
echo "* Updated sshd_config"
mv sshd_config /etc/ssh/sshd_config
echo ""