diff --git a/bin/v-add-firewall-ban b/bin/v-add-firewall-ban new file mode 100755 index 00000000..26dc6cbc --- /dev/null +++ b/bin/v-add-firewall-ban @@ -0,0 +1,78 @@ +#!/bin/bash +# info: add firewall blocking rule +# options: IP CHAIN +# +# The function adds new blocking rule to system firewall + + +#----------------------------------------------------------# +# Variable&Function # +#----------------------------------------------------------# + +# Importing system variables +source /etc/profile + +# Argument defenition +ip=$1 +chain=$(echo $2|tr '[:lower:]' '[:upper:]') + +# Defining absolute path for iptables and modprobe +iptables="/sbin/iptables" + +# Includes +source $VESTA/func/main.sh +source $VESTA/conf/vesta.conf + + +#----------------------------------------------------------# +# Verifications # +#----------------------------------------------------------# + +check_args '2' "$#" 'IP CHAIN' +validate_format 'ip' 'chain' +is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM' + + +#----------------------------------------------------------# +# Action # +#----------------------------------------------------------# + +# Checking server ip +if [ -e "$VESTA/data/ips/$ip" ] || [ "$ip" = '127.0.0.1' ]; then + exit +fi + +# Checking ip exclusions +excludes="$VESTA/data/firewall/excludes.conf" +check_excludes=$(grep "^$ip$" $excludes 2>/dev/null) +if [ ! -z "$check_excludes" ]; then + exit +fi + +# Checking ip in banlist +conf="$VESTA/data/firewall/banlist.conf" +check_ip=$(grep "IP='$ip' CHAIN='$chain'" $conf 2>/dev/null) +if [ ! -z "$check_ip" ]; then + exit +fi + +# Adding chain +$BIN/v-add-firewall-chain $chain + +# Adding ip to banlist +echo "IP='$ip' CHAIN='$chain' TIME='$TIME' DATE='$DATE'" >> $conf +$iptables -I fail2ban-$chain 1 -s $ip \ + -j REJECT --reject-with icmp-port-unreachable 2>/dev/null + +# Changing permissions +chmod 660 $conf + + +#----------------------------------------------------------# +# Vesta # +#----------------------------------------------------------# + +# Logging +log_event "$OK" "$EVENT" + +exit diff --git a/bin/v-add-firewall-chain b/bin/v-add-firewall-chain new file mode 100755 index 00000000..dd90c44c --- /dev/null +++ b/bin/v-add-firewall-chain @@ -0,0 +1,83 @@ +#!/bin/bash +# info: add firewall chain +# options: CHAIN [PORT] [PROTOCOL] [PROTOCOL] +# +# The function adds new rule to system firewall + + +#----------------------------------------------------------# +# Variable&Function # +#----------------------------------------------------------# + +# Importing system variables +source /etc/profile + +# Argument defenition +chain=$(echo $1 | tr '[:lower:]' '[:upper:]') +port=$2 +protocol=${4-TCP} +protocol=$(echo $protocol|tr '[:lower:]' '[:upper:]') + +# Defining absolute path to iptables +iptables="/sbin/iptables" + +# Includes +source $VESTA/func/main.sh +source $VESTA/conf/vesta.conf + + +#----------------------------------------------------------# +# Verifications # +#----------------------------------------------------------# + +check_args '1' "$#" 'CHAIN [PORT] [PROTOCOL]' +validate_format 'chain' +is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM' + + +#----------------------------------------------------------# +# Action # +#----------------------------------------------------------# + +# Checking known chains +case $chain in + SSH) port=22; protocol=TCP ;; + FTP) port=21; protocol=TCP ;; + MAIL) port=25; protocol=TCP ;; + DNS) port=53; protocol=UDP ;; + HTTP) port=80; protocol=TCP ;; + HTTPS) port=443; protocol=TCP ;; + POP3) port=110; protocol=TCP ;; + IMAP) port=143; protocol=TCP ;; + MYSQL) port=3306; protocol=TCP ;; + POSTGRES) port=5432; protocol=TCP ;; + VESTA) port=8083; protocol=TCP ;; + *) check_args '2' "$#" 'CHAIN PORT' ;; +esac + +# Adding chain +$iptables -N fail2ban-$chain 2>/dev/null +if [ $? -eq 0 ]; then + $iptables -A fail2ban-$chain -j RETURN + $iptables -I INPUT -p $protocol --dport $port -j fail2ban-$chain +fi + +# Preserving chain +chains=$VESTA/data/firewall/chains.conf +check_chain=$(grep "CHAIN='$chain'" $chains 2>/dev/null) +if [ -z "$check_chain" ]; then + echo "CHAIN='$chain' PORT='$port' PROTOCOL='$protocol'" >> $chains +fi + +# Changing permissions +chmod 660 $chains + + +#----------------------------------------------------------# +# Vesta # +#----------------------------------------------------------# + +# Logging +log_event "$OK" "$EVENT" + +exit diff --git a/bin/v-add-sys-firewall-rule b/bin/v-add-firewall-rule similarity index 70% rename from bin/v-add-sys-firewall-rule rename to bin/v-add-firewall-rule index 5e65ad30..126f62b4 100755 --- a/bin/v-add-sys-firewall-rule +++ b/bin/v-add-firewall-rule @@ -1,6 +1,6 @@ #!/bin/bash # info: add firewall rule -# options: ACTION PROTOCOL PORT IP [COMMENT] [RULE] +# options: ACTION IP PORT [PROTOCOL] [COMMENT] [RULE] # # The function adds new rule to system firewall @@ -9,11 +9,15 @@ # Variable&Function # #----------------------------------------------------------# +# Importing system variables +source /etc/profile + # Argument defenition action=$(echo $1|tr '[:lower:]' '[:upper:]') -protocol=$(echo $2|tr '[:lower:]' '[:upper:]') +ip=$2 port_ext=$3 -ip=$4 +protocol=${4-TCP} +protocol=$(echo $protocol|tr '[:lower:]' '[:upper:]') comment=$5 rule=$6 @@ -24,17 +28,17 @@ source $VESTA/conf/vesta.conf # Get next firewall rule id get_next_fw_rule() { if [ -z "$rule" ]; then - curr_str=$(grep "RULE=" $VESTA/data/firewall/rules_ipv4.conf |\ + curr_str=$(grep "RULE=" $VESTA/data/firewall/rules.conf |\ cut -f 2 -d \' | sort -n | tail -n1) rule="$((curr_str +1))" fi } sort_fw_rules() { - cat $VESTA/data/firewall/rules_ipv4.conf |\ - sort -n -k 2 -t \' > $VESTA/data/firewall/rules_ipv4.conf.tmp - mv -f $VESTA/data/firewall/rules_ipv4.conf.tmp \ - $VESTA/data/firewall/rules_ipv4.conf + cat $VESTA/data/firewall/rules.conf |\ + sort -n -k 2 -t \' > $VESTA/data/firewall/rules.conf.tmp + mv -f $VESTA/data/firewall/rules.conf.tmp \ + $VESTA/data/firewall/rules.conf } @@ -42,12 +46,12 @@ sort_fw_rules() { # Verifications # #----------------------------------------------------------# -check_args '4' "$#" 'ACTION PROTOCOL PORT IP [COMMENT] [RULE]' +check_args '3' "$#" 'ACTION IP PORT [PROTOCOL] [COMMENT] [RULE]' validate_format 'action' 'protocol' 'port_ext' 'ip' is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM' get_next_fw_rule validate_format 'rule' -is_object_new '../../data/firewall/rules_ipv4' 'RULE' "$rule" +is_object_new '../../data/firewall/rules' 'RULE' "$rule" if [ ! -z "$comment"]; then validate_format 'comment' fi @@ -57,22 +61,22 @@ fi # Action # #----------------------------------------------------------# -# Concatenating cron string +# Concatenating rule str="RULE='$rule' ACTION='$action' PROTOCOL='$protocol' PORT='$port_ext'" str="$str IP='$ip' COMMENT='$comment' SUSPENDED='no'" str="$str TIME='$TIME' DATE='$DATE'" -# Adding to crontab -echo "$str" >> $VESTA/data/firewall/rules_ipv4.conf +# Adding to config +echo "$str" >> $VESTA/data/firewall/rules.conf # Changing permissions -chmod 660 $VESTA/data/firewall/rules_ipv4.conf +chmod 660 $VESTA/data/firewall/rules.conf # Sorting firewall rules by id number sort_fw_rules # Updating system firewall -$BIN/v-update-sys-firewall +$BIN/v-update-firewall #----------------------------------------------------------# diff --git a/bin/v-change-sys-firewall-rule b/bin/v-change-firewall-rule similarity index 66% rename from bin/v-change-sys-firewall-rule rename to bin/v-change-firewall-rule index 46964b9f..e7fa1638 100755 --- a/bin/v-change-sys-firewall-rule +++ b/bin/v-change-firewall-rule @@ -1,6 +1,6 @@ #!/bin/bash # info: change firewall rule -# options: RULE ACTION PROTOCOL PORT IP [COMMENT] +# options: RULE ACTION IP PORT [PROTOCOL] [COMMENT] # # The function is used for changing existing firewall rule. # It fully replace rule with new one but keeps same id. @@ -10,12 +10,16 @@ # Variable&Function # #----------------------------------------------------------# +# Importing system variables +source /etc/profile + # Argument defenition rule=$1 action=$(echo $2|tr '[:lower:]' '[:upper:]') -protocol=$(echo $3|tr '[:lower:]' '[:upper:]') +ip=$3 port_ext=$4 -ip=$5 +protocol=${5-TCP} +protocol=$(echo $protocol|tr '[:lower:]' '[:upper:]') comment=$6 # Includes @@ -24,10 +28,10 @@ source $VESTA/conf/vesta.conf # Sort function sort_fw_rules() { - cat $VESTA/data/firewall/rules_ipv4.conf |\ - sort -n -k 2 -t \' > $VESTA/data/firewall/rules_ipv4.conf.tmp - mv -f $VESTA/data/firewall/rules_ipv4.conf.tmp \ - $VESTA/data/firewall/rules_ipv4.conf + cat $VESTA/data/firewall/rules.conf |\ + sort -n -k 2 -t \' > $VESTA/data/firewall/rules.conf.tmp + mv -f $VESTA/data/firewall/rules.conf.tmp \ + $VESTA/data/firewall/rules.conf } @@ -35,10 +39,13 @@ sort_fw_rules() { # Verifications # #----------------------------------------------------------# -check_args '5' "$#" 'RULE ACTION PROTOCOL PORT IP [COMMENT]' -validate_format 'rule' 'action' 'protocol' 'port_ext' 'ip' 'comment' +check_args '5' "$#" 'RULE ACTION IP PORT [PROTOCOL] [COMMENT]' +validate_format 'rule' 'action' 'protocol' 'port_ext' 'ip' +if [ ! -z "$comment" ]; then + validate_format 'comment' +fi is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM' -is_object_valid '../../data/firewall/rules_ipv4' 'RULE' "$rule" +is_object_valid '../../data/firewall/rules' 'RULE' "$rule" #----------------------------------------------------------# @@ -51,16 +58,16 @@ str="$str IP='$ip' COMMENT='$comment' SUSPENDED='no'" str="$str TIME='$TIME' DATE='$DATE'" # Deleting old rule -sed -i "/RULE='$rule' /d" $VESTA/data/firewall/rules_ipv4.conf +sed -i "/RULE='$rule' /d" $VESTA/data/firewall/rules.conf # Adding new -echo "$str" >> $VESTA/data/firewall/rules_ipv4.conf +echo "$str" >> $VESTA/data/firewall/rules.conf # Sorting firewall rules by id number sort_fw_rules # Updating system firewall -$BIN/v-update-sys-firewall +$BIN/v-update-firewall #----------------------------------------------------------# diff --git a/bin/v-delete-firewall-ban b/bin/v-delete-firewall-ban new file mode 100755 index 00000000..97362ada --- /dev/null +++ b/bin/v-delete-firewall-ban @@ -0,0 +1,63 @@ +#!/bin/bash +# info: delete firewall blocking rule +# options: IP CHAIN +# +# The function deletes blocking rule from system firewall + + +#----------------------------------------------------------# +# Variable&Function # +#----------------------------------------------------------# + +# Importing system variables +source /etc/profile + +# Argument defenition +ip=$1 +chain=$(echo $2|tr '[:lower:]' '[:upper:]') + +# Defining absolute path for iptables and modprobe +iptables="/sbin/iptables" + +# Includes +source $VESTA/func/main.sh +source $VESTA/conf/vesta.conf + + +#----------------------------------------------------------# +# Verifications # +#----------------------------------------------------------# + +check_args '2' "$#" 'IP CHAIN' +validate_format 'ip' 'chain' +is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM' + + +#----------------------------------------------------------# +# Action # +#----------------------------------------------------------# + +# Checking ip in banlist +conf="$VESTA/data/firewall/banlist.conf" +check_ip=$(grep "IP='$ip' CHAIN='$chain'" $conf 2>/dev/null) +if [ -z "$check_ip" ]; then + exit +fi + +# Deleting ip from banlist +sed -i "/IP='$ip' CHAIN='$chain'/d" $conf +$iptables -D fail2ban-$chain -s $ip \ + -j REJECT --reject-with icmp-port-unreachable 2>/dev/null + +# Changing permissions +chmod 660 $conf + + +#----------------------------------------------------------# +# Vesta # +#----------------------------------------------------------# + +# Logging +log_event "$OK" "$EVENT" + +exit diff --git a/bin/v-delete-firewall-chain b/bin/v-delete-firewall-chain new file mode 100755 index 00000000..cb1316bb --- /dev/null +++ b/bin/v-delete-firewall-chain @@ -0,0 +1,66 @@ +#!/bin/bash +# info: delete firewall chain +# options: CHAIN +# +# The function adds new rule to system firewall + + +#----------------------------------------------------------# +# Variable&Function # +#----------------------------------------------------------# + +# Importing system variables +source /etc/profile + +# Argument defenition +chain=$(echo $1 | tr '[:lower:]' '[:upper:]') + +# Defining absolute path to iptables +iptables="/sbin/iptables" + +# Includes +source $VESTA/func/main.sh +source $VESTA/conf/vesta.conf + + +#----------------------------------------------------------# +# Verifications # +#----------------------------------------------------------# + +check_args '1' "$#" 'CHAIN' +validate_format 'chain' +is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM' + + +#----------------------------------------------------------# +# Action # +#----------------------------------------------------------# + +# Deleting chain +chains=$VESTA/data/firewall/chains.conf +banlist=$VESTA/data/firewall/banlist.conf +chain_param=$(grep "CHAIN='$chain'" $chains 2>/dev/null) +if [ ! -z "$chain_param" ]; then + eval $chain_param + sed -i "/CHAIN='$chain'/d" $chains + sed -i "/CHAIN='$chain'/d" $banlist + $iptables -D INPUT -p $PROTOCOL \ + --dport $PORT -j fail2ban-$CHAIN 2>/dev/null +fi + +# Deleting iptables chain +$iptables -F fail2ban-$CHAIN 2>/dev/null +$iptables -X fail2ban-$CHAIN 2>/dev/null + +# Changing permissions +chmod 660 $chains + + +#----------------------------------------------------------# +# Vesta # +#----------------------------------------------------------# + +# Logging +log_event "$OK" "$EVENT" + +exit diff --git a/bin/v-delete-sys-firewall-rule b/bin/v-delete-firewall-rule similarity index 85% rename from bin/v-delete-sys-firewall-rule rename to bin/v-delete-firewall-rule index a9dad926..7f1c24d8 100755 --- a/bin/v-delete-sys-firewall-rule +++ b/bin/v-delete-firewall-rule @@ -9,6 +9,9 @@ # Variable&Function # #----------------------------------------------------------# +# Importing system variables +source /etc/profile + # Argument defenition rule=$1 @@ -24,7 +27,7 @@ source $VESTA/conf/vesta.conf check_args '1' "$#" 'RULE' validate_format 'rule' is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM' -is_object_valid '../../data/firewall/rules_ipv4' 'RULE' "$rule" +is_object_valid '../../data/firewall/rules' 'RULE' "$rule" #----------------------------------------------------------# @@ -32,10 +35,10 @@ is_object_valid '../../data/firewall/rules_ipv4' 'RULE' "$rule" #----------------------------------------------------------# # Deleting rule -sed -i "/RULE='$rule' /d" $VESTA/data/firewall/rules_ipv4.conf +sed -i "/RULE='$rule' /d" $VESTA/data/firewall/rules.conf # Updating system firewall -$BIN/v-update-sys-firewall +$BIN/v-update-firewall #----------------------------------------------------------# diff --git a/bin/v-list-sys-firewall b/bin/v-list-firewall similarity index 96% rename from bin/v-list-sys-firewall rename to bin/v-list-firewall index f8c133d1..c841f34e 100755 --- a/bin/v-list-sys-firewall +++ b/bin/v-list-firewall @@ -21,7 +21,7 @@ source $VESTA/func/main.sh #----------------------------------------------------------# # Defining config -conf=$VESTA/data/firewall/rules_ipv4.conf +conf=$VESTA/data/firewall/rules.conf # Defining fileds to select fields="\$RULE \$ACTION \$PROTOCOL \$PORT \$IP \$COMMENT" diff --git a/bin/v-list-firewall-ban b/bin/v-list-firewall-ban new file mode 100755 index 00000000..d3457029 --- /dev/null +++ b/bin/v-list-firewall-ban @@ -0,0 +1,43 @@ +#!/bin/bash +# info: list firewall block list +# options: [FORMAT] +# +# The function of obtaining the list of currently blocked ips. + + +#----------------------------------------------------------# +# Variable&Function # +#----------------------------------------------------------# + +# Argument defenition +format=${1-shell} + +# Includes +source $VESTA/func/main.sh + + +#----------------------------------------------------------# +# Action # +#----------------------------------------------------------# + +# Defining config +conf=$VESTA/data/firewall/banlist.conf + +# Defining fileds to select +fields="\$IP:\$CHAIN \$TIME \$DATE" + +# Listing domains +case $format in + json) json_list ;; + plain) nohead=1; shell_list ;; + shell) fields='$IP $CHAIN $TIME $DATE'; + shell_list | column -t ;; + *) check_args '1' '0' 'USER [FORMAT]' +esac + + +#----------------------------------------------------------# +# Vesta # +#----------------------------------------------------------# + +exit diff --git a/bin/v-list-sys-firewall-rule b/bin/v-list-firewall-rule similarity index 95% rename from bin/v-list-sys-firewall-rule rename to bin/v-list-firewall-rule index 7b0c288d..ab9cfa4a 100755 --- a/bin/v-list-sys-firewall-rule +++ b/bin/v-list-firewall-rule @@ -61,7 +61,7 @@ shell_list_fw_rule() { #----------------------------------------------------------# check_args '1' "$#" 'RULE [FORMAT]' -is_object_valid '../../data/firewall/rules_ipv4' 'RULE' "$rule" +is_object_valid '../../data/firewall/rules' 'RULE' "$rule" #----------------------------------------------------------# @@ -69,7 +69,7 @@ is_object_valid '../../data/firewall/rules_ipv4' 'RULE' "$rule" #----------------------------------------------------------# # Defining config and fields to select -conf=$VESTA/data/firewall/rules_ipv4.conf +conf=$VESTA/data/firewall/rules.conf fields="\$RULE \$ACTION \$PROTOCOL \$PORT \$IP \$COMMENT" fields="$fields \$RULE \$SUSPENDED \$TIME \$DATE" diff --git a/bin/v-suspend-firewall-rule b/bin/v-suspend-firewall-rule new file mode 100755 index 00000000..a5e2d638 --- /dev/null +++ b/bin/v-suspend-firewall-rule @@ -0,0 +1,49 @@ +#!/bin/bash +# info: suspend firewall rule +# options: RULE +# +# The function suspends a certain firewall rule. + + +#----------------------------------------------------------# +# Variable&Function # +#----------------------------------------------------------# + +# Argument defenition +rule=$1 + +# Inlcudes +source $VESTA/func/main.sh +source $VESTA/conf/vesta.conf + + +#----------------------------------------------------------# +# Verifications # +#----------------------------------------------------------# + +check_args '1' "$#" 'RULE' +validate_format 'rule' +is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM' +is_object_valid '../../data/firewall/rules' 'RULE' "$rule" +is_object_unsuspended '../../data/firewall/rules' 'RULE' "$rule" + + +#----------------------------------------------------------# +# Action # +#----------------------------------------------------------# + +# Suspending rule +update_object_value ../../data/firewall/rules RULE $rule '$SUSPENDED' yes + +# Updating system firewall +$BIN/v-update-firewall + + +#----------------------------------------------------------# +# Vesta # +#----------------------------------------------------------# + +# Logging +log_event "$OK" "$EVENT" + +exit diff --git a/bin/v-unsuspend-firewall-rule b/bin/v-unsuspend-firewall-rule new file mode 100755 index 00000000..c1c97e2c --- /dev/null +++ b/bin/v-unsuspend-firewall-rule @@ -0,0 +1,49 @@ +#!/bin/bash +# info: unsuspend firewall rule +# options: RULE +# +# The function unsuspends a certain firewall rule. + + +#----------------------------------------------------------# +# Variable&Function # +#----------------------------------------------------------# + +# Argument defenition +rule=$1 + +# Inlcudes +source $VESTA/func/main.sh +source $VESTA/conf/vesta.conf + + +#----------------------------------------------------------# +# Verifications # +#----------------------------------------------------------# + +check_args '1' "$#" 'RULE' +validate_format 'rule' +is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM' +is_object_valid '../../data/firewall/rules' 'RULE' "$rule" +is_object_suspended '../../data/firewall/rules' 'RULE' "$rule" + + +#----------------------------------------------------------# +# Action # +#----------------------------------------------------------# + +# Suspending rule +update_object_value ../../data/firewall/rules RULE $rule '$SUSPENDED' no + +# Updating system firewall +$BIN/v-update-firewall + + +#----------------------------------------------------------# +# Vesta # +#----------------------------------------------------------# + +# Logging +log_event "$OK" "$EVENT" + +exit diff --git a/bin/v-update-sys-firewall b/bin/v-update-firewall similarity index 81% rename from bin/v-update-sys-firewall rename to bin/v-update-firewall index 95770c62..d072ffa4 100755 --- a/bin/v-update-sys-firewall +++ b/bin/v-update-firewall @@ -31,7 +31,10 @@ is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM' #----------------------------------------------------------# # Checking local IPv4 rules -rules="$VESTA/data/firewall/rules_ipv4.conf" +rules="$VESTA/data/firewall/rules.conf" +ports="$VESTA/data/firewall/ports.conf" +fail2ban="$VESTA/data/firewall/fail2ban.conf" + if [ ! -e "$rules" ]; then exit fi @@ -87,13 +90,18 @@ for line in $(sort -r -n -k 2 -t \' $rules); do done # Handling local traffic -echo "$iptables -A INPUT -p udp --sport 53 -j ACCEPT" >> $tmp -echo "$iptables -A INPUT -s 127.0.0.1 -j ACCEPT" >> $tmp for ip in $(ls $VESTA/data/ips); do echo "$iptables -A INPUT -s $ip -j ACCEPT" >> $tmp done +echo "$iptables -A INPUT -s 127.0.0.1 -j ACCEPT" >> $tmp +IFS=$'\n' +for p_rule in $(cat $ports); do + eval $p_rule + rule="$iptables -A INPUT -p $PROTOCOL" + echo "$rule --sport $PORT -j ACCEPT" >> $tmp +done -# Enabling stateful firewall +# Enabling stateful support if [ "$stateful" != 'no' ]; then str="$iptables -A INPUT -p tcp -m state" str="$str --state ESTABLISHED,RELATED -j ACCEPT" @@ -103,12 +111,27 @@ fi # Switching chain policy to DROP echo "$iptables -P INPUT DROP" >> $tmp +# Adding vesta chain +echo "$iptables -N vesta" >> $tmp + # Applying rules -bash $tmp +bash $tmp 2>/dev/null # Deleting temporary file rm -f $tmp +# Checking custom trigger +if [ -x "$VESTA/data/firewall/custom.sh" ]; then + bash $VESTA/data/firewall/custom.sh +fi + +# Checking fail2ban support +chains=$VESTA/data/firewall/chains.conf +for chain in $(cat $chains 2>/dev/null); do + eval $chain + $iptables -I INPUT -p $PROTOCOL --dport $PORT -j fail2ban-$CHAIN +done + # Saving rules to the master iptables file if [ -e "/etc/redhat-release" ]; then /sbin/iptables-save > /etc/sysconfig/iptables diff --git a/web/add/firewall/banlist/index.php b/web/add/firewall/banlist/index.php new file mode 100644 index 00000000..f0e97042 --- /dev/null +++ b/web/add/firewall/banlist/index.php @@ -0,0 +1,66 @@ + $error) { + if ( $i == 0 ) { + $error_msg = $error; + } else { + $error_msg = $error_msg.", ".$error; + } + } + $_SESSION['error_msg'] = __('Field "%s" can not be blank.',$error_msg); + } + + // Protect input + $v_chain = escapeshellarg($_POST['v_chain']); + $v_ip = escapeshellarg($_POST['v_ip']); + + // Add firewall ban + if (empty($_SESSION['error_msg'])) { + exec (VESTA_CMD."v-add-firewall-ban ".$v_ip." ".$v_chain, $output, $return_var); + check_return_code($return_var,$output); + unset($output); + } + + // Flush field values on success + if (empty($_SESSION['error_msg'])) { + $_SESSION['ok_msg'] = __('BANLIST_CREATED_OK'); + unset($v_ip); + } +} + +// Header +include($_SERVER['DOCUMENT_ROOT'].'/templates/header.html'); + +// Panel +top_panel($user,$TAB); + +// Display body +include($_SERVER['DOCUMENT_ROOT'].'/templates/admin/add_firewall_banlist.html'); + +// Flush session messages +unset($_SESSION['error_msg']); +unset($_SESSION['ok_msg']); + +// Footer +include($_SERVER['DOCUMENT_ROOT'].'/templates/footer.html'); diff --git a/web/add/firewall/index.php b/web/add/firewall/index.php index 992d42b3..fb4bb495 100644 --- a/web/add/firewall/index.php +++ b/web/add/firewall/index.php @@ -45,7 +45,7 @@ if (!empty($_POST['ok'])) { // Add firewall rule if (empty($_SESSION['error_msg'])) { - exec (VESTA_CMD."v-add-sys-firewall-rule ".$v_action." ".$v_protocol." ".$v_port." ".$v_ip." ".$v_comment, $output, $return_var); + exec (VESTA_CMD."v-add-firewall-rule ".$v_action." ".$v_ip." ".$v_port." ".$v_protocol." ".$v_comment, $output, $return_var); check_return_code($return_var,$output); unset($output); } diff --git a/web/bulk/firewall/banlist/index.php b/web/bulk/firewall/banlist/index.php new file mode 100644 index 00000000..8014b7ad --- /dev/null +++ b/web/bulk/firewall/banlist/index.php @@ -0,0 +1,36 @@ + + + + + +
+ → ".$_SESSION['error_msg'].""; + } else { + if (!empty($_SESSION['ok_msg'])) { + echo " → ".$_SESSION['ok_msg'].""; + } + } + ?> +
+ + +
+ + + + + + + +
+ + +
+ 		+ + + + + + + + + + + + + + + +
+ +
+ +
+ () +
+ +
+ + + +
+
+ diff --git a/web/templates/admin/list_firewall.html b/web/templates/admin/list_firewall.html index 6ce2e28f..9f1885c1 100644 --- a/web/templates/admin/list_firewall.html +++ b/web/templates/admin/list_firewall.html @@ -19,6 +19,11 @@ + +
+ [ ] +
+ @@ -37,10 +42,10 @@ } else { $status = 'active'; $spnd_action = 'suspend' ; - $spnd_confirmation = 'UNSUSPEND_RULE_CONFIRMATION' ; + $spnd_confirmation = 'SUSPEND_RULE_CONFIRMATION' ; } ?> - + @@ -58,7 +63,17 @@ - + + + + + + + + + diff --git a/web/templates/admin/list_firewall_banlist.html b/web/templates/admin/list_firewall_banlist.html new file mode 100644 index 00000000..3ba39383 --- /dev/null +++ b/web/templates/admin/list_firewall_banlist.html @@ -0,0 +1,88 @@ +
+ + + +
+
+ +
+
+ + + + +
+
+
+ + + +
+ +
+ + +
+ + + + +
+ Fail2ban +
+ + $value) { + ++$i; + list($ip,$chain) = split(":",$key); + ?> + + + + + +
+ + + +
+ 		+ + + + + + + + + + + + + + + +
+
+ +
+ 1) { + echo __('%s IP addresses',$i); + } + ?> +
+
diff --git a/web/unsuspend/firewall/index.php b/web/unsuspend/firewall/index.php new file mode 100644 index 00000000..ab2ebc72 --- /dev/null +++ b/web/unsuspend/firewall/index.php @@ -0,0 +1,28 @@ +