untouched

1 files changed, 230 insertions, 0 deletions

diff --git a/firewall_wizard/scripts/do_it_firew.sh b/firewall_wizard/scripts/do_it_firew.sh
new file mode 100755
index 00000000..89defad7
--- /dev/null
+++ b/firewall_wizard/scripts/do_it_firew.sh
@@ -0,0 +1,230 @@
+#!/bin/bash
+#
+# firewall		This script sets up firewall rules.
+#
+# description: Sets up or removes firewall rules.
+#
+# Firewall rules for a firewall between a private internal network and the
+# Internet.
+#
+# hacked to fit with wizard, protection level and initscripts.
+#
+# initial copyright :
+# Copyright (C) 2000 Roaring Penguin Software Inc.  This software may
+# be distributed under the terms of the GNU General Public License, version
+# 2 or any later version.
+
+# firewall protection level
+#
+#- level 0 : no protection
+#	open all TCP/UDP PORT on / and through the server/firewall
+#	DROP unroutable network
+#
+#- level 1 : light filtering, usual services opened
+#	open all TCP/UDP PORT on / and through the server/firewall
+#	DROP unroutable network
+#	NAT Activated on external interface
+#
+#- level 2 : only 'internet' services
+#	open only configured services on this server/firewall
+#	DROP unroutable network
+#	NAT Activated on external interface
+#
+#- level 3 : strong protection : only out mail & http
+#	DROP unroutable network
+#	block all ports except ssh
+#
+
+# this should be launched by a wizard screen ?
+${CWD}/scripts/store_fwall.sh
+
+typeset -i firewall_level
+wiz_firewall_level=`get_var wiz_firewall_level`
+[ -z "${wiz_firewall_level}" ] && wiz_firewall_level=0
+[ ${wiz_firewall_level} -le 0 ] && wiz_firewall_level=0
+[ ${wiz_firewall_level} -ge 3 ] && wiz_firewall_level=3
+echo_debug "# firewall level : ${wiz_firewall_level}"
+
+firewall_cfg=/etc/Bastille/bastille-firewall.cfg
+bastille_firewall=/etc/init.d/bastille-firewall
+bastille_ipchains=/sbin/bastille-ipchains
+bastille_netfilter=/sbin/bastille-netfilter
+file=/etc/sysconfig/mdk_serv
+
+# check requires files
+[ -f $firewall_cfg ] || {
+        echo_debug "no Bastille config file"
+		        cp -a ./scripts/bastille-firewall.cfg.default $firewall_cfg
+		}
+for f in $bastille_firewall $bastille_ipchains $bastille_netfilter; do
+		[ -f $f ] || {
+		echo_debug "no $f file"
+		cp /usr/share/Bastille/$(basename $f) $f
+		chmod +x $f
+}
+done
+
+TCP_PUBLIC_SERVICES=""
+UDP_PUBLIC_SERVICES=""
+TCP_INTERNAL_SERVICES=""
+UDP_INTERNAL_SERVICES=""
+
+# Wildcard address
+ANY=0.0.0.0/0
+
+# Interface to Internet
+EXTIF=`get_var wiz_ext_device`
+if [ -z "${EXTIF}" ]; then 
+	EXTIF=ppp0
+fi	
+
+INTERNAL_IFACES=`get_var wiz_device`
+if [ -z "${INTERNAL_IFACES}" ]; then
+	echo_debug "# no internal network, exiting"
+	exit 1
+fi
+if [ "x$INTERNAL_IFACES" = "x$EXTIF" ]; then
+		echo_debug "# external network device : ${EXTIF}"
+		chg_val ${firewall_cfg} PUBLIC_IFACES ""
+
+		echo_debug "# internal network device : ${INTERNAL_IFACES}"
+		chg_val ${firewall_cfg} INTERNAL_IFACES ${INTERNAL_IFACES}
+
+else
+		echo_debug "# external network device : ${EXTIF}"
+		chg_val ${firewall_cfg} PUBLIC_IFACES ${EXTIF}
+
+		echo_debug "# internal network device : ${INTERNAL_IFACES}"
+		chg_val ${firewall_cfg} INTERNAL_IFACES ${INTERNAL_IFACES}
+fi
+
+# Internal network address.  For stand-alone machines, delete this and
+# all the "forward" rules.
+INTERNAL=`get_var wiz_ip_net`/24
+if [ "${INTERNAL}" = "/24" ]; then 
+	echo_debug "# no internal network, exiting"
+	exit 1
+fi	
+
+# DNS Caching Name Server activated or not
+wiz_caching_dns=`get_val ${file} wiz_caching_dns`
+if [ ${wiz_caching_dns} -eq 1 ]; then 
+	echo_debug "# DNS caching dns server : ${wiz_caching_dns}"
+	chg_val ${firewall_cfg} DNS_SERVERS ${ANY} s
+	UDP_INTERNAL_SERVICES="$UDP_INTERNAL_SERVICES domain "
+else
+	echo_debug "# No DNS caching dns server : ${wiz_caching_dns}"
+	chg_val ${firewall_cfg} DNS_SERVERS "" s
+fi
+# news
+echo_debug "# if exist, activate news server queries"
+wiz_news_server=`get_val ${file} wiz_news_server`
+if [ ! -z "${wiz_news_server}" ]; then
+	chg_val ${firewall_cfg}  NTP_SERVERS ${wiz_news_server} s
+	TCP_INTERNAL_SERVICES="$TCP_INTERNAL_SERVICES nntp "
+	UDP_INTERNAL_SERVICES="$UDP_INTERNAL_SERVICES nntp "
+else 
+	chg_val ${firewall_cfg}  NTP_SERVERS "" s
+fi
+
+echo_debug "# check ftp server"
+wiz_ftp_internal=`get_val ${file} wiz_ftp_internal`
+wiz_ftp_external=`get_val ${file} wiz_ftp_external`
+
+if [ ${wiz_ftp_external} -eq 1 ]; then
+	TCP_PUBLIC_SERVICES="$TCP_PUBLIC_SERVICES ftp ftp-data "
+	UDP_PUBLIC_SERVICES="$UDP_PUBLIC_SERVICES ftp ftp-data "
+	TCP_INTERNAL_SERVICES="$TCP_INTERNAL_SERVICES ftp ftp-data "
+	UDP_INTERNAL_SERVICES="$UDP_INTERNAL_SERVICES ftp ftp-data "
+elif [ ${wiz_ftp_internal} -eq 1 ]; then
+	TCP_PUBLIC_SERVICES="$TCP_PUBLIC_SERVICES "
+	UDP_PUBLIC_SERVICES="$UDP_PUBLIC_SERVICES "
+	TCP_INTERNAL_SERVICES="$TCP_INTERNAL_SERVICES ftp ftp-data "
+	UDP_INTERNAL_SERVICES="$UDP_INTERNAL_SERVICES ftp ftp-data "
+fi
+
+echo_debug "# check http server"
+wiz_web_internal=`get_val ${file} wiz_web_internal`
+wiz_web_external=`get_val ${file} wiz_web_external`
+
+if [ ${wiz_web_external} -eq 1 ]; then
+	TCP_PUBLIC_SERVICES="$TCP_PUBLIC_SERVICES http https "
+	UDP_PUBLIC_SERVICES="$UDP_PUBLIC_SERVICES http https "
+	TCP_INTERNAL_SERVICES="$TCP_INTERNAL_SERVICES http https "
+	UDP_INTERNAL_SERVICES="$UDP_INTERNAL_SERVICES http https "
+elif [ ${wiz_web_internal} -eq 1 ]; then
+	TCP_PUBLIC_SERVICES="$TCP_PUBLIC_SERVICES "
+	UDP_PUBLIC_SERVICES="$UDP_PUBLIC_SERVICES "
+	TCP_INTERNAL_SERVICES="$TCP_INTERNAL_SERVICES http https "
+	UDP_INTERNAL_SERVICES="$UDP_INTERNAL_SERVICES http https "
+fi
+
+echo_debug "# check Samba server"
+wiz_workgroup=`get_val ${file} wiz_workgroup`
+
+if [ ! -z ${wiz_workgroup} ]; then
+	TCP_INTERNAL_SERVICES="$TCP_INTERNAL_SERVICES netbios-ns netbios-dgm netbios-ssn "
+	UDP_INTERNAL_SERVICES="$UDP_INTERNAL_SERVICES netbios-ns netbios-dgm netbios-ssn "
+fi
+
+echo_debug "# check Mail server"
+wiz_mail_server=`get_val ${file} wiz_mail_server`
+if [ ! -z ${wiz_mail_server} ]; then
+	TCP_INTERNAL_SERVICES="$TCP_INTERNAL_SERVICES smtp pop3 pop3s pop2 imap  imap3 imap4-ssl imaps "
+	UDP_INTERNAL_SERVICES="$UDP_INTERNAL_SERVICES smtp pop3 pop3s pop2 imap  imap3 imap4-ssl imaps "
+fi
+echo_debug "# check DHCP server"
+wiz_ip_range1=`get_val ${file} wiz_ip_range1`
+if [ ! -z ${wiz_ip_range1} -a ! -z ${wiz_ip_range2} ]; then
+	TCP_INTERNAL_SERVICES="$TCP_INTERNAL_SERVICES bootps bootpc "
+	UDP_INTERNAL_SERVICES="$UDP_INTERNAL_SERVICES bootps bootpc "
+fi
+# open ssh 
+TCP_PUBLIC_SERVICES="$TCP_INTERNAL_SERVICES ssh "
+UDP_PUBLIC_SERVICES="$UDP_INTERNAL_SERVICES ssh "
+TCP_INTERNAL_SERVICES="$TCP_INTERNAL_SERVICES ssh "
+UDP_INTERNAL_SERVICES="$UDP_INTERNAL_SERVICES ssh "
+
+
+# Source function library.  THIS WORKS ONLY ON RED HAT-LIKE SYSTEMS.
+#. /etc/rc.d/init.d/functions
+
+# level 0 et 3
+if [ ${wiz_firewall_level} -eq 0 -o ${wiz_firewall_level} -eq 3  ]; then
+	echo_debug "# Direct routing (without NAT)"
+	chg_val ${firewall_cfg} IP_MASQ_NETWORK "" s
+else
+	echo_debug "# NAT internal network : ${INTERNAL}"
+	chg_val ${firewall_cfg} IP_MASQ_NETWORK ${INTERNAL}
+fi
+
+# level 0 ou 1
+if [ ${wiz_firewall_level} -le 1 ]; then
+	echo_debug "# open all TCP/UDP PORT on/and through the server/firewall"
+	chg_val ${firewall_cfg} TCP_PUBLIC_SERVICES ":" s
+	chg_val ${firewall_cfg} UDP_PUBLIC_SERVICES ":" s
+	chg_val ${firewall_cfg} TCP_INTERNAL_SERVICES ":" s
+	chg_val ${firewall_cfg} UDP_INTERNAL_SERVICES ":" s
+fi
+
+
+if [ ${wiz_firewall_level} -eq 2 ]; then
+	chg_val ${firewall_cfg} TCP_PUBLIC_SERVICES "$TCP_PUBLIC_SERVICES" s
+	chg_val ${firewall_cfg} UDP_PUBLIC_SERVICES "$UDP_PUBLIC_SERVICES" s
+	chg_val ${firewall_cfg} TCP_INTERNAL_SERVICES "$TCP_INTERNAL_SERVICES" s
+	chg_val ${firewall_cfg} UDP_INTERNAL_SERVICES "$UDP_INTERNAL_SERVICES" s
+fi
+
+if [ ${wiz_firewall_level} -eq 3 ]; then
+	chg_val ${firewall_cfg} TCP_PUBLIC_SERVICES " " s
+	chg_val ${firewall_cfg} UDP_PUBLIC_SERVICES " " s
+	chg_val ${firewall_cfg} TCP_INTERNAL_SERVICES "ssh" s
+	chg_val ${firewall_cfg} UDP_INTERNAL_SERVICES "ssh" s
+fi
+
+echo_debug "# launch bastille-firewall script"
+
+chkconfig --level 345 bastille-firewall on
+service bastille-firewall start
+
+exit 0