diff --git a/scripts/shield-trigger b/scripts/shield-trigger index 7cc73d1..35174bd 100755 --- a/scripts/shield-trigger +++ b/scripts/shield-trigger @@ -23,9 +23,6 @@ # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA null_route() { - # - # louzy detection of IPv4 or IPv6 address - # TASK="$1" INET="" GW="127.0.0.1" @@ -34,9 +31,8 @@ null_route() { GW="::1" fi - if [ -x /sbin/ip ] - then - if [ "$TASK" = "show" ]; then + if [ -x /sbin/ip ] ; then + if [ "$TASK" = "show" ] ; then if /sbin/ip $INET route "$TASK" "$2" | read -r _x ; then return fi @@ -44,21 +40,16 @@ null_route() { fi /sbin/ip $INET route "$TASK" blackhole "$2" 2>/dev/null else - if [ -n "$INET" ] - then - INET="-A inet6" - fi + [ -n "$INET" ] && INET="-A inet6" /sbin/route $INET "$TASK" -host "$2" gw "$GW" dev lo fi - -# mail -s "[security] pam_shield blocked $2" root </dev/null) -if [ -z "$CHAIN_TEST" ] -then - "$IPT" -N pam_shield - "$IPT" -I pam_shield -j DROP - if [ "$TASK" = "-D" ]; then - return + # check to see if pam_shield chain exists and create if necessary + if [ -z "$($IPT -L pam_shield 2>/dev/null)" ] ; then + "$IPT" -N pam_shield + "$IPT" -I pam_shield -j DROP + [ "$TASK" = "-D" ] && return fi -fi -# -# CUSTOMIZE THIS RULE if you want to -# -# $TASK is the iptables command: -A/-I or -D -# $2 is the IP number -# -# * put in the correct chain name (pam_shield or INPUT) -# * put in the correct network interface name (e.g. -i eth0) -# Currently blocks on all interfaces -# * put in a port number (e.g.--destination-port 22 for ssh only) -# Currently blocks all ports -# * add additional rules for additional services as needed -# - -if ! "$IPT" "$TASK" INPUT -p tcp -s "$2" -j pam_shield ; then - if [ "$TASK" = "-C" ]; then - run_iptables "-I" "$2" + # CUSTOMIZE THIS RULE if you want to + # + # $TASK is the iptables command: -A/-I or -D + # $2 is the IP number + # + # * put in the correct chain name (pam_shield or INPUT) + # * put in the correct network interface name (e.g. -i eth0) + # Currently blocks on all interfaces + # * put in a port number (e.g.--destination-port 22 for ssh only) + # Currently blocks all ports + # * add additional rules for additional services as needed + + if ! "$IPT" "$TASK" INPUT -p tcp -s "$2" -j pam_shield ; then + [ "$TASK" = "-C" ] && run_iptables "-I" "$2" fi -fi - -# mail -s "[security] pam_shield blocked $2" root <" @@ -29,34 +33,22 @@ usage() { exit 1 } - PATH=/sbin:/usr/sbin:/bin:/usr/bin -if [ -z "$2" ] -then - usage -fi +[ -z "$2" ] && usage case "$1" in add) - logger -i -t shield-trigger-ufw -p authpriv.info "blocking $2" + log "blocking $2" ufw insert 1 deny from "$2" - # mail -s "[security] pam_shield blocked $2" root <