Gecko [ contributie.vriendennsm.nl ]

Name	Size	Permission	Date
help	[ DIR ]	drwxr-xr-x	2026-07-25 20:55
images	[ DIR ]	drwxr-xr-x	2026-07-25 20:55
lang	[ DIR ]	drwxr-xr-x	2026-07-25 20:55
CHANGELOG	2.79 KB	-rw-r--r--	2026-07-17 21:17
acl_security.pl	1.02 KB	-rwxr-xr-x	2026-07-17 21:17
apply.cgi	512 B	-rwxr-xr-x	2026-07-17 21:22
backup_config.pl	649 B	-rwxr-xr-x	2026-07-17 21:17
bootup.cgi	600 B	-rwxr-xr-x	2026-07-17 21:22
cgi_args.pl	430 B	-rwxr-xr-x	2026-07-17 21:17
cluster.cgi	2.08 KB	-rwxr-xr-x	2026-07-17 21:22
cluster_add.cgi	2.19 KB	-rwxr-xr-x	2026-07-17 21:22
cluster_delete.cgi	651 B	-rwxr-xr-x	2026-07-17 21:22
coherent-linux-lib.pl	1.54 KB	-rwxr-xr-x	2026-07-17 21:17
config	83 B	-rw-r--r--	2026-07-17 21:17
config.info	1.24 KB	-rw-r--r--	2026-07-17 21:17
config.info.bg	2.48 KB	-rw-r--r--	2026-07-17 21:17
config.info.ca	1.5 KB	-rw-r--r--	2026-07-17 21:17
config.info.cs	982 B	-rw-r--r--	2026-07-17 21:17
config.info.de	1.42 KB	-rw-r--r--	2026-07-17 21:17
config.info.fr	1.63 KB	-rw-r--r--	2026-07-17 21:17
config.info.ja	421 B	-rw-r--r--	2026-07-17 21:17
config.info.nl	976 B	-rw-r--r--	2026-07-17 21:17
config.info.no	968 B	-rw-r--r--	2026-07-17 21:17
config.info.pl	1012 B	-rw-r--r--	2026-07-17 21:17
config.info.pt_BR	983 B	-rw-r--r--	2026-07-17 21:17
config.info.ru	1.31 KB	-rw-r--r--	2026-07-17 21:17
config.info.sk	989 B	-rw-r--r--	2026-07-17 21:17
config.info.tr	827 B	-rw-r--r--	2026-07-17 21:17
convert.cgi	756 B	-rwxr-xr-x	2026-07-17 21:22
debian-linux-lib.pl	4.74 KB	-rwxr-xr-x	2026-07-17 21:17
defaultacl	100 B	-rw-r--r--	2026-07-17 21:17
edit_rule.cgi	15.04 KB	-rwxr-xr-x	2026-07-17 21:22
firewall-lib.pl	17.41 KB	-rwxr-xr-x	2026-07-17 21:17
firewall4-lib.pl	1.82 KB	-rwxr-xr-x	2026-07-17 21:17
firewall6-lib.pl	1.76 KB	-rwxr-xr-x	2026-07-17 21:17
gentoo-linux-lib.pl	722 B	-rwxr-xr-x	2026-07-17 21:17
index.cgi	16.08 KB	-rwxr-xr-x	2026-07-17 21:22
install_check.pl	841 B	-rwxr-xr-x	2026-07-17 21:17
log_parser.pl	835 B	-rwxr-xr-x	2026-07-17 21:17
mandrake-linux-lib.pl	1.69 KB	-rwxr-xr-x	2026-07-17 21:17
module.info	218 B	-rw-r--r--	2026-07-17 21:17
module.info.ar	0 B	-rw-r--r--	2026-07-17 21:17
module.info.ar.auto	258 B	-rw-r--r--	2026-07-17 21:17
module.info.bg	0 B	-rw-r--r--	2026-07-17 21:17
module.info.bg.auto	292 B	-rw-r--r--	2026-07-17 21:17
module.info.ca	150 B	-rw-r--r--	2026-07-17 21:17
module.info.ca.auto	17 B	-rw-r--r--	2026-07-17 21:17
module.info.cs	24 B	-rw-r--r--	2026-07-17 21:17
module.info.cs.auto	148 B	-rw-r--r--	2026-07-17 21:17
module.info.da	0 B	-rw-r--r--	2026-07-17 21:17
module.info.da.auto	167 B	-rw-r--r--	2026-07-17 21:17
module.info.de	155 B	-rw-r--r--	2026-07-17 21:17
module.info.de.auto	17 B	-rw-r--r--	2026-07-17 21:17
module.info.el	0 B	-rw-r--r--	2026-07-17 21:17
module.info.el.auto	331 B	-rw-r--r--	2026-07-17 21:17
module.info.es	26 B	-rw-r--r--	2026-07-17 21:17
module.info.es.auto	149 B	-rw-r--r--	2026-07-17 21:17
module.info.eu	0 B	-rw-r--r--	2026-07-17 21:17
module.info.eu.auto	160 B	-rw-r--r--	2026-07-17 21:17
module.info.fa	0 B	-rw-r--r--	2026-07-17 21:17
module.info.fa.auto	272 B	-rw-r--r--	2026-07-17 21:17
module.info.fi	0 B	-rw-r--r--	2026-07-17 21:17
module.info.fi.auto	192 B	-rw-r--r--	2026-07-17 21:17
module.info.fr	0 B	-rw-r--r--	2026-07-17 21:17
module.info.fr.auto	173 B	-rw-r--r--	2026-07-17 21:17
module.info.hr	0 B	-rw-r--r--	2026-07-17 21:17
module.info.hr.auto	166 B	-rw-r--r--	2026-07-17 21:17
module.info.hu	33 B	-rw-r--r--	2026-07-17 21:17
module.info.hu.auto	172 B	-rw-r--r--	2026-07-17 21:17
module.info.it	0 B	-rw-r--r--	2026-07-17 21:17
module.info.it.auto	167 B	-rw-r--r--	2026-07-17 21:17
module.info.ja	39 B	-rw-r--r--	2026-07-17 21:17
module.info.ja.auto	218 B	-rw-r--r--	2026-07-17 21:17
module.info.ko	0 B	-rw-r--r--	2026-07-17 21:17
module.info.ko.auto	198 B	-rw-r--r--	2026-07-17 21:17
module.info.ms	158 B	-rw-r--r--	2026-07-17 21:17
module.info.ms.auto	17 B	-rw-r--r--	2026-07-17 21:17
module.info.nl	23 B	-rw-r--r--	2026-07-17 21:17
module.info.nl.auto	157 B	-rw-r--r--	2026-07-17 21:17
module.info.no	23 B	-rw-r--r--	2026-07-17 21:17
module.info.no.auto	146 B	-rw-r--r--	2026-07-17 21:17
module.info.pl	141 B	-rw-r--r--	2026-07-17 21:17
module.info.pl.auto	23 B	-rw-r--r--	2026-07-17 21:17
module.info.pt	0 B	-rw-r--r--	2026-07-17 21:17
module.info.pt.auto	170 B	-rw-r--r--	2026-07-17 21:17
module.info.pt_BR	26 B	-rw-r--r--	2026-07-17 21:17
module.info.pt_BR.auto	150 B	-rw-r--r--	2026-07-17 21:17
module.info.ru	51 B	-rw-r--r--	2026-07-17 21:17
module.info.ru.auto	241 B	-rw-r--r--	2026-07-17 21:17
module.info.sk	24 B	-rw-r--r--	2026-07-17 21:17
module.info.sk.auto	174 B	-rw-r--r--	2026-07-17 21:17
module.info.sv	0 B	-rw-r--r--	2026-07-17 21:17
module.info.sv.auto	174 B	-rw-r--r--	2026-07-17 21:17
module.info.tr	0 B	-rw-r--r--	2026-07-17 21:17
module.info.tr.auto	215 B	-rw-r--r--	2026-07-17 21:17
module.info.uk	0 B	-rw-r--r--	2026-07-17 21:17
module.info.uk.auto	277 B	-rw-r--r--	2026-07-17 21:17
module.info.zh	0 B	-rw-r--r--	2026-07-17 21:17
module.info.zh.auto	145 B	-rw-r--r--	2026-07-17 21:17
module.info.zh_TW	0 B	-rw-r--r--	2026-07-17 21:17
module.info.zh_TW.auto	154 B	-rw-r--r--	2026-07-17 21:17
move.cgi	1.29 KB	-rwxr-xr-x	2026-07-17 21:22
newchain.cgi	898 B	-rwxr-xr-x	2026-07-17 21:22
open-ports.pl	3.4 KB	-rwxr-xr-x	2026-07-17 21:22
prefs.info	55 B	-rw-r--r--	2026-07-17 21:17
redhat-linux-lib.pl	2.16 KB	-rwxr-xr-x	2026-07-17 21:17
save_policy.cgi	7.15 KB	-rwxr-xr-x	2026-07-17 21:22
save_rule.cgi	12.4 KB	-rwxr-xr-x	2026-07-17 21:22
save_rule6.cgi	12.11 KB	-rwxr-xr-x	2026-07-17 21:22
setup.cgi	9.46 KB	-rwxr-xr-x	2026-07-17 21:22
setup6.cgi	8.21 KB	-rwxr-xr-x	2026-07-17 21:22
trustix-linux-lib.pl	2.16 KB	-rwxr-xr-x	2026-07-17 21:17
unapply.cgi	609 B	-rwxr-xr-x	2026-07-17 21:22

Rename

#!/usr/bin/perl
# setup.cgi
# Setup an initial save file

require './firewall-lib.pl';
require './firewall6-lib.pl';
&ReadParse();
$access{'setup'} || &error($text{'setup_ecannot'});

&lock_file($ip6tables_save_file);
if ($in{'reset'}) {
	# Clear out all rules
	foreach $t ("filter", "nat", "mangle") {
		&system_logged("ip6tables -t $t -P INPUT ACCEPT >/dev/null 2>&1");
		&system_logged("ip6tables -t $t -P OUTPUT ACCEPT >/dev/null 2>&1");
		&system_logged("ip6tables -t $t -P FORWARD ACCEPT >/dev/null 2>&1");
		&system_logged("ip6tables -t $t -P PREROUTING ACCEPT >/dev/null 2>&1");
		&system_logged("ip6tables -t $t -P POSTROUTING ACCEPT >/dev/null 2>&1");
		&system_logged("ip6tables -t $t -F >/dev/null 2>&1");
		&system_logged("ip6tables -t $t -X >/dev/null 2>&1");
		}
	}

# Save all existing active rules
if (defined(&unapply_ip6tables)) {
	&unapply_ip6tables();
	}
else {
	&backquote_logged("ip6tables-save >$ip6tables_save_file 2>&1");
	}

# Get important variable ports
&get_miniserv_config(\%miniserv);
$webmin_port = $miniserv{'port'} || 10000;
$webmin_port2 = $webmin_port + 10;
$usermin_port = undef;
if (&foreign_installed("usermin")) {
	&foreign_require("usermin", "usermin-lib.pl");
	&usermin::get_usermin_miniserv_config(\%uminiserv);
	$usermin_port = $uminiserv{'port'};
	}
$usermin_port ||= 20000;
$ssh_port = undef;
if (&foreign_installed("sshd")) {
	&foreign_require("sshd", "sshd-lib.pl");
	$conf = &sshd::get_sshd_config();
	$ssh_port = &sshd::find_value("Port", $conf);
	}
$ssh_port ||= 22;

if ($in{'auto'}) {
	@tables = &get_iptables_save();
	if ($in{'auto'} == 1) {
		# Add a single rule to the nat table for masquerading
		$iface = $in{'iface1'} eq 'other' ? $in{'iface1_other'}
						  : $in{'iface1'};
		$iface || &error($text{'setup_eiface'});
		($table) = grep { $_->{'name'} eq 'nat' } @tables;
		$table ||= { 'name' => 'nat',
			     'rules' => [ ],
			     'defaults' => { } };
		push(@{$table->{'rules'}},
		     	{ 'chain' => 'POSTROUTING',
			  'o' => [ "", $iface ],
			  'j' => [ "", 'MASQUERADE' ] } );
		}
	elsif ($in{'auto'} >= 2) {
		# Block all incoming traffic, except for established
		# connections, DNS replies and safe ICMP types
		# In mode 3 allow ssh and ident too
		# In mode 4 allow ftp, echo-request and high ports too
		$iface = $in{'iface'.$in{'auto'}} eq 'other' ?
				 $in{'iface'.$in{'auto'}.'_other'} :
				 $in{'iface'.$in{'auto'}};
		$iface || &error($text{'setup_eiface'});
		($table) = grep { $_->{'name'} eq 'filter' } @tables;
		$table ||= { 'name' => 'nat',
			     'rules' => [ ],
			     'defaults' => { } };
		$table->{'defaults'}->{'INPUT'} = 'DROP';
		my $sd = &supports_conntrack() ? "ctstate" : "state";
		my $sm = $sd eq "state" ? "state" : "conntrack";
		push(@{$table->{'rules'}},
		     { 'chain' => 'INPUT',
		       'i' => [ "!", $iface ],
		       'j' => [ "", 'ACCEPT' ],
		       'cmt' => 'Accept traffic from internal interfaces' },
		     { 'chain' => 'INPUT',
		       'm' => [ [ "", "tcp" ] ],
		       'p' => [ "", "tcp" ],
		       'tcp-flags' => [ "", "ACK", "ACK" ],
		       'j' => [ "", 'ACCEPT' ],
		       'cmt' => 'Accept traffic with the ACK flag set' },
		     { 'chain' => 'INPUT',
		       'm' => [ [ "", $sm ] ],
		       $sd => [ "", "ESTABLISHED" ],
		       'j' => [ "", 'ACCEPT' ],
		       'cmt' => 'Allow incoming data that is part of a connection we established' },
		     { 'chain' => 'INPUT',
		       'm' => [ [ "", $sm ] ],
		       $sd => [ "", "RELATED" ],
		       'j' => [ "", 'ACCEPT' ],
		       'cmt' => 'Allow data that is related to existing connections' },
		     { 'chain' => 'INPUT',
		       'm' => [ [ "", "udp" ] ],
		       'p' => [ "", "udp" ],
		       'sport' => [ "", 53 ],
		       'dport' => [ "", "1024:65535" ],
		       'j' => [ "", 'ACCEPT' ],
		       'cmt' => 'Accept responses to DNS queries' },
			);
		if ($in{'auto'} >= 3) {
			# Allow ssh and ident
			push(@{$table->{'rules'}},
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ] ],
			       'p' => [ "", "tcp" ],
			       'dport' => [ "", $ssh_port ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow connections to our SSH server' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ] ],
			       'p' => [ "", "tcp" ],
			       'dport' => [ "", "auth" ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow connections to our IDENT server'}
				);
			}
		if ($in{'auto'} >= 4) {
			# Allow pings
			push(@{$table->{'rules'}},
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "icmpv6" ] ],
			       'p' => [ [ "", "icmpv6" ] ],
			       'icmpv6-type' => [ "", "echo-request" ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Respond to pings' }, );
			}
		if ($in{'auto'} == 4) {
			# Allow pings and most high ports
			push(@{$table->{'rules'}},
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ] ],
			       'p' => [ "", "tcp" ],
			       'dport' => [ "", "2049:2050" ],
			       'j' => [ "", 'DROP' ],
			       'cmt' => 'Protect our NFS server' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ] ],
			       'p' => [ "", "tcp" ],
			       'dport' => [ "", "6000:6063" ],
			       'j' => [ "", 'DROP' ],
			       'cmt' => 'Protect our X11 display server' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ] ],
			       'p' => [ "", "tcp" ],
			       'dport' => [ "", "7000:7010" ],
			       'j' => [ "", 'DROP' ],
			       'cmt' => 'Protect our X font server' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ] ],
			       'p' => [ "", "tcp" ],
			       'dport' => [ "", "1024:65535" ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow connections to unprivileged ports' },
				);
			}
		if ($in{'auto'} == 5) {
			# Allow typical hosting server ports
			push(@{$table->{'rules'}},
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ] ],
			       'p' => [ "", "tcp" ],
			       'dport' => [ "", "53" ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow DNS zone transfers' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "udp" ] ],
			       'p' => [ "", "udp" ],
			       'dport' => [ "", "53" ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow DNS queries' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ] ],
			       'p' => [ "", "tcp" ],
			       'dport' => [ "", "80" ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow connections to webserver' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ] ],
			       'p' => [ "", "tcp" ],
			       'dport' => [ "", "443" ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow SSL connections to webserver' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ], [ "", "multiport" ] ],
			       'p' => [ "", "tcp" ],
			       'dports' => [ "", "25,587" ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow connections to mail server' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ] ],
			       'p' => [ "", "tcp" ],
			       'dport' => [ "", "20:21" ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow connections to FTP server' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ], [ "", "multiport" ] ],
			       'p' => [ "", "tcp" ],
			       'dports' => [ "", "110,995" ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow connections to POP3 server' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ], [ "", "multiport" ] ],
			       'p' => [ "", "tcp" ],
			       'dports' => [ "", "143,220,993" ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow connections to IMAP server' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ] ],
			       'p' => [ "", "tcp" ],
			       'dport' => [ "",$webmin_port.":".$webmin_port2 ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow connections to Webmin' },
			     { 'chain' => 'INPUT',
			       'm' => [ [ "", "tcp" ] ],
			       'p' => [ "", "tcp" ],
			       'dport' => [ "", $usermin_port ],
			       'j' => [ "", 'ACCEPT' ],
			       'cmt' => 'Allow connections to Usermin' },
				);
			}
		}
	&run_before_command();
	&save_table($table);
	&run_after_command();
	&copy_to_cluster();
	}

if ($in{'atboot'}) {
	&create_firewall_init();
	}
&unlock_file($ip6tables_save_file);

&webmin_log("setup");
&redirect("");