UnknownSec Bypass 403

: /usr/share/ufw/ [ drwxr-xr-x ]
name : check-requirements #!/bin/sh # # check-requirements: verify all the required iptables functionality is # available # # Copyright 2008-2020 Canonical Ltd. # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License version 3, # as published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # set -e chain="ufw-check-requirements" error="" error_runtime="" runcmd() { runtime="no" if [ "$1" = "runtime" ]; then runtime="yes" shift 1 fi local output ret=0 # make sure to always return success below because of set -e output=$( "$@" 2>&1 ) || ret=$? if [ $ret -eq 0 ]; then echo pass else if [ "$runtime" = "yes" ]; then echo "FAIL (no runtime support)" echo "error was: $output" error_runtime="yes" else echo FAIL echo "error was: $output" error="yes" fi fi } # check python found_python="no" echo -n "Has python: " for exe in python3 python2 python ; do if ! which $exe >/dev/null 2>&1; then continue fi v=`$exe --version 2>&1 | cut -f 2 -d ' '` if echo "$v" | grep -q "^2.[5-7]"; then echo "pass (binary: $exe, version: $v, py2)" found_python="yes" break elif echo "$v" | grep -q "^3.[2-8]"; then echo "pass (binary: $exe, version: $v, py3)" found_python="yes" break fi done if [ "$found_python" != "yes" ]; then echo "ERROR: could not find valid python" >&2 error="yes" fi # check binaries for i in "" 6; do exe="iptables" if [ "$i" = "6" ]; then exe="ip6tables" fi echo -n "Has $exe: " if ! PATH=/sbin:/usr/sbin:/bin:/usr/bin which $exe >/dev/null 2>&1; then echo "ERROR: could not find '$exe'" >&2 error="yes" else echo "pass" fi done if [ -n "$error" ]; then exit 1 fi echo "" # check /proc for i in /proc/net/dev /proc/net/if_inet6; do echo -n "Has $i: " if [ ! -e "$i" ]; then echo "no" error="yes" else echo "pass" fi done if [ -n "$error" ]; then exit 1 fi echo "" echo "This script will now attempt to create various rules using the iptables" echo "and ip6tables commands. This may result in module autoloading (eg, for" echo "IPv6)." if [ "$1" != "-f" ]; then echo -n "Proceed with checks (Y/n)? " read ans if [ "$ans" = "n" ] || [ "$ans" = "N" ] || [ "$ans" = "no" ]; then echo "Aborting" exit 1 fi fi # check modules for i in "" 6; do exe="iptables" c="${chain}" ipv="4" if [ "$i" = "6" ]; then exe="ip6tables" c="${chain}6" ipv="6" fi if [ "$i" = "6" ]; then echo "== IPv6 ==" else echo "== IPv4 ==" fi echo -n "Creating '$c'... " $exe -N "$c" || { echo "ERROR: could not create '$c'. Aborting" >&2 error="yes" break } echo "done" # set up a RETURN rule right at the top, so we don't open anything up when # running the script. Isn't attached to INPUT, but better safe than sorry. echo -n "Inserting RETURN at top of '$c'... " $exe -I "$c" -j RETURN || { echo "ERROR: could insert RETURN rule into '$c'. Aborting" >&2 error="yes" break } echo "done" echo -n "TCP: " runcmd $exe -A $c -p tcp -j ACCEPT echo -n "UDP: " runcmd $exe -A $c -p udp -j ACCEPT echo -n "destination port: " runcmd $exe -A $c -p tcp --dport 22 -j ACCEPT echo -n "source port: " runcmd $exe -A $c -p tcp --sport 22 -j ACCEPT for j in ACCEPT DROP REJECT LOG; do echo -n "$j: " runcmd $exe -A $c -p tcp --sport 23 -j $j done echo -n "hashlimit: " runcmd $exe -A $c -m hashlimit -m tcp -p tcp --dport 22 --hashlimit 1/min --hashlimit-mode srcip --hashlimit-name ssh -m conntrack --ctstate NEW -j ACCEPT echo -n "limit: " runcmd $exe -A $c -m limit --limit 3/min --limit-burst 10 -j ACCEPT for j in NEW RELATED ESTABLISHED INVALID; do echo -n "ctstate ($j): " runcmd $exe -A $c -m conntrack --ctstate $j done echo -n "ctstate (new, recent set): " runcmd runtime $exe -A $c -m conntrack --ctstate NEW -m recent --set echo -n "ctstate (new, recent update): " runcmd runtime $exe -A $c -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 6 -j ACCEPT echo -n "ctstate (new, limit): " runcmd $exe -A $c -m conntrack --ctstate NEW -m limit --limit 3/min --limit-burst 10 -j ACCEPT echo -n "interface (input): " runcmd $exe -A $c -i eth0 -j ACCEPT echo -n "interface (output): " runcmd $exe -A $c -o eth0 -j ACCEPT echo -n "multiport: " runcmd $exe -A $c -p tcp -m multiport --dports 80,443,8080:8090 -j ACCEPT echo -n "comment: " runcmd $exe -A $c -m comment --comment 'dapp_Samba' if [ -z "$i" ]; then for j in LOCAL MULTICAST BROADCAST; do echo -n "addrtype ($j): " runcmd $exe -A $c -m addrtype --dst-type $j -j RETURN done for j in destination-unreachable source-quench time-exceeded parameter-problem echo-request; do echo -n "icmp ($j): " runcmd $exe -A $c -p icmp --icmp-type $j -j ACCEPT done else for j in destination-unreachable packet-too-big time-exceeded parameter-problem echo-request; do echo -n "icmpv6 ($j): " runcmd $exe -A $c -p icmpv6 --icmpv6-type $j -j ACCEPT done for j in neighbor-solicitation neighbor-advertisement router-solicitation router-advertisement; do echo -n "icmpv6 with hl ($j): " runcmd $exe -A $c -p icmpv6 --icmpv6-type $j -m hl --hl-eq 255 -j ACCEPT done echo -n "ipv6 rt: " runcmd $exe -A $c -m rt --rt-type 0 -j ACCEPT fi echo "" done # cleanup for i in "" 6; do exe="iptables" c="${chain}" if [ "$i" = "6" ]; then exe="ip6tables" c="${chain}6" fi $exe -F $c >/dev/null 2>&1 || { if [ -z "$error" ]; then echo "ERROR: could not flush '$c'" >&2 error="yes" fi } $exe -X $c >/dev/null 2>&1 || { if [ -z "$error" ]; then error="yes" echo "ERROR: could not remove '$c'" >&2 fi } done # check and warn if various firewall applications are installed found= for exe in apf arno-iptables-firewall ferm firehol firewalld ipkungfu iptables-persistent netfilter-persistent pyroman uruk ; do if PATH=/sbin:/usr/sbin:/bin:/usr/bin which "$exe" >/dev/null 2>&1; then found="$found $exe" fi done if [ ! -z "$found" ]; then echo "WARN: detected other firewall applications:" echo "$found" echo "(if enabled, these applications may interfere with ufw)" echo "" fi if [ -n "$error" ] || [ -n "$error_runtime" ]; then if [ -n "$error" ]; then echo "FAIL: check your kernel and that you have iptables >= 1.4.0" fi if [ -n "$error_runtime" ]; then echo "FAIL: check your kernel and iptables for additional runtime support" fi exit 1 fi echo "All tests passed" exit 0