sshutter/usr/sbin/sshutterd

49 lines
1.3 KiB
Plaintext
Raw Permalink Normal View History

2024-06-27 12:56:48 +00:00
#!/bin/bash -e
2024-06-19 21:11:09 +00:00
function log {
echo "$(date +'%Y-%m-%d %H:%M:%S') $@"
}
# Include config file if present
2024-06-19 21:11:09 +00:00
if [ -f "/etc/sshutter.conf" ]; then
. /etc/sshutter.conf
fi
# Check if args are given
if [ "$WHITELIST" == "" ] || [ "$PORT" == "" ] || [ "$TARGET" == "" ]; then
echo "Error: you need to specify WHITELIST, PORT and TARGET, either in /etc/sshutter.conf or through environment variables." 1>&2
exit 1
fi
2024-06-19 21:11:09 +00:00
# Check if permissions are high enough
2024-06-19 21:11:09 +00:00
if [ "$UID" -ne 0 ]; then
echo "Error: must be root." 1>&2
exit 1
fi
# Main loop
2024-06-27 13:21:19 +00:00
oldstate=""
2024-06-19 21:11:09 +00:00
while [ true ]; do
ping -c 3 "$TARGET" 1>/dev/null
if [ "$?" -eq 0 ]; then
# Ping successful, apply shutter
2024-06-27 13:21:19 +00:00
if [ "$oldstate" != "blocked" ]; then
log "[sshutter] Blocking port 22 for IPs outside $WHITELIST"
oldstate="blocked"
fi
2024-06-19 21:11:09 +00:00
nft add table inet filter
nft add chain inet filter sshutterv4 \{ type filter hook input priority filter \; policy accept \; \}
nft add rule inet filter sshutterv4 tcp dport "$PORT" ip saddr "$WHITELIST" accept
nft add rule inet filter sshutterv4 tcp dport "$PORT" drop
else
# Ping failed, lift shutter
2024-06-27 13:21:19 +00:00
if [ "$oldstate" != "released" ]; then
log "[sshutter] Releasing port block"
oldstate="released"
fi
2024-06-19 21:11:09 +00:00
nft destroy chain inet filter sshutterv4
fi
sleep 60
done