maride/sshutter
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: maride/sshutter:6c9245be0a6600800cb5753db621bc1f9eb8ded5
Branches Tags
maride/sshutter:main
...
compare: maride/sshutter:main
Branches Tags
maride/sshutter:main

4 Commits
6c9245be0a ... main

Author SHA1 Message Date
maride 1045f11b27 Add sshutter.conf to dpkg-handled configure files, update README to Debian naming scheme 2024-08-09 23:51:19 +02:00
maride 6dfb40a70a Only log changes 2024-06-27 15:21:19 +02:00
maride e5a8d2d21b Fix: correctly check if environment variables are set 2024-06-27 14:57:16 +02:00
maride e295e915d8 Stop on errors 2024-06-27 14:56:48 +02:00
3 changed files with 13 additions and 5 deletions
Expand all files Collapse all files
DEBIAN/conffiles
+1
View File
@@ -0,0 +1 @@
/etc/sshutter.conf
README.md
+1 -1
View File
@@ -10,4 +10,4 @@ This situation asks for dynamic solutions. And **sshutter** is such a dynamic so
## Building/Packing ## Building/Packing
To create the Debian/Ubuntu package for sshutter, run `dpkg-deb --root-owner-group --build . sshutter-v0.1.deb` To create the Debian/Ubuntu package for sshutter, run `dpkg-deb --root-owner-group --build . sshutter_v0.1_all.deb`
usr/sbin/sshutterd
+11 -4
View File
@@ -1,4 +1,4 @@
#!/bin/bash #!/bin/bash -e
function log { function log {
echo "$(date +'%Y-%m-%d %H:%M:%S') $@" echo "$(date +'%Y-%m-%d %H:%M:%S') $@"
@@ -10,7 +10,7 @@ if [ -f "/etc/sshutter.conf" ]; then
fi fi
# Check if args are given # Check if args are given
if [ "$WHITELIST" -eq "" ] || [ "$PORT" -eq "" ] || [ "$TARGET" -eq "" ]; then if [ "$WHITELIST" == "" ] || [ "$PORT" == "" ] || [ "$TARGET" == "" ]; then
echo "Error: you need to specify WHITELIST, PORT and TARGET, either in /etc/sshutter.conf or through environment variables." 1>&2 echo "Error: you need to specify WHITELIST, PORT and TARGET, either in /etc/sshutter.conf or through environment variables." 1>&2
exit 1 exit 1
fi fi
@@ -22,18 +22,25 @@ if [ "$UID" -ne 0 ]; then
fi fi
# Main loop # Main loop
oldstate=""
while [ true ]; do while [ true ]; do
ping -c 3 "$TARGET" 1>/dev/null ping -c 3 "$TARGET" 1>/dev/null
if [ "$?" -eq 0 ]; then if [ "$?" -eq 0 ]; then
# Ping successful, apply shutter # Ping successful, apply shutter
log "[sshutter] Blocking port 22 for IPs outside $WHITELIST" if [ "$oldstate" != "blocked" ]; then
log "[sshutter] Blocking port 22 for IPs outside $WHITELIST"
oldstate="blocked"
fi
nft add table inet filter nft add table inet filter
nft add chain inet filter sshutterv4 \{ type filter hook input priority filter \; policy accept \; \} nft add chain inet filter sshutterv4 \{ type filter hook input priority filter \; policy accept \; \}
nft add rule inet filter sshutterv4 tcp dport "$PORT" ip saddr "$WHITELIST" accept nft add rule inet filter sshutterv4 tcp dport "$PORT" ip saddr "$WHITELIST" accept
nft add rule inet filter sshutterv4 tcp dport "$PORT" drop nft add rule inet filter sshutterv4 tcp dport "$PORT" drop
else else
# Ping failed, lift shutter # Ping failed, lift shutter
log "[sshutter] Releasing port block" if [ "$oldstate" != "released" ]; then
log "[sshutter] Releasing port block"
oldstate="released"
fi
nft destroy chain inet filter sshutterv4 nft destroy chain inet filter sshutterv4
fi fi