Compare commits
4 Commits
6c9245be0a
..
main
| Author | SHA1 | Date | |
|---|---|---|---|
| 1045f11b27 | |||
| 6dfb40a70a | |||
| e5a8d2d21b | |||
| e295e915d8 |
@@ -0,0 +1 @@
|
||||
/etc/sshutter.conf
|
||||
@@ -10,4 +10,4 @@ This situation asks for dynamic solutions. And **sshutter** is such a dynamic so
|
||||
|
||||
## Building/Packing
|
||||
|
||||
To create the Debian/Ubuntu package for sshutter, run `dpkg-deb --root-owner-group --build . sshutter-v0.1.deb`
|
||||
To create the Debian/Ubuntu package for sshutter, run `dpkg-deb --root-owner-group --build . sshutter_v0.1_all.deb`
|
||||
|
||||
+11
-4
@@ -1,4 +1,4 @@
|
||||
#!/bin/bash
|
||||
#!/bin/bash -e
|
||||
|
||||
function log {
|
||||
echo "$(date +'%Y-%m-%d %H:%M:%S') $@"
|
||||
@@ -10,7 +10,7 @@ if [ -f "/etc/sshutter.conf" ]; then
|
||||
fi
|
||||
|
||||
# Check if args are given
|
||||
if [ "$WHITELIST" -eq "" ] || [ "$PORT" -eq "" ] || [ "$TARGET" -eq "" ]; then
|
||||
if [ "$WHITELIST" == "" ] || [ "$PORT" == "" ] || [ "$TARGET" == "" ]; then
|
||||
echo "Error: you need to specify WHITELIST, PORT and TARGET, either in /etc/sshutter.conf or through environment variables." 1>&2
|
||||
exit 1
|
||||
fi
|
||||
@@ -22,18 +22,25 @@ if [ "$UID" -ne 0 ]; then
|
||||
fi
|
||||
|
||||
# Main loop
|
||||
oldstate=""
|
||||
while [ true ]; do
|
||||
ping -c 3 "$TARGET" 1>/dev/null
|
||||
if [ "$?" -eq 0 ]; then
|
||||
# Ping successful, apply shutter
|
||||
log "[sshutter] Blocking port 22 for IPs outside $WHITELIST"
|
||||
if [ "$oldstate" != "blocked" ]; then
|
||||
log "[sshutter] Blocking port 22 for IPs outside $WHITELIST"
|
||||
oldstate="blocked"
|
||||
fi
|
||||
nft add table inet filter
|
||||
nft add chain inet filter sshutterv4 \{ type filter hook input priority filter \; policy accept \; \}
|
||||
nft add rule inet filter sshutterv4 tcp dport "$PORT" ip saddr "$WHITELIST" accept
|
||||
nft add rule inet filter sshutterv4 tcp dport "$PORT" drop
|
||||
else
|
||||
# Ping failed, lift shutter
|
||||
log "[sshutter] Releasing port block"
|
||||
if [ "$oldstate" != "released" ]; then
|
||||
log "[sshutter] Releasing port block"
|
||||
oldstate="released"
|
||||
fi
|
||||
nft destroy chain inet filter sshutterv4
|
||||
fi
|
||||
|
||||
|
||||
Reference in New Issue
Block a user