Compare commits

...

2 Commits

3 changed files with 11 additions and 3 deletions
+1
View File
@@ -0,0 +1 @@
/etc/sshutter.conf
+1 -1
View File
@@ -10,4 +10,4 @@ This situation asks for dynamic solutions. And **sshutter** is such a dynamic so
## Building/Packing ## Building/Packing
To create the Debian/Ubuntu package for sshutter, run `dpkg-deb --root-owner-group --build . sshutter-v0.1.deb` To create the Debian/Ubuntu package for sshutter, run `dpkg-deb --root-owner-group --build . sshutter_v0.1_all.deb`
+9 -2
View File
@@ -22,18 +22,25 @@ if [ "$UID" -ne 0 ]; then
fi fi
# Main loop # Main loop
oldstate=""
while [ true ]; do while [ true ]; do
ping -c 3 "$TARGET" 1>/dev/null ping -c 3 "$TARGET" 1>/dev/null
if [ "$?" -eq 0 ]; then if [ "$?" -eq 0 ]; then
# Ping successful, apply shutter # Ping successful, apply shutter
log "[sshutter] Blocking port 22 for IPs outside $WHITELIST" if [ "$oldstate" != "blocked" ]; then
log "[sshutter] Blocking port 22 for IPs outside $WHITELIST"
oldstate="blocked"
fi
nft add table inet filter nft add table inet filter
nft add chain inet filter sshutterv4 \{ type filter hook input priority filter \; policy accept \; \} nft add chain inet filter sshutterv4 \{ type filter hook input priority filter \; policy accept \; \}
nft add rule inet filter sshutterv4 tcp dport "$PORT" ip saddr "$WHITELIST" accept nft add rule inet filter sshutterv4 tcp dport "$PORT" ip saddr "$WHITELIST" accept
nft add rule inet filter sshutterv4 tcp dport "$PORT" drop nft add rule inet filter sshutterv4 tcp dport "$PORT" drop
else else
# Ping failed, lift shutter # Ping failed, lift shutter
log "[sshutter] Releasing port block" if [ "$oldstate" != "released" ]; then
log "[sshutter] Releasing port block"
oldstate="released"
fi
nft destroy chain inet filter sshutterv4 nft destroy chain inet filter sshutterv4
fi fi