Compare commits
2 Commits
e5a8d2d21b
...
main
| Author | SHA1 | Date | |
|---|---|---|---|
| 1045f11b27 | |||
| 6dfb40a70a |
@@ -0,0 +1 @@
|
||||
/etc/sshutter.conf
|
||||
@@ -10,4 +10,4 @@ This situation asks for dynamic solutions. And **sshutter** is such a dynamic so
|
||||
|
||||
## Building/Packing
|
||||
|
||||
To create the Debian/Ubuntu package for sshutter, run `dpkg-deb --root-owner-group --build . sshutter-v0.1.deb`
|
||||
To create the Debian/Ubuntu package for sshutter, run `dpkg-deb --root-owner-group --build . sshutter_v0.1_all.deb`
|
||||
|
||||
+9
-2
@@ -22,18 +22,25 @@ if [ "$UID" -ne 0 ]; then
|
||||
fi
|
||||
|
||||
# Main loop
|
||||
oldstate=""
|
||||
while [ true ]; do
|
||||
ping -c 3 "$TARGET" 1>/dev/null
|
||||
if [ "$?" -eq 0 ]; then
|
||||
# Ping successful, apply shutter
|
||||
log "[sshutter] Blocking port 22 for IPs outside $WHITELIST"
|
||||
if [ "$oldstate" != "blocked" ]; then
|
||||
log "[sshutter] Blocking port 22 for IPs outside $WHITELIST"
|
||||
oldstate="blocked"
|
||||
fi
|
||||
nft add table inet filter
|
||||
nft add chain inet filter sshutterv4 \{ type filter hook input priority filter \; policy accept \; \}
|
||||
nft add rule inet filter sshutterv4 tcp dport "$PORT" ip saddr "$WHITELIST" accept
|
||||
nft add rule inet filter sshutterv4 tcp dport "$PORT" drop
|
||||
else
|
||||
# Ping failed, lift shutter
|
||||
log "[sshutter] Releasing port block"
|
||||
if [ "$oldstate" != "released" ]; then
|
||||
log "[sshutter] Releasing port block"
|
||||
oldstate="released"
|
||||
fi
|
||||
nft destroy chain inet filter sshutterv4
|
||||
fi
|
||||
|
||||
|
||||
Reference in New Issue
Block a user