Compare commits
2 Commits
e5a8d2d21b
..
main
| Author | SHA1 | Date | |
|---|---|---|---|
| 1045f11b27 | |||
| 6dfb40a70a |
@@ -0,0 +1 @@
|
|||||||
|
/etc/sshutter.conf
|
||||||
@@ -10,4 +10,4 @@ This situation asks for dynamic solutions. And **sshutter** is such a dynamic so
|
|||||||
|
|
||||||
## Building/Packing
|
## Building/Packing
|
||||||
|
|
||||||
To create the Debian/Ubuntu package for sshutter, run `dpkg-deb --root-owner-group --build . sshutter-v0.1.deb`
|
To create the Debian/Ubuntu package for sshutter, run `dpkg-deb --root-owner-group --build . sshutter_v0.1_all.deb`
|
||||||
|
|||||||
@@ -22,18 +22,25 @@ if [ "$UID" -ne 0 ]; then
|
|||||||
fi
|
fi
|
||||||
|
|
||||||
# Main loop
|
# Main loop
|
||||||
|
oldstate=""
|
||||||
while [ true ]; do
|
while [ true ]; do
|
||||||
ping -c 3 "$TARGET" 1>/dev/null
|
ping -c 3 "$TARGET" 1>/dev/null
|
||||||
if [ "$?" -eq 0 ]; then
|
if [ "$?" -eq 0 ]; then
|
||||||
# Ping successful, apply shutter
|
# Ping successful, apply shutter
|
||||||
|
if [ "$oldstate" != "blocked" ]; then
|
||||||
log "[sshutter] Blocking port 22 for IPs outside $WHITELIST"
|
log "[sshutter] Blocking port 22 for IPs outside $WHITELIST"
|
||||||
|
oldstate="blocked"
|
||||||
|
fi
|
||||||
nft add table inet filter
|
nft add table inet filter
|
||||||
nft add chain inet filter sshutterv4 \{ type filter hook input priority filter \; policy accept \; \}
|
nft add chain inet filter sshutterv4 \{ type filter hook input priority filter \; policy accept \; \}
|
||||||
nft add rule inet filter sshutterv4 tcp dport "$PORT" ip saddr "$WHITELIST" accept
|
nft add rule inet filter sshutterv4 tcp dport "$PORT" ip saddr "$WHITELIST" accept
|
||||||
nft add rule inet filter sshutterv4 tcp dport "$PORT" drop
|
nft add rule inet filter sshutterv4 tcp dport "$PORT" drop
|
||||||
else
|
else
|
||||||
# Ping failed, lift shutter
|
# Ping failed, lift shutter
|
||||||
|
if [ "$oldstate" != "released" ]; then
|
||||||
log "[sshutter] Releasing port block"
|
log "[sshutter] Releasing port block"
|
||||||
|
oldstate="released"
|
||||||
|
fi
|
||||||
nft destroy chain inet filter sshutterv4
|
nft destroy chain inet filter sshutterv4
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user