Merge branch 'master' of git+ssh://46.4.205.177:262/var/www/git/mcBash

prox-fire.d/README

+Das script öffnet und schließt einen Port in einer iptables basierende Firewall durch hinzufügen bzw. löschen einer Regel.
+
+Es sollte in 
+
+/usr/local/sbin/ 
+
+installiert werden.

prox-fire.d/prox-fire

+#!/bin/bash
+
+#    <prox-fire Proxmox-Port öffnen und schließen>
+# version: 0.3
+#    Copyright (C) <2013>  <Heiko Kokemoor>
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License as published by
+#    the Free Software Foundation, either version 3 of the License, or
+#    (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+
+
+EXT_IFACE='eth0'
+LO_EXT_IFACE='lo'
+IPTABLES='/sbin/iptables'
+LOGLEVELDROP='4' # 1=alert,2=critical,3=error,4=warning,5=notice,6=info,7=debug
+LOGLEVELACCEPT='4'
+PROXPORT='8006'
+
+
+
+check_rule_start()
+{
+        CLIENT_IP=$(echo $SSH_CLIENT | awk '{ print $1}')
+
+        $IPTABLES -L -n|grep "tcp dpt:$PROXPORT"|grep $CLIENT_IP
+}
+
+accept_proxmox()
+{
+        CLIENT_IP=$(echo $SSH_CLIENT | awk '{ print $1}')
+        $IPTABLES -A INPUT -i $EXT_IFACE -p tcp --dport $PROXPORT -s $CLIENT_IP -j ACCEPT
+        $IPTABLES -A OUTPUT  -o $EXT_IFACE -p tcp --dport $PROXPORT -d $CLIENT_IP -j ACCEPT
+        echo "Port $PROXPORT for IP $CLIENT_IP is unblocked"
+}
+
+drop_proxmox()
+{       
+        CLIENT_IP=$(echo $SSH_CLIENT | awk '{ print $1}')
+        
+        EI=0
+        EO=0
+        while [ $EI = 0 ] && [ $EO = 0 ]
+        do      
+                $IPTABLES -D INPUT -i $EXT_IFACE -p tcp --dport $PROXPORT -s $CLIENT_IP -j ACCEPT 
+                EI=$?
+                $IPTABLES -D OUTPUT  -o $EXT_IFACE -p tcp --dport $PROXPORT -d $CLIENT_IP -j ACCEPT
+                EO=$?
+        done 
+        echo "Port $PROXPORT for IP $CLIENT_IP is blocked"
+}
+
+
+stop_all()
+{       
+        C=0
+        L=0
+        unset Z 
+        declare -a Z
+         
+         A=$(iptables -L -n |grep $PROXPORT |awk '{print $4}'|grep -v 0.0.0.0||iptables -L -n |grep $PROXPORT |awk '{print $5}'|grep -v 0.0.0.0)
+        
+        while [ $C = 0 ]
+                do      
+                        L=$(( $L+1 ))
+                        Z[$L]=$(echo $A|awk '{ print $'''$L'''}')
+                        $IPTABLES -D INPUT -i $EXT_IFACE -p tcp --dport $PROXPORT -s ${Z[$L]} -j ACCEPT   
+                        $IPTABLES -D OUTPUT -o $EXT_IFACE -p tcp --dport $PROXPORT -d ${Z[$L]} -j ACCEPT  
+                        if [ -z ${Z[$L]} ]
+                                then C=1
+                        fi
+                done
+        
+        echo "Port $PROXPORT for all IPs blocked"
+}
+
+i=$1
+ 
+case $i in
+        start)
+               check_rule_start
+               if [  $? = 1 ]
+                       then 
+                                accept_proxmox
+              		else
+                                echo "IP $CLIENT_IP already unblocked"
+
+		fi              
+                
+        ;;      
+        stop)
+               drop_proxmox
+        ;;     
+        stop-all)
+                stop_all
+        ;;              
+	check)
+		check_rule_start
+	;;
+        *)
+                echo $(basename $0) '[start|stop|stop-all] - opens a port for the Proxmox Webinterface'
+        ;;
+esac
+