WebSVN – ALCASAR – Path Comparison – /

Ignore whitespace Rev 782 → Rev 783

 /conf/sudoers
 ,13 → 6,13
 #
 # Host alias specification
-Host_Alias      LAN_ORG=192.168.182.0/24,localhost              #réseau de l'organisme
+Host_Alias      LAN_ORG=192.168.182.0/255.255.255.0,localhost           #réseau de l'organisme
 # User alias specification
 User_Alias      ADMIN=sysadmin                          # compte d'admin local de l'organisme
 User_Alias      ADMWEB=apache                           # compte lié à l'interface de gestion
 # Cmnd alias specification
-Cmnd_Alias      NET=/sbin/arping,/sbin/arp,/usr/sbin/arpscan,/usr/sbin/tcpdump                          # commandes réseau
+Cmnd_Alias      NET=/sbin/arping,/sbin/arp,/usr/sbin/arpscan,/usr/sbin/tcpdump,/usr/local/bin/alcasar-watchdog.sh       # commandes réseau
 Cmnd_Alias      URPMI=/usr/sbin/urpmi,/usr/sbin/urpmi.update                                            # gestion des paquetages
 Cmnd_Alias      BYPASS=/usr/local/sbin/alcasar-bypass.sh                                                # contournement du système d'authentification
 Cmnd_Alias      RADDB=/usr/bin/radwho,/usr/sbin/chilli_query                                            # pour la gestion des usagers en ligne

 /CHANGELOG
 ,9 → 6,11
 - Bug : don't download RPMs twice
 - Bug : allow connexion to an LDAP server on WAN side
 - Bug : don't disconnect user in some case (when the equipment is authenticated with Mac adresse)
+- Core : new alcasar-iptables.sh script (more logically strutured)
+- Core : update phpsysinfo page ("Internet access flag" nom show the right status)
 - Core : Authenticate user on Mysql when LDAP server is down
 - Core : import users via text file with or without password
-- Security : The 8080 port is now hidden on Lan side
+- Security : The 8080 (TCP) and 53 (UDP) ports are now hidden on Lan side
 ---- 2.4 ----
 - Bug : some minor bugs (log rotate, intercept page, squid, ...)
 - Bug : ACC - correction of the Internet connectivity test flag

 /scripts/alcasar-iptables.sh
 ,37 → 9,38
 #       1 (default) for tracability;
 #       2 for secure admin (ssh);
 #       3 for exterior access attempts.
-# The French Security Agency (ANSSI) rules was applied by 'alcasar.sh' script
+# The French Security Agency (ANSSI) rules was applied by 'this script
 # The bootps/dhcp (67) port is always open on tun0/eth1 by coova
 conf_file="/usr/local/etc/alcasar.conf"
 private_ip_mask=`grep PRIVATE_IP= $conf_file|cut -d"=" -f2`
 private_ip_mask=${private_ip_mask:=192.168.182.1/24}
+PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`                      # ALCASAR LAN IP address
 private_network=`/bin/ipcalc -n $private_ip_mask|cut -d"=" -f2`         # LAN IP address (ie.: 192.168.182.0)
 private_prefix=`/bin/ipcalc -p $private_ip_mask|cut -d"=" -f2`          # LAN prefix (ie. 24)
+PRIVATE_NETWORK_MASK=$private_network/$private_prefix                   # Lan IP address + prefix (192.168.182.0/24)
+public_ip_mask=`grep PUBLIC_IP= $conf_file|cut -d"=" -f2`               # ALCASAR WAN IP address
+PUBLIC_IP=`echo $public_ip_mask | cut -d"/" -f1`
 dns1=`grep DNS1= $conf_file|cut -d"=" -f2`                              # first public DNS server
 dns1=${dns1:=208.67.220.220}
 dns2=`grep DNS2= $conf_file|cut -d"=" -f2`                              # second public DNS server
 dns2=${dns2:=208.67.222.222}
+DNSSERVERS="$dns1,$dns2"                                                # first and second DNS IP servers addresses
 PROTOCOLS_FILTERING=`grep PROTOCOLS_FILTERING= $conf_file|cut -d"=" -f2`        # Network protocols filter (on/off)
 PROTOCOLS_FILTERING=${PROTOCOLS_FILTERING:=off}
 DNS_FILTERING=`grep DNS_FILTERING= $conf_file|cut -d"=" -f2`            # DNS and URLs filter (on/off)
 DNS_FILTERING=${DNS_FILTERING:=off}
-QOS=`grep QOS= $conf_file|cut -d"=" -f2`                                        # QOS (on/off)
+QOS=`grep QOS= $conf_file|cut -d"=" -f2`                                # QOS (on/off)
 QOS=${QOS:=off}
-SSH=`grep SSH= $conf_file|cut -d"=" -f2`                                        # sshd active (on/off)
+SSH=`grep SSH= $conf_file|cut -d"=" -f2`                                # sshd active (on/off)
 SSH=${SSH:=off}
-Admin_from_IP=${Admin_from_IP:="0.0.0.0/0.0.0.0"}                       # Une @IP fixe peut-être fournie pour restreindre l'accès en ssh depuis l'extérieur (ex: 80.22.21.53/24) ( 0.0.0.0/0.0.0.0  = de n'importe où ! )
-LDAP=`grep LDAP= $conf_file|cut -d"=" -f2`                              # ldap external server active (on/off)
+Admin_from_IP=${Admin_from_IP:="0.0.0.0/0.0.0.0"}                       # WAN IP address to reduce ssh access (all ip allowed on LAN side)
+LDAP=`grep LDAP= $conf_file|cut -d"=" -f2`                              # LDAP external server active (on/off)
 LDAP=${LDAP:=off}
-LDAP_IP=`grep LDAP_IP= $conf_file|cut -d"=" -f2`                        # ldap external server IP address
+LDAP_IP=`grep LDAP_IP= $conf_file|cut -d"=" -f2`                        # WAN IP address to reduce LDAP WAN access (all ip allowed on LAN side)
 LDAP_IP=${LDAP_IP:="0.0.0.0/0.0.0.0"}
-PRIVATE_NETWORK_MASK=$private_network/$private_prefix                   # Lan IP address + prefix (192.168.182.0/24)
-PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`                      # ALCASAR LAN IP address
-DNSSERVERS="$dns1,$dns2"                                                # first and second DNS IP servers addresses
 EXTIF="eth0"
 INTIF="eth1"
-TUNIF="tun0"                                                            # listen card for chilli daemon
+TUNIF="tun0"                                                            # listen device for chilli daemon
 IPTABLES="/sbin/iptables"
 # Effacement des règles existantes
 ,23 → 66,56
 $IPTABLES -t nat -P POSTROUTING ACCEPT
 $IPTABLES -t nat -P OUTPUT ACCEPT
-# Tout passe sur loopback
-# accept all on loopback
-$IPTABLES -A INPUT -i lo -j ACCEPT
 #############################
-#       INTIF rules         #
+#       PREROUTING          #
 #############################
-# interdit l'accès à INTIF (n'est utile que lorsque chilli est arrêté).
-# Reject INTIF access (only when chilli is down)
-$IPTABLES -A INPUT -i $INTIF -j ULOG --ulog-prefix "RULE Protect1 -- REJECT "
-$IPTABLES -A INPUT -i $INTIF -j REJECT
+# Marquage (et journalisation) des paquets qui tentent d'accéder directement à DansGuardian pour pouvoir les rejeter en INPUT
+# mark (and log) the dansguardian bypass attempts in order to DROP them in INPUT rules
+# $IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8080 -j ULOG --ulog-prefix "RULE direct-proxy -- DENY "
+$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8080 -j MARK --set-mark 1
+# Marquage (et journalisation) des paquets qui tentent d'accéder directement au port udp 54 pour pouvoir les rejeter en INPUT
+# Mark (and log) the udp 54 direct attempts to REJECT them in INPUT rules
+# Remarque : Ce port n'est ouvert que lorsque le filtrage est activé
+# Remark : this port is only open when filtering is on
+# $IPTABLES -A PREROUTING -t nat -i $TUNIF -p udp -d $PRIVATE_IP -m udp --dport 54 -j ULOG --ulog-prefix "RULE DNS-proxy -- DENY "
+$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 54 -j MARK --set-mark 2
+# Si le filtrage est activé, redirection des flux DNS vers le port 54 (dns+blackhole) sauf pour les IP en exceptions
+# If DNS filter is on, redirect DNS request to udp 54 (dns+blackhole) except for exception IP addresses
+if [ $DNS_FILTERING = on ]; then
+        # Compute exception IP
+        nb_exceptions=`wc -l /usr/local/etc/alcasar-filter-exceptions | cut -d" " -f1`
+        if [ $nb_exceptions != "0" ]
+        then
+                while read ip_exception
+                do
+                        $IPTABLES -A PREROUTING -t nat -i $TUNIF -p udp -s $ip_exception -d $PRIVATE_IP --dport domain -j ACCEPT
+                done < /usr/local/etc/alcasar-filter-exceptions
+        fi
+                $IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport domain -j REDIRECT --to-port 54
+fi
+# Journalisation des requètes HTTP vers Internet (seulement les paquets SYN) - Les autres protocoles sont journalisés en FORWARD
+# Log HTTP requests to Internet (only syn packets) - Other protocols are log in FORWARD
+$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p tcp --dport http -m state --state NEW -j ULOG --ulog-prefix "RULE F_http -- ACCEPT "
+# Redirection des requêtes HTTP vers DansGuardian (proxy transparent)
+# Redirect HTTP requests in DansGuardian (transparent proxy)
+$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8080
+# Redirection des requêtes NTP vers le serveur NTP local
+# Redirect NTP request in local NTP server
+$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p udp --dport ntp -j REDIRECT --to-port 123
 #############################
-#  Local protection rules   #
+#         INPUT             #
 #############################
-# On stoppe les demande de connexions non conformes (NullScan, XMAS (tous flags à 1), NEW not SYN, etc.)
-# Drop non standard connexions (NULLscans, XMAS, "NEW not SYN", etc.)
+# Tout passe sur loopback
+# accept all on loopback
+$IPTABLES -A INPUT -i lo -j ACCEPT
+# Rejet des demandes de connexions non conformes (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
+# Drop non standard connexions (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
 $IPTABLES -A INPUT -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
 $IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
 $IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
 ,38 → 122,81
 $IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
 $IPTABLES -A INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP
-# On ne traite pas les broadcasts et multicast
-# Drop broadcast & multicast
-$IPTABLES -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP
+# On rejète les trame en broadcast et en multicast sur EXTIF (pour ne pas les journaliser)
+# Drop broadcast & multicast on EXTIF to not be logged
+$IPTABLES -A INPUT -i $EXTIF -m addrtype --dst-type BROADCAST,MULTICAST -j DROP
-# Rejet des tentatives de création de tunnels DNS (même pour les utilisateurs authentifiés)
-# Deny forward DNS (even for authenticated users ...)
-$IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
-$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
+# On autorise les retours de connexions légitimes par INPUT
+# Conntrack on INPUT
+$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-# On autorise les retours de connexions légitimes par FORWARD
-# Conntrack on forward
-$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
+# On interdit les connexions directes au port utilisé par DansGuardian (8080). Les packets concernés ont été marqués dans la table mangle (PREROUTING)
+# Deny direct connections on DansGuardian port (8080). The concerned paquets are marked in mangle table (PREROUTING)
+$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m mark --mark 1 -j REJECT --reject-with tcp-reset
+# Autorisation des connexions légitimes à DansGuardian
+# Allow connections for DansGuardian
+$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8080 -m state --state NEW --syn -j ACCEPT
-###############################
-#  If DNS filter is activate  #
-###############################
-# Redirection des flux DNS vers le port 54 (dns+blackhole) sauf pour les IP en exceptions
-if [ $DNS_FILTERING = on ]; then
-        # Compute exception IP
-        nb_exceptions=`wc -l /usr/local/etc/alcasar-filter-exceptions | cut -d" " -f1`
-        if [ $nb_exceptions != "0" ]
+# On interdit les connexions directes au port UDP 54. Les packets concernés ont été marqués dans la table mangle (PREROUTING)
+# Deny direct connections on UDP 54. The concerned paquets are marked in mangle table (PREROUTING)
+$IPTABLES -A INPUT -i $TUNIF -p udp --dport 54 -m mark --mark 2 -j REJECT --reject-with icmp-port-unreachable
+# autorisation des connexion légitime à DNSMASQ (avec blackhole)
+# Allow connections for DNSMASQ (with blackhole)
+$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 54 -j ACCEPT
+# Accès direct aux services internes
+# Internal services access
+$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport domain -j ACCEPT # DNS non filtré # DNS without blackhole
+#$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp --icmp-type 8 -j ACCEPT  # Requête ping # ping request
+$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p icmp --icmp-type 0 -j ACCEPT    # Réponse ping # ping reply
+$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport https -j ACCEPT             # Pages d'authentification et MCC # authentication pages and MCC
+$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport http -j ACCEPT              # Page d'avertissement filtrage # Filtering warning pages
+$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 3990 -j ACCEPT              # Requêtes de deconnexion usagers # Users logout requests
+$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport ntp -j ACCEPT               # Serveur local de temps # local time server
+# SSHD rules if activate
+if [ $SSH = on ]
         then
-                while read ip_exception
-                do
-                        $IPTABLES -A PREROUTING -t nat -i $TUNIF -p udp -s $ip_exception -d $PRIVATE_IP --dport domain -j ACCEPT
-                done < /usr/local/etc/alcasar-filter-exceptions
-        fi
-                $IPTABLES -A PREROUTING -t nat -i $TUNIF -p udp -d $PRIVATE_IP --dport domain -j REDIRECT --to-port 54
+        $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT"
+        $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
+        $IPTABLES -A INPUT -i $EXTIF -s $Admin_from_IP -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT"
+        $IPTABLES -A INPUT -i $EXTIF -s $Admin_from_IP -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
 fi
-#####################################
-#  If protocols filter is activate  #
-#####################################
+# Insertion de règles locales
+# Here, we add local rules (i.e. VPN from Internet)
+if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
+        . /usr/local/etc/alcasar-iptables-local.sh
+fi
+# Journalisation et rejet des connexions (autres que celles autorisées) effectuées depuis le LAN
+# Deny and log on INPUT from the LAN
+$IPTABLES -A INPUT -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE rej-int -- REJECT "
+$IPTABLES -A INPUT -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
+$IPTABLES -A INPUT -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
+# interdiction d'accès à INTIF (n'est utile que lorsque chilli est arrêté).
+# Reject INTIF access (only when chilli is down)
+$IPTABLES -A INPUT -i $INTIF -j ULOG --ulog-prefix "RULE Protect1 -- REJECT "
+$IPTABLES -A INPUT -i $INTIF -j REJECT
+# Journalisation et rejet des connexions initiées depuis le réseau extérieur (test des effets du paramètre --limit en cours)
+# On EXTIF, the access attempts are log in channel 2 (we should test --limit option to avoid deny of service)
+$IPTABLES -A INPUT -i $EXTIF -m state --state NEW -j ULOG --ulog-nlgroup 3 --ulog-qthreshold 10 --ulog-prefix "RULE rej-ext -- DROP"
+#############################
+#        FORWARD            #
+#############################
+# Autorisation des retours de connexions légitimes
+# Allow conntrack
+$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
+# Rejet des requêtes DNS vers Internet
+# Deny forward DNS
+$IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
+$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
+#  If protocols filter is activate
 if [ $PROTOCOLS_FILTERING = on ]; then
         # Compute exception IP (IP addresses that shouldn't be filtered)
         nb_exceptions=`wc -l /usr/local/etc/alcasar-filter-exceptions | cut -d" " -f1`
 ,14 → 232,16
                         then
                                 $IPTABLES -A FORWARD -i $TUNIF -p icmp -j ACCEPT
                         else
-                                $IPTABLES -A FORWARD -i $TUNIF -p tcp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_$svc_name -- ACCEPT "
+                                $IPTABLES -A FORWARD -i $TUNIF -p tcp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_TCP-$svc_name -- ACCEPT "
                                 $IPTABLES -A FORWARD -i $TUNIF -p tcp --dport $svc_port -m state --state NEW -j ACCEPT
+                                $IPTABLES -A FORWARD -i $TUNIF -p udp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_UDP-$svc_name -- ACCEPT "
+                                $IPTABLES -A FORWARD -i $TUNIF -p udp --dport $svc_port -m state --state NEW -j ACCEPT
                         fi
                 fi
         done < /usr/local/etc/alcasar-services
-        # Rejet explicite (vers le LAN) des autres protocoles
-        # reject the others
-        $IPTABLES -A FORWARD -i $TUNIF -p tcp -j ULOG --ulog-prefix "RULE F_filter -- REJECT "
+        # Rejet explicite des autres protocoles
+        # reject the others protocols
+        $IPTABLES -A FORWARD -i $TUNIF -j ULOG --ulog-prefix "RULE F_filter -- REJECT "
         $IPTABLES -A FORWARD -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
         $IPTABLES -A FORWARD -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
         $IPTABLES -A FORWARD -i $TUNIF -p icmp -j REJECT
 ,75 → 259,14
 $IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
 $IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ACCEPT
-#################################################################################################
-#  Direct input from local network (icmp, dns, ntp, https, http, ssh and 3990 (user disconnect) #
-#################################################################################################
-$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp --icmp-type 0 -j ACCEPT # ping reply
-$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp --icmp-type 8 -j ACCEPT # ping request
-$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p udp --dport domain -j ACCEPT # dnsmasq without forward
-$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p udp --dport 54 -j ACCEPT # dnsmasq with blackhole
-$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p udp --dport ntp -j ACCEPT
-$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport https -j ACCEPT
-$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport http -j ACCEPT
-$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport 3990 -j ACCEPT
+#############################
+#         OUTPUT            #
+#############################
 # SSHD rules if activate
 if [ $SSH = on ]
         then
-        $IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT"
-        $IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
-        $IPTABLES -A INPUT -i $EXTIF -p tcp --dport ssh -s $Admin_from_IP -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT"
-        $IPTABLES -A INPUT -i $EXTIF -p tcp --dport ssh -s $Admin_from_IP -m state --state NEW,ESTABLISHED -j ACCEPT
         $IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport ssh -m state --state ESTABLISHED -j ACCEPT
 fi
-# Insertion de règles locales
-# Here, we add local rules (i.e. VPN from Internet)
-if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
-        . /usr/local/etc/alcasar-iptables-local.sh
-fi
-# On autorise les retours de connexions légitimes par INPUT
-# Conntrack on INPUT
-$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-# On interdit les connexions directes au port utilisé par DansGuardian (8080)
-# Les packets concernés ont fait l'objet d'un marquage dans la table mangle
-# lors d'une règle de PREROUTING (voir plus bas)
-# Deny direct connections on DansGuardian port (8080)
-# The concerned paquets are marked by a pre-routing rule (see further)
-$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m mark --mark 1 -j REJECT --reject-with tcp-reset
-# Autorisation des connexions à DansGuardian
-# Allow connections for DansGuardian
-$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m state --state NEW --syn -j ACCEPT
-# Journalisation des requètes HTTP (seulement des paquets SYN)
-# Log HTTP requests (only syn)
-$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp ! -d $PRIVATE_IP --dport http -m state --state NEW -j ULOG --ulog-prefix "RULE F_http -- ACCEPT "
-# On redirige les requêtes HTTP vers DansGuardian (transparent pour les utilisateurs)
-# Redirect HTTP request in DansGuardian (transparent proxy)
-$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp ! -d $PRIVATE_IP --dport http -j REDIRECT --to-port 8080
-# Journalisation et marquage des paquets qui tentent d'accéder directement à DansGuardian
-# pour pouvoir les supprimer en INPUT (voir plus haut)
-# Mark the dansguardian bypass attempts
-$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8080 -j ULOG --ulog-prefix "RULE direct-proxy -- DENY "
-$IPTABLES -A PREROUTING -t mangle -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8080 -j MARK --set-mark 1
-# On redirige les requêtes NTP vers le serveur NTP local
-# Redirect NTP request in local NTP server
-$IPTABLES -A PREROUTING -t nat -i $TUNIF -p udp ! -d $PRIVATE_IP --dport ntp -j REDIRECT --to-port 123
-# Journalisation et rejet des connexions (autres que celles autorisées) effectuées depuis le LAN
-# Deny and log on INPUT from the LAN
-$IPTABLES -A INPUT -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE rej-int -- REJECT "
-$IPTABLES -A INPUT -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
-$IPTABLES -A INPUT -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
-# Journalisation et rejet des connexions initiées depuis le réseau extérieur (test des effets du paramètre --limit en cours)
-# On EXTIF, the access attempts are log in channel 2 (we should test --limit option to avoid deny of service)
-$IPTABLES -A INPUT -i $EXTIF -m state --state NEW -j ULOG --ulog-nlgroup 3 --ulog-qthreshold 10 --ulog-prefix "RULE rej-ext -- DROP"
-#############################
-# filtering outside OUTPUT. #
-#############################
 # On laisse tout sortir sur toutes les cartes sauf celle qui est connectée sur l'extérieur
 # Everything is allowed but traffic through outside network interface
 $IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT
 ,15 → 274,19
 # On autorise les requêtes DNS vers les serveurs DNS identifiés
 # Allow DNS requests to identified DNS servers
 $IPTABLES -A OUTPUT -o $EXTIF -d $DNSSERVERS -p udp --dport domain -m state --state NEW -j ACCEPT
 # On autorise les requêtes HTTP sortantes
 # HTTP requests are allowed
 $IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport http -j ACCEPT
 # On autorise les requêtes NTP
 # NTP requests are allowed
 $IPTABLES -A OUTPUT -o $EXTIF -p udp --dport ntp -j ACCEPT
 # On autorise les requêtes ICMP (ping)
 # ICMP (ping) requests are allowed
 $IPTABLES -A OUTPUT -o $EXTIF -p icmp --icmp-type 8 -j ACCEPT
 # On autorise les requêtes LDAP si un serveur externe est configué
 # LDAP requests are allowed if an external server is declared
 if [ $LDAP = on ]
 ,6 → 296,11
 #       $IPTABLES -A INPUT  -p tcp -s $LDAP_IP -m multiports --sports ldap,ldaps -m state --state ESTABLISHED -j ACCEPT
 #       $IPTABLES -A INPUT  -p udp -s $LDAP_IP -m multiports --sports ldap,ldaps -m state --state ESTABLISHED -j ACCEPT
 fi
+#############################
+#       POSTROUTING         #
+#############################
 # Traduction dynamique d'adresse en sortie
 # Dynamic NAT on EXTIF
 $IPTABLES -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE

 /scripts/alcasar-watchdog.sh
 ,11 → 23,10
 OLDIFS=$IFS
 IFS=$'\n'
-# Fonction appelée si un Pb de connectivité Internet
-# On fait pointer les usagers sur l'adresse locale
-function ext_down_alert ()
+function lan_down_alert ()
+# users are redirected on ALCASAR IP address if LAN Pb detected
 {
-        case $EXT_DOWN in
+        case $LAN_DOWN in
         "1")
                 logger "eth0 link down"
                 /bin/sed -i "s?diagnostic =.*?diagnostic = \"eth0 link down\";?g" $Index_Page
 ,10 → 35,6
                 logger "can't contact the default router"
                 /bin/sed -i "s?diagnostic =.*?diagnostic = \"can't contact the default router\";?g" $Index_Page
                 ;;
-        "3")
-                logger "can't contact the Internet DNS"
-                /bin/sed -i "s?diagnostic =.*?diagnostic = \"can't contact the Internet DNS\";?g" $Index_Page
-                ;;
         esac
         net_pb=`cat /etc/dnsmasq.conf|grep "address=/#/"|wc -l`
         if [ $net_pb = "0" ] # on alerte les usagers (si ce n'est pas déjà le cas).
 ,76 → 46,92
         fi
 }
-# On teste la connectivité réseau
-# On teste l'état d'EXTIF
-EXT_DOWN="0"
-if [ "`/usr/sbin/ethtool $EXTIF|grep Link|cut -d' ' -f3`" != "yes" ]
-        then
-        EXT_DOWN="1"
-fi
-# si EXTIF ok, on teste la connectivité vers le routeur par défaut (Box FAI)
-if [ $EXT_DOWN -eq "0" ]
-        then
-        IP_GW=`/sbin/ip route list|grep ^default|cut -d" " -f3`
-        arp_reply=`/usr/sbin/arping -I$EXTIF -c1 $IP_GW|grep response|cut -d" " -f2`
-        if [ $arp_reply -eq "0" ]
-                then
-                EXT_DOWN="2"
+function lan_test ()
+# LAN connectiivity testing
+{
+        # EXTIF testing
+        LAN_DOWN="0"
+        if [ "`/usr/sbin/ethtool $EXTIF|grep Link|cut -d' ' -f3`" != "yes" ]
+                then
+                LAN_DOWN="1"
         fi
-fi
-# si routeur OK, on teste la connectivité vers les DNS externes
-# + tard (EXT_DOWN=3)
-# si Pb réseau, on avertit les usagers
-if [ $EXT_DOWN != "0" ]
-        then
-                ext_down_alert
-        else
-# sinon, le cas échéant, on rebascule en mode normal
-        net_pb=`cat /etc/dnsmasq.conf|grep "address=/#/"|wc -l`
-        if [ $net_pb != "0" ]
+        # Default GW testing
+        if [ $LAN_DOWN -eq "0" ]
                 then
-                /bin/sed -i "s?^\$network_pb.*?\$network_pb = False;?g" $Index_Page
-                /bin/sed -i "s?^address=\/#\/.*?conf-dir=/usr/local/etc/alcasar-dnsfilter-enabled?g" /etc/dnsmasq-blackhole.conf
-                /bin/sed -i "/^address=/d" /etc/dnsmasq.conf
-                /etc/init.d/dnsmasq restart
+                IP_GW=`/sbin/ip route list|grep ^default|cut -d" " -f3`
+                arp_reply=`/usr/sbin/arping -I$EXTIF -c1 $IP_GW|grep response|cut -d" " -f2`
+                if [ $arp_reply -eq "0" ]
+                        then
+                        LAN_DOWN="2"
+                fi
         fi
-fi
+        # if LAN pb detected, users are warned
+        if [ $LAN_DOWN != "0" ]
+                then
+                        lan_down_alert
+        # else switch in normal mode
+        else
+                net_pb=`cat /etc/dnsmasq.conf|grep "address=/#/"|wc -l`
+                if [ $net_pb != "0" ]
+                        then
+                        /bin/sed -i "s?^\$network_pb.*?\$network_pb = False;?g" $Index_Page
+                        /bin/sed -i "s?^address=\/#\/.*?conf-dir=/usr/local/etc/alcasar-dnsfilter-enabled?g" /etc/dnsmasq-blackhole.conf
+                        /bin/sed -i "/^address=/d" /etc/dnsmasq.conf
+                        /etc/init.d/dnsmasq restart
+                fi
+        fi
+}
+usage="Usage: alcasar-watchdog.sh {-lt --lan_test}"
+case $1 in
+        -\? | -h* | --h*)
+                echo "$usage"
+                exit 0
+                ;;
+        -lt | --lan_test)
+                lan_test
+                exit 0
+                ;;
+        *)
+                lan_test
 # lecture du fichier contenant les adresses IP des stations muettes
-if [ -e $tmp_file ]; then
-        cat $tmp_file | while read noresponse
-        do
-                noresponse_ip=`echo $noresponse | cut -d" " -f1`
-                noresponse_mac=`echo $noresponse | cut -d" " -f2`
-                arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c1 -w4 $noresponse_ip|grep response|cut -d" " -f2`
-                if [[ $(expr $arp_reply) -eq 0 ]]
-                then
-                        logger "alcasar-watchdog $noresponse_ip ($noresponse_mac) can't be contact. Alcasar disconnects the user."
-                        /usr/sbin/chilli_query logout $noresponse_mac
+                if [ -e $tmp_file ]; then
+                        cat $tmp_file | while read noresponse
+                        do
+                                noresponse_ip=`echo $noresponse | cut -d" " -f1`
+                                noresponse_mac=`echo $noresponse | cut -d" " -f2`
+                                arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c1 -w4 $noresponse_ip|grep response|cut -d" " -f2`
+                                if [[ $(expr $arp_reply) -eq 0 ]]
+                                        then
+                                        logger "alcasar-watchdog $noresponse_ip ($noresponse_mac) can't be contact. Alcasar disconnects the user."
+                                        /usr/sbin/chilli_query logout $noresponse_mac
+                                fi
+                        done
+                        rm $tmp_file
                 fi
-        done
-        rm $tmp_file
-fi
 # on traite chaque équipements connus de chilli
-for system in `/usr/sbin/chilli_query list |grep -v "\.0\.0\.0"`
-do
-        active_ip=`echo $system |cut -d" " -f2`
-        active_session=`echo $system |cut -d" " -f5`
-        active_mac=`echo $system | cut -d" " -f1`
+                for system in `/usr/sbin/chilli_query list |grep -v "\.0\.0\.0"`
+                do
+                        active_ip=`echo $system |cut -d" " -f2`
+                        active_session=`echo $system |cut -d" " -f5`
+                        active_mac=`echo $system | cut -d" " -f1`
 # on ne traite que les équipements exploitées par un usager authentifié (test de 2 réponses en 4 secondes)
-if [[ $(expr $active_session) -eq 1 ]]
-        then
-        arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c2 -w4 $active_ip|grep "Unicast reply"|wc -l`
+                        if [[ $(expr $active_session) -eq 1 ]]
+                                then
+                                arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c2 -w4 $active_ip|grep "Unicast reply"|wc -l`
 # on stocke les adresses IP des stations muettes
-        if [[ $(expr $arp_reply) -eq 0 ]]
-                then
-                        echo "$active_ip $active_mac" >> $tmp_file
-        fi
+                                if [[ $(expr $arp_reply) -eq 0 ]]
+                                        then
+                                        echo "$active_ip $active_mac" >> $tmp_file
+                                fi
 # on deconnecte l'usager d'une stations usurpée (@MAC)
-        if [[ $(expr $arp_reply) -gt 2 ]]
-                then
-                        logger "alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user."
-                        /usr/sbin/chilli_query logout $active_mac
-        fi
-fi
-done
+                                if [[ $(expr $arp_reply) -gt 2 ]]
+                                        then
+                                        logger "alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user."
+                                        /usr/sbin/chilli_query logout $active_mac
+                                fi
+                        fi
+                done
+                ;;
+esac
 IFS=$OLDIFS

 /web/acc/phpsysinfo/includes/xml/portail.php
 ,7 → 29,7
                 $host = "localhost";
                 $DB_USER = "radius";
                 $DB_RADIUS = "radius";
-                $radiuspwd = "w9VMtJD1";
+                $radiuspwd = "";
                 // Connexion au serveur
                 mysql_connect($host, $DB_USER,$radiuspwd) or die("erreur de connexion au serveur");
                 mysql_select_db($DB_RADIUS) or die("erreur de connexion a la base de donnees");
 ,18 → 57,21
 }
 // Fonction de test de connectivité internet
 function internetTest(){
-        $host = "www.google.fr";  # Google Test
+        $host = "www.google.com";  # Google Test
         $host2 = "www.alcasar.info";
         $port = "80";
         //var $num;     //non utilisé
         //var $error;   //non utilisé
-        if (! $sock = @fsockopen($host, $port, $num, $error, 2)) {
-                return false; } # Internet access is down
+        $sock = fsockopen($host, $port, $num, $error, 2);
+        if (!$sock){
+                return false; # Internet access is down
+                }
         else    {
                 fclose($sock);
-                if ($sock = @fsockopen($host2, $port, $num, $error, 2)) {
+                $sock = fsockopen($host2, $port, $num, $error, 2);
+                if ($sock){
                         fputs($sock,"GET http://$host2/images/M_images/weblink24.png HTTP/1.0\n\n");
-                        fclose($sock); }
+                        fclose($sock); }
                 return true;
                 }
 }
 ,7 → 99,7
         global $webpath;
         global $XPath;
         global $text;
+        exec ("sudo /usr/local/bin/alcasar-watchdog.sh -lt");
         $file_version = "/var/www/html/VERSION";
         $handle = fopen ($file_version, "r");
         $INSTALLEDVERSION = fread ($handle, filesize ($file_version));
 ,7 → 120,7
         if (filtrageTest("/etc/dansguardian/dansguardian.conf","/^proxyport = 8090/")){
                 $web_antivir_status = $text['enable'];}
         else {  $web_antivir_status = $text['disable'];}
-        if (internetTest()){
+        if ((filtrageTest("/var/www/html/index.php","/network_pb = False/")) && (internetTest())){
                 $internet_status =  "<img src='/images/state_ok.gif'>".$text['enable'];
                 $version = dns_get_record("version.alcasar.info",DNS_TXT);
                 $AVAILABLEDVERSION = $version[0]['txt'];

 /web/index.php
 ,6 → 1,6
 <?php
 $hostname = "alcasar";
-$network_pb = False;
+$network_pb = True;
 $cert_add = "http://alcasar/certs";
 $direct_access = False;
 $diagnostic = "eth0 link down";
 ,7 → 10,7
 $nb_connection_history = 3;
 # on discrimine les accès directs sur Alcasar par rapport aux redirections (blacklist ou pannes rso)
-if (($_SERVER['HTTP_HOST'] == $_SERVER['SERVER_ADDR']) || preg_match ("/^alcasar/", $_SERVER['HTTP_HOST']) || preg_match ("/^$hostname/", $_SERVER['HTTP_POST']))
+if (($_SERVER['HTTP_HOST'] == $_SERVER['SERVER_ADDR']) || preg_match ("/^alcasar/", $_SERVER['HTTP_HOST']) || preg_match ("/^$hostname/", $_SERVER['HTTP_HOST']))
         {
         $direct_access=True;
         exec ("sudo /usr/sbin/chilli_query list|grep $remote_ip" , $tab);
 ,7 → 30,7
 $l_connected = "connected"; // a traduire (choix de la langue ci-dessous mais nécessitant de $connection_history)
 // si on a pas d'accès à la bdd, la page s'affiche quand même correctement
-if ($user[4] != "0"){
+if ((isset ($user[4])) && ($user[4] != "0")){
         if ((is_file("./acc/manager/lib/sql/drivers/mysql/functions.php"))&&(is_file("/etc/freeradius-web/config.php"))){
                 include_once("/etc/freeradius-web/config.php");
                 include_once("./acc/manager/lib/sql/drivers/mysql/functions.php");
 ,12 → 102,15
   $l_install_certif_more = "<a href=\"$cert_add/certificat_alcasar_ca.cert\">Install ALCASAR AC Certificate</a>";
   $l_certif_explain = "Allow secure data exchange between your computer and ALCASAR portal.<BR>If this certificate isn't incorporated in your computer, some security alerts should appear in your browser.<br><br>";
   $l_certif_explain_help = "<a href=\"alcasar-certificat.pdf\" target=\"_blank\">Complementary help</a>";
-if ($user[4] == "0") {
+if ((isset ($user[4])) && ($user[4] == "0")) {
           $l_logout_explain = "No Internet consultation session is actualy open on your system";
           $l_logout = "<a href=\"http://www.google.fr\">Open an Internet session</a>";}
   else {
-          $l_logout_explain = "Close the session of the user actualy connecterd.<br> User logged-on : <a href=\"http://$hostname:3990/logoff\" title=\"Disconnect user $user[5]\"><b>$user[5]</b></a><br><br>$nb_connection_history last connections :$connection_history";
-          $l_logout = "<a href=\"http://$hostname:3990/logoff\">Logoff from internet</a>";}
+          if (isset ($user[5])) {
+                  $l_logout_explain = "Close the session of the user actualy connecterd.<br> User logged-on : <a href=\"http://$hostname:3990/logoff\" title=\"Disconnect user $user[5]\"><b>$user[5]</b></a><br><br>$nb_connection_history last connections :$connection_history";
+                  $l_logout = "<a href=\"http://$hostname:3990/logoff\">Logoff from internet</a>";
+                }
+        }
   $l_password_change = "<a href=\"https://$hostname/pass\">Change your password</a>";
   $l_password_change_explain = "Ridirect you on password change page.<br><br> You should already have an Internet access account.";
   $l_back_page = "<a href=\"javascript:history.back()\">Previous page</a>";
 ,7 → 130,7
 $img_false = "interdit.png";
 $img_internet = $img_connect;
-if ($user[4] == "0") {
+if ((isset ($user[4])) && ($user[4] == "0")) {
         if (! $network_pb) {
                 $img_internet = $img_access;
                 }

Subversion Repositories ALCASAR

Compare Revisions

Ignore whitespace Rev 782 → Rev 783