Subversion Repositories ALCASAR

Compare Revisions

Ignore whitespace Rev 870 → Rev 871

/scripts/alcasar-iptables.sh
110,11 → 110,11
#############################
# INPUT #
#############################
 
# Tout passe sur loopback
# accept all on loopback
$IPTABLES -A INPUT -i lo -j ACCEPT
 
 
# Rejet des demandes de connexions non conformes (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
# Drop non standard connexions (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
123,8 → 123,8
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPTABLES -A INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP
 
# On rejette les trame en broadcast et en multicast sur EXTIF (pour ne pas les journaliser)
# Drop broadcast & multicast on EXTIF to not be logged
# On rejette les trame en broadcast et en multicast sur EXTIF (évite leur journalisation)
# Drop broadcast & multicast on EXTIF to avoid log
$IPTABLES -A INPUT -i $EXTIF -m addrtype --dst-type BROADCAST,MULTICAST -j DROP
 
# On autorise les retours de connexions légitimes par INPUT
201,6 → 201,7
# On EXTIF, the access attempts are log in channel 2 (we should test --limit option to avoid deny of service)
$IPTABLES -A INPUT -i $EXTIF -m state --state NEW -j ULOG --ulog-nlgroup 3 --ulog-qthreshold 10 --ulog-prefix "RULE rej-ext -- DROP"
 
 
#############################
# FORWARD #
#############################
243,9 → 244,9
$IPTABLES -A FORWARD -i $TUNIF -s $ip_exception -m state --state NEW -j ACCEPT
done < /usr/local/etc/alcasar-filter-exceptions
fi
# Compute uamallowed IP (IP address of equipments connect between ALCASAR and Internet (DMZ, own servers, ...)
nb_exceptions=`wc -l /usr/local/etc/alcasar-uamallowed | cut -d" " -f1`
if [ $nb_exceptions != "0" ]
# Compute uamallowed IP (IP address of equipments connected between ALCASAR and Internet (DMZ, own servers, ...)
nb_uamallowed=`wc -l /usr/local/etc/alcasar-uamallowed | cut -d" " -f1`
if [ $nb_uamallowed != "0" ]
then
while read ip_allowed_line
do
/web/acc/admin/auth_exceptions.php
30,7 → 30,7
$l_error_open_file = "Erreur d'ouverture du fichier";
$l_trusted_domain = "Noms de domaine Internet de confiance";
$l_domain = "Noms de domaine";
$l_comment_explain = "Lien de la page d'interception";
$l_comment_explain = "Lien affiché dans la page d'interception";
$l_comment_explain2 = "Laissez vide si non affiché";
$l_remove = "Retirer de la liste";
$l_trusted_ip = "adresses IP de confiance";
45,8 → 45,8
$l_error_open_file = "File open error";
$l_trusted_domain = "Trusted Internet domain names";
$l_domain = "Domain names";
$l_comment_explain = "Link showed in intercep page";
$l_comment_explain2 = "Let empty for no link";
$l_comment_explain = "Link displayed in intercept page";
$l_comment_explain2 = "Let empty to not display link";
$l_remove = "Remove from list";
$l_trusted_ip = "Trusted Internet domain and IP addresses";
$l_comment = "Comments";
/web/acc/admin/firewallEyes/configuration.php
43,7 → 43,7
$index=0;
while ($Fichier = readdir($dossier)) {
$exclusion = stripos ($Fichier, '.gz');
if ($Fichier != "." && $Fichier != ".." && $fichier != " " && $exclusion == 0) {
if ($Fichier != "." && $Fichier != ".." && $Fichier != " " && $exclusion == 0) {
$index ++;
$logfiles[]=$folder . "/" . $Fichier;
} # end if