Revisión 216
Añadido por Francisco Rodrigo hace más de 13 años
| tareas_puppet/servidores_aula/squid-ltsp/files/deny_https_iptables | ||
|---|---|---|
|
#! /bin/sh
|
||
|
### BEGIN INIT INFO
|
||
|
# Provides: deny_https_iptables
|
||
|
# Required-Start:
|
||
|
# Required-Stop:
|
||
|
# Provides: deny https
|
||
|
# Required-Start: $remote_fs
|
||
|
# Should-Start: $network
|
||
|
# Required-Stop: $remote_fs
|
||
|
# Should-Stop: $network
|
||
|
# Default-Start: 2 3 4 5
|
||
|
# Default-Stop: 0 1 6
|
||
|
# Short-Description: Controla la activacion/desactivacion de reglas iptables
|
||
|
# que contan el trafico https de las webs indicadas en el fichero de configuracion.
|
||
|
# Depende del fichero de configuracion: /etc/squid/acl/deny_https
|
||
|
# La regla "iptables-restore < /etc/network/iptables" se pone por seguridad
|
||
|
# porque su ejecucion deberia dejar la situacion tal cual esta.
|
||
|
# Short-Description: Deny https
|
||
|
# Description: Deny https
|
||
|
#
|
||
|
### END INIT INFO
|
||
|
#----------------------------------------------------------------------------------------
|
||
|
# Antonio J. Abasolo Sierra (Mayo-2010)
|
||
|
# Modificado por Francisco Rodrigo López (Octubre - 2011)
|
||
|
#----------------------------------------------------------------------------------------
|
||
|
# Controla la activación/desactivación de reglas iptables
|
||
|
# que cortan el tráfico https para todas las webs externas, e ips del centro
|
||
|
# que indiquemos en su fichero de configuración.
|
||
|
#
|
||
|
# Depende del fichero de configuración "/etc/squid/acl/deny_https".
|
||
|
#
|
||
|
# La regla "iptables-restore < /etc/network/iptables" se pone por seguridad:
|
||
|
# ya que se ejecuta tras eliminar las reglas, en cuyo momento la situación
|
||
|
# ya debería ser la misma que plantea esta línea.
|
||
|
#
|
||
|
# Se incluye cortar el tráfico facebook mediante rangos.
|
||
|
#
|
||
|
#----------------------------------------------------------------------------------------
|
||
|
|
||
|
set -e
|
||
|
|
||
|
PATH=/sbin:/bin:/usr/sbin:/usr/bin
|
||
|
|
||
|
#----------------------------------------------------------------------------------------
|
||
|
IPTABLES=/sbin/iptables
|
||
|
|
||
|
DENY_HTTPS=/etc/squid/acl/deny_https
|
||
|
RED=`ifconfig | grep Bcast | cut -f2 -d: | awk '{print }' | cut -f1 -d.`
|
||
|
|
||
|
#iptables -A FORWARD -p tcp -m tcp --dport 443 -d WEB/IP -j DROP
|
||
|
#iptables -A FORWARD -p tcp --dport 443 -d WEB -j DROP
|
||
|
#iptables -A FORWARD -p tcp --dport 443 -s IP -j DROP
|
||
|
|
||
|
# Bail out if no iptables binary or no configuration
|
||
|
[ -x ${IPTABLES} -a "$DENY_HTTPS" ] || exit 0
|
||
|
|
||
|
clear
|
||
|
|
||
|
#----------------------------------------------------------------------------------------
|
||
|
do_status() {
|
||
|
echo ""
|
||
|
echo "ESTADO ACTUAL DE LAS REGLAS ..."
|
||
|
echo "----------------------------------------------------"
|
||
|
$IPTABLES -L
|
||
|
echo "----------------------------------------------------"
|
||
|
|
||
|
}
|
||
|
|
||
|
is_enabled() {
|
||
|
if do_status | grep "REJECT" ; then
|
||
|
true
|
||
|
else
|
||
|
false
|
||
|
fi
|
||
|
}
|
||
|
|
||
|
#----------------------------------------------------------------------------------------
|
||
|
do_start() {
|
||
|
|
||
|
iptables-restore < /etc/network/iptables
|
||
|
if is_enabled ; then
|
||
|
echo "REJECT https to iptables already enabled."
|
||
|
else
|
||
|
echo "Enabling REJECT to iptables."
|
||
|
cat /etc/squid/acl/deny_https | while read linea; do
|
||
|
echo "Filtrando $linea ..."
|
||
|
iptables -A FORWARD -p tcp -m tcp --dport 443 -d $linea -j REJECT
|
||
|
done
|
||
|
fi
|
||
|
do_status
|
||
|
echo "ACTIVANDO reglas para controlar el tráfico https:"
|
||
|
echo "-------------------------------------------------"
|
||
|
iptables-restore < /etc/network/iptables
|
||
|
egrep -v '#|^$' $DENY_HTTPS | awk '{print $1}' | while read LINEA; do
|
||
|
if [ `echo $LINEA | grep $RED` ]; then OPCION="-s"; else OPCION="-d"; fi
|
||
|
echo " * Denegando https a $LINEA ..."
|
||
|
$IPTABLES -A FORWARD -p tcp --dport 443 $OPCION $LINEA -j REJECT 2> /dev/null
|
||
|
done
|
||
|
cortar_facebook
|
||
|
echo " ----------------------------------------------"
|
||
|
echo " * EL TRAFICO HTTPS ESTA RESTRINGIDO."
|
||
|
echo ""
|
||
|
}
|
||
|
|
||
|
do_stop() {
|
||
|
if is_enabled ; then
|
||
|
echo "Disabling REJECT to iptables.."
|
||
|
cat /etc/squid/acl/deny_https | while read linea; do
|
||
|
echo "Desactivando $linea ..."
|
||
|
iptables -D FORWARD -p tcp -m tcp --dport 443 -d $linea -j REJECT
|
||
|
done
|
||
|
else
|
||
|
echo "REJECT https to iptables already disabled."
|
||
|
fi
|
||
|
|
||
|
iptables-restore < /etc/network/iptables
|
||
|
do_status
|
||
|
echo "DESACTIVANDO reglas para controlar el tráfico https:"
|
||
|
echo "-------------------------------------------------"
|
||
|
egrep -v '#|^$' $DENY_HTTPS | awk '{print $1}' | while read LINEA; do
|
||
|
if [ `echo $LINEA | grep $RED` ]; then OPCION="-s"; else OPCION="-d"; fi
|
||
|
echo " * Eliminando regla https para $LINEA ..."
|
||
|
$IPTABLES -D FORWARD -p tcp --dport 443 $OPCION $LINEA -j REJECT 2> /dev/null
|
||
|
done
|
||
|
echo " * Eliminando reglas https para facebook (rangos) ..."
|
||
|
iptables-restore < /etc/network/iptables
|
||
|
echo " -----------------------------------------------"
|
||
|
echo " * EL TRAFICO HTTPS ESTA LIBERADO."
|
||
|
echo ""
|
||
|
}
|
||
|
|
||
|
do_restart() {
|
||
|
if is_enabled ; then
|
||
|
echo "Disabling REJECT to iptables.."
|
||
|
cat /etc/squid/acl/deny_https | while read linea; do
|
||
|
echo "Desactivando $linea ..."
|
||
|
iptables -D FORWARD -p tcp -m tcp --dport 443 -d $linea -j REJECT
|
||
|
done
|
||
|
fi
|
||
|
|
||
|
iptables-restore < /etc/network/iptables
|
||
|
echo "Enabling REJECT to iptables."
|
||
|
cat /etc/squid/acl/deny_https | while read linea; do
|
||
|
echo "Filtrando $linea ..."
|
||
|
iptables -A FORWARD -p tcp -m tcp --dport 443 -d $linea -j REJECT
|
||
|
done
|
||
|
do_stop
|
||
|
do_start
|
||
|
}
|
||
|
|
||
|
do_status
|
||
|
cortar_facebook() {
|
||
|
iptables -N FACEBOOK
|
||
|
|
||
|
echo " * Denegando https para facebook (rangos) ..."
|
||
|
iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 66.220.144.0-66.220.159.255 --dport 443 -j FACEBOOK
|
||
|
iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 69.63.176.0-69.63.191.255 --dport 443 -j FACEBOOK
|
||
|
iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 69.171.0.0-69.171.242.255 --dport 443 -j FACEBOOK
|
||
|
iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 184.50.162.0-184.50.162.255 --dport 443 -j FACEBOOK
|
||
|
iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 204.15.20.0-204.15.23.255 --dport 443 -j FACEBOOK
|
||
|
|
||
|
iptables -A FACEBOOK -j REJECT
|
||
|
}
|
||
|
|
||
|
#----------------------------------------------------------------------------------------
|
||
|
case "$1" in
|
||
|
start)
|
||
|
do_start
|
||
|
do_start
|
||
|
# do_status
|
||
|
;;
|
||
|
stop)
|
||
|
do_stop
|
||
|
do_stop
|
||
|
# do_status
|
||
|
;;
|
||
|
restart|force-reload)
|
||
|
do_restart
|
||
|
do_restart
|
||
|
# do_status
|
||
|
;;
|
||
|
status)
|
||
|
do_status
|
||
| ... | ... | |
|
exit 2
|
||
|
;;
|
||
|
esac
|
||
|
|
||
|
exit 0
|
||
|
#----------------------------------------------------------------------------------------
|
||
|
|
||
Exportar a: Unified diff
Actualizo squid-ltsp para que corte facebook