Index: limitar-https/trunk/test
===================================================================
--- limitar-https/trunk/test	(revision 5)
+++ limitar-https/trunk/test	(nonexistent)
@@ -1,2 +0,0 @@
-probando
-segunda opción
Index: limitar-https/trunk/deny_https
===================================================================
--- limitar-https/trunk/deny_https	(nonexistent)
+++ limitar-https/trunk/deny_https	(revision 6)
@@ -0,0 +1,107 @@
+#! /bin/sh
+#----------------------------------------------------------------------------------------
+# Antonio J. Abasolo Sierra (Mayo-2010)
+#----------------------------------------------------------------------------------------
+# Controla la activación/desactivación de reglas iptables
+# que cortan el tráfico https para todas las webs externas, e ips del centro
+# que indiquemos en su fichero de configuración.
+#
+# Depende del fichero de configuración "/etc/network/deny_https.conf", 
+# el cual se genera a partir del fichero "/etc/network/deny_https.all" 
+# obtenido a diario del repositorio general, mas el fichero "/etc/network/deny_https.ies",
+# el cual será modificado por cada IES según sus necesidades.
+# Dichos ficheros podrán tener dos tipos de líneas (no importa el orden):
+# 	- web's de destino que queremos bloquear vía https
+#		iptables -A FORWARD -p tcp --dport 443 -d WEB -j REJECT
+#	- ip's de equipos locales del IES a los que queremos restringir el tráfico https
+#		iptables -A FORWARD -p tcp --dport 443 -s IP -j REJECT
+#
+# La regla "iptables-restore < /etc/network/iptables" se pone por seguridad:
+# ya que se ejecuta tras eliminar las reglas, en cuyo momento la situación
+# ya debería ser la misma que plantea esta línea; y justo antes de añadir las reglas,
+# para garantizar que partimos del estado inicial.
+# Dicho fichero, a partir de ahora, se gestionará vía puppet para garantizar el mismo 
+# contenido en todos los IES.
+#----------------------------------------------------------------------------------------
+
+# Variables 
+IPTABLES=/sbin/iptables
+DENY_HTTPS=/etc/network/deny_https.conf
+RED=`ifconfig | grep Bcast | cut -f2 -d: | awk '{print }' | cut -f1 -d.`
+#----------------------------------------------------------------------------------------
+
+# Unimos y filtramos los ficheros de configuración
+cat deny_https.all deny_https.ies | egrep -v '#|^$' | awk '{print $1}' | sort | uniq > $DENY_HTTPS
+#----------------------------------------------------------------------------------------
+
+# Bail out if no iptables binary or no configuration
+[ -x ${IPTABLES} -a "$DENY_HTTPS" ] || exit 0
+#----------------------------------------------------------------------------------------
+
+#----------------------------------------------------------------------------------------
+do_status() {
+    echo ""
+    echo "ESTADO ACTUAL DE LAS REGLAS ..."
+    echo "----------------------------------------------------"
+    $IPTABLES -L
+    echo "----------------------------------------------------"
+}
+
+#----------------------------------------------------------------------------------------
+do_start() {
+  echo "ACTIVANDO reglas para controlar el tráfico https:"
+  echo "-------------------------------------------------"
+  iptables-restore < /etc/network/iptables
+  cat $DENY_HTTPS | while read LINEA; do
+    if [ `echo $LINEA | grep $RED` ]; then OPCION="-s"; else OPCION="-d"; fi
+    echo "  * Denegando https a $LINEA ..."
+    $IPTABLES -A FORWARD -p tcp --dport 443 $OPCION $LINEA -j REJECT 2> /dev/null
+  done
+  echo "  ----------------------------------------------"
+  echo "  * EL TRAFICO HTTPS ESTA RESTRINGIDO."
+}
+
+do_stop() {
+  echo "DESACTIVANDO reglas para controlar el tráfico https:"
+  echo "-------------------------------------------------"
+  cat $DENY_HTTPS | while read LINEA; do
+    if [ `echo $LINEA | grep $RED` ]; then OPCION="-s"; else OPCION="-d"; fi
+    echo "  * Eliminando regla https para $LINEA ..."
+    $IPTABLES -D FORWARD -p tcp --dport 443 $OPCION $LINEA -j REJECT 2> /dev/null
+  done
+  iptables-restore < /etc/network/iptables
+  echo "  -----------------------------------------------"
+  echo "  * EL TRAFICO HTTPS ESTA LIBERADO."
+}
+
+do_restart() {
+  do_stop
+  do_start
+}
+
+# INICIO --------------------------------------------------------------------------------
+clear
+case "$1" in
+    start)
+	do_start
+	do_status
+        ;;
+    stop)
+	do_stop
+	do_status
+        ;;
+    restart|force-reload)
+	do_restart
+	do_status
+        ;;
+    status)
+        do_status
+        ;;
+    *)
+        echo "Usage: $0 {start|stop|restart|force-reload|status}"
+        exit 2
+        ;;
+esac
+exit 0
+# FIN -----------------------------------------------------------------------------------
+

Property changes on: limitar-https/trunk/deny_https
___________________________________________________________________
Added: svn:executable
## -0,0 +1 ##
+*
\ No newline at end of property
Index: limitar-https/trunk/iptables
===================================================================
--- limitar-https/trunk/iptables	(nonexistent)
+++ limitar-https/trunk/iptables	(revision 6)
@@ -0,0 +1,34 @@
+# Generated by iptables-save v1.3.6 on Wed Feb 13 10:54:53 2008
+*filter
+:INPUT ACCEPT [8704860:9777713158]
+:FORWARD ACCEPT [55619:8261637]
+:OUTPUT ACCEPT [6140664:1872966901]
+-A FORWARD -p tcp -m tcp --dport 445 -j LOG --log-prefix "win-gusano" 
+-A FORWARD -p tcp -m tcp --dport 445 -j DROP 
+-A FORWARD -p tcp -m tcp --dport 137 -j LOG --log-prefix "win-gusano" 
+-A FORWARD -p tcp -m tcp --dport 137 -j DROP 
+-A FORWARD -p tcp -m tcp --dport 139 -j LOG --log-prefix "win-gusano" 
+-A FORWARD -p tcp -m tcp --dport 139 -j DROP 
+COMMIT
+# Completed on Wed Feb 13 10:54:53 2008
+# Generated by iptables-save v1.3.6 on Wed Feb 13 10:54:53 2008
+*nat
+:PREROUTING ACCEPT [39355:4796594]
+:POSTROUTING ACCEPT [59346:4231171]
+:OUTPUT ACCEPT [54652:39474654]
+-A PREROUTING -d 127.0.0.1 -i eth0 -p tcp -j ACCEPT 
+-A PREROUTING -d 172.23.20.10 -i eth0 -p tcp -j ACCEPT 
+-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 
+-A PREROUTING -i eth0 -p tcp -m tcp --dport 110 -j DNAT --to-destination 217.124.183.2
+-A PREROUTING -i eth0 -p tcp -m tcp --dport 465 -j DNAT --to-destination 217.124.183.2
+COMMIT
+# Completed on Wed Feb 13 10:54:53 2008
+# Generated by iptables-save v1.3.6 on Wed Feb 13 10:54:53 2008
+*mangle
+:PREROUTING ACCEPT [8787237:9789063292]
+:INPUT ACCEPT [8704860:9777713158]
+:FORWARD ACCEPT [55619:8261637]
+:OUTPUT ACCEPT [6156510:1874092901]
+:POSTROUTING ACCEPT [6196283:1881228538]
+COMMIT
+# Completed on Wed Feb 13 10:54:53 2008
Index: limitar-https/trunk/limitar_https.class
===================================================================
--- limitar-https/trunk/limitar_https.class	(nonexistent)
+++ limitar-https/trunk/limitar_https.class	(revision 6)
@@ -0,0 +1,30 @@
+class limitar_https {
+
+   file { "/etc/network/iptables":
+ 	owner=>root, group=>root, mode=>644,
+	source=>"puppet:///puppet.educarex.es/files/iptables",
+	notify => Exec["denegar-https"]
+   }
+
+   file { "/etc/init.d/deny_https":
+ 	owner=>root, group=>root, mode=>755,
+	source=>"puppet:///puppet.educarex.es/files/deny_https",
+	notify => Exec["configurar-https"],
+   }
+
+    exec { "configurar-https":
+	command => "/usr/sbin/update-rc.d deny_https start 99 2 3 4 5 . stop 01 0 1 6 ; /etc/init.d/deny_https start",
+	require => File["/etc/init.d/deny_https"],
+     	unless => "/bin/ls /etc/rc2.d/S99deny_https",
+        refreshonly => true,
+    }
+
+   cron { 
+	"Descarga-Diaria-https.all":
+	        command => "/usr/sbin/sarg-reports today",
+		user => root,
+		hour => '08',
+		minute => '15';
+	}
+
+}
Index: limitar-https/trunk/deny_https.all
===================================================================
--- limitar-https/trunk/deny_https.all	(nonexistent)
+++ limitar-https/trunk/deny_https.all	(revision 6)
@@ -0,0 +1,9 @@
+# Lista de web's https prohibidas para todos
+www.tuenti.com
+www.facebook.com
+www.meebo.com
+www.imo.im
+www.badoo.com
+www.twitter.com
+www.hi5.com
+www.suresome.com
