v1.0.0
This commit is contained in:
parent
63a7e17e15
commit
15f86cafb4
4
LICENSE
4
LICENSE
@ -1,4 +1,4 @@
|
||||
Non-Commercial Use License – [template.sh, install.sh]
|
||||
Non-Commercial Use License – [stop-output-traffic-http-https.sh]
|
||||
|
||||
Copyright (c) [2025] [Gilles Mouchet]
|
||||
|
||||
@ -15,7 +15,7 @@ It is strictly prohibited to:
|
||||
|
||||
These scripts are provided "as is," without warranty of any kind.
|
||||
-----------------------------------------------------------------------------------------
|
||||
Licence d’utilisation non commerciale – [template.sh, install.sh]
|
||||
Licence d’utilisation non commerciale – [stop-output-traffic-http-https.sh]
|
||||
|
||||
Copyright (c) [2025] [Gilles Mouchet]
|
||||
|
||||
|
||||
22
README.md
22
README.md
@ -1,21 +1,17 @@
|
||||
# Project Name
|
||||
TODO: Write a project description
|
||||
# stop-output-traffic-http-https
|
||||
|
||||
Blocks all outgoing http and https traffic
|
||||
|
||||
## Requirements
|
||||
TODO: Requirments
|
||||
Server proxy
|
||||
## Installation
|
||||
TODO: Describe the installation process
|
||||
N/A
|
||||
## Usage
|
||||
TODO: Write usage instructions
|
||||
./stop-output-traffic-http-https.sh
|
||||
|
||||
### Changelog
|
||||
### [1.0.0] - 2025-09-06
|
||||
### [1.0.0] - 2025-09-17
|
||||
#### Added
|
||||
- New features and functionality.
|
||||
#### Modified
|
||||
- Changes to existing functionality (backwards compatible).
|
||||
#### Fixed
|
||||
- Bug fixes.
|
||||
#### Removed
|
||||
- Deprecated or removed features (breaking changes).
|
||||
- set firewall rules
|
||||
#### Project initialization
|
||||
- initialization by [GMo](mailto:gilles.mouchet@gmail.com)
|
||||
|
||||
100
install.sh
100
install.sh
@ -1,100 +0,0 @@
|
||||
#!/bin/bash
|
||||
############################################################
|
||||
# Decription: Install script
|
||||
# Author: Gilles Mouchet (gilles.mouchet@gmail.com)
|
||||
# Creation Date: 06-Sep-2025
|
||||
# Version: 1.0
|
||||
#
|
||||
# Changelog:
|
||||
# V1.0.0 - 06-Sep-2025 - GMo
|
||||
# Added
|
||||
# - Creation of script from scratch
|
||||
#
|
||||
############################################################
|
||||
|
||||
#-----------------------------------------------------------
|
||||
# FUNCTIONS
|
||||
#-----------------------------------------------------------
|
||||
# Function installPacakege if needed
|
||||
installPackage() {
|
||||
packageName="$1"
|
||||
echo "Installation of $packageName..."
|
||||
case "$packageManager" in
|
||||
apt)
|
||||
sudo apt update && sudo apt install -y "$packageName"
|
||||
;;
|
||||
dnf)
|
||||
sudo dnf install -y "$packageName"
|
||||
;;
|
||||
esac
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "$packageName installed successfully"
|
||||
else
|
||||
echo "Error installing $packageName"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
#-----------------------------------------------------------
|
||||
# variables
|
||||
|
||||
fullScriptName=template.sh
|
||||
shortScriptName=`echo $fullScriptName | sed -e 's|.*/||g' | cut -f1 -d.`
|
||||
destPath=/usr/local/bin/
|
||||
configFile=$shortScriptName.conf
|
||||
configFilePath=/etc/$shortScriptName/
|
||||
logRotateFile=$shortScriptName
|
||||
logRotateFilePath=/etc/logrotate.d/$logRotateFile
|
||||
|
||||
# check if the effective user ID is 0 (root)
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo "This script must be run as root or with sudo."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# select packet manager if need to install package during install
|
||||
packageManager=""
|
||||
if command -v apt &> /dev/null; then
|
||||
packageManager="apt"
|
||||
elif command -v dnf &> /dev/null; then
|
||||
packageManager="dnf"
|
||||
else
|
||||
echo "Erreur : No supported package managers (apt, dnf) were found."
|
||||
exit 1
|
||||
fi
|
||||
echo "Package manager detected: $packageManager"
|
||||
|
||||
# check if logPath exist
|
||||
if [ ! -d $configFilePath ]; then
|
||||
mkdir $configFilePath &> /dev/null
|
||||
rc=$?
|
||||
if [ "$rc" != "0" ];then
|
||||
echo "[ERROR] - An error occurred while creating $configFilePath ($rc)"
|
||||
else echo "[SUCCESS] - The folder $configFilePath was created successfully."
|
||||
fi
|
||||
fi
|
||||
# install package (example)
|
||||
installPackage mutt &> /dev/null
|
||||
|
||||
# install script
|
||||
cp $fullScriptName $destPath/. &> /dev/null
|
||||
rc=$?
|
||||
if [ "$rc" != "0" ];then
|
||||
echo "[ERROR] - An error occurred while copying $fullScriptName to $destPath ($rc)"
|
||||
else echo "[SUCCESS] - The script ${fullScriptName} to $destPath was copied successfully."
|
||||
fi
|
||||
|
||||
# copy config file
|
||||
cp $configFile $configFilePath &> /dev/null
|
||||
rc=$?
|
||||
if [ "$rc" != "0" ];then
|
||||
echo "[ERROR] - An error occurred while copying $configFile to $configFilePath ($rc)"
|
||||
else echo "[SUCCESS] - The script $configFile to $configFilepath was copied successfully."
|
||||
fi
|
||||
|
||||
cp $logRotateFile.logrotate $logRotateFilePath &> /dev/null
|
||||
rc=$?
|
||||
if [ "$rc" != "0" ];then
|
||||
echo "[ERROR] - An error occurred while copying $logRotateFile.logrotate to $logRotateFilePath ($rc)"
|
||||
else echo "[SUCCESS] - The script $logRotateFile.logrotate to $logRotateFilePath was copied successfully."
|
||||
fi
|
||||
echo "Installation completed."
|
||||
89
stop-output-traffic-http-https.sh
Executable file
89
stop-output-traffic-http-https.sh
Executable file
@ -0,0 +1,89 @@
|
||||
#!/usr/bin/env bash
|
||||
############################################################
|
||||
# Decription: Active rule to block
|
||||
# all http and https OUTPUT.
|
||||
# To access http and https, you must use proxy
|
||||
#
|
||||
# Author: Gilles Mouchet (gilles.mouchet@gmail.com)
|
||||
# Creation Date: 17-Sep-2025
|
||||
# Version: 1.0.0
|
||||
#
|
||||
# Changelog:
|
||||
# V1.0.0 - 17-Sep-2025 - GMo
|
||||
# Added
|
||||
# - Creation of script from scratch
|
||||
#
|
||||
############################################################
|
||||
|
||||
#-----------------------------------------------------------------
|
||||
# DON'T CHANGE ANYTHING FROM HERE
|
||||
#-----------------------------------------------------------------
|
||||
version="1.0.0"
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# ---------------------- CONFIG ----------------------
|
||||
PROXY_NAME="proxy.ville-geneve.ch"
|
||||
PROXY_PORT="8080"
|
||||
NTP_NAME="ch.pool.ntp.org"
|
||||
MYCLOUD_NAME="myhomecloud.gmotech.net"
|
||||
SSH_ALLOWED_IP="0.0.0.0/0" # Ajustez si vous voulez restreindre l'accès SSH entrant
|
||||
# ---------------------------------------------------
|
||||
cat << EOF
|
||||
****************************************************************************
|
||||
* To prevent handling errors, remove the 'exit' around line 55
|
||||
* pour prévenire les erreurs de manipulation, enlever le 'exit'
|
||||
* vers la ligne 55
|
||||
****************************************************************************
|
||||
EOF
|
||||
# Détection automatique de l'interface principale
|
||||
DEFAULT_IF=$(ip route | awk '/^default/ {print $5; exit}')
|
||||
# set proxy IP
|
||||
PROXY_IP=$(getent ahostsv4 $PROXY_NAME | awk '{print $1; exit}')
|
||||
# Détection du DNS utilisé
|
||||
DNS_IP=$(awk '/^nameserver/ {print $2; exit}' /etc/resolv.conf)
|
||||
# Résolution de ch.pool.ntp.org -> prend la première IP trouvée
|
||||
NTP_IP=$(getent ahostsv4 $NTP_NAME | awk '{print $1; exit}')
|
||||
# Résolution de myhomecloud.gmotech.net
|
||||
CIFS_IP=$(getent ahostsv4 $MYCLOUD_NAME | awk '{print $1; exit}')
|
||||
|
||||
echo "[INFO] Interface réseau détectée : $DEFAULT_IF"
|
||||
echo "[INFO] DNS détecté : $DNS_IP"
|
||||
echo "[INFO] NTP résolu : $NTP_IP"
|
||||
echo "[INFO] CIFS serveur résolu : $CIFS_IP"
|
||||
## HERE
|
||||
exit
|
||||
|
||||
echo "[INFO] Sauvegarde de l'état nftables actuel"
|
||||
sudo nft list ruleset > "/root/nftables-backup-$(date +%Y%m%d-%H%M%S).txt"
|
||||
|
||||
echo "[INFO] Réinitialisation et création de la table"
|
||||
sudo nft flush ruleset
|
||||
sudo nft add table inet filter
|
||||
|
||||
# INPUT : SSH + established + icmp echo-reply
|
||||
sudo nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
|
||||
sudo nft add rule inet filter input tcp dport 22 ip saddr $SSH_ALLOWED_IP accept
|
||||
sudo nft add rule inet filter input ct state established,related accept
|
||||
sudo nft add rule inet filter input icmp type echo-reply accept # réponse ping
|
||||
|
||||
# OUTPUT : policy drop
|
||||
sudo nft add chain inet filter output { type filter hook output priority 0 \; policy drop \; }
|
||||
|
||||
# Autorisations OUTPUT
|
||||
sudo nft add rule inet filter output oif lo accept # Loopback
|
||||
sudo nft add rule inet filter output tcp dport 22 accept # SSH sortant
|
||||
sudo nft add rule inet filter output ip daddr $PROXY_IP tcp dport $PROXY_PORT accept # Proxy
|
||||
sudo nft add rule inet filter output ip daddr $DNS_IP udp dport 53 accept # DNS UDP
|
||||
sudo nft add rule inet filter output ip daddr $DNS_IP tcp dport 53 accept # DNS TCP
|
||||
sudo nft add rule inet filter output ip daddr $NTP_IP udp dport 123 accept # NTP
|
||||
sudo nft add rule inet filter output ip daddr $CIFS_IP tcp dport 445 accept # CIFS/SMB
|
||||
sudo nft add rule inet filter output icmp type echo-request accept # ping sortant
|
||||
sudo nft add rule inet filter output tcp dport 25 accept # SMTP (port 25)
|
||||
sudo nft add rule inet filter output tcp dport 587 accept # SMTP submission (587)
|
||||
sudo nft add rule inet filter output ct state established,related accept # Réponses aux connexions
|
||||
|
||||
echo "[INFO] État final des règles nftables :"
|
||||
sudo nft list ruleset
|
||||
|
||||
echo "[INFO] Script terminé. Autorisé : loopback, proxy, DNS, NTP, SSH, CIFS, ping et SMTP (25,587). Tout le reste est bloqué."
|
||||
@ -1,3 +0,0 @@
|
||||
# mail recipient
|
||||
msgRecipient=exploit.gmotech@gmail.com
|
||||
|
||||
@ -1,8 +0,0 @@
|
||||
/var/log/template/template.log {
|
||||
daily
|
||||
rotate 7
|
||||
compress
|
||||
missingok
|
||||
notifempty
|
||||
create 644 root root
|
||||
}
|
||||
175
template.sh
175
template.sh
@ -1,175 +0,0 @@
|
||||
#!/bin/bash
|
||||
############################################################
|
||||
# Decription: Template script
|
||||
# Author: Gilles Mouchet (gilles.mouchet@gmail.com)
|
||||
# Creation Date: 06-Sep-2025
|
||||
# Version: 1.0.0
|
||||
#
|
||||
# Changelog:
|
||||
# V1.0.0 - 25-Sep-2025 - GMo
|
||||
# Added
|
||||
# - Creation of script from scratch
|
||||
#
|
||||
############################################################
|
||||
|
||||
#-----------------------------------------------------------------
|
||||
# DON'T CHANGE ANYTHING FROM HERE
|
||||
#-----------------------------------------------------------------
|
||||
version="1.0.0"
|
||||
mailSubject="[SUCCESS] - script result on `hostname`"
|
||||
mailHeader="my_hdr From: GMO Check System <exploit.gmotech@gmail.com>"
|
||||
mailBody=""
|
||||
mailFooter="\n\nTemplate script $version by Exploit GMoTech"
|
||||
tmpFile=/tmp/list.txt
|
||||
|
||||
#-----------------------------------------------------------
|
||||
# FUNCTIONS
|
||||
#-----------------------------------------------------------
|
||||
function usage() {
|
||||
cat << EOF
|
||||
Usage: ./$(basename "$0") options
|
||||
Template script
|
||||
Options:
|
||||
-p, --param - display parameters
|
||||
-h, --help - display this help
|
||||
-v, --version - display script version
|
||||
EOF
|
||||
}
|
||||
#-----------------------------------------------------------
|
||||
function sendMail() {
|
||||
if [ -f "$tmpFile" ];then
|
||||
echo -e "$mailBody $mailFooter" | mutt -e "$mailHeader" -s "${mailSubject}" $msgRecipient -a $tmpFile
|
||||
else
|
||||
echo -e "$mailBody $mailFooter" | mutt -e "$mailHeader" -s "${mailSubject}" $msgRecipient
|
||||
fi
|
||||
}
|
||||
#-----------------------------------------------------------
|
||||
# Function write log in file log
|
||||
# parameter
|
||||
# $1 define entry type (info, warning, error)
|
||||
# $2 define text
|
||||
# $3 define display on screen or not (nothing=no, 1=yes)
|
||||
function log() {
|
||||
if [ -z "$3" ]; then
|
||||
displayScreen=0
|
||||
else displayScreen=1
|
||||
fi
|
||||
case "$1" in
|
||||
I)
|
||||
logType="[info]"
|
||||
;;
|
||||
W)
|
||||
logType="[warning]"
|
||||
;;
|
||||
E)
|
||||
logType="[error]"
|
||||
;;
|
||||
esac
|
||||
# on screen and logfile
|
||||
#echo "$(date "+%Y-%m-%d")-$(date "+%H:%M:%S") - $logType - $2" | tee -a "$logFile"
|
||||
#echo "[$(date "+%Y-%m-%d")-$(date "+%H:%M:%S")] - $logType - $2" >> "$logFile"
|
||||
# true to display screen to
|
||||
if [ "${displayScreen}" -eq 1 ];then
|
||||
echo "[$(date "+%Y-%m-%d")-$(date "+%H:%M:%S")] - $logType - $2" | tee -a "$logFile"
|
||||
else
|
||||
echo "[$(date "+%Y-%m-%d")-$(date "+%H:%M:%S")] - $logType - $2" >> "$logFile"
|
||||
fi
|
||||
}
|
||||
#-----------------------------------------------------------
|
||||
# MAIN
|
||||
#-----------------------------------------------------------
|
||||
|
||||
# check if the effective user ID is 0 (root)
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo "This script must be run as root or with sudo."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# config
|
||||
progName=`echo $0 | sed -e 's|.*/||g' | cut -f1 -d.`
|
||||
confDir=/etc/$progName
|
||||
cfgFile=$confDir/$progName.conf
|
||||
logPath=/var/log/$progName
|
||||
logFile=$logPath/$progName.log
|
||||
|
||||
# check if conf file or passphrase file exist
|
||||
if [ ! -f $cfgFile ]; then
|
||||
echo "$progName not installed correctly. Please run install.sh script"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
# read config file
|
||||
. $cfgFile
|
||||
log I "script start" 1
|
||||
# check if logPath exist
|
||||
if [ ! -d $logPath ]; then
|
||||
mkdir $logPath
|
||||
fi
|
||||
|
||||
# check param exist. Uncomment if your script need parameters
|
||||
#if [ -z "$1" ]; then
|
||||
# usage
|
||||
# exit
|
||||
#fi
|
||||
|
||||
while [[ "$#" -gt 0 ]]; do
|
||||
case "$1" in
|
||||
-p|--param)
|
||||
cat << EOF
|
||||
-------------------------------------------------------------------------------
|
||||
Parameters
|
||||
-------------------------------------------------------------------------------
|
||||
Defined in script
|
||||
-------------------------------------------------------------------------------
|
||||
script name: $progName
|
||||
config folder: $confDir
|
||||
config file: $cfgFile
|
||||
log path: $logPath
|
||||
log file: $logFile
|
||||
-------------------------------------------------------------------------------
|
||||
Defined in $cfgFile
|
||||
-------------------------------------------------------------------------------
|
||||
message recipient: $msgRecipient
|
||||
|
||||
EOF
|
||||
exit
|
||||
;;
|
||||
version|-v|--version)
|
||||
cat << EOF
|
||||
$(basename "$0") v$version (c) 1990 - $(date +%Y) by Gilles Mouchet
|
||||
Non-Commercial Use License – See LICENSE for details
|
||||
EOF
|
||||
exit
|
||||
;;
|
||||
# must be in the last block of the case because of *
|
||||
*|help|-h|--help)
|
||||
usage
|
||||
exit
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
# success message
|
||||
log I "send a success message" 1
|
||||
mailSubject="[SUCCESS] - script result on `hostname`"
|
||||
mailBody=" This is a success test mail\nHave a good day"
|
||||
sendMail
|
||||
|
||||
# warnig message
|
||||
log W "send a warning message" 1
|
||||
mailSubject="[WARNING] - script result on `hostname`"
|
||||
mailBody=" This is a warning test mail\nHave a good day"
|
||||
sendMail
|
||||
|
||||
# error message
|
||||
log E "send an error message" 1
|
||||
cat << EOF > $tmpFile
|
||||
This file contain the description error
|
||||
or log file
|
||||
EOF
|
||||
mailSubject="[ERROR] - script result on `hostname`"
|
||||
mailBody=" This is a warning test mail\nHave a good day"
|
||||
sendMail
|
||||
rm -rf $tmpFile
|
||||
Loading…
x
Reference in New Issue
Block a user