mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-04-29 03:38:51 +00:00
77 lines
1.9 KiB
Bash
Executable file
77 lines
1.9 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
### Vars, Ports for Standard services
|
|
myHOSTPORTS="7634 64295"
|
|
myDOCKERCOMPOSEYML="$1"
|
|
myRULESFUNCTION="$2"
|
|
|
|
function fuCHECKFORARGS {
|
|
### Check if args are present, if not throw error
|
|
|
|
if [ "$myDOCKERCOMPOSEYML" != "" ] && ([ "$myRULESFUNCTION" == "set" ] || [ "$myRULESFUNCTION" == "unset" ]);
|
|
then
|
|
echo "All arguments met. Continuing."
|
|
else
|
|
echo "Usage: rules.sh <docker-compose.yml> <[set, unset]>"
|
|
exit
|
|
fi
|
|
}
|
|
|
|
function fuNFQCHECK {
|
|
### Check if honeytrap or glutton is actively enabled in docker-compose.yml
|
|
|
|
myNFQCHECK=$(grep -e '^\s*honeytrap:\|^\s*glutton:' $myDOCKERCOMPOSEYML | tr -d ': ' | wc -l)
|
|
if [ "$myNFQCHECK" == "0" ];
|
|
then
|
|
echo "No NFQ related honeypot detected, no firewall rules needed. Exiting."
|
|
exit
|
|
else
|
|
echo "Detected at least one NFQ based honeypot, firewall rules needed. Continuing."
|
|
fi
|
|
}
|
|
|
|
function fuGETPORTS {
|
|
### Get ports from docker-compose.yml
|
|
|
|
myDOCKERCOMPOSEPORTS=$(cat $myDOCKERCOMPOSEYML | yq -r '.services[].ports' | grep ':' | sed -e s/127.0.0.1// | tr -d '", ' | sed -e s/^:// | cut -f1 -d ':' )
|
|
myDOCKERCOMPOSEPORTS+=" $myHOSTPORTS"
|
|
myRULESPORTS=$(for i in $myDOCKERCOMPOSEPORTS; do echo $i; done | sort -gu)
|
|
}
|
|
|
|
function fuSETRULES {
|
|
### Setting up iptables rules
|
|
|
|
/sbin/iptables -w -A INPUT -s 127.0.0.1 -j ACCEPT
|
|
/sbin/iptables -w -A INPUT -d 127.0.0.1 -j ACCEPT
|
|
|
|
for myPORT in $myRULESPORTS; do
|
|
/sbin/iptables -w -A INPUT -p tcp --dport $myPORT -j ACCEPT
|
|
done
|
|
|
|
/sbin/iptables -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
|
|
}
|
|
|
|
function fuUNSETRULES {
|
|
### Removing iptables rules
|
|
|
|
/sbin/iptables -w -D INPUT -s 127.0.0.1 -j ACCEPT
|
|
/sbin/iptables -w -D INPUT -d 127.0.0.1 -j ACCEPT
|
|
|
|
for myPORT in $myRULESPORTS; do
|
|
/sbin/iptables -w -D INPUT -p tcp --dport $myPORT -j ACCEPT
|
|
done
|
|
|
|
/sbin/iptables -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
|
|
}
|
|
|
|
# Main
|
|
fuCHECKFORARGS
|
|
fuNFQCHECK
|
|
fuGETPORTS
|
|
|
|
if [ "$myRULESFUNCTION" == "set" ];
|
|
then
|
|
fuSETRULES
|
|
else
|
|
fuUNSETRULES
|
|
fi
|