#8065

diff --git a/resources/servers/amadeus/firewall b/resources/servers/amadeus/firewall
index 50fbc25c7eacd4410ac5c7f33d862c0b52ad210c..7fc816a1bb3178cc85be800bf1cb7df58ff776fc 100644 (file)
--- a/resources/servers/amadeus/firewall
+++ b/resources/servers/amadeus/firewall
@@ -42,11 +42,12 @@ s3=`dig +short dobermann.cubedesigners.com | tail -1`
 s4=`dig +short elephantman.cubedesigners.com | tail -1`
 s5=`dig +short fastandfurious.cubedesigners.com | tail -1`
 s6=`dig +short gremlins.cubedesigners.com | tail -1`
-s7=`dig +short kingkong.cubedesigners.com | tail -1`
+s7=`dig +short hotfuzz.cubedesigners.com | tail -1`
+s8=`dig +short kingkong.cubedesigners.com | tail -1`
 
-auth=($s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7)
+auth=($s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7 $s8)
 
-docker_allowed=($i0 $i1 $i2 $i3 $i4 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7)
+docker_allowed=($i0 $i1 $i2 $i3 $i4 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7 $s8)
 
 
 for ip in "${blacklist[@]}"

diff --git a/resources/servers/benhur/firewall b/resources/servers/benhur/firewall
index cc57b1f261955c3a458e4314243929c5cfa70981..f8fd290d087c3d75974106a5679011e6eeed59e7 100644 (file)
--- a/resources/servers/benhur/firewall
+++ b/resources/servers/benhur/firewall
@@ -42,11 +42,12 @@ s3=`dig +short dobermann.cubedesigners.com | tail -1`
 s4=`dig +short elephantman.cubedesigners.com | tail -1`
 s5=`dig +short fastandfurious.cubedesigners.com | tail -1`
 s6=`dig +short gremlins.cubedesigners.com | tail -1`
-s7=`dig +short kingkong.cubedesigners.com | tail -1`
+s7=`dig +short hotfuzz.cubedesigners.com | tail -1`
+s8=`dig +short kingkong.cubedesigners.com | tail -1`
 
-auth=($s0 $s0_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7)
+auth=($s0 $s0_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7 $s8)
 
-docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7)
+docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7 $s8)
 
 
 for ip in "${blacklist[@]}"

diff --git a/resources/servers/cloudatlas/firewall b/resources/servers/cloudatlas/firewall
index b7b8a0251621fa6bf8a3f4c1573c15dffb21a020..603e38002a072c6053e8df47411b88c48db6d3f4 100644 (file)
--- a/resources/servers/cloudatlas/firewall
+++ b/resources/servers/cloudatlas/firewall
@@ -35,11 +35,12 @@ s3=`dig +short dobermann.cubedesigners.com | tail -1`
 s4=`dig +short elephantman.cubedesigners.com | tail -1`
 s5=`dig +short fastandfurious.cubedesigners.com | tail -1`
 s6=`dig +short gremlins.cubedesigners.com | tail -1`
-s7=`dig +short kingkong.cubedesigners.com | tail -1`
+s7=`dig +short hotfuzz.cubedesigners.com | tail -1`
+s8=`dig +short kingkong.cubedesigners.com | tail -1`
 
-auth=($s0 $s0_0 $s1 $s1_0 $s3 $s4 $s5 $s6 $s7)
+auth=($s0 $s0_0 $s1 $s1_0 $s3 $s4 $s5 $s6 $s7 $s8)
 
-docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s3 $s4 $s5 $s6 $s7)
+docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s3 $s4 $s5 $s6 $s7 $s8)
 
 
 for ip in "${blacklist[@]}"

diff --git a/resources/servers/dobermann/firewall b/resources/servers/dobermann/firewall
index 227d8eeedbb4bc57bf0ad4c2058beaab8002828e..f91c924db1af68bbfcf5df40ea7a126bc4103dce 100644 (file)
--- a/resources/servers/dobermann/firewall
+++ b/resources/servers/dobermann/firewall
@@ -43,11 +43,12 @@ s2_7=`dig +short mattermost.cubedesigners.com | tail -1`
 s4=`dig +short elephantman.cubedesigners.com | tail -1`
 s5=`dig +short fastandfurious.cubedesigners.com | tail -1`
 s6=`dig +short gremlins.cubedesigners.com | tail -1`
-s7=`dig +short kingkong.cubedesigners.com | tail -1`
+s7=`dig +short hotfuzz.cubedesigners.com | tail -1`
+s8=`dig +short kingkong.cubedesigners.com | tail -1`
 
-auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s4 $s5 $s6 $s7)
+auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s4 $s5 $s6 $s7 $s8)
 
-docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s4 $s5 $s6 $s7)
+docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s4 $s5 $s6 $s7 $s8)
 
 c0=`dig +short www.fondation-sycomore.com | tail -1`
 backup=($c0)

diff --git a/resources/servers/elephantman/firewall b/resources/servers/elephantman/firewall
index 3aa762ca062cb891a05bd50f360e4849f8ac2b0b..7b8a2d9e134df5777406a11615e055bba7357b22 100644 (file)
--- a/resources/servers/elephantman/firewall
+++ b/resources/servers/elephantman/firewall
@@ -43,11 +43,12 @@ s2_7=`dig +short mattermost.cubedesigners.com | tail -1`
 s3=`dig +short dobermann.cubedesigners.com | tail -1`
 s5=`dig +short fastandfurious.cubedesigners.com | tail -1`
 s6=`dig +short gremlins.cubedesigners.com | tail -1`
-s7=`dig +short kingkong.cubedesigners.com | tail -1`
+s7=`dig +short hotfuzz.cubedesigners.com | tail -1`
+s8=`dig +short kingkong.cubedesigners.com | tail -1`
 
-auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s5 $s6 $s7)
+auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s5 $s6 $s7 $s8)
 
-docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s5 $s6 $s7)
+docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s5 $s6 $s7 $s8)
 
 
 for ip in "${blacklist[@]}"

diff --git a/resources/servers/fastandfurious/firewall b/resources/servers/fastandfurious/firewall
index f6cf60f7f65b7a6d385113b10d1b28742599ffad..0e09e1cec08f582279123d566f2b6e091b6b7343 100644 (file)
--- a/resources/servers/fastandfurious/firewall
+++ b/resources/servers/fastandfurious/firewall
@@ -43,11 +43,12 @@ s2_7=`dig +short mattermost.cubedesigners.com | tail -1`
 s3=`dig +short dobermann.cubedesigners.com | tail -1`
 s4=`dig +short elephantman.cubedesigners.com | tail -1`
 s6=`dig +short gremlins.cubedesigners.com | tail -1`
-s7=`dig +short kingkong.cubedesigners.com | tail -1`
+s7=`dig +short hotfuzz.cubedesigners.com | tail -1`
+s8=`dig +short kingkong.cubedesigners.com | tail -1`
 
-auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s6 $s7)
+auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s6 $s7 $s8)
 
-docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s6 $s7)
+docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s6 $s7 $s8)
 
 ufw allow 51820
 

diff --git a/resources/servers/gremlins/firewall b/resources/servers/gremlins/firewall
index 82d26380a4398f6bf2a8bfb309d2f5a711259457..a00d2524bb4a6af97d4780e2b0f2f903dfb49b97 100644 (file)
--- a/resources/servers/gremlins/firewall
+++ b/resources/servers/gremlins/firewall
@@ -43,11 +43,12 @@ s2_7=`dig +short mattermost.cubedesigners.com | tail -1`
 s3=`dig +short dobermann.cubedesigners.com | tail -1`
 s4=`dig +short elephantman.cubedesigners.com | tail -1`
 s5=`dig +short fastandfurious.cubedesigners.com | tail -1`
-s7=`dig +short kingkong.cubedesigners.com | tail -1`
+s7=`dig +short hotfuzz.cubedesigners.com | tail -1`
+s8=`dig +short kingkong.cubedesigners.com | tail -1`
 
-auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s7)
+auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s7 $s8)
 
-docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s7)
+docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s7 $s8)
 
 ufw allow 80
 ufw allow 443

diff --git a/resources/servers/hotfuzz/firewall b/resources/servers/hotfuzz/firewall
new file mode 100644 (file)
index 0000000..9626aeb
--- /dev/null
+++ b/resources/servers/hotfuzz/firewall
@@ -0,0 +1,127 @@
+#!/bin/bash
+
+export DEBIAN_FRONTEND=noninteractive
+apt install --no-install-recommends -y dnsutils ufw
+# Reset all rules
+ufw --force reset
+# Disable firewall
+ufw disable
+
+ufw default allow outgoing
+
+l0=127.0.0.0/8
+l1=10.0.0.0/8
+l2=172.16.0.0/12
+l3=192.168.0.0/16
+i0=`dig +short paris.cubedesigners.com | tail -1`
+i1=`dig +short montpellier.cubedesigners.com | tail -1`
+i2=`dig +short tortuga.enhydra.fr | tail -1`
+i3=`dig +short cocodrilo.enhydra.fr | tail -1`
+i4=`dig +short pinguino.enhydra.fr | tail -1`
+
+local=($l0 $l1 $l2 $l3 $i0 $i1 $i2 $i3 $i4)
+
+b0=24.104.34.225
+b1=62.99.220.220
+b2=50.62.177.177
+b3=195.70.4.231
+blacklist=($b0 $b1 $b2 $b3)
+
+s0=`dig +short amadeus.cubedesigners.com | tail -1`
+s0_0=`dig +short toolbox.fluidbook.com | tail -1`
+s1=`dig +short benhur.cubedesigners.com | tail -1`
+s1_0=`dig +short postal.cubedesigners.com | tail -1`
+s2=`dig +short cloudatlas.cubedesigners.com | tail -1`
+s2_0=`dig +short hostingdev.cubedesigners.com | tail -1`
+s2_1=`dig +short hosting.fluidbook.com | tail -1`
+s2_2=`dig +short hosting.cubedesigners.com | tail -1`
+s2_3=`dig +short hosting2.fluidbook.com | tail -1`
+s2_4=`dig +short hosting2.cubedesigners.com | tail -1`
+s2_5=`dig +short git.cubedesigners.com | tail -1`
+s2_6=`dig +short mail.cubedesigners.com | tail -1`
+s2_7=`dig +short mattermost.cubedesigners.com | tail -1`
+s3=`dig +short dobermann.cubedesigners.com | tail -1`
+s4=`dig +short elephantman.cubedesigners.com | tail -1`
+s5=`dig +short fastandfurious.cubedesigners.com | tail -1`
+s6=`dig +short gremlins.cubedesigners.com | tail -1`
+s8=`dig +short kingkong.cubedesigners.com | tail -1`
+
+auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s8)
+
+docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s8)
+
+
+for ip in "${blacklist[@]}"
+do
+        ufw deny from $ip
+        ufw deny to $ip
+done
+
+for ip in "${local[@]}"
+do
+        ufw allow from $ip
+done
+
+for ip in "${auth[@]}"
+do
+       ufw allow from $ip
+       ufw allow to $ip
+       ufw allow out to $ip port 22
+       ufw allow out to $ip port 22022
+       ufw allow out to $ip port 22822
+       ufw allow out to $ip port 22222
+done
+
+for ip in "${backup[@]}"
+do
+        ufw allow in from $ip port 22
+done
+
+#SSH
+ufw deny out 22
+ufw deny out 22022
+ufw deny out 22822
+ufw deny out 22222
+
+
+restricted_containers=("portainer" "monit" )
+
+sudo wget -O /usr/local/bin/ufw-docker https://raw.githubusercontent.com/EnhydraV/ufw-docker/refs/heads/master/ufw-docker
+sudo chmod +x /usr/local/bin/ufw-docker
+# Finally enable firewall
+ufw --force enable
+
+# Enable
+ufw-docker install
+docker ps --filter publish=1-65535 --filter status=running --format "table {{.Names}}" | tail -n +2 | while read container; do
+       # Check if the current line is in the skip_lines array
+    skip=false
+    for restricted_container in "${restricted_containers[@]}"; do
+        if [[ "$container" == "$restricted_container" ]]; then
+            skip=true
+            break
+        fi
+    done
+
+    if ! $skip; then
+        ufw-docker allow "$container"
+    else
+        for ip in "${docker_allowed[@]}"
+        do
+            ufw-docker allow-from "$container" $ip
+        done
+    fi
+done
+
+# Enable loging
+ufw logging on
+
+# Display status
+ufw status verbose
+
+rm -f /etc/ufw/after.rules.*
+rm -f /etc/ufw/after6.rules.*
+rm -f /etc/ufw/before.rules.*
+rm -f /etc/ufw/before6.rules.*
+rm -f /lib/ufw/user6.rules.*
+rm -f /lib/ufw/user.rules.*

diff --git a/resources/servers/kingkong/firewall b/resources/servers/kingkong/firewall
index c0cb52794f18c781879b765f9dd0550d64a514f4..d671e3814a4ddab85d46927d0989208833284ef6 100644 (file)
--- a/resources/servers/kingkong/firewall
+++ b/resources/servers/kingkong/firewall
@@ -44,10 +44,11 @@ s3=`dig +short dobermann.cubedesigners.com | tail -1`
 s4=`dig +short elephantman.cubedesigners.com | tail -1`
 s5=`dig +short fastandfurious.cubedesigners.com | tail -1`
 s6=`dig +short gremlins.cubedesigners.com | tail -1`
+s7=`dig +short hotfuzz.cubedesigners.com | tail -1`
 
-auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6)
+auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7)
 
-docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6)
+docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7)
 
 
 for ip in "${blacklist[@]}"

diff --git a/resources/servers/update.bat b/resources/servers/update.bat
index cb47514750cb8cea0d50ad9aca2211db49be5091..30e0b08568734081747a17774d534902c49c272a 100644 (file)
--- a/resources/servers/update.bat
+++ b/resources/servers/update.bat
@@ -24,6 +24,9 @@ ssh -p 22822 root@fastandfurious.cubedesigners.com 'chmod 755 /usr/local/bin/fw;
 scp -P 22 ./gremlins/firewall root@gremlins.cubedesigners.com:/usr/local/bin/fw
 ssh -p 22 root@gremlins.cubedesigners.com 'chmod 755 /usr/local/bin/fw;rm -f /usr/local/bin/firewall;/usr/local/bin/fw'
 
+scp -P 22 ./hotfuzz/firewall root@hotfuzz.cubedesigners.com:/usr/local/bin/fw
+ssh -p 22 root@hotfuzz.cubedesigners.com 'chmod 755 /usr/local/bin/fw;rm -f /usr/local/bin/firewall;/usr/local/bin/fw'
+
 scp -P 22 ./kingkong/firewall root@kingkong.cubedesigners.com:/usr/local/bin/fw
 ssh -p 22 root@kingkong.cubedesigners.com 'chmod 755 /usr/local/bin/fw;rm -f /usr/local/bin/firewall;/usr/local/bin/fw'