Commit c2163edc authored by Gabriel Detraz's avatar Gabriel Detraz Committed by root
Browse files

Zamok firewall complete

parent 9adb9497
......@@ -42,6 +42,7 @@ class iptables:
self.filter6 = "\n*filter"
self.subnet_ports = api_client.list("firewall/subnet-ports/")
self.interface_ports = api_client.list("firewall/interface-ports/")
self.normal_users = api_client.list("users/normaluser/")
self.verbose = False
self.action = None
self.export = False
......@@ -202,7 +203,6 @@ class iptables:
def users(self, table):
"""Securisation d'un serveur avec comptes d'utilisateurs"""
if table == 'filter':
#self.blacklist_output()
self.base_filter()
if self.verbose:
print("Filter : Forbid admin vlan for users")
......@@ -453,25 +453,14 @@ class iptables:
if machine.blacklist_actif() and set(bl['type'] for bl in machine.blacklist_actif()).intersection(self.config.blacklist_sanctions) and machine['macAddress'] and machine['macAddress'][0].value != '<automatique>':
self.add_in_subtable("filter", subtable, """-m mac --mac-source %s -j REJECT""" % machine['macAddress'][0].value)
def blacklist_output(self, subtable='BLACKLIST-OUTPUT'):
"""Génération de la chaine blackliste output, meme idée que si dessus sauf que
ici on filtre les users uid sur un serveur et non leurs ip"""
self.init_filter(subtable, decision="-")
for interface in self.interfaces_settings['routable']:
self.jump_traficto("filter", interface, "OUTPUT", subtable)
for user in self.conn.search(u'(&(uidNumber=*)(!(droits=nounou))(!(droits=apprenti))(|(objectClass=adherent)(objectClass=club)))', sizelimit=10000):
if user.blacklist_actif():
self.add_in_subtable("filter", subtable, """-m owner --uid-owner %s -j REJECT""" % user['uidNumber'][0].value)
def forbid_adm(self, subtable='ADMIN-VLAN'):
"""Interdit aux users non admin de parler sur les vlans admin"""
self.init_filter(subtable, decision="-")
for interface in self.interfaces_settings['admin']:
self.jump_traficto("filter", interface, "OUTPUT", subtable)
for user in self.conn.search(u'(&(uidNumber=*)(!(droits=nounou))(!(droits=apprenti))(|(objectClass=adherent)(objectClass=club)))', sizelimit=10000):
self.add_in_subtable("filter", subtable, """-m owner --uid-owner %s -j REJECT""" % user['uidNumber'][0].value)
for user in self.normal_users:
self.add_in_subtable("filter", subtable, """-m owner --uid-owner %s -j REJECT""" % user['uid'])
def gen_nat(self, empty=False):
"""Génération de la chaine nat"""
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment