|
|
| Zeile 1: |
Zeile 1: |
| =Status= | | =Status= |
| *sudo bbb-conf --status | | *sudo bbb-conf --status |
| =Firewall=
| | *[[BigBlueButton hardening]] |
| ==Script==
| |
| */usr/local/sbin/firewall | |
| <pre>
| |
| #!/bin/bash
| |
| iptables -F INPUT
| |
| case $1 in
| |
| start)
| |
| iptables -P INPUT DROP
| |
| iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
| |
| iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
| |
| iptables -A INPUT -i lo -j ACCEPT
| |
| iptables -A INPUT -p tcp --dport 22 -j ACCEPT
| |
| iptables -A INPUT -p tcp --dport 80 -j ACCEPT
| |
| iptables -A INPUT -p tcp --dport 443 -j ACCEPT
| |
| iptables -A INPUT -p tcp --dport 1935 -j ACCEPT
| |
| iptables -A INPUT -p tcp --dport 7443 -j ACCEPT
| |
| iptables -A INPUT -p udp --dport 16384:32768 -j ACCEPT
| |
| iptables -A INPUT -j LOG --log-prefix " --ipt-in-- "
| |
| ;;
| |
| stop)
| |
| iptables -P INPUT ACCEPT
| |
| ;;
| |
| esac
| |
| </pre>
| |
| ==Unit==
| |
| */etc/system/system/firewall.service
| |
| <pre>
| |
| [Unit] | |
| Description=firewall
| |
| After=network.target syslog.target
| |
| | |
| [Service] | |
| RemainAfterExit=yes
| |
| ExecStart=/usr/local/sbin/firewall start
| |
| ExecStop=/usr/local/sbin/firewall stop
| |
| User=root
| |
| | |
| [Install]
| |
| WantedBy=multi-user.target
| |
| </pre>
| |