Forum Debian Users Gang

ServerName            "serwerek.com
ServerType            standalone
DeferWelcome            off

ShowSymlinks            on
MultilineRFC2228        on
DefaultServer            on
ShowSymlinks            on
AllowOverwrite            on

LogFormat             traff "%b %u"

TimeoutNoTransfer        600
TimeoutStalled            600
TimeoutIdle            1200

DisplayLogin                    welcome.msg
DisplayFirstChdir               .message

#LsDefaultOptions                "-l"

DenyFilter            *.*/

DefaultRoot            ~

# Uncomment this if you are using NIS or LDAP to retrieve passwords:
#PersistentPasswd        off

# Port 21 is the standard FTP port.

Port                21


MaxInstances            30

User                nobody
Group                nogroup

# Normally, we want files to be overwriteable.

<Directory /*>
  # Umask 022 is a good standard umask to prevent new files and dirs
  # (second parm) from being group and world writable.
  Umask                022  022

  AllowOverwrite        on
  HideNoAccess on

</Directory>

<Limit ALL>
  IgnoreHidden on
</Limit>

<Global>
    TransferLog                     /var/log/xferlog
    ExtendedLog                     /var/log/ftp_traff.log read,write traff
    PathDenyFilter ".quota$"
</Global>

<IfModule mod_delay.c>
    DelayEngine off
</IfModule>



SQLAuthTypes         Crypt
SQLAuthenticate        on
SQLConnectInfo        vhcs2@localhost vftp 1SZTV9hzBCp0
SQLUserInfo            ftp_users userid passwd uid gid homedir shell
SQLGroupInfo        ftp_group groupname gid members
SQLMinID            2000        


QuotaEngine on
QuotaShowQuotas on
QuotaDisplayUnits Mb

SQLNamedQuery get-quota-limit SELECT "name, quota_type, per_session, limit_type, bytes_in_avail, bytes_out_avail, bytes_xfer_avail, files_in_avail, files_out_avail, files_xfer_avail FROM quotalimits WHERE name = '%{0}' AND quota_type = '%{1}'"
SQLNamedQuery get-quota-tally SELECT "name, quota_type, bytes_in_used, bytes_out_used, bytes_xfer_used, files_in_used, files_out_used, files_xfer_used FROM quotatallies WHERE name = '%{0}' AND quota_type = '%{1}'"
SQLNamedQuery update-quota-tally UPDATE "bytes_in_used = bytes_in_used + %{0}, bytes_out_used = bytes_out_used + %{1}, bytes_xfer_used = bytes_xfer_used + %{2}, files_in_used = files_in_used + %{3}, files_out_used = files_out_used + %{4}, files_xfer_used = files_xfer_used + %{5} WHERE name = '%{6}' AND quota_type = '%{7}'" quotatallies
SQLNamedQuery insert-quota-tally INSERT "%{0}, %{1}, %{2}, %{3}, %{4}, %{5}, %{6}, %{7}" quotatallies

QuotaLock /var/run/proftpd/tally.lock
QuotaLimitTable sql:/get-quota-limit
QuotaTallyTable sql:/get-quota-tally/update-quota-tally/insert-quota-tally

#!/bin/bash
IPT="iptables"
if [ "$1" = "stop" ]
then
echo "Czyszczenie firewalla rozpoczete"
$IPT -F
$IPT -t mangle -F
$IPT -P FORWARD ACCEPT
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -X syn-flood
/bin/echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all
/bin/echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
/bin/echo "1" > /proc/sys/net/ipv4/conf/all/accept_source_route
/bin/echo "1" > /proc/sys/net/ipv4/conf/all/accept_redirects
/bin/echo "0" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
/bin/echo "0" > /proc/sys/net/ipv4/conf/all/rp_filter
/bin/echo "0" > /proc/sys/net/ipv4/conf/all/log_martians
echo "Czyszczenie firewalla zakonczone"
exit
fi

echo "Konfiguracja firewalla rozpoczeta"

# ustawiamy zmienne potrzebne firewallowi
MOJEIP="IP.IP.IP.IP"
ALIAS0="IP.IP.IP.IP"
ALIAS1="IP.IP.IP.IP"
ALIAS2="IP.IP.IP.IP"
ALIAS3="IP.IP.IP.IP"
ALIAS4="IP.IP.IP.IP"
ALIAS5="IP.IP.IP.IP"
ALIAS6="IP.IP.IP.IP"
ALIAS7="IP.IP.IP.IP"
DNS1="IP.IP.IP.IP"
DNS2="IP.IP.IP.IP"

# czyscimy wszystko
$IPT -F -t nat
$IPT -X -t nat
$IPT -F -t filter
$IPT -X -t filter


######################
# ustawienia wstepne #
######################


echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

################
# co blokujemy #
################

$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD DROP

# zakazane IP

$IPT -A INPUT -s 88.226.67.89 -j DROP      # Turkey
$IPT -A INPUT -s 213.189.64.0/24 -j DROP    # Kuwait
$IPT -A INPUT -s 213.189.68.0/24 -j DROP    # Kuwait
$IPT -A INPUT -s 85.102.40.0/21 -j DROP  # Turkey        
$IPT -A INPUT -s 85.102.48.0/20 -j DROP  # Turkey        
$IPT -A INPUT -s 85.102.64.0/18 -j DROP  # Turkey        
$IPT -A INPUT -s 85.102.128.0/17 -j DROP  # Turkey        
$IPT -A INPUT -s 85.101.0.0/17 -j DROP  # Turkey        
$IPT -A INPUT -s 85.97.16.0/20 -j DROP  # Turkey        
$IPT -A INPUT -s 85.97.32.0/21 -j DROP  # Turkey        
$IPT -A INPUT -s 211.206.123.0/23 -j DROP   # Korean
$IPT -A INPUT -s 61.152.0.0/255.255.0.0 -j DROP     # China
$IPT -A INPUT -s 61.191.0.0/255.255.0.0 -j DROP     # China
$IPT -A INPUT -s 218.22.0.0/15 -j DROP       # China
$IPT -A INPUT -s 220.192.0.0/12 -j DROP       # China
$IPT -A INPUT -s 222.176.0.0/13 -j DROP       # China
$IPT -A INPUT -s 202.3.208.0/20 -j DROP      # Indonesia
$IPT -A INPUT -s 217.27.112.0/22 -j DROP     # Italy
$IPT -A INPUT -s 217.27.116.0/23 -j DROP     # Italy
$IPT -A INPUT -s 217.27.118.0/24 -j DROP     # Italy
$IPT -A INPUT -s 200.49.160/20 -j DROP    # Guatemala
$IPT -A INPUT -s 212.138.113.0/24 -j DROP    # Saudi Arabia
$IPT -A INPUT -s 222.124.136.0/25 -j DROP # Indonesia
$IPT -A INPUT -s 71.208.0.0/13 -j DROP # USA California 
$IPT -A INPUT -s 71.216.0.0/16 -j DROP # USA Californa
$IPT -A INPUT -s 61.17.14.0/255.255.255.0 -j DROP # India
$IPT -A INPUT -s 61.17.15.0/255.255.255.0 -j DROP # India
$IPT -A INPUT -s 59.104.0.0/15 -j DROP # Taiwan
$IPT -A INPUT -s 62.252.64.0/19 -j DROP # GB
$IPT -A INPUT -s 58.208.0.0/12 -j DROP # China
$IPT -A INPUT -s 220.192.0.0/12 -j DROP # China
$IPT -A INPUT -s 219.128.0.0/13 -j DROP # China
$IPT -A INPUT -s 219.136.0.0/15 -j DROP # China
$IPT -A INPUT -s 218.93.112.0/30 -j DROP # China
$IPT -A INPUT -s 202.105.0.0/16 -j DROP # China
$IPT -A INPUT -s 61.128.128.0/19 -j DROP # China
$IPT -A INPUT -s 59.32.0.0/13 -j DROP # China
$IPT -A INPUT -s 59.40.0.0/15 -j DROP # China
$IPT -A INPUT -s 59.42.0.0/16 -j DROP # China
$IPT -A INPUT -s 131.107.0.0/16 -j DROP # Microsoft Redmond
#$IPT -A INPUT -s 57.0.0.0/8 -j DROP # France

######################
# dodatkowe atrakcje #
######################


$IPT -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 10/s --limit-burst 4 -j LOG --log-level debug --log-prefix "SKAN_NULL: "
$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

$IPT -N skany
$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j skany
$IPT -A skany -p tcp --tcp-flags ALL RST -m limit --limit 10/s --limit-burst 4 -j LOG --log-level debug --log-prefix "SKAN_INVERSE: "
$IPT -A skany -p tcp --tcp-flags ALL RST -j DROP
$IPT -A skany -p tcp --tcp-flags ALL ACK -m limit --limit 10/s --limit-burst 4 -j LOG --log-level debug --log-prefix "SKAN_TCP_PING: "
$IPT -A skany -p tcp --tcp-flags ALL ACK -j DROP
$IPT -A skany -p tcp --tcp-flags ALL FIN -m limit --limit 10/s --limit-burst 4 -j LOG --log-level debug --log-prefix "SKAN_FIN: "
$IPT -A skany -p tcp --tcp-flags ALL FIN -j DROP
$IPT -A skany -p tcp --tcp-flags ALL FIN,PSH,URG -m limit --limit 10/s --limit-burst 4 -j LOG --log-level debug --log-prefix "SKAN_XMAS-NMAP: "
$IPT -A skany -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
$IPT -A skany -p tcp -m limit --limit 10/s --limit-burst 4 -j LOG --log-level debug --log-prefix "SKAN_INNE: "
$IPT -A skany -j DROP

#$IPT -N syn-flood
#$IPT -A INPUT -p tcp --syn -j syn-flood
#$IPT -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
#$IPT -A syn-flood -m limit --limit 1/s --limit-burst 4 -j LOG --log-level debug --log-prefix "SYN-FLOOD: "
#$IPT -A syn-flood -j DROP
#$IPT -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
#$IPT -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#-------zamknicie luki w iptables---------------------
$IPT -A OUTPUT -m state -p icmp --state INVALID -j DROP
echo "zamknięcia luki w iptables             [OK]"

# pakiety z nieporzadanych adresow
$IPT -A INPUT -s $MOJEIP -j DROP # atak Land
$IPT -A INPUT -s $ALIAS0 -j DROP # atak Land
$IPT -A INPUT -s $ALIAS1 -j DROP # atak Land
$IPT -A INPUT -s $ALIAS2 -j DROP # atak Land
$IPT -A INPUT -s $ALIAS3 -j DROP # atak Land
$IPT -A INPUT -s $ALIAS4 -j DROP # atak Land
$IPT -A INPUT -s $ALIAS5 -j DROP # atak Land
$IPT -A INPUT -s $ALIAS6 -j DROP # atak Land
$IPT -A INPUT -s $ALIAS7 -j DROP # atak Land
$IPT -A INPUT -s 10.0.0.0/8 -j DROP # klasa A
$IPT -A INPUT -s 172.16.0.0/12 -j DROP # klasa B
$IPT -A INPUT -s 192.168.0.0/16 -j DROP # klasa C
$IPT -A INPUT -s 224.0.0.0/4 -j DROP # multicast
$IPT -A INPUT -d 224.0.0.0/4 -j DROP # multicast
$IPT -A INPUT -s 240.0.0.0/5 -j DROP # reserved


#nowe poł±czenia
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
$IPT -A INPUT -p tcp -m state --state ESTABLISHED,RELATED   -j ACCEPT
$IPT -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT
#$IPT -A INPUT -p icmp -m state --state ESTABLISHED,RELATED  -j ACCEPT
echo "nowe poł±czenia                        [OK]" 


#ICMP
$IPT -A INPUT -p icmp -s 0/0 -m limit --limit 3/s --limit-burst 4 -j ACCEPT

#-------------zezwolenia na nowe poł±czenia----------------------
# HTTP
$IPT -m state -A INPUT -p tcp --state NEW --dport 80 -j ACCEPT
# FTP
$IPT -m state -A INPUT -p tcp --state NEW --dport 21 -j ACCEPT
# SSH
$IPT -m state -A INPUT -p tcp --state NEW --dport 1960 -j ACCEPT
#  DNS
$IPT -m state -A INPUT -p tcp --state NEW --dport 53 -j ACCEPT
$IPT -m state -A INPUT -p udp --state NEW --dport 53 -j ACCEPT
# HTTPS
$IPT -m state -A INPUT -p tcp --state NEW --dport 443 -j ACCEPT
# SMTP
$IPT -m state -A INPUT -p tcp --state NEW --dport 25 -j ACCEPT
# POP3
$IPT -m state -A INPUT -p tcp --state NEW --dport 110 -j ACCEPT
# ufo ssh tunel
$IPT -m state -A INPUT -p tcp --state NEW --dport 22 -j ACCEPT
# Asterisk
#$IPT -m state -A INPUT -p tcp --state NEW --dport 5060 -j ACCEPT
#$IPT -m state -A INPUT -p udp --state NEW --dport 5060 -j ACCEPT
# shoutcast
#$IPT -m state -A INPUT -p tcp --state NEW --dport 8000 -j ACCEPT
#$IPT -m state -A INPUT -p tcp --state NEW --dport 8001 -j ACCEPT
echo "zezwolenia nowych poł±czeń             [OK]"

#----------------polaczenia nawiazane--------------------------------
$IPT -A FORWARD -p tcp -j ACCEPT -m state --state  ESTABLISHED,RELATED
$IPT -A OUTPUT -p tcp -j ACCEPT -m state --state ESTABLISHED,RELATED
$IPT -A FORWARD -p udp -j ACCEPT -m state --state  ESTABLISHED,RELATED
$IPT -A OUTPUT -p udp -j ACCEPT -m state --state ESTABLISHED,RELATED
$IPT -A FORWARD -p icmp -j ACCEPT -m state --state ESTABLISHED,RELATED
$IPT -A OUTPUT -p icmp -j ACCEPT -m state --state ESTABLISHED,RELATED
echo "poł±czenia nawi±zane                   [OK]"

# bity TOS dla poł±czen lokalnych
$IPT -t mangle -A OUTPUT -p tcp --dport 20 -j TOS --set-tos 8
$IPT -t mangle -A OUTPUT -p tcp --dport 21 -j TOS --set-tos 16
$IPT -t mangle -A OUTPUT -p tcp --dport 1960 -j TOS --set-tos 16
$IPT -t mangle -A OUTPUT -p tcp --dport 23 -j TOS --set-tos 16
$IPT -t mangle -A OUTPUT -p tcp --dport 25 -j TOS --set-tos 16
$IPT -t mangle -A OUTPUT -p tcp --dport 53 -j TOS --set-tos 16
$IPT -t mangle -A OUTPUT -p udp --dport 53 -j TOS --set-tos 16
$IPT -t mangle -A OUTPUT -p tcp --dport 80 -j TOS --set-tos 8
$IPT -t mangle -A OUTPUT -p tcp --dport 443 -j TOS --set-tos 8
echo "ustawienie bitów TOS                   [OK]"
echo "Konfiguracja firewalla zakonczona"