require "${General::swroot}/header.pl";
#workaround to suppress a warning when a variable is used only once
-my @dummy = ( ${Header::colouryellow} );
+my @dummy = (
+ ${Header::colourred},
+ ${Header::colourgreen}
+);
+
undef (@dummy);
my $string=();
my @memory=();
my @pid=();
my @guardian=();
-my %cgiparams=();
# Path to the guardian.ignore file.
my $ignorefile ='/var/ipfire/guardian/guardian.ignore';
&General::readhash("${General::swroot}/main/settings", \%mainsettings);
&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
+# Pakfire meta file for owncloud.
+# (File exists when the addon is installed.)
+my $owncloud_meta = "/opt/pakfire/db/installed/meta-owncloud";
+
our %settings = ();
+$settings{'ACTION'} = '';
+
$settings{'GUARDIAN_ENABLED'} = 'off';
$settings{'GUARDIAN_ENABLE_SNORT'} = 'on';
$settings{'GUARDIAN_ENABLE_SSH'} = 'on';
$settings{'GUARDIAN_ENABLE_HTTPD'} = 'on';
-$settings{'GUARDIAN_LOGLEVEL'} ='info';
+$settings{'GUARDIAN_ENABLE_OWNCLOUD'} = '';
+$settings{'GUARDIAN_LOGLEVEL'} = 'info';
+$settings{'GUARDIAN_BLOCKCOUNT'} = '3';
$settings{'GUARDIAN_BLOCKTIME'} = '86400';
$settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log';
$settings{'GUARDIAN_SNORT_ALERTFILE'} = '/var/log/snort/alert';
+$settings{'GUARDIAN_PRIORITY_LEVEL'} = '3';
-$settings{'ACTION'} = '';
+# Default settings for owncloud if installed.
+if ( -e "$owncloud_meta") {
+ $settings{'GUARDIAN_ENABLE_OWNCLOUD'} = 'off';
+}
my $errormessage = '';
# Get GUI values.
&Header::getcgihash(\%settings);
-&Header::getcgihash(\%cgiparams);
+
+# Check if guardian is running and grab some stats.
+&daemonstats();
+my $pid = $pid[0];
## Perform input checks and save settings.
#
if ($settings{'ACTION'} eq $Lang::tr{'save'}) {
-
# Check for valid blocktime.
- if ($settings{'GUARDIAN_BLOCKTIME'} ne '') {
- if (($settings{'GUARDIAN_BLOCKTIME'} !~ /^[0-9]+$/) || ($settings{'GUARDIAN_BLOCKTIME'} le '0')) {
+ unless(($settings{'GUARDIAN_BLOCKTIME'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKTIME'} ne "0")) {
$errormessage = "$Lang::tr{'guardian invalid blocktime'}";
- }
+ }
+
+ # Check if the bloccount is valid.
+ unless(($settings{'GUARDIAN_BLOCKCOUNT'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKCOUNT'} ne "0")) {
+ $errormessage = "$Lang::tr{'guardian invalid blockcount'}";
}
# Check Logfile.
- if ($settings{'GUARDIAN_LOGFILE'} ne '') {
- if ($settings{'GUARDIAN_LOGFILE'} !~ /^[a-zA-Z0-9\.\/]+$/) {
- $errormessage = "$Lang::tr{'guardian invalid logfile'}";
- }
+ unless($settings{'GUARDIAN_LOGFILE'} =~ /^[a-zA-Z0-9\.\/]+$/) {
+ $errormessage = "$Lang::tr{'guardian invalid logfile'}";
}
# Check input for snort alert file.
- if ($settings{'GUARDIAN_SNORT_ALERTFILE'} ne '') {
- if ($settings{'GUARDIAN_SNORT_ALERTFILE'} !~ /^[a-zA-Z0-9\.\/]+$/) {
- $errormessage = "$Lang::tr{'guardian invalid alertfile'}";
- }
- }
+ unless($settings{'GUARDIAN_SNORT_ALERTFILE'} =~ /^[a-zA-Z0-9\.\/]+$/) {
+ $errormessage = "$Lang::tr{'guardian invalid alertfile'}";
+ }
# Only continue if no error message has been set.
- if ($errormessage eq '') {
+ if($errormessage eq '') {
# Write configuration settings to file.
&General::writehash("${General::swroot}/guardian/settings", \%settings);
close(FILE);
}
+ # Check if guardian is running.
+ if ($pid > 0) {
+ # Call guardianctrl to perform a reload.
+ system("/usr/local/bin/guardianctrl reload &>/dev/null");
+ }
+
## Remove entry from ignore list.
#
} elsif ($settings{'ACTION'} eq $Lang::tr{'remove'}) {
# So this line is missing in the new file and the entry has been deleted.
foreach my $line (@current) {
$id++;
- unless ($cgiparams{'ID'} eq $id) {
+ unless ($settings{'ID'} eq $id) {
print FILE "$line";
}
}
close(FILE);
+ # Check if guardian is running.
+ if ($pid > 0) {
+ # Call guardianctrl to perform a reload.
+ system("/usr/local/bin/guardianctrl reload &>/dev/null");
+ }
+
## Block a user given address or subnet.
#
} elsif ($settings{'ACTION'} eq $Lang::tr{'block'}) {
- # Check if no empty input has been performed.
- if ($settings{'ADDRESS_BLOCK'} ne '') {
+ # Assign some temporary variables used for input validation.
+ my $input = $settings{'ADDRESS_BLOCK'};
+ my $green = $netsettings{'GREEN_ADDRESS'};
+ my $blue = $netsettings{'BLUE_ADDRESS'};
+ my $orange = $netsettings{'ORANGE_ADDRESS'};
+ my $red = $netsettings{'RED_ADDRESS'};
- # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
- if ((!&General::validip($settings{'ADDRESS_BLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_BLOCK'}))) {
- $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
- }
+ # Get gateway address.
+ my $gateway = &General::get_gateway();
- } else {
- $errormessage = "$Lang::tr{'guardian empty input'}";
- }
+ # Check if any input has been performed.
+ if ($input eq '') {
+ $errormessage = "$Lang::tr{'guardian empty input'}";
+ }
+
+ # Check if the given input is localhost (127.0.0.1).
+ elsif ($input eq "127.0.0.1") {
+ $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
+ }
+
+ # Check if the given input is anywhere (0.0.0.0).
+ elsif ($input eq "0.0.0.0") {
+ $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
+ }
+
+ # Check if the given input is one of the interface addresses or our gateway.
+ elsif ($input eq "$green" || $input eq "$blue" || $input eq "$orange" || $input eq "$red" || $input eq "$gateway") {
+ $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
+ }
+
+ # Check if the given input is a valid IP address.
+ elsif (!&General::validip($input)) {
+ $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
+ }
# Go further if there was no error.
if ($errormessage eq '') {
# Call helper to flush iptables chain from guardian.
system("/usr/local/bin/guardianctrl flush-chain &>/dev/null");
-
-} else {
- # Load settings from file.
- &General::readhash("${General::swroot}/guardian/settings", \%settings);
}
+# Load settings from file.
+&General::readhash("${General::swroot}/guardian/settings", \%settings);
# Call functions to generate whole page.
&showMainBox();
&showIgnoreBox();
# Display area only if guardian is running.
-if ( ($memory != 0) && (@pid[0] ne "///") ) {
+if ( ($memory != 0) && ($pid > 0) ) {
&showBlockedBox();
}
$checked{'GUARDIAN_ENABLE_HTTPD'}{'off'} = '';
$checked{'GUARDIAN_ENABLE_HTTPD'}{'on'} = '';
$checked{'GUARDIAN_ENABLE_HTTPD'}{$settings{'GUARDIAN_ENABLE_HTTPD'}} = "checked='checked'";
+ $checked{'GUARDIAN_ENABLE_OWNCLOUD'}{'off'} = '';
+ $checked{'GUARDIAN_ENABLE_OWNCLOUD'}{'on'} = '';
+ $checked{'GUARDIAN_ENABLE_OWNCLOUD'}{$settings{'GUARDIAN_ENABLE_OWNCLOUD'}} = "checked='checked'";
- $selected{'GUARDIAN_LOGLEVEL'}{$settings{'GUARDIAN_LOGLEVEL'}}= 'selected';
+ $selected{'GUARDIAN_LOGLEVEL'}{$settings{'GUARDIAN_LOGLEVEL'}} = 'selected';
+ $selected{'GUARDIAN_PRIORITY_LEVEL'}{$settings{'GUARDIAN_PRIORITY_LEVEL'}} = 'selected';
&Header::openpage($Lang::tr{'guardian configuration'}, 1, '');
&Header::openbigbox('100%', 'left', '', $errormessage);
# Draw current guardian state.
&Header::openbox('100%', 'center', $Lang::tr{'guardian'});
- # Check if guardian is running and grab some stats.
+ # Get current status of guardian.
&daemonstats();
+ $pid = $pid[0];
# Display some useful information related to guardian, if daemon is running.
- if ( ($memory != 0) && (@pid[0] ne "///") ){
+ if ( ($memory != 0) && ($pid > 0) ){
print <<END;
<table width='95%' cellspacing='0' class='tbl'>
<tr>
</tr>
<tr>
<td class='base'></td>
- <td bgcolor='$color{'color22'}' align='center'>@pid[0]</td>
+ <td bgcolor='$color{'color22'}' align='center'>$pid</td>
<td bgcolor='$color{'color22'}' align='center'>$memory KB</td>
</tr>
</table>
<td colspan='2'><br></td>
</tr>
<tr>
- <td width='20%' class='base'>Monitor Snort Alerts:</td>
+ <td width='20%' class='base'>$Lang::tr{'guardian watch snort alertfile'}</td>
<td align='left'>on <input type='radio' name='GUARDIAN_ENABLE_SNORT' value='on' $checked{'GUARDIAN_ENABLE_SNORT'}{'on'} /> /
<input type='radio' name='GUARDIAN_ENABLE_SNORT' value='off' $checked{'GUARDIAN_ENABLE_SNORT'}{'off'} /> off</td>
</tr>
<tr>
- <td width='20%' class='base'>Block SSH-Bruteforcing:</td>
+ <td width='20%' class='base'>$Lang::tr{'guardian block ssh brute-force'}</td>
<td align='left'>on <input type='radio' name='GUARDIAN_ENABLE_SSH' value='on' $checked{'GUARDIAN_ENABLE_SSH'}{'on'} /> /
<input type='radio' name='GUARDIAN_ENABLE_SSH' value='off' $checked{'GUARDIAN_ENABLE_SSH'}{'off'} /> off</td>
</tr>
<tr>
- <td width='20%' class='base'>Block WUI-Bruteforcing:</td>
+ <td width='20%' class='base'>$Lang::tr{'guardian block httpd brute-force'}</td>
<td align='left'>on <input type='radio' name='GUARDIAN_ENABLE_HTTPD' value='on' $checked{'GUARDIAN_ENABLE_HTTPD'}{'on'} /> /
<input type='radio' name='GUARDIAN_ENABLE_HTTPD' value='off' $checked{'GUARDIAN_ENABLE_HTTPD'}{'off'} /> off</td>
</tr>
+END
+ # Display owncloud checkbox when the addon is installed.
+ if ( -e "$owncloud_meta" ) {
+ print"<tr>\n";
+ print"<td width='20%' class='base'>$Lang::tr{'guardian block owncloud brute-force'}</td>\n";
+ print"<td align='left'>on <input type='radio' name='GUARDIAN_ENABLE_OWNCLOUD' value='on' $checked{'GUARDIAN_ENABLE_OWNCLOUD'}{'on'} /> /\n";
+ print"<input type='radio' name='GUARDIAN_ENABLE_OWNCLOUD' value='off' $checked{'GUARDIAN_ENABLE_OWNCLOUD'}{'off'} /> off</td>\n";
+ print"</tr>\n";
+ }
+ print <<END;
<tr>
<td colspan='2'><br></td>
</tr>
<tr>
- <td align='left' width='20%'>$Lang::tr{'guardian loglevel'}</td>
+ <td align='left' width='20%'>$Lang::tr{'guardian loglevel'}:</td>
<td><select name='GUARDIAN_LOGLEVEL'>
<option value='off' $selected{'GUARDIAN_LOGLEVEL'}{'off'}>off</option>
<option value='info' $selected{'GUARDIAN_LOGLEVEL'}{'info'}>info</option>
<option value='debug' $selected{'GUARDIAN_LOGLEVEL'}{'debug'}>debug</option>
</select></td>
</tr>
-
+ <tr>
+ <td colspan='2'><br></td>
+ </tr>
+ <tr>
+ <td align='left' width='20%'>$Lang::tr{'guardian priority level'}:</td>
+ <td><select name='GUARDIAN_PRIORITY_LEVEL'>
+ <option value='1' $selected{'GUARDIAN_PRIORITY_LEVEL'}{'1'}>1</option>
+ <option value='2' $selected{'GUARDIAN_PRIORITY_LEVEL'}{'2'}>2</option>
+ <option value='3' $selected{'GUARDIAN_PRIORITY_LEVEL'}{'3'}>3</option>
+ <option value='4' $selected{'GUARDIAN_PRIORITY_LEVEL'}{'4'}>4</option>
+ </select></td>
+ </tr>
+ <tr>
+ <td colspan='2'><br></td>
+ </tr>
+ <tr>
+ <td width='20%' class='base'>$Lang::tr{'guardian blockcount'}:</td>
+ <td><input type='text' name='GUARDIAN_BLOCKCOUNT' value='$settings{'GUARDIAN_BLOCKCOUNT'}' size='5' /></td>
+ </tr>
<tr>
<td width='20%' class='base'>$Lang::tr{'guardian blocktime'}:</td>
<td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td>
<tr>
<td width='80%' class='base' $col>$ignored_element</td>
<td width='20%' align='center' $col>
- <form method='post' name='frma$id' action='$ENV{'SCRIPT_NAME'}'>
+ <form method='post' name='$id' action='$ENV{'SCRIPT_NAME'}'>
<input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' title='$Lang::tr{'remove'}' alt='$Lang::tr{'remove'}'>
<input type='hidden' name='ID' value='$id'>
<input type='hidden' name='ACTION' value='$Lang::tr{'remove'}'>
# Open configfile for writing.
open(FILE, ">$configfile");
- print FILE "EnableSnortMonitoring $settings{'GUARDIAN_ENABLE_SNORT'}\n";
- print FILE "EnableSSHMonitoring $settings{'GUARDIAN_ENABLE_SSH'}\n";
- print FILE "EnableHTTPDMonitoring $settings{'GUARDIAN_ENABLE_HTTPD'}\n";
- print FILE "LogLevel $settings{'GUARDIAN_LOGLEVEL'}\n";
- print FILE "HostGatewayByte $HostGatewayByte\n";
- print FILE "LogFile $settings{'GUARDIAN_LOGFILE'}\n";
- print FILE "AlertFile $settings{'GUARDIAN_SNORT_ALERTFILE'}\n";
- print FILE "IgnoreFile $ignorefile\n";
- print FILE "TimeLimit $settings{'GUARDIAN_BLOCKTIME'}\n";
+ print FILE "EnableSnortMonitoring\t\t$settings{'GUARDIAN_ENABLE_SNORT'}\n";
+ print FILE "EnableSSHMonitoring\t\t$settings{'GUARDIAN_ENABLE_SSH'}\n";
+ print FILE "EnableHTTPDMonitoring\t\t$settings{'GUARDIAN_ENABLE_HTTPD'}\n";
+
+ # Check if owncloud settings should be written.
+ if (exists $settings{'GUARDIAN_ENABLE_OWNCLOUD'}) {
+ print FILE "EnableOwncloudMonitoring\t$settings{'GUARDIAN_ENABLE_OWNCLOUD'}\n";
+ }
+
+ print FILE "LogLevel\t\t\t$settings{'GUARDIAN_LOGLEVEL'}\n";
+ print FILE "BlockCount\t\t\t$settings{'GUARDIAN_BLOCKCOUNT'}\n";
+ print FILE "HostGatewayByte\t\t\t$HostGatewayByte\n";
+ print FILE "LogFile\t\t\t\t$settings{'GUARDIAN_LOGFILE'}\n";
+ print FILE "AlertFile\t\t\t$settings{'GUARDIAN_SNORT_ALERTFILE'}\n";
+ print FILE "IgnoreFile\t\t\t$ignorefile\n";
+ print FILE "TimeLimit\t\t\t$settings{'GUARDIAN_BLOCKTIME'}\n";
+ print FILE "PriorityLevel\t\t\t$settings{'GUARDIAN_PRIORITY_LEVEL'}\n";
close(FILE);
- # Restart the service.
- if ($settings{'GUARDIAN_ENABLED'} eq 'on') {
- system("/usr/local/bin/guardianctrl restart &>/dev/null");
+ # Check if guardian should be started or stopped.
+ if($settings{'GUARDIAN_ENABLED'} eq 'on') {
+ if($pid > 0) {
+ # Call guardianctl to perform a reload.
+ system("/usr/local/bin/guardianctrl reload &>/dev/null");
+ } else {
+ # Launch guardian.
+ system("/usr/local/bin/guardianctrl start &>/dev/null");
+ }
} else {
+ # Stop the daemon.
system("/usr/local/bin/guardianctrl stop &>/dev/null");
}
}
projects / people / stevee / ipfire-2.x.git / blobdiff