###############################################################################
use strict;
-use Locale::Codes::Country;
use Guardian::Socket;
# enable only the following on debugging purpose
# file locations on IPFire systems.
my %module_file_locations = (
"HTTPD" => "/var/log/httpd/error_log",
- "OWNCLOUD" => "/var/owncloud/data/owncloud.log",
- "SNORT" => "/var/log/snort/alert",
"SSH" => "/var/log/messages",
);
our %color = ();
our %mainsettings = ();
&General::readhash("${General::swroot}/main/settings", \%mainsettings);
-&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
-
-# Pakfire meta file for owncloud.
-# (File exists when the addon is installed.)
-my $owncloud_meta = "/opt/pakfire/db/installed/meta-owncloud";
-
+&General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
# File declarations.
my $settingsfile = "${General::swroot}/guardian/settings";
$settings{'ACTION'} = '';
$settings{'GUARDIAN_ENABLED'} = 'off';
-$settings{'GUARDIAN_MONITOR_SNORT'} = 'on';
$settings{'GUARDIAN_MONITOR_SSH'} = 'on';
$settings{'GUARDIAN_MONITOR_HTTPD'} = 'on';
$settings{'GUARDIAN_MONITOR_OWNCLOUD'} = '';
$settings{'GUARDIAN_BLOCKTIME'} = '86400';
$settings{'GUARDIAN_FIREWALL_ACTION'} = 'DROP';
$settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log';
-$settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'} = '3';
-
-# Default settings for owncloud if installed.
-if ( -e "$owncloud_meta") {
- $settings{'GUARDIAN_MONITOR_OWNCLOUD'} = 'off';
-}
my $errormessage = '';
# File declarations.
my $gatewayfile = "${General::swroot}/red/remote-ipaddress";
- my $dns1file = "${General::swroot}/red/dns1";
- my $dns2file = "${General::swroot}/red/dns2";
# Get gateway address.
- my $gateway = &_get_address_from_file($gatewayfile);
-
- # Get addresses from the used dns servers.
- my $dns1 = &_get_address_from_file($dns1file);
- my $dns2 = &_get_address_from_file($dns2file);
+ my $gateway = &General::grab_address_from_file($gatewayfile);
# Check if any input has been performed.
if ($input eq '') {
}
# Check if the given input is one of the interface addresses or our gateway.
- elsif ($input eq "$green" || $input eq "$blue" || $input eq "$orange" || $input eq "$red" || $input eq "$gateway" || $input eq "$dns1" || $input eq "$dns2") {
+ elsif ($input eq "$green" || $input eq "$blue" || $input eq "$orange" || $input eq "$red" || $input eq "$gateway") {
$errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
}
$checked{'GUARDIAN_ENABLED'}{'on'} = '';
$checked{'GUARDIAN_ENABLED'}{'off'} = '';
$checked{'GUARDIAN_ENABLED'}{$settings{'GUARDIAN_ENABLED'}} = 'checked';
- $checked{'GUARDIAN_MONITOR_SNORT'}{'off'} = '';
- $checked{'GUARDIAN_MONITOR_SNORT'}{'on'} = '';
- $checked{'GUARDIAN_MONITOR_SNORT'}{$settings{'GUARDIAN_MONITOR_SNORT'}} = "checked='checked'";
$checked{'GUARDIAN_MONITOR_SSH'}{'off'} = '';
$checked{'GUARDIAN_MONITOR_SSH'}{'on'} = '';
$checked{'GUARDIAN_MONITOR_SSH'}{$settings{'GUARDIAN_MONITOR_SSH'}} = "checked='checked'";
$selected{'GUARDIAN_LOG_FACILITY'}{$settings{'GUARDIAN_LOG_FACILITY'}} = 'selected';
$selected{'GUARDIAN_LOGLEVEL'}{$settings{'GUARDIAN_LOGLEVEL'}} = 'selected';
- $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{$settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'}} = 'selected';
$selected{'GUARDIAN_FIREWALL_ACTION'}{$settings{'GUARDIAN_FIREWALL_ACTION'}} = 'selected';
&Header::openpage($Lang::tr{'guardian configuration'}, 1, '');
\$("#GUARDIAN_LOG_FACILITY").change(update_options);
\$("#GUARDIAN_LOGLEVEL").change(update_options);
update_options();
-
- // Show / Hide snort priority level option, based if
- // snort is enabled / disabled.
- if (\$('input[name=GUARDIAN_MONITOR_SNORT]:checked').val() == 'on') {
- \$('.GUARDIAN_SNORT_PRIORITY_LEVEL').show();
- } else {
- \$('.GUARDIAN_SNORT_PRIORITY_LEVEL').hide();
- }
-
- // Show/Hide snort priority level when GUARDIAN_MONITOR_SNORT get changed.
- \$('input[name=GUARDIAN_MONITOR_SNORT]').change(function() {
- \$('.GUARDIAN_SNORT_PRIORITY_LEVEL').toggle();
- });
});
</script>
END
<td colspan='2'><br></td>
</tr>
- <tr>
- <td width='25%' class='base'>$Lang::tr{'guardian watch snort alertfile'}</td>
- <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SNORT' value='on' $checked{'GUARDIAN_MONITOR_SNORT'}{'on'} /> /
- <input type='radio' name='GUARDIAN_MONITOR_SNORT' value='off' $checked{'GUARDIAN_MONITOR_SNORT'}{'off'} /> off</td>
- </tr>
-
<tr>
<td width='25%' class='base'>$Lang::tr{'guardian block ssh brute-force'}</td>
<td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SSH' value='on' $checked{'GUARDIAN_MONITOR_SSH'}{'on'} /> /
<td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_HTTPD' value='on' $checked{'GUARDIAN_MONITOR_HTTPD'}{'on'} /> /
<input type='radio' name='GUARDIAN_MONITOR_HTTPD' value='off' $checked{'GUARDIAN_MONITOR_HTTPD'}{'off'} /> off</td>
</tr>
-END
- # Display owncloud checkbox when the addon is installed.
- if ( -e "$owncloud_meta" ) {
- print"<tr>\n";
- print"<td width='25%' class='base'>$Lang::tr{'guardian block owncloud brute-force'}</td>\n";
- print"<td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_OWNCLOUD' value='on' $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'on'} /> /\n";
- print"<input type='radio' name='GUARDIAN_MONITOR_OWNCLOUD' value='off' $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'off'} /> off</td>\n";
- print"</tr>\n";
- }
- print <<END;
<tr>
<td colspan='2'><br></td>
</tr>
<td><input type='text' name='GUARDIAN_LOGFILE' value='$settings{'GUARDIAN_LOGFILE'}' size='30' /></td>
</tr>
- <tr class="GUARDIAN_SNORT_PRIORITY_LEVEL">
+ <tr>
<td colspan='2'><br></td>
</tr>
- <tr class="GUARDIAN_SNORT_PRIORITY_LEVEL">
- <td align='left' width='20%'>$Lang::tr{'guardian priority level'}:</td>
- <td><select name='GUARDIAN_SNORT_PRIORITY_LEVEL'>
- <option value='1' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'1'}>$Lang::tr{'guardian priolevel_high'}</option>
- <option value='2' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'2'}>$Lang::tr{'guardian priolevel_medium'}</option>
- <option value='3' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'3'}>$Lang::tr{'guardian priolevel_low'}</option>
- <option value='4' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'4'}>$Lang::tr{'guardian priolevel_very_low'}</option>
+ <tr>
+ <td width='25%' class='base'>$Lang::tr{'guardian firewallaction'}:</td>
+ <td><select name='GUARDIAN_FIREWALL_ACTION'>
+ <option value='DROP' $selected{'GUARDIAN_FIREWALL_ACTION'}{'DROP'}>Drop</option>
+ <option value='REJECT' $selected{'GUARDIAN_FIREWALL_ACTION'}{'REJECT'}>Reject</option>
</select></td>
<td width='25%' class='base'>$Lang::tr{'guardian blockcount'}:</td>
</tr>
<tr>
- <td width='25%' class='base'>$Lang::tr{'guardian firewallaction'}:</td>
- <td><select name='GUARDIAN_FIREWALL_ACTION'>
- <option value='DROP' $selected{'GUARDIAN_FIREWALL_ACTION'}{'DROP'}>Drop</option>
- <option value='REJECT' $selected{'GUARDIAN_FIREWALL_ACTION'}{'REJECT'}>Reject</option>
- </select></td>
-
<td width='25%' class='base'>$Lang::tr{'guardian blocktime'}:</td>
<td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td>
</tr>
# Module settings.
print FILE "\n# Module settings.\n";
- # Check if SNORT is enabled and add snort priority.
- if ($settings{'GUARDIAN_MONITOR_SNORT'} eq "on") {
- print FILE "SnortPriorityLevel = $settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'}\n";
- }
-
close(FILE);
# Generate ignore file.
# File declarations.
my $public_address_file = "${General::swroot}/red/local-ipaddress";
my $gatewayfile = "${General::swroot}/red/remote-ipaddress";
- my $dns1file = "${General::swroot}/red/dns1";
- my $dns2file = "${General::swroot}/red/dns2";
# Write the obtained addresses to the ignore file.
print FILE "# IPFire local interfaces.\n";
print FILE "# Include the corresponding files to obtain the addresses.\n";
print FILE "Include_File = $public_address_file\n";
print FILE "Include_File = $gatewayfile\n";
- print FILE "Include_File = $dns1file\n";
- print FILE "Include_File = $dns2file\n";
# Add all user defined hosts and networks to the ignore file.
#
close(FILE);
}
-
-# Private subfunction to obtain IP-addresses from given file names.
-#
-sub _get_address_from_file ($) {
- my $file = shift;
-
- # Check if the file exists.
- if (-e $file) {
- # Open the given file.
- open(FILE, "$file") or die "Could not open $file.";
-
- # Obtain the address from the first line of the file.
- my $address = <FILE>;
-
- # Close filehandle
- close(FILE);
-
- # Remove newlines.
- chomp $address;
-
- # Check if the grabbed address is valid.
- if (&General::validip($address)) {
- # Return the address.
- return $address;
- }
- }
-
- # Return nothing.
- return;
-}
projects / ipfire-2.x.git / blobdiff