wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-06-06 15:13:56 +02:00
Code Issues Projects Releases Wiki Activity

Block link-local networks. Block traffic from SSH tunnels to VPN clients (#1458)

Browse source
This commit is contained in:
Jack Ivanov 2019-06-03 01:01:08 +02:00 • committed by Dan Guido
parent 2d04f65284
commit 498cf46391
3 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
roles/common/templates/rules.v4.j2
View file

@ -77,6 +77,13 @@ COMMIT
# Drop traffic between VPN clients # Drop traffic between VPN clients
-A FORWARD -s {{ subnets|join(',') }} -d {{ subnets|join(',') }} -j {{ "DROP" if BetweenClients_DROP else "ACCEPT" }} -A FORWARD -s {{ subnets|join(',') }} -d {{ subnets|join(',') }} -j {{ "DROP" if BetweenClients_DROP else "ACCEPT" }}
# Drop traffic to VPN clients from SSH tunnels
-A OUTPUT -d {{ subnets|join(',') }} -m owner --gid-owner 15000 -j {{ "DROP" if BetweenClients_DROP else "ACCEPT" }}
# Drop traffic to the link-local network
-A FORWARD -s {{ subnets|join(',') }} -d 169.254.0.0/16 -j DROP
# Drop traffic to the link-local network from SSH tunnels
-A OUTPUT -d 169.254.0.0/16 -m owner --gid-owner 15000 -j DROP
# Forward any packet that's part of an established connection # Forward any packet that's part of an established connection
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

2
roles/common/templates/rules.v6.j2
View file

@ -87,6 +87,8 @@ COMMIT
# Drop traffic between VPN clients # Drop traffic between VPN clients
-A FORWARD -s {{ subnets|join(',') }} -d {{ subnets|join(',') }} -j {{ "DROP" if BetweenClients_DROP else "ACCEPT" }} -A FORWARD -s {{ subnets|join(',') }} -d {{ subnets|join(',') }} -j {{ "DROP" if BetweenClients_DROP else "ACCEPT" }}
# Drop traffic to VPN clients from SSH tunnels
-A OUTPUT -d {{ subnets|join(',') }} -m owner --gid-owner 15000 -j {{ "DROP" if BetweenClients_DROP else "ACCEPT" }}
-A FORWARD -j ICMPV6-CHECK -A FORWARD -j ICMPV6-CHECK
-A FORWARD -p tcp --dport 445 -j DROP -A FORWARD -p tcp --dport 445 -j DROP

7
roles/ssh_tunneling/tasks/main.yml
View file

@ -14,7 +14,10 @@
- restart ssh - restart ssh
- name: Ensure that the algo group exist - name: Ensure that the algo group exist
group: name=algo state=present group:
name: algo
state: present
gid: 15000
- name: Ensure that the jail directory exist - name: Ensure that the jail directory exist
file: file:
@ -28,7 +31,7 @@
- name: Ensure that the SSH users exist - name: Ensure that the SSH users exist
user: user:
name: "{{ item }}" name: "{{ item }}"
groups: algo group: algo
home: '/var/jail/{{ item }}' home: '/var/jail/{{ item }}'
createhome: yes createhome: yes
generate_ssh_key: false generate_ssh_key: false