#
#############################################################################
#
#         [+] fwknop - Firewall Knock Operator [+]
#
# This is the default configuration file for fwknop that is used by the
# fwknop test suite.  Some directives (such as FIREWALL_TYPE) are derived
# from the installed /etc/fwknop/fwknop.conf config file.
#
#############################################################################
#
# $Id: default_fwknop.conf 1298 2008-10-10 02:03:17Z mbr $
#

EMAIL_ADDRESSES             root@localhost;
HOSTNAME                    fwknoptest;
FIREWALL_TYPE               iptables;
AUTH_MODE                   PCAP;
PCAP_INTF                   eth0;
ENABLE_PCAP_PROMISC         Y;
PCAP_FILTER                 udp port 62201;
ENABLE_SPA_PACKET_AGING     Y;
MAX_SPA_PACKET_AGE          120;
ENABLE_DIGEST_PERSISTENCE   Y;
ENABLE_DIGEST_INCLUDE_SRC   Y;
DIGEST_TYPE                 ALL;
ENABLE_IPT_FORWARDING       N;
ENABLE_IPT_LOCAL_NAT        Y;
ENABLE_IPT_OUTPUT           N;
ENABLE_IPT_SNAT             N;
SNAT_TRANSLATE_IP           _CHANGEME_;
ENABLE_PROC_IP_FORWARD      Y;
REQUIRE_SOURCE_ADDRESS      N;
ENABLE_VOLUNTARY_EXITS      N;
ENABLE_FKO_MODULE           Y;
EXIT_INTERVAL               1440;  ### minutes
ENABLE_INTF_CHECKS          Y;
INTF_CHECKS_INTERVAL        20;
ENABLE_INTF_EXISTS_CHECK    Y;
ENABLE_INTF_RUNNING_CHECK   Y;
ENABLE_INTF_BYTES_CHECK     Y;
ENABLE_CONNTRACK_PERSIST    N;
CONNTRACK_ESTAB_PORTS       0;
IPT_CONNTRACK_FILE          /proc/net/ip_conntrack;
MAX_SNIFF_BYTES             1500;
FLUSH_IPT_AT_INIT           Y;
IPFW_RULE_NUM               1;
IPFW_SET_NUM                1;
IPFW_DYNAMIC_INTERVAL       60;
PCAP_CMD_TIMEOUT            10;
GPG_DEFAULT_HOME_DIR        /root/.gnupg;
PCAP_PKT_FILE               output/sniff.pcap;
ENABLE_COOKED_INTF          N;
BLACKLIST                   NONE;
SLEEP_INTERVAL              2;  ### seconds
MAX_HOPS                    20;
ENABLE_SPA_OVER_HTTP        N;
ENABLE_TCP_SERVER           N;
ENABLE_UDP_SERVER           N;
TCPSERV_PORT                62201;
UDPSERV_PORT                62201;
LOCALE                      C;
ENABLE_SYSLOG_FILE          Y;
IPT_SYSLOG_FILE             /var/log/messages;
ENABLE_EXTERNAL_CMDS        N;
EXTERNAL_CMD_OPEN           __NONE__;
EXTERNAL_CMD_CLOSE          __NONE__;
EXTERNAL_CMD_ALARM          30;
ENABLE_EXT_CMD_PREFIX       N;
EXT_CMD_PREFIX              FWKNOP_;
SYSLOG_DAEMON               syslogd;
SYSLOG_IDENTITY             fwknopd;
SYSLOG_FACILITY             LOG_LOCAL7;
SYSLOG_PRIORITY             LOG_INFO;
KNOPTM_SYSLOG_IDENTITY      fwknop(knoptm);
KNOPTM_SYSLOG_FACILITY      LOG_LOCAL7;
KNOPTM_SYSLOG_PRIORITY      LOG_INFO;
FWSERV_SYSLOG_IDENTITY             fwknop(fwknop_serv);
FWSERV_SYSLOG_FACILITY             LOG_LOCAL7;
FWSERV_SYSLOG_PRIORITY             LOG_INFO;
ALERTING_METHODS            nomail;
FW_MSG_SEARCH               DROP;
KNOPWATCHD_CHECK_INTERVAL   5;  ### seconds
KNOPWATCHD_MAX_RETRIES      10;
MIN_SPA_PKT_LEN             160;
MIN_GNUPG_MSG_SIZE          400;
IPT_CMD_ALARM               30;
IPT_EXEC_STYLE              popen;
IPT_EXEC_SLEEP              0;
IPT_EXEC_TRIES              1;
IPT_INPUT_ACCESS            ACCEPT, src, filter, INPUT, 1, FWKNOP_INPUT, 1;
IPT_OUTPUT_ACCESS           ACCEPT, dst, filter, OUTPUT, 1, FWKNOP_OUTPUT, 1;
IPT_FORWARD_ACCESS          ACCEPT, src, filter, FORWARD, 1, FWKNOP_FORWARD, 1;
IPT_DNAT_ACCESS             DNAT, src, nat, PREROUTING, 1, FWKNOP_PREROUTING, 1;
IPT_SNAT_ACCESS             SNAT, src, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1;
IPT_MASQUERADE_ACCESS       MASQUERADE, src, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1;

### Directories
FWKNOP_DIR                  output;
FWKNOP_RUN_DIR              output;
FWKNOP_LIB_DIR              output; # for legacy port knocking mode
FWKNOP_MOD_DIR              /usr/lib/fwknop;
FWKNOP_CONF_DIR             conf;
FWKNOP_ERR_DIR              $FWKNOP_DIR;

### Files
FW_DATA_FILE                $FWKNOP_DIR/fwdata; # legacy port knocking mode
ACCESS_CONF                 $FWKNOP_CONF_DIR/access.conf;
P0F_FILE                    $FWKNOP_CONF_DIR/pf.os;   ### p0f-based fingerprints
DIGEST_FILE                 $FWKNOP_DIR/digest.cache;
KNOPTM_TIMEOUT_FILE         $FWKNOP_DIR/knoptm.cache;  ### timeout cache
FWKNOP_PID_FILE             $FWKNOP_RUN_DIR/fwknopd.pid;
FWKNOP_CMDLINE_FILE         $FWKNOP_RUN_DIR/fwknopd.cmd;
TCPSERV_PID_FILE            $FWKNOP_RUN_DIR/fwknop_serv.pid;
KNOPWATCHD_PID_FILE         $FWKNOP_RUN_DIR/knopwatchd.pid;
KNOPMD_PID_FILE             $FWKNOP_RUN_DIR/knopmd.pid;
KNOPTM_PID_FILE             $FWKNOP_RUN_DIR/knoptm.pid;
KNOPTM_IP_TIMEOUT_SOCK      $FWKNOP_RUN_DIR/knoptm_ip_timeout.sock;
FWKNOP_SERV_SOCK            $FWKNOP_RUN_DIR/fwknop_serv.sock;
KNOPMD_FIFO                 $FWKNOP_LIB_DIR/fwknopfifo;
PROC_IP_FORWARD_FILE        /proc/sys/net/ipv4/ip_forward;

### iptables command output and error collection files; these are
### used by IPTables::ChainMgr
IPT_OUTPUT_FILE             $FWKNOP_DIR/fwknopd.iptout;
IPT_ERROR_FILE              $FWKNOP_DIR/fwknopd.ipterr;
KNOPTM_IPT_OUTPUT_FILE      $FWKNOP_DIR/knoptm.iptout;
KNOPTM_IPT_ERROR_FILE       $FWKNOP_DIR/knoptm.ipterr;

### system binaries
mailCmd          /bin/mail;
sendmailCmd      /usr/sbin/sendmail;
gpgCmd           /usr/bin/gpg;
shCmd            /bin/sh;
ifconfigCmd      /sbin/ifconfig;
mknodCmd         /bin/mknod;
iptablesCmd      /sbin/iptables;
ipfwCmd          /sbin/ipfw;  ### BSD and Mac OS X only
fwknopdCmd       /usr/sbin/fwknopd;
fwknop_servCmd   /usr/sbin/fwknop_serv;
knopmdCmd        /usr/sbin/knopmd;
knoptmCmd        /usr/sbin/knoptm;
knopwatchdCmd    /usr/sbin/knopwatchd;
