DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

Added an initial fwknopd.8 man page (and source asciidoc). Added the --locale and --no-locale command-line option support. The set_config_entry function now allows setting a config entry to NULL to clear and free it.

Browse Source 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@209 510a4753-2344-4c79-9c09-4d669213fbeb
This commit is contained in:
Damien Stuart
2010-02-09 20:23:42 +00:00
parent d24b19ec94
commit f3c33c273b
10 changed files with 525 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog
+6
View File
@@ -1,3 +1,9 @@
2010-02-09 Damien Stuart <dstuart@dstuart.org>
* Created initial fwknopd.8 man page.
* Added --locale and --no-locale options.
* Allow using internal set_config_entry function to set NULL values
to configuration options to clear and free them.
2010-02-05 Damien Stuart <dstuart@dstuart.org>
* Updated libfko to set gpgme to use of gpg (vice gpg2) by default.
* Added fko_set_gpg_exe and fko_get_gpg_exe function for getting or
doc/Makefile.am
+1 -1
View File
@@ -3,4 +3,4 @@ CLEANFILES = libfko.info
info_TEXINFOS = libfko.texi
libfko_TEXINFOS = gpl-2.0.texi
EXTRA_DIST = fwknop.man.asciidoc
EXTRA_DIST = README fwknop.man.asciidoc fwknopd.man.asciidoc
doc/README
+19
View File
@@ -0,0 +1,19 @@
NOTES on the generation of the fwknop man pages:
UNtil we decide on a better way, the man pages for 'fwknop' (client) and
'fwknopd' (server) are generated from the asciidoc sources in this directory,
then copied to their respective directories before check-in.
We use the "a2x" command to generate the inital nroff-formated version,
which is then manually edited to clean it up a bit. The "a2x" command is:
a2x -f manpage fwknopd.man.asciidoc
This creates the "fwknopd.8" man page. However, depending on the a2x and.or
asciidoc configuration on your system, you may have to edit the "fwknopd.8"
file directly to remove the "[FIXME: source/manual]" string embedded within.
At present, we simply remove them. There may also be places where you want
items on succesive line without intervening lines (i.e. the AUTHORS section
of the generated man page). In those cases, simply change the ".sp"
between those lines to ".br".
doc/fwknopd.man.asciidoc
+457
View File
@@ -0,0 +1,457 @@
FWKNOPD(8)
==========
NAME
----
fwknopd - Firewall Knock Operator Daemon
SYNOPSIS
--------
*fwknopd* ['options']
DESCRIPTION
-----------
*fwknopd* is the server component for the FireWall Knock Operator, and
is responsible for monitoring Single Packet Authorization (SPA) packets
that are generated by *fwknop* clients, modifying a firewall or acl
policy to allow the desired access after decrypting a valid SPA packet,
and removing access after a configurable timeout. The main application
of this program is to protect services such as 'SSH' with an additional
layer of security in order to make the exploitation of vulnerabilities
(both 0-day and unpatched code) much more difficult.
The main configuration for *fwknopd* is maintained within two files:
'fwknopd.conf' and 'access.conf'. The default location for these files
is determined at package configuration (typically '/etc/fwknop')The
configuration variables within these files are desribed below.
COMMAND-LINE OPTIONS
--------------------
*-a, --access-file*='<access-file>'::
Specify the location of the 'access.conf' file. If this option is
not given, 'fwkopd' will use the default location (typically
'/etc/fwknop/access.conf'.
*-c, --config*='<config-file>'::
Specify the location of the 'fwknopd.conf' file. If this option is
not given, 'fwkopd' will use the default location (typically
'/etc/fwknop/fwknopd.conf'.
*-C, --packet-limit*='<n>'::
Specify the number of candidate SPA packets to process and exit when
this limit is reached.
*-i, --interface*='<interface>'::
Manually specify interface on which to sniff, e.g. ``-i eth0''. This
option is not usually needed because the ``PCAP_INTF'' keyword in the
'fwknopd.conf' file defines the sniffing interface.
*--fw-list*::
List all active rules in the ``FWKNOP'' Netfilter chain(s).
*--fw-flush*::
Flush all active rules in the ``FWKNOP'' Netfilter chain(s).
*-O, --Override-config*='<file>'::
Override config variable values that are normally read from the
'fwknop.conf' file with values from the specified file. Multiple
override config files can be given as a comma-separated list.
*-D, --Dump-config*::
Dump the configuration values that *fwknopd* derives from the
'fwknop.conf' (or override files) and 'access.conf' on STDERR.
*-K, --Kill*::
Kill the current *fwknopd* process. This provides a quick and easy
way to stop *fwknopd* without having to look in the process table.
*-R, --Restart*::
Restart the currently running *fwknopd* processes. This option
will preserve the command line options that were supplied to the
original *fwknopd* process but will force *fwknopd* to re-read the
'fwknopd.conf' and 'access.conf' files. This will also force a
flush of the current ``FWKNOP'' Netfilter chain(s).
*-S, --Status*::
Display the status of any *fwknopd* processes that may or not be
running.
*-l, --locale*='<locale>'::
Provide a locale setting other than the default ``C'' locale.
*--no-locale*::
Do not set the locale at all so that the default system locale
will apply.
*-v, --verbose*::
Run *fwknopd* in verbose mode.
*-h, --help*::
Display usage information and exit.
*-V, --Version*::
Display version information and exit.
FWKNOPD CONFIG AND ACCESS VARIABLES
-----------------------------------
*fwknopd* references the 'fwknopd.conf' file for configuration
variables such as the path to the firewall logfile, the sleep interval
fwknop uses to check for new log messages, and paths to system
binaries, etc. The fwknop config file does not define any access
control directives.
The access control directives are contained in the 'access.conf' file.
Access control directives define encryption keys and level of access that
is granted to an fwknop client that has generated the appropriate encrypted
message.
FWKNOPS.CONF VARIABLES
~~~~~~~~~~~~~~~~~~~~~~
This section list the more prominent configuration variables used by
*fwknopd*. It is not a complete list. See the 'fwknopd.conf' file for
the full list and corresponding details.
*HOSTNAME* '<hostname>'::
Force hostname to this value. If not set here, *fwknopd* will attempt
to use 'gethostname()' to determine the local hostname and use that.
*FIREWALL_TYPE* '<iptables|ipfw>'::
Define the firewall type. The default is 'iptables' for Linux systems,
but this can be set to 'ipfw' for BSD systems. Also supported is
'external_cmd' to allow *fwknopd* to invoke an external command instead
of interfacing with the firewall at all.
*AUTH_MODE* '<PCAP|FILE_PCAP|ULOG_PCAP>'::
This defines the general strategy *fwknopd* uses to authenticate remote
clients. Possible values are 'PCAP' (authenticate via regular pcap;
this is the default and puts the interface in promiscuous mode unless
``ENABLE_PCAP_PROMISC'' is turned off), 'FILE_PCAP' (authenticate via
a pcap file that is built by a sniffer), 'ULOG_PCAP' (authenticate via
the ulogd pcap writer). *Note:* Currently, only 'PCAP' is implemented.
*PCAP_INTF* '<interface>'::
Define the ethernet interface on which *fwknopd* will sniff packets.
Note that this is only used if the ``AUTH_MODE'' keyword above is set
to ``PCAP''.
*ENABLE_PCAP_PROMISC* '<Y/N>'::
By default *fwknopd* puts the pcap interface into promiscuous mode. Set
this to ``N'' to disable that behavior (non-promiscuous).
*PCAP_FILTER* '<pcap filter spec>'::
Define the filter used for 'PCAP' modes; *fwknopd* defaults to UDP
port 62201. However, if an *fwknop* client uses the *--rand-port* option
to send the SPA packet over a random port, then this variable should be
updated to something like ``udp dst portrange 10000-65535''.
*ENABLE_SPA_PACKET_AGING* '<Y/N>'::
This instructs *fwknopd* to not honor SPA packets that have an old time
stamp. The value for ``old'' is defined by the ``MAX_SPA_PACKET_AGE''
variable. If ``ENABLE_SPA_PACKET_AGING'' is set to ``N'', *fwknopd*
will not use the client time stamp at all.
*MAX_SPA_PACKET_AGE* '<seconds>'::
Defines the maximum age (in seconds) that an SPA packet will be accepted.
This requires that the client system is in relatively close time
synchronization with the *fwknopd* server system (NTP is good). The
default age is 120 seconds (two minutes).
*ENABLE_DIGEST_PERSISTENCE* '<Y/N>'::
Track digest sums associated with previous SPA packets processed by
*fwknopd*. This allows digest sums to remain persistent across
executions of *fwknopd*. The default is ``Y''. If set to ``N'',
*fwknopd* will not check incoming SPA packet data against any
previously save digests.
*ENABLE_IPT_FORWARDING* '<Y/N>'::
Allow SPA clients to request access to services through an iptables
firewall instead of just to it (i.e. access through the FWKNOP_FORWARD
chain instead of the INPUT chain). This also requires the
``ENABLE_FORWARD_ACCESS'' variable to be set in the 'access.conf'
file for the specific ``SOURCE'' stanzas that should be allowed for
forwarding access.
*ENABLE_IPT_LOCAL_NAT* '>Y/N>'::
Allow SPA clients to request access to a local socket via NAT. This
still puts an ACCEPT rule into the FWKNOP_INPUT chain, but a different
port is translated via DNAT rules to the real one. So, the user would
do ``ssh -p <port>'' to access the local service (see the *--NAT-local*
and *--NAT-rand-port* on the *fwknop* client command line).
*ENABLE_IPT_SNAT* '<Y/N>'::
Set this to ``Y'' to enable a corresponding SNAT rule. By default, if
forwarding access is enabled (see the ``ENABLE_IPT_FORWARDING'' variable
above), then *fwknopd* creates DNAT rules for incoming connections, but
does not also complement these rules with SNAT rules at the same time.
In some situations, internal systems may not have a route back out for
the source address of the incoming connection, so it is necessary to
also apply SNAT rules so that the internal systems see the IP of the
internal interface where *fwknopd* is running.
*SNAT_TRANSLATE_IP* '<ip_address>'::
Specify the IP address for SNAT. This functionality is only enabled
when ``ENABLE_IPT_SNAT'' is set to ``Y'' and by default SNAT rules are
built with the MASQUERADE target (since then the internal IP does not
have to be defined here in the 'fwknopd.conf' file), but if you want
*fwknopd* to use the SNAT target, you mus also define an IP address with
the ``SNAT_TRANSLATE_IP'' variable.
*ENABLE_IPT_OUTPUT* '<Y/N>'::
Add ACCEPT rules to the FWKNOP_OUTPUT chain. This is usually only useful
if there are no state tracking rules to allow connection responses out
and the OUTPUT chain has a default-drop stance.
*MAX_SNIFF_BYTES* '<bytes>'::
Specify the the maximum number of bytes to sniff per frame. 1500
is the default.
*FLUSH_IPT_AT_INIT* '<Y/N>'::
Flush all existing rules in the fwknop chains at *fwknopd* start time.
The default is ``Y''.
*FLUSH_IPT_AT_EXIT* '<Y/N>'::
Flush all existing rules in the fwknop chains when *fwknopd* is stopped
or otherwise exits cleanly. The default is ``Y''.
*IPFW_RULE_NUM* '<rule_num>'::
If running on 'ipfw' firewalls, this variable defines the rule number
that *fwknopd* uses to insert an ipfw 'pass' rule.
*IPFW_SET_NUM* '<set_num>'::
If running on 'ipfw' firewalls, this variable defines the rule set
that will be used to store expired rules that still have a dynamic
rule associated to them. That set will be disabled by *fwknopd* and
should not be enabled while *fwknopd* is running. Not used when ipfw
isn't using dynamic rules.
*IPFW_DYNAMIC_INTERVAL* '<seconds>'::
For 'ipfw' firewalls set the interval (in seconds) over those rules
that have no remaining dynamic rules associated with them will be
removed.
*PCAP_CMD_TIMEOUT* '<seconds>'::
Define the timeout for running a command.
*GPG_HOME_DIR* '<path>'::
If GPG keys are used instead of a Rijndael symmetric key, this is
the default GPG keys directory. Note that each access block in
'access.conf' can specify its own GPG directory to override
this default. If not set here or in an 'access.conf' stanza, then
the '$HOME/.gnupg' directory of the user running *fwknopd* (most
likely root).
*PCAP_PKT_FILE* '</path/to/sniff.pcap>'::
This gets used if AUTH_MODE is set to "FILE_PCAP". This file must
be created by a sniffer process (or something like the ulogd pcap
writer).
*BLACKLIST* '<ipaddr/mask,...ipaddr,etc>'::
Define a comma-separated set of IP addresses and/or networks that should
be globally blacklisted. That is, any SPA packet that is from a source
IP (or has an internal --allow-ip) within a blacklisted network will be
ignored.
*MAX_HOPS* '<num_hops>'::
TTL values are decremented depending on the number of hops the packet
has taken before it hits the firewall. We will assume packets will not
jump through more than 'num_hops' hops on average.
*ENABLE_SPA_OVER_HTTP* '<Y/N>'::
Allow *fwknopd* to acquire SPA data from HTTP requests (generated with
the fwknop client in *--HTTP* mode). Note that the ``PCAP_FILTER''
variable would need to be updated when this is enabled to sniff traffic
over TCP/80 connections.
*ENABLE_TCP_SERVER* '<Y/N>'::
Note that *fwknopd* still only gets its data via pcap, so the filter
defined by ``PCAP_FILTER'' needs to be updated to include this TCP port.
*TCPSERV_PORT* '<port>'::
Set the default port number that the 'fwknopd_serv' ``dummy'' TCP server
listens on. This server is only spawned when ``ENABLE_TCP_SERVER'' is set
to ``Y''.
*LOCALE* '<locale>'::
Set the locale (via the LC_ALL variable). This can be unset or set to
``NONE'' to have *fwknopd* honor the default system locale.
*SYSLOG_IDENTITY* '<identity>'::
Override syslog identity on message logged by *fwknopd*. The defaults
are usually ok.
*SYSLOG_FACILITY* '<facility>'::
Override syslog facility. The ``SYSLOG_FACILITY'' variable can be set to
one of ``LOG_LOCAL{0-7}'' or ``LOG_DAEMON'' (the default).
*IPT_EXEC_TRIES* '<num_tries>'::
Define the number of times that *fwknopd* will run certain critical
iptables commands (such as adding a new access rule) if any
problems are encountered.
ACCESS.CONF VARIABLES
~~~~~~~~~~~~~~~~~~~~~
This section describes the access control directives in the 'access.conf'
file. Theses directives define encryption keys and level of access that
is granted to *fwknop* clients that have generated the appropriate
encrypted message.
The 'access.conf' variables described below provide the access directives
for the SPA packets with a source (or embeded request) IP that matches an
address or network range defined by the ``SOURCE'' variable. All variables
following ``SOURCE'' apply to the source 'stanza'. Each ``SOURCE''
directive starts a new stanza.
*SOURCE*: '<IP,..,IP/NET,..,NET/ANY>'::
This defines the source address from which the SPA packet will be
accepted. The string ``ANY'' is also accepted if a valid SPA packet
should be honored from any source IP. Every authorization stanza in
'access.conf' definition must start with the ``SOURCE'' keyword.
Networks should be specified in CIDR notation (e.g. ``192.168.10.0/24''),
and individual IP addresses can be specified as well. Also, multiple
IP's and/or networks can be defined as a comma separated list (e.g.
``192.168.10.0/24,10.1.1.123'')
*OPEN_PORTS*: '<proto/port>,...,<proto/port>'::
Define a set of ports and protocols (tcp or udp) that will be
opened if a valid knock sequence is seen. If this entry is not set,
*fwknopd* will attempt to honor the request specifed in the SPA data
(unless of it matches any ``RESTRICT_PORTS'' entries). Multiple entries
are comma-separated.
*RESTRICT_PORTS*: '<proto/port>,...,<proto/port>'::
Define a set of ports and protocols (tcp or udp) that are explicitly
*not* allowed regardless of the validity of the incoming SPA packet.
Multiple entries are comma-separated.
*KEY*: '<password>'::
Define the key used for decrypting an incoming SPA packet that is using
its built-in (Rijndael) encryption. This variable is required for
all non-GPG-encrypted SPA packets.
*FW_ACCESS_TIMEOUT*: '<seconds>'::
Define the length of time access will be granted by *fwknopd* through the
firewall after a valid knock sequence from a source IP address. If
``FW_ACCESS_TIMEOUT'' is not set then the default timeout of 120 seconds
(2 minutes) will automatically be set.
*ENABLE_CMD_EXEC*: '<Y/N>'::
This instructs *fwknopd* to accept complete commands that are
contained within an authorization packet. Any such command will
be executed as root by the *fwknopd* server.
*CMD_REGEX*: '<regex>' '(NOT IMPLEMENTED)'::
If ``ENABLE_CMD_EXEC'' is specified, the
``CMD_REGEX'' keyword instructs *fwknopd* to restrict command execution
to only those command that match the given regular expression.
*REQUIRE_USERNAME*: '<username>'::
Require a specific username from the client system as encoded in the SPA
data. This variable is optional and if not specified, the username data
in the SPA data is ignored.
*REQUIRE_SOURCE_ADDRESS:* '<Y/N>'::
Force all SPA packets to contain a real IP address within the
encrypted data. This makes it impossible to use the *-s* command
line argument on the *fwknop* client command line, so either *-R* has
to be used to automatically resolve the external address (if the
client behind a NAT) or the client must know the external IP.
*GPG_HOME_DIR*: '<path>'::
Define the path to the GnuPG directory to be used by the *fwknopd*
server. If this keyword is not specified within 'access.conf' then
*fwknopd* will default to using the '/root/.gnupg' directory for the
server key(s) for incoming SPA packets handled by the matching
'access.conf' stanza.
*GPG_DECRYPT_ID*: '<keyID>'::
Define a GnuPG key ID to use for decrypting SPA messages that
have been encrypted by an *fwknop* client. This keyword is
required for authentication that is based on GPG keys. The GPG
key ring on the client must have imported and signed the *fwknopd*
server key, and vice versa. It is ok to use a sensitive
personal GPG key on the client, but each *fwknopd* server should
have its own GPG key that is generated specifically for fwknop
communications. The reason for this is that the decryption
password for the server key must be placed within the 'access.conf'
file for *fwknopd* to function (it has to be able to decrypt SPA
messages that have been encrypted with the server's public key).
For more information on using fwknop with GnuPG keys, see the
following link: ``http://www.cipherdyne.org/fwknop/docs/gpghowto.html''.
*GPG DECRYPT_PW*: '<decrypt password>'::
Specify the decryption password for the gpg key defined by the
``GPG_DECRYPT_ID'' above. This is a required field for gpg-based
authentication.
*GPG_REMOTE_ID*: '<keyID,...,keyID>'::
Define a list of gpg key ID's that are required to have signed
any incoming SPA message that has been encrypted with the
*fwknopd* server key. This ensures that the verification of the
remote user is accomplished via a strong cryptographic
mechanism.
FILES
-----
*/etc/fwknop/fwknop.conf*::
The main configuration file for fwknop.
*/etc/fwknop/access.conf*::
Defines all knock sequences and access control directives.
DEPENDENCIES
------------
The *fwknopd* daemon requires a functioning Netfilter firewall on the
underlying operating system.
DIAGNOSTICS
-----------
*fwknopd* can be run in debug mode with the *--debug* command line option.
This will disable daemon mode execution, and print verbose information
to the screen on STDERR as packets are received.
SEE ALSO
--------
fwknop(8), iptables(8), gpg(1), gpg-agent(1), libfko docmentation.
AUTHOR
------
Damien Stuart <dstuart@dstuart.org>
Michael Rash <mbr@cipherdyne.org>
CREDITS
-------
This ``C'' version of *fwknopd* was derived from the original Perl-based
version on which many people who are active in the open source community
have contributed. See the 'CREDITS' file in the fwknop sources, or visit
'http://www.cipherdyne.org/fwknop/docs/contributors.html' to view the online
list of contributors.
The phrase ``Single Packet Authorization'' was coined by MadHat and Simple
Nomad at the BlackHat Briefings of 2005 (see: 'http://www.nmrc.org').
BUGS
----
Send bug reports to dstuart@dstuart.org. Suggestions and/or comments
are always welcome as well.
DISTRIBUTION
------------
*fwknopd* is distributed under the GNU General Public License (GPL), and
the latest version may be downloaded from 'http://www.cipherdyne.org'.
server/Makefile.am
+2
View File
@@ -13,5 +13,7 @@ fwknopd_CPPFLAGS = -I $(top_srcdir)/lib -I $(top_srcdir)/common -DSYSCONFDIR=
fwknopddir = @sysconfdir@/fwknop
dist_man_MANS = fwknopd.8
dist_fwknopd_DATA = fwknopd.conf access.conf
server/config_init.c
+24 -9
View File
@@ -46,20 +46,22 @@ set_config_entry(fko_srv_options_t *opts, int var_ndx, char *value)
exit(EXIT_FAILURE);
}
/* Make sure we have a valid value.
*/
if(value == NULL)
{
fprintf(stderr, "Config value for index %i was NULL\n", var_ndx);
exit(EXIT_FAILURE);
}
/* If this particular entry was already set (i.e. not NULL), then
* assume it needs to be freed first.
*/
if(opts->config[var_ndx] != NULL)
free(opts->config[var_ndx]);
/* If we are setting it to NULL, do it and be done.
*/
if(value == NULL)
{
opts->config[var_ndx] = NULL;
return;
}
/* Otherwise, make the space we need and set it.
*/
space_needed = strlen(value) + 1;
opts->config[var_ndx] = malloc(space_needed);
@@ -463,6 +465,15 @@ config_init(fko_srv_options_t *opts, int argc, char **argv)
case 'K':
opts->kill = 1;
break;
case 'l':
if(opts->no_locale)
fprintf(stderr, "Local option ignored due to no-locale flag.\n");
else
set_config_entry(opts, CONF_LOCALE, optarg);
break;
case NO_LOCALE:
set_config_entry(opts, CONF_LOCALE, NULL);
break;
case 'O':
/* This was handled earlier */
break;
@@ -538,7 +549,11 @@ usage(void)
" -K, --kill - Kill the currently running fwknopd.\n"
" --gpg-home-dir - Specify the GPG home directory.\n"
" --gpg-key - Specify the GPG key ID used for decryption.\n"
" -O, --override-config - \n"
" -l, --locale - Provide a locale setting other than the default\n"
" of \"C\".\n"
" --no-locale - Do not set any locale. Allow the system default\n"
" -O, --override-config - Specify a file with configuration entries that will\n"
" overide those in fwknopd.conf\n"
" -R, --restart - Force the currently running fwknopd to restart.\n"
" -S, --status - Display the status of any running fwknopd process.\n"
" -v, --verbose - Set verbose mode.\n"
server/config_init.h
+4 -1
View File
@@ -58,12 +58,13 @@ enum {
FIREWALL_LIST,
FIREWALL_FLUSH,
FIREWALL_LOG,
NO_LOCALE,
NOOP /* Just to be a marker for the end */
};
/* Our getopt_long options string.
*/
#define GETOPTS_OPTION_STRING "a:c:C:Dfhi:KO:RSvV"
#define GETOPTS_OPTION_STRING "a:c:C:Dfhi:Kl:O:RSvV"
/* Our program command-line options...
*/
@@ -82,6 +83,8 @@ static struct option cmd_opts[] =
{"kill", 0, NULL, 'K'},
{"gpg-home-dir", 1, NULL, GPG_HOME_DIR },
{"gpg-key", 1, NULL, GPG_KEY },
{"locale", 1, NULL, 'l' },
{"no-locale", 0, NULL, NO_LOCALE },
{"override-config", 1, NULL, 'O' },
{"restart", 0, NULL, 'R'},
{"status", 0, NULL, 'S'},
server/fwknopd.c
+1 -1
View File
@@ -130,7 +130,7 @@ main(int argc, char **argv)
#if HAVE_LOCALE_H
/* Set the locale if specified.
*/
if(opts.config[CONF_LOCALE] != NULL)
if(opts.config[CONF_LOCALE] != NULL && !opts.no_locale)
{
locale = setlocale(LC_ALL, opts.config[CONF_LOCALE]);
server/fwknopd.conf
+4 -25
View File
@@ -16,12 +16,8 @@
##############################################################################
#
# Supports multiple email addresses (as a comma separated list).
#
EMAIL_ADDRESSES root@localhost;
# Machine hostname. If not set, fwknopd will attempt to use gethostname()
# to determine the local hostname and use it.
# to determine the local hostname and use that.
#
#HOSTNAME _CHANGEME_;
@@ -121,14 +117,6 @@ ENABLE_PROC_IP_FORWARD Y;
#
ENABLE_IPT_OUTPUT N;
# Force all SPA packets to contain a real IP address within the encrypted
# data. This makes it impossible to use the -s command line argument on
# the fwknop client command line, so either -R has to be used to
# automatically resolve the external address (if the client behind a NAT) or
# the client must know the external IP.
#
REQUIRE_SOURCE_ADDRESS N;
# Specify the the maximum number of bytes to sniff per frame - 1500
# is a good default
#
@@ -137,8 +125,8 @@ MAX_SNIFF_BYTES 1500;
# Flush all existing rules in the fwknop chains at fwknop start time and/or
# exit time. They default to Y.
#
#FLUSH_IPT_AT_INIT Y;
#FLUSH_IPT_AT_EXIT Y;
FLUSH_IPT_AT_INIT Y;
FLUSH_IPT_AT_EXIT Y;
# If running on ipfw firewalls, this variable defines the rule number that
# fwknopd uses to insert an ipfw pass rule.
@@ -166,7 +154,7 @@ PCAP_CMD_TIMEOUT 10;
# fwknop access.conf can specify its own GPG directory to override
# this default.
#
GPG_HOME_DIR /root/.gnupg;
#GPG_HOME_DIR /root/.gnupg;
# This gets used if AUTH_MODE is set to "FILE_PCAP". This file must
# be created by a sniffer process (or something like the ulogd pcap
@@ -217,15 +205,6 @@ LOCALE C;
#SYSLOG_IDENTITY fwknopd;
#SYSLOG_FACILITY LOG_DAEMON;
# Allow reporting methods to be enabled/restricted. This keyword can
# accept values of "nosyslog" (don't write any messages to syslog),
# "noemail" (don't send any email messages), or "ALL" (to generate both
# syslog and email messages). "ALL" is the default. Both "nosyslog"
# and "noemail" can be combined with a comma to disable all logging
# and alerting.
#
#ALERTING_METHODS ALL;
# Define the number of times that fwknopd will run certain
# critical iptables commands (such as adding a new access rule) if any
# problems are encountered.
server/fwknopd_common.h
+7 -10
View File
@@ -106,7 +106,7 @@ enum {
enum {
CONF_CONFIG_FILE = 0,
CONF_OVERRIDE_CONFIG,
CONF_EMAIL_ADDRESSES,
//CONF_EMAIL_ADDRESSES,
CONF_HOSTNAME,
CONF_FIREWALL_TYPE,
CONF_AUTH_MODE,
@@ -123,13 +123,12 @@ enum {
CONF_SNAT_TRANSLATE_IP,
CONF_ENABLE_PROC_IP_FORWARD,
CONF_ENABLE_IPT_OUTPUT,
CONF_REQUIRE_SOURCE_ADDRESS,
//CONF_ENABLE_COOKED_INTF,
CONF_ENABLE_VOLUNTARY_EXITS,
CONF_EXIT_INTERVAL,
CONF_MAX_SNIFF_BYTES,
//CONF_FLUSH_IPT_AT_INIT,
//CONF_FLUSH_IPT_AT_EXIT,
CONF_FLUSH_IPT_AT_INIT,
CONF_FLUSH_IPT_AT_EXIT,
//CONF_IPFW_RULE_NUM,
//CONF_IPFW_SET_NUM,
//CONF_IPFW_DYNAMIC_INTERVAL,
@@ -143,7 +142,6 @@ enum {
CONF_LOCALE,
CONF_SYSLOG_IDENTITY,
CONF_SYSLOG_FACILITY,
//CONF_ALERTING_METHODS,
CONF_IPT_EXEC_TRIES,
//CONF_ENABLE_EXTERNAL_CMDS,
//CONF_EXTERNAL_CMD_OPEN,
@@ -191,7 +189,7 @@ enum {
static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = {
"CONFIG_FILE",
"OVERRIDE_CONFIG",
"EMAIL_ADDRESSES",
//"EMAIL_ADDRESSES",
"HOSTNAME",
"FIREWALL_TYPE",
"AUTH_MODE",
@@ -208,13 +206,12 @@ static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = {
"SNAT_TRANSLATE_IP",
"ENABLE_PROC_IP_FORWARD",
"ENABLE_IPT_OUTPUT",
"REQUIRE_SOURCE_ADDRESS",
//"ENABLE_COOKED_INTF",
"ENABLE_VOLUNTARY_EXITS",
"EXIT_INTERVAL",
"MAX_SNIFF_BYTES",
//"FLUSH_IPT_AT_INIT",
//"FLUSH_IPT_AT_EXIT",
"FLUSH_IPT_AT_INIT",
"FLUSH_IPT_AT_EXIT",
//"IPFW_RULE_NUM",
//"IPFW_SET_NUM",
//"IPFW_DYNAMIC_INTERVAL",
@@ -228,7 +225,6 @@ static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = {
"LOCALE",
"SYSLOG_IDENTITY",
"SYSLOG_FACILITY",
//"ALERTING_METHODS",
"IPT_EXEC_TRIES",
//"ENABLE_EXTERNAL_CMDS",
//"EXTERNAL_CMD_OPEN",
@@ -337,6 +333,7 @@ typedef struct fko_srv_options
unsigned char dump_config; /* Dump current configuration flag */
unsigned char foreground; /* Run in foreground flag */
unsigned char kill; /* flag to initiate kill of fwknopd */
unsigned char no_locale; /* Flag to not allow setting locale */
unsigned char restart; /* Restart fwknopd flag */
unsigned char status; /* Get fwknopd status flag */
unsigned char test; /* Test mode flag */