From f3c33c273bf18fab710e31da19d1e2aeac4b3ddd Mon Sep 17 00:00:00 2001 From: Damien Stuart Date: Tue, 9 Feb 2010 20:23:42 +0000 Subject: [PATCH] Added an initial fwknopd.8 man page (and source asciidoc). Added the --locale and --no-locale command-line option support. The set_config_entry function now allows setting a config entry to NULL to clear and free it. git-svn-id: file:///home/mbr/svn/fwknop/trunk@209 510a4753-2344-4c79-9c09-4d669213fbeb --- ChangeLog | 6 + doc/Makefile.am | 2 +- doc/README | 19 ++ doc/fwknopd.man.asciidoc | 457 +++++++++++++++++++++++++++++++++++++++ server/Makefile.am | 2 + server/config_init.c | 33 ++- server/config_init.h | 5 +- server/fwknopd.c | 2 +- server/fwknopd.conf | 29 +-- server/fwknopd_common.h | 17 +- 10 files changed, 525 insertions(+), 47 deletions(-) create mode 100644 doc/README create mode 100644 doc/fwknopd.man.asciidoc diff --git a/ChangeLog b/ChangeLog index 3ed4359d..25679cef 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2010-02-09 Damien Stuart + * Created initial fwknopd.8 man page. + * Added --locale and --no-locale options. + * Allow using internal set_config_entry function to set NULL values + to configuration options to clear and free them. + 2010-02-05 Damien Stuart * Updated libfko to set gpgme to use of gpg (vice gpg2) by default. * Added fko_set_gpg_exe and fko_get_gpg_exe function for getting or diff --git a/doc/Makefile.am b/doc/Makefile.am index 8dbe8156..a2902f57 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -3,4 +3,4 @@ CLEANFILES = libfko.info info_TEXINFOS = libfko.texi libfko_TEXINFOS = gpl-2.0.texi -EXTRA_DIST = fwknop.man.asciidoc +EXTRA_DIST = README fwknop.man.asciidoc fwknopd.man.asciidoc diff --git a/doc/README b/doc/README new file mode 100644 index 00000000..590080f2 --- /dev/null +++ b/doc/README @@ -0,0 +1,19 @@ +NOTES on the generation of the fwknop man pages: + +UNtil we decide on a better way, the man pages for 'fwknop' (client) and +'fwknopd' (server) are generated from the asciidoc sources in this directory, +then copied to their respective directories before check-in. + +We use the "a2x" command to generate the inital nroff-formated version, +which is then manually edited to clean it up a bit. The "a2x" command is: + + a2x -f manpage fwknopd.man.asciidoc + +This creates the "fwknopd.8" man page. However, depending on the a2x and.or +asciidoc configuration on your system, you may have to edit the "fwknopd.8" +file directly to remove the "[FIXME: source/manual]" string embedded within. +At present, we simply remove them. There may also be places where you want +items on succesive line without intervening lines (i.e. the AUTHORS section +of the generated man page). In those cases, simply change the ".sp" +between those lines to ".br". + diff --git a/doc/fwknopd.man.asciidoc b/doc/fwknopd.man.asciidoc new file mode 100644 index 00000000..68a02a76 --- /dev/null +++ b/doc/fwknopd.man.asciidoc @@ -0,0 +1,457 @@ +FWKNOPD(8) +========== + + +NAME +---- +fwknopd - Firewall Knock Operator Daemon + + +SYNOPSIS +-------- +*fwknopd* ['options'] + +DESCRIPTION +----------- +*fwknopd* is the server component for the FireWall Knock Operator, and +is responsible for monitoring Single Packet Authorization (SPA) packets +that are generated by *fwknop* clients, modifying a firewall or acl +policy to allow the desired access after decrypting a valid SPA packet, +and removing access after a configurable timeout. The main application +of this program is to protect services such as 'SSH' with an additional +layer of security in order to make the exploitation of vulnerabilities +(both 0-day and unpatched code) much more difficult. + +The main configuration for *fwknopd* is maintained within two files: +'fwknopd.conf' and 'access.conf'. The default location for these files +is determined at package configuration (typically '/etc/fwknop')The +configuration variables within these files are desribed below. + + +COMMAND-LINE OPTIONS +-------------------- +*-a, --access-file*='':: + Specify the location of the 'access.conf' file. If this option is + not given, 'fwkopd' will use the default location (typically + '/etc/fwknop/access.conf'. + +*-c, --config*='':: + Specify the location of the 'fwknopd.conf' file. If this option is + not given, 'fwkopd' will use the default location (typically + '/etc/fwknop/fwknopd.conf'. + +*-C, --packet-limit*='':: + Specify the number of candidate SPA packets to process and exit when + this limit is reached. + +*-i, --interface*='':: + Manually specify interface on which to sniff, e.g. ``-i eth0''. This + option is not usually needed because the ``PCAP_INTF'' keyword in the + 'fwknopd.conf' file defines the sniffing interface. + +*--fw-list*:: + List all active rules in the ``FWKNOP'' Netfilter chain(s). + +*--fw-flush*:: + Flush all active rules in the ``FWKNOP'' Netfilter chain(s). + +*-O, --Override-config*='':: + Override config variable values that are normally read from the + 'fwknop.conf' file with values from the specified file. Multiple + override config files can be given as a comma-separated list. + +*-D, --Dump-config*:: + Dump the configuration values that *fwknopd* derives from the + 'fwknop.conf' (or override files) and 'access.conf' on STDERR. + +*-K, --Kill*:: + Kill the current *fwknopd* process. This provides a quick and easy + way to stop *fwknopd* without having to look in the process table. + +*-R, --Restart*:: + Restart the currently running *fwknopd* processes. This option + will preserve the command line options that were supplied to the + original *fwknopd* process but will force *fwknopd* to re-read the + 'fwknopd.conf' and 'access.conf' files. This will also force a + flush of the current ``FWKNOP'' Netfilter chain(s). + +*-S, --Status*:: + Display the status of any *fwknopd* processes that may or not be + running. + +*-l, --locale*='':: + Provide a locale setting other than the default ``C'' locale. + +*--no-locale*:: + Do not set the locale at all so that the default system locale + will apply. + +*-v, --verbose*:: + Run *fwknopd* in verbose mode. + +*-h, --help*:: + Display usage information and exit. + +*-V, --Version*:: + Display version information and exit. + + +FWKNOPD CONFIG AND ACCESS VARIABLES +----------------------------------- +*fwknopd* references the 'fwknopd.conf' file for configuration +variables such as the path to the firewall logfile, the sleep interval +fwknop uses to check for new log messages, and paths to system +binaries, etc. The fwknop config file does not define any access +control directives. + +The access control directives are contained in the 'access.conf' file. +Access control directives define encryption keys and level of access that +is granted to an fwknop client that has generated the appropriate encrypted +message. + +FWKNOPS.CONF VARIABLES +~~~~~~~~~~~~~~~~~~~~~~ +This section list the more prominent configuration variables used by +*fwknopd*. It is not a complete list. See the 'fwknopd.conf' file for +the full list and corresponding details. + +*HOSTNAME* '':: + Force hostname to this value. If not set here, *fwknopd* will attempt + to use 'gethostname()' to determine the local hostname and use that. + +*FIREWALL_TYPE* '':: + Define the firewall type. The default is 'iptables' for Linux systems, + but this can be set to 'ipfw' for BSD systems. Also supported is + 'external_cmd' to allow *fwknopd* to invoke an external command instead + of interfacing with the firewall at all. + +*AUTH_MODE* '':: + This defines the general strategy *fwknopd* uses to authenticate remote + clients. Possible values are 'PCAP' (authenticate via regular pcap; + this is the default and puts the interface in promiscuous mode unless + ``ENABLE_PCAP_PROMISC'' is turned off), 'FILE_PCAP' (authenticate via + a pcap file that is built by a sniffer), 'ULOG_PCAP' (authenticate via + the ulogd pcap writer). *Note:* Currently, only 'PCAP' is implemented. + +*PCAP_INTF* '':: + Define the ethernet interface on which *fwknopd* will sniff packets. + Note that this is only used if the ``AUTH_MODE'' keyword above is set + to ``PCAP''. + +*ENABLE_PCAP_PROMISC* '':: + By default *fwknopd* puts the pcap interface into promiscuous mode. Set + this to ``N'' to disable that behavior (non-promiscuous). + +*PCAP_FILTER* '':: + Define the filter used for 'PCAP' modes; *fwknopd* defaults to UDP + port 62201. However, if an *fwknop* client uses the *--rand-port* option + to send the SPA packet over a random port, then this variable should be + updated to something like ``udp dst portrange 10000-65535''. + +*ENABLE_SPA_PACKET_AGING* '':: + This instructs *fwknopd* to not honor SPA packets that have an old time + stamp. The value for ``old'' is defined by the ``MAX_SPA_PACKET_AGE'' + variable. If ``ENABLE_SPA_PACKET_AGING'' is set to ``N'', *fwknopd* + will not use the client time stamp at all. + +*MAX_SPA_PACKET_AGE* '':: + Defines the maximum age (in seconds) that an SPA packet will be accepted. + This requires that the client system is in relatively close time + synchronization with the *fwknopd* server system (NTP is good). The + default age is 120 seconds (two minutes). + +*ENABLE_DIGEST_PERSISTENCE* '':: + Track digest sums associated with previous SPA packets processed by + *fwknopd*. This allows digest sums to remain persistent across + executions of *fwknopd*. The default is ``Y''. If set to ``N'', + *fwknopd* will not check incoming SPA packet data against any + previously save digests. + +*ENABLE_IPT_FORWARDING* '':: + Allow SPA clients to request access to services through an iptables + firewall instead of just to it (i.e. access through the FWKNOP_FORWARD + chain instead of the INPUT chain). This also requires the + ``ENABLE_FORWARD_ACCESS'' variable to be set in the 'access.conf' + file for the specific ``SOURCE'' stanzas that should be allowed for + forwarding access. + +*ENABLE_IPT_LOCAL_NAT* '>Y/N>':: + Allow SPA clients to request access to a local socket via NAT. This + still puts an ACCEPT rule into the FWKNOP_INPUT chain, but a different + port is translated via DNAT rules to the real one. So, the user would + do ``ssh -p '' to access the local service (see the *--NAT-local* + and *--NAT-rand-port* on the *fwknop* client command line). + +*ENABLE_IPT_SNAT* '':: + Set this to ``Y'' to enable a corresponding SNAT rule. By default, if + forwarding access is enabled (see the ``ENABLE_IPT_FORWARDING'' variable + above), then *fwknopd* creates DNAT rules for incoming connections, but + does not also complement these rules with SNAT rules at the same time. + In some situations, internal systems may not have a route back out for + the source address of the incoming connection, so it is necessary to + also apply SNAT rules so that the internal systems see the IP of the + internal interface where *fwknopd* is running. + +*SNAT_TRANSLATE_IP* '':: + Specify the IP address for SNAT. This functionality is only enabled + when ``ENABLE_IPT_SNAT'' is set to ``Y'' and by default SNAT rules are + built with the MASQUERADE target (since then the internal IP does not + have to be defined here in the 'fwknopd.conf' file), but if you want + *fwknopd* to use the SNAT target, you mus also define an IP address with + the ``SNAT_TRANSLATE_IP'' variable. + +*ENABLE_IPT_OUTPUT* '':: + Add ACCEPT rules to the FWKNOP_OUTPUT chain. This is usually only useful + if there are no state tracking rules to allow connection responses out + and the OUTPUT chain has a default-drop stance. + +*MAX_SNIFF_BYTES* '':: + Specify the the maximum number of bytes to sniff per frame. 1500 + is the default. + +*FLUSH_IPT_AT_INIT* '':: + Flush all existing rules in the fwknop chains at *fwknopd* start time. + The default is ``Y''. + +*FLUSH_IPT_AT_EXIT* '':: + Flush all existing rules in the fwknop chains when *fwknopd* is stopped + or otherwise exits cleanly. The default is ``Y''. + +*IPFW_RULE_NUM* '':: + If running on 'ipfw' firewalls, this variable defines the rule number + that *fwknopd* uses to insert an ipfw 'pass' rule. + +*IPFW_SET_NUM* '':: + If running on 'ipfw' firewalls, this variable defines the rule set + that will be used to store expired rules that still have a dynamic + rule associated to them. That set will be disabled by *fwknopd* and + should not be enabled while *fwknopd* is running. Not used when ipfw + isn't using dynamic rules. + +*IPFW_DYNAMIC_INTERVAL* '':: + For 'ipfw' firewalls set the interval (in seconds) over those rules + that have no remaining dynamic rules associated with them will be + removed. + +*PCAP_CMD_TIMEOUT* '':: + Define the timeout for running a command. + + +*GPG_HOME_DIR* '':: + If GPG keys are used instead of a Rijndael symmetric key, this is + the default GPG keys directory. Note that each access block in + 'access.conf' can specify its own GPG directory to override + this default. If not set here or in an 'access.conf' stanza, then + the '$HOME/.gnupg' directory of the user running *fwknopd* (most + likely root). + +*PCAP_PKT_FILE* '':: + This gets used if AUTH_MODE is set to "FILE_PCAP". This file must + be created by a sniffer process (or something like the ulogd pcap + writer). + +*BLACKLIST* '':: + Define a comma-separated set of IP addresses and/or networks that should + be globally blacklisted. That is, any SPA packet that is from a source + IP (or has an internal --allow-ip) within a blacklisted network will be + ignored. + +*MAX_HOPS* '':: + TTL values are decremented depending on the number of hops the packet + has taken before it hits the firewall. We will assume packets will not + jump through more than 'num_hops' hops on average. + +*ENABLE_SPA_OVER_HTTP* '':: + Allow *fwknopd* to acquire SPA data from HTTP requests (generated with + the fwknop client in *--HTTP* mode). Note that the ``PCAP_FILTER'' + variable would need to be updated when this is enabled to sniff traffic + over TCP/80 connections. + +*ENABLE_TCP_SERVER* '':: + Note that *fwknopd* still only gets its data via pcap, so the filter + defined by ``PCAP_FILTER'' needs to be updated to include this TCP port. + +*TCPSERV_PORT* '':: + Set the default port number that the 'fwknopd_serv' ``dummy'' TCP server + listens on. This server is only spawned when ``ENABLE_TCP_SERVER'' is set + to ``Y''. + +*LOCALE* '':: + Set the locale (via the LC_ALL variable). This can be unset or set to + ``NONE'' to have *fwknopd* honor the default system locale. + +*SYSLOG_IDENTITY* '':: + Override syslog identity on message logged by *fwknopd*. The defaults + are usually ok. + +*SYSLOG_FACILITY* '':: +Override syslog facility. The ``SYSLOG_FACILITY'' variable can be set to +one of ``LOG_LOCAL{0-7}'' or ``LOG_DAEMON'' (the default). + +*IPT_EXEC_TRIES* '':: + Define the number of times that *fwknopd* will run certain critical + iptables commands (such as adding a new access rule) if any + problems are encountered. + + +ACCESS.CONF VARIABLES +~~~~~~~~~~~~~~~~~~~~~ +This section describes the access control directives in the 'access.conf' +file. Theses directives define encryption keys and level of access that +is granted to *fwknop* clients that have generated the appropriate +encrypted message. + +The 'access.conf' variables described below provide the access directives +for the SPA packets with a source (or embeded request) IP that matches an +address or network range defined by the ``SOURCE'' variable. All variables +following ``SOURCE'' apply to the source 'stanza'. Each ``SOURCE'' +directive starts a new stanza. + +*SOURCE*: '':: + This defines the source address from which the SPA packet will be + accepted. The string ``ANY'' is also accepted if a valid SPA packet + should be honored from any source IP. Every authorization stanza in + 'access.conf' definition must start with the ``SOURCE'' keyword. + Networks should be specified in CIDR notation (e.g. ``192.168.10.0/24''), + and individual IP addresses can be specified as well. Also, multiple + IP's and/or networks can be defined as a comma separated list (e.g. + ``192.168.10.0/24,10.1.1.123'') + +*OPEN_PORTS*: ',...,':: + Define a set of ports and protocols (tcp or udp) that will be + opened if a valid knock sequence is seen. If this entry is not set, + *fwknopd* will attempt to honor the request specifed in the SPA data + (unless of it matches any ``RESTRICT_PORTS'' entries). Multiple entries + are comma-separated. + +*RESTRICT_PORTS*: ',...,':: + Define a set of ports and protocols (tcp or udp) that are explicitly + *not* allowed regardless of the validity of the incoming SPA packet. + Multiple entries are comma-separated. + +*KEY*: '':: + Define the key used for decrypting an incoming SPA packet that is using + its built-in (Rijndael) encryption. This variable is required for + all non-GPG-encrypted SPA packets. + +*FW_ACCESS_TIMEOUT*: '':: + Define the length of time access will be granted by *fwknopd* through the + firewall after a valid knock sequence from a source IP address. If + ``FW_ACCESS_TIMEOUT'' is not set then the default timeout of 120 seconds + (2 minutes) will automatically be set. + +*ENABLE_CMD_EXEC*: '':: + This instructs *fwknopd* to accept complete commands that are + contained within an authorization packet. Any such command will + be executed as root by the *fwknopd* server. + +*CMD_REGEX*: '' '(NOT IMPLEMENTED)':: + If ``ENABLE_CMD_EXEC'' is specified, the + ``CMD_REGEX'' keyword instructs *fwknopd* to restrict command execution + to only those command that match the given regular expression. + +*REQUIRE_USERNAME*: '':: + Require a specific username from the client system as encoded in the SPA + data. This variable is optional and if not specified, the username data + in the SPA data is ignored. + +*REQUIRE_SOURCE_ADDRESS:* '':: + Force all SPA packets to contain a real IP address within the + encrypted data. This makes it impossible to use the *-s* command + line argument on the *fwknop* client command line, so either *-R* has + to be used to automatically resolve the external address (if the + client behind a NAT) or the client must know the external IP. + +*GPG_HOME_DIR*: '':: + Define the path to the GnuPG directory to be used by the *fwknopd* + server. If this keyword is not specified within 'access.conf' then + *fwknopd* will default to using the '/root/.gnupg' directory for the + server key(s) for incoming SPA packets handled by the matching + 'access.conf' stanza. + +*GPG_DECRYPT_ID*: '':: + Define a GnuPG key ID to use for decrypting SPA messages that + have been encrypted by an *fwknop* client. This keyword is + required for authentication that is based on GPG keys. The GPG + key ring on the client must have imported and signed the *fwknopd* + server key, and vice versa. It is ok to use a sensitive + personal GPG key on the client, but each *fwknopd* server should + have its own GPG key that is generated specifically for fwknop + communications. The reason for this is that the decryption + password for the server key must be placed within the 'access.conf' + file for *fwknopd* to function (it has to be able to decrypt SPA + messages that have been encrypted with the server's public key). + For more information on using fwknop with GnuPG keys, see the + following link: ``http://www.cipherdyne.org/fwknop/docs/gpghowto.html''. + +*GPG DECRYPT_PW*: '':: + Specify the decryption password for the gpg key defined by the + ``GPG_DECRYPT_ID'' above. This is a required field for gpg-based + authentication. + +*GPG_REMOTE_ID*: '':: + Define a list of gpg key ID's that are required to have signed + any incoming SPA message that has been encrypted with the + *fwknopd* server key. This ensures that the verification of the + remote user is accomplished via a strong cryptographic + mechanism. + + +FILES +----- +*/etc/fwknop/fwknop.conf*:: +The main configuration file for fwknop. + +*/etc/fwknop/access.conf*:: +Defines all knock sequences and access control directives. + + +DEPENDENCIES +------------ +The *fwknopd* daemon requires a functioning Netfilter firewall on the +underlying operating system. + + +DIAGNOSTICS +----------- +*fwknopd* can be run in debug mode with the *--debug* command line option. +This will disable daemon mode execution, and print verbose information +to the screen on STDERR as packets are received. + + +SEE ALSO +-------- +fwknop(8), iptables(8), gpg(1), gpg-agent(1), libfko docmentation. + + +AUTHOR +------ +Damien Stuart + +Michael Rash + + +CREDITS +------- +This ``C'' version of *fwknopd* was derived from the original Perl-based +version on which many people who are active in the open source community +have contributed. See the 'CREDITS' file in the fwknop sources, or visit +'http://www.cipherdyne.org/fwknop/docs/contributors.html' to view the online +list of contributors. + +The phrase ``Single Packet Authorization'' was coined by MadHat and Simple +Nomad at the BlackHat Briefings of 2005 (see: 'http://www.nmrc.org'). + + +BUGS +---- +Send bug reports to dstuart@dstuart.org. Suggestions and/or comments +are always welcome as well. + + +DISTRIBUTION +------------ +*fwknopd* is distributed under the GNU General Public License (GPL), and +the latest version may be downloaded from 'http://www.cipherdyne.org'. + + diff --git a/server/Makefile.am b/server/Makefile.am index 27ff59c0..39c4a8ea 100644 --- a/server/Makefile.am +++ b/server/Makefile.am @@ -13,5 +13,7 @@ fwknopd_CPPFLAGS = -I $(top_srcdir)/lib -I $(top_srcdir)/common -DSYSCONFDIR= fwknopddir = @sysconfdir@/fwknop +dist_man_MANS = fwknopd.8 + dist_fwknopd_DATA = fwknopd.conf access.conf diff --git a/server/config_init.c b/server/config_init.c index 7cc6a724..4634b09b 100644 --- a/server/config_init.c +++ b/server/config_init.c @@ -46,20 +46,22 @@ set_config_entry(fko_srv_options_t *opts, int var_ndx, char *value) exit(EXIT_FAILURE); } - /* Make sure we have a valid value. - */ - if(value == NULL) - { - fprintf(stderr, "Config value for index %i was NULL\n", var_ndx); - exit(EXIT_FAILURE); - } - /* If this particular entry was already set (i.e. not NULL), then * assume it needs to be freed first. */ if(opts->config[var_ndx] != NULL) free(opts->config[var_ndx]); + /* If we are setting it to NULL, do it and be done. + */ + if(value == NULL) + { + opts->config[var_ndx] = NULL; + return; + } + + /* Otherwise, make the space we need and set it. + */ space_needed = strlen(value) + 1; opts->config[var_ndx] = malloc(space_needed); @@ -463,6 +465,15 @@ config_init(fko_srv_options_t *opts, int argc, char **argv) case 'K': opts->kill = 1; break; + case 'l': + if(opts->no_locale) + fprintf(stderr, "Local option ignored due to no-locale flag.\n"); + else + set_config_entry(opts, CONF_LOCALE, optarg); + break; + case NO_LOCALE: + set_config_entry(opts, CONF_LOCALE, NULL); + break; case 'O': /* This was handled earlier */ break; @@ -538,7 +549,11 @@ usage(void) " -K, --kill - Kill the currently running fwknopd.\n" " --gpg-home-dir - Specify the GPG home directory.\n" " --gpg-key - Specify the GPG key ID used for decryption.\n" - " -O, --override-config - \n" + " -l, --locale - Provide a locale setting other than the default\n" + " of \"C\".\n" + " --no-locale - Do not set any locale. Allow the system default\n" + " -O, --override-config - Specify a file with configuration entries that will\n" + " overide those in fwknopd.conf\n" " -R, --restart - Force the currently running fwknopd to restart.\n" " -S, --status - Display the status of any running fwknopd process.\n" " -v, --verbose - Set verbose mode.\n" diff --git a/server/config_init.h b/server/config_init.h index 54ead9c5..bed65f84 100644 --- a/server/config_init.h +++ b/server/config_init.h @@ -58,12 +58,13 @@ enum { FIREWALL_LIST, FIREWALL_FLUSH, FIREWALL_LOG, + NO_LOCALE, NOOP /* Just to be a marker for the end */ }; /* Our getopt_long options string. */ -#define GETOPTS_OPTION_STRING "a:c:C:Dfhi:KO:RSvV" +#define GETOPTS_OPTION_STRING "a:c:C:Dfhi:Kl:O:RSvV" /* Our program command-line options... */ @@ -82,6 +83,8 @@ static struct option cmd_opts[] = {"kill", 0, NULL, 'K'}, {"gpg-home-dir", 1, NULL, GPG_HOME_DIR }, {"gpg-key", 1, NULL, GPG_KEY }, + {"locale", 1, NULL, 'l' }, + {"no-locale", 0, NULL, NO_LOCALE }, {"override-config", 1, NULL, 'O' }, {"restart", 0, NULL, 'R'}, {"status", 0, NULL, 'S'}, diff --git a/server/fwknopd.c b/server/fwknopd.c index cca496f6..7e49c656 100644 --- a/server/fwknopd.c +++ b/server/fwknopd.c @@ -130,7 +130,7 @@ main(int argc, char **argv) #if HAVE_LOCALE_H /* Set the locale if specified. */ - if(opts.config[CONF_LOCALE] != NULL) + if(opts.config[CONF_LOCALE] != NULL && !opts.no_locale) { locale = setlocale(LC_ALL, opts.config[CONF_LOCALE]); diff --git a/server/fwknopd.conf b/server/fwknopd.conf index 833d61cf..71668373 100644 --- a/server/fwknopd.conf +++ b/server/fwknopd.conf @@ -16,12 +16,8 @@ ############################################################################## # -# Supports multiple email addresses (as a comma separated list). -# -EMAIL_ADDRESSES root@localhost; - # Machine hostname. If not set, fwknopd will attempt to use gethostname() -# to determine the local hostname and use it. +# to determine the local hostname and use that. # #HOSTNAME _CHANGEME_; @@ -121,14 +117,6 @@ ENABLE_PROC_IP_FORWARD Y; # ENABLE_IPT_OUTPUT N; -# Force all SPA packets to contain a real IP address within the encrypted -# data. This makes it impossible to use the -s command line argument on -# the fwknop client command line, so either -R has to be used to -# automatically resolve the external address (if the client behind a NAT) or -# the client must know the external IP. -# -REQUIRE_SOURCE_ADDRESS N; - # Specify the the maximum number of bytes to sniff per frame - 1500 # is a good default # @@ -137,8 +125,8 @@ MAX_SNIFF_BYTES 1500; # Flush all existing rules in the fwknop chains at fwknop start time and/or # exit time. They default to Y. # -#FLUSH_IPT_AT_INIT Y; -#FLUSH_IPT_AT_EXIT Y; +FLUSH_IPT_AT_INIT Y; +FLUSH_IPT_AT_EXIT Y; # If running on ipfw firewalls, this variable defines the rule number that # fwknopd uses to insert an ipfw pass rule. @@ -166,7 +154,7 @@ PCAP_CMD_TIMEOUT 10; # fwknop access.conf can specify its own GPG directory to override # this default. # -GPG_HOME_DIR /root/.gnupg; +#GPG_HOME_DIR /root/.gnupg; # This gets used if AUTH_MODE is set to "FILE_PCAP". This file must # be created by a sniffer process (or something like the ulogd pcap @@ -217,15 +205,6 @@ LOCALE C; #SYSLOG_IDENTITY fwknopd; #SYSLOG_FACILITY LOG_DAEMON; -# Allow reporting methods to be enabled/restricted. This keyword can -# accept values of "nosyslog" (don't write any messages to syslog), -# "noemail" (don't send any email messages), or "ALL" (to generate both -# syslog and email messages). "ALL" is the default. Both "nosyslog" -# and "noemail" can be combined with a comma to disable all logging -# and alerting. -# -#ALERTING_METHODS ALL; - # Define the number of times that fwknopd will run certain # critical iptables commands (such as adding a new access rule) if any # problems are encountered. diff --git a/server/fwknopd_common.h b/server/fwknopd_common.h index 549674ca..4e19a8e9 100644 --- a/server/fwknopd_common.h +++ b/server/fwknopd_common.h @@ -106,7 +106,7 @@ enum { enum { CONF_CONFIG_FILE = 0, CONF_OVERRIDE_CONFIG, - CONF_EMAIL_ADDRESSES, + //CONF_EMAIL_ADDRESSES, CONF_HOSTNAME, CONF_FIREWALL_TYPE, CONF_AUTH_MODE, @@ -123,13 +123,12 @@ enum { CONF_SNAT_TRANSLATE_IP, CONF_ENABLE_PROC_IP_FORWARD, CONF_ENABLE_IPT_OUTPUT, - CONF_REQUIRE_SOURCE_ADDRESS, //CONF_ENABLE_COOKED_INTF, CONF_ENABLE_VOLUNTARY_EXITS, CONF_EXIT_INTERVAL, CONF_MAX_SNIFF_BYTES, - //CONF_FLUSH_IPT_AT_INIT, - //CONF_FLUSH_IPT_AT_EXIT, + CONF_FLUSH_IPT_AT_INIT, + CONF_FLUSH_IPT_AT_EXIT, //CONF_IPFW_RULE_NUM, //CONF_IPFW_SET_NUM, //CONF_IPFW_DYNAMIC_INTERVAL, @@ -143,7 +142,6 @@ enum { CONF_LOCALE, CONF_SYSLOG_IDENTITY, CONF_SYSLOG_FACILITY, - //CONF_ALERTING_METHODS, CONF_IPT_EXEC_TRIES, //CONF_ENABLE_EXTERNAL_CMDS, //CONF_EXTERNAL_CMD_OPEN, @@ -191,7 +189,7 @@ enum { static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = { "CONFIG_FILE", "OVERRIDE_CONFIG", - "EMAIL_ADDRESSES", + //"EMAIL_ADDRESSES", "HOSTNAME", "FIREWALL_TYPE", "AUTH_MODE", @@ -208,13 +206,12 @@ static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = { "SNAT_TRANSLATE_IP", "ENABLE_PROC_IP_FORWARD", "ENABLE_IPT_OUTPUT", - "REQUIRE_SOURCE_ADDRESS", //"ENABLE_COOKED_INTF", "ENABLE_VOLUNTARY_EXITS", "EXIT_INTERVAL", "MAX_SNIFF_BYTES", - //"FLUSH_IPT_AT_INIT", - //"FLUSH_IPT_AT_EXIT", + "FLUSH_IPT_AT_INIT", + "FLUSH_IPT_AT_EXIT", //"IPFW_RULE_NUM", //"IPFW_SET_NUM", //"IPFW_DYNAMIC_INTERVAL", @@ -228,7 +225,6 @@ static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = { "LOCALE", "SYSLOG_IDENTITY", "SYSLOG_FACILITY", - //"ALERTING_METHODS", "IPT_EXEC_TRIES", //"ENABLE_EXTERNAL_CMDS", //"EXTERNAL_CMD_OPEN", @@ -337,6 +333,7 @@ typedef struct fko_srv_options unsigned char dump_config; /* Dump current configuration flag */ unsigned char foreground; /* Run in foreground flag */ unsigned char kill; /* flag to initiate kill of fwknopd */ + unsigned char no_locale; /* Flag to not allow setting locale */ unsigned char restart; /* Restart fwknopd flag */ unsigned char status; /* Get fwknopd status flag */ unsigned char test; /* Test mode flag */