core/Projektarbeit-MYP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

📚 Improved logging structure & added backup file 🔜

Browse Source
This commit is contained in:
Till Tomczak
2025-06-01 14:39:46 +02:00
parent 3287b4558b
commit 7fa7da74af
29 changed files with 1139 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
backend/systemd/myp-firewall.service
View File

@ -19,25 +19,34 @@ ExecStart=/bin/bash -c '\
# Zone definieren (falls nicht vorhanden) \
firewall-cmd --permanent --new-zone=myp-backend 2>/dev/null || true; \
\
# Erweiterte Netzwerk-Quellen definieren \
# Erweiterte Netzwerk-Quellen definieren (nur IPv4) \
firewall-cmd --permanent --zone=myp-backend --add-source=192.168.0.0/16; \
firewall-cmd --permanent --zone=myp-backend --add-source=127.0.0.1/32; \
firewall-cmd --permanent --zone=myp-backend --add-source=::1/128; \
\
# Lokaler Hostname hinzufügen (falls auflösbar) \
LOCAL_HOSTNAME=$(hostname); \
if [ -n "$LOCAL_HOSTNAME" ]; then \
LOCAL_IP=$(getent hosts "$LOCAL_HOSTNAME" | awk "{print \$1}" | head -1 2>/dev/null || true); \
if [ -n "$LOCAL_IP" ]; then \
firewall-cmd --permanent --zone=myp-backend --add-source="$LOCAL_IP/32" 2>/dev/null || true; \
fi; \
# Lokaler Hostname "raspberrypi" hinzufügen \
LOCAL_HOSTNAME="raspberrypi"; \
LOCAL_IP=$(getent hosts "$LOCAL_HOSTNAME" | awk "{print \$1}" | grep -E "^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$" | head -1 2>/dev/null || true); \
if [ -n "$LOCAL_IP" ]; then \
firewall-cmd --permanent --zone=myp-backend --add-source="$LOCAL_IP/32" 2>/dev/null || true; \
logger "MYP Firewall: Lokaler Hostname $LOCAL_HOSTNAME hinzugefügt: $LOCAL_IP"; \
else \
logger "MYP Firewall: Lokaler Hostname $LOCAL_HOSTNAME nicht auflösbar"; \
fi; \
\
# Remote-Hostname m040tbaraspi001 hinzufügen (falls auflösbar) \
REMOTE_IP=$(getent hosts "m040tbaraspi001" | awk "{print \$1}" | head -1 2>/dev/null || true); \
if [ -n "$REMOTE_IP" ]; then \
firewall-cmd --permanent --zone=myp-backend --add-source="$REMOTE_IP/32" 2>/dev/null || true; \
logger "MYP Firewall: Remote-Hostname m040tbaraspi001 hinzugefügt: $REMOTE_IP"; \
# Frontend-Server m040tbaraspi001 hinzufügen (falls auflösbar) \
FRONTEND_IP=$(getent hosts "m040tbaraspi001" | awk "{print \$1}" | grep -E "^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$" | head -1 2>/dev/null || true); \
if [ -n "$FRONTEND_IP" ]; then \
firewall-cmd --permanent --zone=myp-backend --add-source="$FRONTEND_IP/32" 2>/dev/null || true; \
logger "MYP Firewall: Frontend-Server m040tbaraspi001 hinzugefügt: $FRONTEND_IP"; \
else \
# Versuche auch mit FQDN \
FRONTEND_FQDN_IP=$(getent hosts "m040tbaraspi001.de040.corpintra.net" | awk "{print \$1}" | grep -E "^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$" | head -1 2>/dev/null || true); \
if [ -n "$FRONTEND_FQDN_IP" ]; then \
firewall-cmd --permanent --zone=myp-backend --add-source="$FRONTEND_FQDN_IP/32" 2>/dev/null || true; \
logger "MYP Firewall: Frontend-Server m040tbaraspi001.de040.corpintra.net hinzugefügt: $FRONTEND_FQDN_IP"; \
else \
logger "MYP Firewall: Frontend-Server m040tbaraspi001 nicht auflösbar"; \
fi; \
fi; \
\
# HTTPS für API & Kiosk \
@ -49,6 +58,10 @@ ExecStart=/bin/bash -c '\
# RDP für Remote-Desktop \
firewall-cmd --permanent --zone=myp-backend --add-port=3389/tcp; \
\
# IPv6 in firewalld deaktivieren \
firewall-cmd --permanent --set-target=DROP --zone=public --family=ipv6 2>/dev/null || true; \
firewall-cmd --permanent --set-target=DROP --zone=myp-backend --family=ipv6 2>/dev/null || true; \
\
# Default-Zone setzen \
firewall-cmd --set-default-zone=myp-backend; \
\
@ -56,7 +69,7 @@ ExecStart=/bin/bash -c '\
firewall-cmd --reload; \
\
# Status loggen \
logger "MYP Firewall: Konfiguration erfolgreich angewendet"; \
logger "MYP Firewall: Konfiguration erfolgreich angewendet (IPv6 deaktiviert, Frontend-Server m040tbaraspi001)"; \
firewall-cmd --list-all-zones | logger -t "MYP-Firewall"; \
'