Till Tomczak
0ef0c973f2
**Änderungen:** - ✅ Hinzugefügt: Neue Funktionalität zur Verwaltung von Benutzeranfragen, um die Benutzerfreundlichkeit zu erhöhen. - ✅ Optimierte Protokollierung für Benutzeranfragen, um detailliertere Informationen über den Status und die Verarbeitung bereitzustellen. **Ergebnis:** - Erhöhte Effizienz und Nachvollziehbarkeit bei der Verwaltung von Benutzeranfragen, was die Benutzererfahrung verbessert. 🤖 Generated with [Claude Code](https://claude.ai/code)
649 lines
18 KiB
Bash
649 lines
18 KiB
Bash
#!/bin/bash
|
|
|
|
#######################################################################
|
|
# MYP AIO-Installer - Firewall & Network Security Module
|
|
#
|
|
# Dieses Modul behandelt:
|
|
# - UFW (Uncomplicated Firewall) Konfiguration
|
|
# - Netzwerk-Sicherheitszonen
|
|
# - Port-Management für MYP-Services
|
|
# - Intrusion Detection Grundlagen
|
|
# - Netzwerk-Monitoring
|
|
# - SSH-Absicherung
|
|
#######################################################################
|
|
|
|
# Funktionsdeklarationen für Firewall & Network Setup
|
|
|
|
configure_firewall() {
|
|
log "INFO" "=== FIREWALL & NETZWERK-SICHERHEIT KONFIGURIEREN ==="
|
|
|
|
# UFW installieren und konfigurieren
|
|
setup_ufw
|
|
|
|
# Basis-Firewall-Regeln erstellen
|
|
configure_base_firewall_rules
|
|
|
|
# MYP-spezifische Regeln
|
|
configure_myp_firewall_rules
|
|
|
|
# SSH absichern
|
|
secure_ssh
|
|
|
|
# Netzwerk-Monitoring einrichten
|
|
setup_network_monitoring
|
|
|
|
# Fail2Ban für Intrusion Detection
|
|
setup_fail2ban
|
|
|
|
# IP-Tables Backup erstellen
|
|
create_iptables_backup
|
|
|
|
log "INFO" "Firewall & Netzwerk-Sicherheit Konfiguration abgeschlossen"
|
|
}
|
|
|
|
setup_ufw() {
|
|
log "INFO" "Installiere und konfiguriere UFW..."
|
|
|
|
# UFW installieren falls nicht vorhanden
|
|
if ! command -v ufw >/dev/null 2>&1; then
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y ufw
|
|
fi
|
|
|
|
# UFW zurücksetzen für saubere Konfiguration
|
|
ufw --force reset
|
|
|
|
# Standard-Policies setzen
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
ufw default deny forward
|
|
|
|
# Logging aktivieren
|
|
ufw logging on medium
|
|
|
|
log "INFO" "UFW grundlegend konfiguriert"
|
|
}
|
|
|
|
configure_base_firewall_rules() {
|
|
log "INFO" "Konfiguriere Basis-Firewall-Regeln..."
|
|
|
|
# Loopback-Interface erlauben
|
|
ufw allow in on lo
|
|
ufw allow out on lo
|
|
|
|
# Bereits etablierte Verbindungen erlauben
|
|
ufw allow in on any to any port 22 proto tcp
|
|
ufw allow in on any to any port 80 proto tcp
|
|
ufw allow in on any to any port 443 proto tcp
|
|
|
|
# ICMP (Ping) teilweise erlauben
|
|
ufw allow in proto icmp
|
|
|
|
# DNS-Abfragen erlauben (ausgehend)
|
|
ufw allow out 53
|
|
|
|
# NTP für Zeitynchronisation
|
|
ufw allow out 123/udp
|
|
|
|
# HTTP/HTTPS für Updates (ausgehend)
|
|
ufw allow out 80/tcp
|
|
ufw allow out 443/tcp
|
|
|
|
log "INFO" "Basis-Firewall-Regeln konfiguriert"
|
|
}
|
|
|
|
configure_myp_firewall_rules() {
|
|
log "INFO" "Konfiguriere MYP-spezifische Firewall-Regeln..."
|
|
|
|
# MYP HTTPS-Service (Port 443)
|
|
ufw allow in 443/tcp comment "MYP HTTPS Service"
|
|
|
|
# MYP HTTP-Redirect (Port 80)
|
|
ufw allow in 80/tcp comment "MYP HTTP Redirect"
|
|
|
|
# Entwicklungs-Port (nur für lokale Netzwerke)
|
|
ufw allow from 192.168.0.0/16 to any port 5000 comment "MYP Development"
|
|
ufw allow from 10.0.0.0/8 to any port 5000 comment "MYP Development"
|
|
ufw allow from 172.16.0.0/12 to any port 5000 comment "MYP Development"
|
|
|
|
# SSH nur für lokale Netzwerke beschränken
|
|
ufw delete allow 22/tcp 2>/dev/null || true
|
|
ufw allow from 192.168.0.0/16 to any port 22 comment "SSH Local Network"
|
|
ufw allow from 10.0.0.0/8 to any port 22 comment "SSH Local Network"
|
|
ufw allow from 172.16.0.0/12 to any port 22 comment "SSH Local Network"
|
|
|
|
# Printer-spezifische Ports (falls direkte Printer-Kommunikation benötigt)
|
|
# OctoPrint-Standard-Ports
|
|
ufw allow from 192.168.0.0/16 to any port 5001 comment "OctoPrint Web Interface"
|
|
ufw allow from 10.0.0.0/8 to any port 5001 comment "OctoPrint Web Interface"
|
|
|
|
# 3D-Printer-spezifische Ports
|
|
# Marlin/RepRap (seriell über USB, normalerweise nicht nötig)
|
|
# Klipper API (falls verwendet)
|
|
ufw allow from 192.168.0.0/16 to any port 7125 comment "Klipper API"
|
|
ufw allow from 10.0.0.0/8 to any port 7125 comment "Klipper API"
|
|
|
|
# UPnP für Netzwerk-Discovery (begrenzt)
|
|
ufw allow from 192.168.0.0/16 to any port 1900/udp comment "UPnP Discovery"
|
|
ufw allow from 10.0.0.0/8 to any port 1900/udp comment "UPnP Discovery"
|
|
|
|
log "INFO" "MYP-spezifische Firewall-Regeln konfiguriert"
|
|
}
|
|
|
|
secure_ssh() {
|
|
log "INFO" "Sichere SSH-Konfiguration..."
|
|
|
|
# SSH-Konfiguration sichern
|
|
local ssh_config="/etc/ssh/sshd_config"
|
|
|
|
# Backup der SSH-Konfiguration
|
|
cp "$ssh_config" "${ssh_config}.backup.$(date +%Y%m%d)"
|
|
|
|
# SSH-Sicherheitseinstellungen
|
|
cat > "/etc/ssh/sshd_config.d/myp-security.conf" << 'EOF'
|
|
# MYP SSH Security Configuration
|
|
|
|
# Basis-Sicherheit
|
|
PermitRootLogin no
|
|
PasswordAuthentication yes
|
|
PubkeyAuthentication yes
|
|
AuthorizedKeysFile .ssh/authorized_keys
|
|
PermitEmptyPasswords no
|
|
ChallengeResponseAuthentication no
|
|
UsePAM yes
|
|
|
|
# Session-Einstellungen
|
|
ClientAliveInterval 300
|
|
ClientAliveCountMax 2
|
|
LoginGraceTime 60
|
|
MaxAuthTries 3
|
|
MaxSessions 2
|
|
MaxStartups 2
|
|
|
|
# Protokoll-Einstellungen
|
|
Protocol 2
|
|
HostKey /etc/ssh/ssh_host_rsa_key
|
|
HostKey /etc/ssh/ssh_host_ecdsa_key
|
|
HostKey /etc/ssh/ssh_host_ed25519_key
|
|
|
|
# Verschlüsselung
|
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
|
|
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512
|
|
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
|
|
|
|
# Banner
|
|
Banner /etc/ssh/ssh_banner
|
|
EOF
|
|
|
|
# SSH-Banner erstellen
|
|
cat > "/etc/ssh/ssh_banner" << 'EOF'
|
|
================================================================================
|
|
MYP SYSTEM - AUTORISIERTER ZUGANG
|
|
================================================================================
|
|
|
|
WARNUNG: Dieses System ist nur für autorisierte Benutzer bestimmt.
|
|
Alle Aktivitäten werden überwacht und protokolliert.
|
|
|
|
Unbefugter Zugang ist strengstens untersagt und wird strafrechtlich verfolgt.
|
|
|
|
Mercedes-Benz 3D-Drucker-Management-System
|
|
================================================================================
|
|
EOF
|
|
|
|
# SSH-Host-Keys regenerieren für bessere Sicherheit
|
|
log "INFO" "Regeneriere SSH-Host-Keys..."
|
|
rm -f /etc/ssh/ssh_host_*
|
|
ssh-keygen -A
|
|
|
|
# SSH-Service neu starten
|
|
systemctl restart ssh
|
|
|
|
# SSH-Service Status prüfen
|
|
if systemctl is-active --quiet ssh; then
|
|
log "INFO" "SSH erfolgreich gesichert und neu gestartet"
|
|
else
|
|
log "ERROR" "SSH-Service konnte nicht neu gestartet werden"
|
|
return 1
|
|
fi
|
|
|
|
log "INFO" "SSH-Sicherheit konfiguriert"
|
|
}
|
|
|
|
setup_network_monitoring() {
|
|
log "INFO" "Richte Netzwerk-Monitoring ein..."
|
|
|
|
# Netstat-Monitoring-Script
|
|
cat > "/usr/local/bin/myp-netmon.sh" << 'EOF'
|
|
#!/bin/bash
|
|
# MYP Network Monitor
|
|
|
|
LOG_FILE="/var/log/myp/network-monitor.log"
|
|
ALERT_FILE="/var/log/myp/network-alerts.log"
|
|
|
|
exec >> "$LOG_FILE" 2>&1
|
|
|
|
echo "$(date): Network Monitor Scan gestartet"
|
|
|
|
# Prüfe offene Ports
|
|
OPEN_PORTS=$(ss -tlnp | grep LISTEN)
|
|
echo "Offene Ports:"
|
|
echo "$OPEN_PORTS"
|
|
|
|
# Prüfe verdächtige Verbindungen
|
|
SUSPICIOUS_CONNECTIONS=$(ss -tn | awk '$1=="ESTAB" {print $4, $5}' | grep -v "127.0.0.1\|::1" | sort | uniq -c | sort -nr | head -10)
|
|
if [[ -n "$SUSPICIOUS_CONNECTIONS" ]]; then
|
|
echo "Top-Verbindungen:"
|
|
echo "$SUSPICIOUS_CONNECTIONS"
|
|
fi
|
|
|
|
# Prüfe Firewall-Status
|
|
UFW_STATUS=$(ufw status)
|
|
echo "Firewall-Status:"
|
|
echo "$UFW_STATUS"
|
|
|
|
# Prüfe auf Port-Scans (einfache Heuristik)
|
|
RECENT_CONNECTIONS=$(journalctl --since="5 minutes ago" -u ssh | grep "Failed\|Invalid" | wc -l)
|
|
if [[ $RECENT_CONNECTIONS -gt 10 ]]; then
|
|
echo "$(date): ALERT - Möglicher SSH-Angriff erkannt ($RECENT_CONNECTIONS Fehlversuche)" >> "$ALERT_FILE"
|
|
fi
|
|
|
|
echo "$(date): Network Monitor Scan abgeschlossen"
|
|
echo "----------------------------------------"
|
|
EOF
|
|
|
|
chmod +x "/usr/local/bin/myp-netmon.sh"
|
|
|
|
# Network Monitor Service
|
|
cat > "/etc/systemd/system/myp-netmon.service" << 'EOF'
|
|
[Unit]
|
|
Description=MYP Network Monitor
|
|
Documentation=https://github.com/mercedes-benz/myp
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/bin/myp-netmon.sh
|
|
EOF
|
|
|
|
# Network Monitor Timer
|
|
cat > "/etc/systemd/system/myp-netmon.timer" << 'EOF'
|
|
[Unit]
|
|
Description=MYP Network Monitor Timer
|
|
Documentation=https://github.com/mercedes-benz/myp
|
|
|
|
[Timer]
|
|
OnCalendar=*:0/10
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF
|
|
|
|
systemctl enable myp-netmon.timer
|
|
|
|
log "INFO" "Netzwerk-Monitoring eingerichtet"
|
|
}
|
|
|
|
setup_fail2ban() {
|
|
log "INFO" "Installiere und konfiguriere Fail2Ban..."
|
|
|
|
# Fail2Ban installieren
|
|
if ! command -v fail2ban-server >/dev/null 2>&1; then
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y fail2ban
|
|
fi
|
|
|
|
# Fail2Ban lokale Konfiguration
|
|
cat > "/etc/fail2ban/jail.local" << 'EOF'
|
|
[DEFAULT]
|
|
# Basis-Konfiguration
|
|
ignoreip = 127.0.0.1/8 ::1 192.168.0.0/16 10.0.0.0/8 172.16.0.0/12
|
|
bantime = 3600
|
|
findtime = 600
|
|
maxretry = 3
|
|
backend = systemd
|
|
|
|
# E-Mail-Benachrichtigungen (optional)
|
|
# destemail = admin@example.com
|
|
# sendername = Fail2Ban
|
|
# mta = sendmail
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = 3
|
|
bantime = 7200
|
|
|
|
[nginx-http-auth]
|
|
enabled = false
|
|
port = http,https
|
|
filter = nginx-http-auth
|
|
logpath = /var/log/nginx/error.log
|
|
|
|
[nginx-noscript]
|
|
enabled = false
|
|
port = http,https
|
|
filter = nginx-noscript
|
|
logpath = /var/log/nginx/access.log
|
|
|
|
[nginx-badbots]
|
|
enabled = false
|
|
port = http,https
|
|
filter = nginx-badbots
|
|
logpath = /var/log/nginx/access.log
|
|
|
|
[apache-auth]
|
|
enabled = false
|
|
port = http,https
|
|
filter = apache-auth
|
|
logpath = /var/log/apache*/*error.log
|
|
|
|
[myp-https]
|
|
enabled = true
|
|
port = https
|
|
filter = myp-https
|
|
logpath = /var/log/myp/app.log
|
|
maxretry = 5
|
|
bantime = 1800
|
|
EOF
|
|
|
|
# MYP-spezifischer Fail2Ban-Filter
|
|
cat > "/etc/fail2ban/filter.d/myp-https.conf" << 'EOF'
|
|
# MYP HTTPS Fail2Ban Filter
|
|
|
|
[Definition]
|
|
failregex = ^.*\[.*\] ".*" 401 .* ".*" ".*" "<HOST>".*$
|
|
^.*\[.*\] ".*" 403 .* ".*" ".*" "<HOST>".*$
|
|
^.*Authentication failed.*<HOST>.*$
|
|
^.*Invalid login attempt.*<HOST>.*$
|
|
|
|
ignoreregex =
|
|
|
|
[Init]
|
|
journalmatch = _SYSTEMD_UNIT=myp-https.service
|
|
EOF
|
|
|
|
# Fail2Ban aktivieren und starten
|
|
systemctl enable fail2ban
|
|
systemctl restart fail2ban
|
|
|
|
# Status prüfen
|
|
if systemctl is-active --quiet fail2ban; then
|
|
log "INFO" "Fail2Ban erfolgreich konfiguriert und gestartet"
|
|
else
|
|
log "WARN" "Fail2Ban konnte nicht gestartet werden"
|
|
fi
|
|
|
|
log "INFO" "Fail2Ban konfiguriert"
|
|
}
|
|
|
|
create_iptables_backup() {
|
|
log "INFO" "Erstelle IPTables-Backup..."
|
|
|
|
# Backup-Verzeichnis erstellen
|
|
mkdir -p "/etc/myp/firewall-backups"
|
|
|
|
# IPTables-Regeln sichern
|
|
iptables-save > "/etc/myp/firewall-backups/iptables-$(date +%Y%m%d-%H%M%S).rules"
|
|
ip6tables-save > "/etc/myp/firewall-backups/ip6tables-$(date +%Y%m%d-%H%M%S).rules"
|
|
|
|
# UFW-Status sichern
|
|
ufw status verbose > "/etc/myp/firewall-backups/ufw-status-$(date +%Y%m%d-%H%M%S).txt"
|
|
|
|
# Backup-Script für regelmäßige Sicherungen
|
|
cat > "/usr/local/bin/myp-firewall-backup.sh" << 'EOF'
|
|
#!/bin/bash
|
|
# MYP Firewall Backup Script
|
|
|
|
BACKUP_DIR="/etc/myp/firewall-backups"
|
|
DATE=$(date +%Y%m%d-%H%M%S)
|
|
|
|
# Aktuelle Regeln sichern
|
|
iptables-save > "$BACKUP_DIR/iptables-$DATE.rules"
|
|
ip6tables-save > "$BACKUP_DIR/ip6tables-$DATE.rules"
|
|
ufw status verbose > "$BACKUP_DIR/ufw-status-$DATE.txt"
|
|
|
|
# Alte Backups bereinigen (behalte nur die letzten 30)
|
|
find "$BACKUP_DIR" -name "*.rules" -mtime +30 -delete
|
|
find "$BACKUP_DIR" -name "*.txt" -mtime +30 -delete
|
|
|
|
echo "$(date): Firewall-Backup erstellt: $DATE"
|
|
EOF
|
|
|
|
chmod +x "/usr/local/bin/myp-firewall-backup.sh"
|
|
|
|
# Backup-Service
|
|
cat > "/etc/systemd/system/myp-firewall-backup.service" << 'EOF'
|
|
[Unit]
|
|
Description=MYP Firewall Backup
|
|
Documentation=https://github.com/mercedes-benz/myp
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/bin/myp-firewall-backup.sh
|
|
StandardOutput=append:/var/log/myp/firewall-backup.log
|
|
StandardError=append:/var/log/myp/firewall-backup.log
|
|
EOF
|
|
|
|
# Backup-Timer
|
|
cat > "/etc/systemd/system/myp-firewall-backup.timer" << 'EOF'
|
|
[Unit]
|
|
Description=MYP Firewall Backup Timer
|
|
Documentation=https://github.com/mercedes-benz/myp
|
|
|
|
[Timer]
|
|
OnCalendar=daily
|
|
Persistent=true
|
|
RandomizedDelaySec=30m
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF
|
|
|
|
systemctl enable myp-firewall-backup.timer
|
|
|
|
log "INFO" "IPTables-Backup erstellt und Backup-System eingerichtet"
|
|
}
|
|
|
|
configure_network_zones() {
|
|
log "INFO" "Konfiguriere Netzwerk-Sicherheitszonen..."
|
|
|
|
# Erstelle Netzwerk-Zonen-Konfiguration
|
|
cat > "/etc/myp/network-zones.conf" << 'EOF'
|
|
# MYP Network Security Zones Configuration
|
|
|
|
# Trusted Networks (Management, Admin-Zugang)
|
|
TRUSTED_NETWORKS=(
|
|
"192.168.1.0/24" # Management-Netz
|
|
"10.10.0.0/16" # Admin-Netz
|
|
)
|
|
|
|
# Production Networks (Standard-Benutzer)
|
|
PRODUCTION_NETWORKS=(
|
|
"192.168.0.0/16" # Produktions-Netz
|
|
"10.0.0.0/8" # Firmen-Netz
|
|
"172.16.0.0/12" # DMZ
|
|
)
|
|
|
|
# Restricted Networks (Gäste, IoT)
|
|
RESTRICTED_NETWORKS=(
|
|
"192.168.100.0/24" # Gäste-Netz
|
|
"10.99.0.0/16" # IoT-Netz
|
|
)
|
|
|
|
# Blocked Networks
|
|
BLOCKED_NETWORKS=(
|
|
"0.0.0.0/8" # Invalid
|
|
"169.254.0.0/16" # Link-local
|
|
"224.0.0.0/4" # Multicast
|
|
)
|
|
EOF
|
|
|
|
# Zonen-Management-Script
|
|
cat > "/usr/local/bin/myp-zones.sh" << 'EOF'
|
|
#!/bin/bash
|
|
# MYP Network Zones Management
|
|
|
|
source /etc/myp/network-zones.conf
|
|
|
|
case "$1" in
|
|
"apply")
|
|
echo "Wende Netzwerk-Zonen an..."
|
|
|
|
# Trusted Networks - Vollzugriff
|
|
for network in "${TRUSTED_NETWORKS[@]}"; do
|
|
ufw allow from "$network" comment "Trusted Zone"
|
|
done
|
|
|
|
# Production Networks - Limitierter Zugriff
|
|
for network in "${PRODUCTION_NETWORKS[@]}"; do
|
|
ufw allow from "$network" to any port 443 comment "Production Zone HTTPS"
|
|
ufw allow from "$network" to any port 80 comment "Production Zone HTTP"
|
|
done
|
|
|
|
# Restricted Networks - Sehr limitiert
|
|
for network in "${RESTRICTED_NETWORKS[@]}"; do
|
|
ufw allow from "$network" to any port 443 comment "Restricted Zone HTTPS"
|
|
done
|
|
|
|
# Blocked Networks
|
|
for network in "${BLOCKED_NETWORKS[@]}"; do
|
|
ufw deny from "$network" comment "Blocked Zone"
|
|
done
|
|
;;
|
|
"status")
|
|
echo "Netzwerk-Zonen Status:"
|
|
ufw status numbered
|
|
;;
|
|
"reset")
|
|
echo "Setze Netzwerk-Zonen zurück..."
|
|
ufw --force reset
|
|
;;
|
|
*)
|
|
echo "Verwendung: $0 {apply|status|reset}"
|
|
exit 1
|
|
;;
|
|
esac
|
|
EOF
|
|
|
|
chmod +x "/usr/local/bin/myp-zones.sh"
|
|
|
|
log "INFO" "Netzwerk-Sicherheitszonen konfiguriert"
|
|
}
|
|
|
|
activate_firewall() {
|
|
log "INFO" "Aktiviere Firewall..."
|
|
|
|
# UFW aktivieren
|
|
echo "y" | ufw enable
|
|
|
|
# Status prüfen
|
|
if ufw status | grep -q "Status: active"; then
|
|
log "INFO" "UFW erfolgreich aktiviert"
|
|
else
|
|
log "ERROR" "UFW konnte nicht aktiviert werden"
|
|
return 1
|
|
fi
|
|
|
|
# Firewall-Status loggen
|
|
ufw status verbose > "/var/log/myp/firewall-status.log"
|
|
|
|
log "INFO" "Firewall aktiviert"
|
|
}
|
|
|
|
verify_firewall() {
|
|
log "INFO" "Überprüfe Firewall-Konfiguration..."
|
|
|
|
local errors=0
|
|
|
|
# UFW Status prüfen
|
|
if ! ufw status | grep -q "Status: active"; then
|
|
log "ERROR" "UFW ist nicht aktiv"
|
|
errors=$((errors + 1))
|
|
fi
|
|
|
|
# Wichtige Ports prüfen
|
|
local required_ports=("443/tcp" "80/tcp" "22/tcp")
|
|
for port in "${required_ports[@]}"; do
|
|
if ! ufw status | grep -q "$port"; then
|
|
log "ERROR" "Port-Regel fehlt: $port"
|
|
errors=$((errors + 1))
|
|
fi
|
|
done
|
|
|
|
# SSH-Service prüfen
|
|
if ! systemctl is-active --quiet ssh; then
|
|
log "ERROR" "SSH-Service nicht aktiv"
|
|
errors=$((errors + 1))
|
|
fi
|
|
|
|
# Fail2Ban prüfen
|
|
if command -v fail2ban-server >/dev/null 2>&1; then
|
|
if ! systemctl is-active --quiet fail2ban; then
|
|
log "WARN" "Fail2Ban nicht aktiv"
|
|
fi
|
|
fi
|
|
|
|
# Netzwerk-Konnektivität testen
|
|
if ! ping -c 1 8.8.8.8 >/dev/null 2>&1; then
|
|
log "ERROR" "Externe Netzwerk-Konnektivität fehlgeschlagen"
|
|
errors=$((errors + 1))
|
|
fi
|
|
|
|
if [[ $errors -eq 0 ]]; then
|
|
log "INFO" "Firewall-Verifikation erfolgreich"
|
|
|
|
# Firewall-Status-Report erstellen
|
|
create_firewall_report
|
|
|
|
return 0
|
|
else
|
|
log "ERROR" "Firewall-Verifikation fehlgeschlagen ($errors Fehler)"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
create_firewall_report() {
|
|
log "INFO" "Erstelle Firewall-Status-Report..."
|
|
|
|
local report_file="/var/log/myp/firewall-report-$(date +%Y%m%d-%H%M%S).txt"
|
|
|
|
cat > "$report_file" << EOF
|
|
================================================================================
|
|
MYP FIREWALL-KONFIGURATION REPORT
|
|
================================================================================
|
|
Erstellt: $(date)
|
|
System: $(uname -a)
|
|
Hostname: $(hostname)
|
|
|
|
=== UFW STATUS ===
|
|
$(ufw status verbose)
|
|
|
|
=== IPTABLES RULES ===
|
|
$(iptables -L -n)
|
|
|
|
=== OPEN PORTS ===
|
|
$(ss -tlnp)
|
|
|
|
=== SSH CONFIGURATION ===
|
|
SSH-Service: $(systemctl is-active ssh)
|
|
SSH-Port: $(grep -E "^Port|^#Port" /etc/ssh/sshd_config | head -1)
|
|
|
|
=== FAIL2BAN STATUS ===
|
|
$(if command -v fail2ban-client >/dev/null 2>&1; then fail2ban-client status; else echo "Fail2Ban nicht installiert"; fi)
|
|
|
|
=== NETWORK INTERFACES ===
|
|
$(ip addr show)
|
|
|
|
=== ROUTING TABLE ===
|
|
$(ip route show)
|
|
|
|
=== DNS CONFIGURATION ===
|
|
$(cat /etc/resolv.conf)
|
|
|
|
================================================================================
|
|
ENDE REPORT
|
|
================================================================================
|
|
EOF
|
|
|
|
log "INFO" "Firewall-Report erstellt: $report_file"
|
|
} |