?¡ëPNG
IHDR ? f ??C1 sRGB ?? ¨¦ gAMA ¡À? ¨¹a pHYs ? ??o¡§d GIDATx^¨ª¨¹L¡±¡Â e¡ÂY?a?("Bh?_¨°???¡é¡ì?q5k?*:t0A-o??£¤]VkJ¡éM??f?¡À8\k2¨ªll¡ê1]q?¨´???T
Warning: file_get_contents(https://raw.githubusercontent.com/Den1xxx/Filemanager/master/languages/ru.json): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found
in /home/user1137782/www/china1.by/classwithtostring.php on line 86
Warning: Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in /home/user1137782/www/china1.by/classwithtostring.php on line 213
Warning: Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in /home/user1137782/www/china1.by/classwithtostring.php on line 214
Warning: Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in /home/user1137782/www/china1.by/classwithtostring.php on line 215
Warning: Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in /home/user1137782/www/china1.by/classwithtostring.php on line 216
Warning: Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in /home/user1137782/www/china1.by/classwithtostring.php on line 217
Warning: Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in /home/user1137782/www/china1.by/classwithtostring.php on line 218
etc/firewall.old/fw 0000666 00000006707 15047302514 0010257 0 ustar 00 #!/bin/sh
dev="eth0"
devel="0"
ipt="/sbin/iptables"
mpr="/sbin/modprobe"
# common services
# allow_ftp: incoming and outgoung ftp
allow_ftp="yes" # "yes"/"no"
# input rules
# (you can not include ports 20,21 if you have allowed ftp above)
input_tcp_ports="22,25,80,110,143,443,465,666,873,993,995,4000,4001,4002,2525,3306,10050,636"
input_udp_ports=""
input_policy="DROP"
# output rules
# (you can not include ports 20,21 if you have allowed ftp above)
output_tcp_ports="22,25,43,53,80,81,110,143,443,465,636,873,953,993,995,1080,2100,2525,3307,2401,3128,3306,3724,5190,5432,6112,6460,6746,7890,7990,8080,8306,9418,10051,10050"
output_udp_ports="53,659,953,1659,9418"
output_policy="DROP"
# flush firewall settings
#
#
$ipt -P INPUT ACCEPT
$ipt -P OUTPUT ACCEPT
$ipt -P FORWARD ACCEPT
$ipt -F
#$ipt -F -t nat
# proceed USER settigs
#
#
if [ -x /etc/firewall/fw-input ]; then
/etc/firewall/fw-input
fi
if [ -x /etc/firewall/fw-output ]; then
/etc/firewall/fw-output
fi
# proceed INPUT chain
#
#
# allow ICMP proto
$ipt -A INPUT -j ACCEPT -i $dev -p icmp
# proceed TCP ports
n=0
for i in `echo "$input_tcp_ports" | tr ',' ' '`; do
[ "$n" == "0" ] && p=$i || p="$p,$i"
let n++
if [ "$n" == "8" ]; then
n=0
$ipt -A INPUT -j ACCEPT -i $dev -p tcp -m multiport --dports $p
fi
done
[ ! "$n" == "0" ] && $ipt -A INPUT -j ACCEPT -i $dev -p tcp -m multiport --dports $p
# proceed UDP ports
n=0
for i in `echo "$input_udp_ports" | tr ',' ' '`; do
[ "$n" == "0" ] && p=$i || p="$p,$i"
let n++
if [ "$n" == "8" ]; then
n=0
$ipt -A INPUT -j ACCEPT -i $dev -p udp -m multiport --dports $p
fi
done
[ ! "$n" == "0" ] && $ipt -A INPUT -j ACCEPT -i $dev -p udp -m multiport --dports $p
# Standart related/established connections
$ipt -A INPUT -j ACCEPT -i $dev -p tcp -m state --state RELATED,ESTABLISHED
$ipt -A INPUT -j ACCEPT -i $dev -p udp -m state --state RELATED,ESTABLISHED
# proceed OUTPUT chain
#
#
# allow ICMP proto
$ipt -A OUTPUT -j ACCEPT -o $dev -p icmp
n=0
for i in `echo "$output_tcp_ports" | tr ',' ' '`; do
[ "$n" == "0" ] && p=$i || p="$p,$i"
let n++
if [ "$n" == "8" ]; then
n=0
$ipt -A OUTPUT -j ACCEPT -o $dev -p tcp -m multiport --dports $p
fi
done
[ ! "$n" == "0" ] && $ipt -A OUTPUT -j ACCEPT -o $dev -p tcp -m multiport --dports $p
# proceed UDP ports
n=0
for i in `echo "$output_udp_ports" | tr ',' ' '`; do
[ "$n" == "0" ] && p=$i || p="$p,$i"
let n++
if [ "$n" == "8" ]; then
n=0
$ipt -A OUTPUT -j ACCEPT -o $dev -p udp -m multiport --dports $p
fi
done
[ ! "$n" == "0" ] && $ipt -A OUTPUT -j ACCEPT -o $dev -p udp -m multiport --dports $p
# Standart related/established connections
$ipt -A OUTPUT -j ACCEPT -o $dev -p tcp --dport 1024:65535 -m state --state RELATED,ESTABLISHED
$ipt -A OUTPUT -j ACCEPT -o $dev -p udp --dport 1024:65535 -m state --state RELATED,ESTABLISHED
# FTP
#
#
if [ "$allow_ftp" == "yes" ]; then
# if [ `cat /proc/modules | grep -c ip_conntrack_ftp` == "0" ]; then
# # try to load module ip_conntrack_ftp
# $mpr ip_conntrack_ftp >/dev/null 2>&1
# fi
$ipt -A INPUT -j ACCEPT -i $dev -p tcp --sport 1024:65535 --dport 21
$ipt -A OUTPUT -j ACCEPT -o $dev -p tcp --sport 1024:65535 --dport 21
fi
# Traceroute
$ipt -A OUTPUT -j ACCEPT -o $dev -p udp --dport 33434:33690
# default input/output policy
$ipt -A INPUT -j $input_policy -i $dev
$ipt -A OUTPUT -j $output_policy -o $dev
# devel
if [ ! "$devel" == "0" ]; then
sleep 60
$ipt -F
fi
etc/firewall/fw 0000666 00000013600 15047315375 0007501 0 ustar 00 #!/bin/bash
ext="eth0"
int="eth1"
iptables="/sbin/iptables"
modprobe="/sbin/modprobe"
# input tcp port 80 (http) and 443 (https)
# output tcp ports 25 (smtp), 465 (smtps)
# output udp port 53 (dns)
# has special processing, so don't enable it here
# internal mysql connections has special processing too
# so make sure that you correct defined internal nic ($int)
#
# WARNING
#
# please don't use this file to add or remove input/output rules
# by client request. There is "fw-input" and "fw-output" hooks
# for this purpose
#
# Only general rules here!
#
input_tcp_ports=()
input_tcp_ports+=( 21 22 ) # ftp,ssh
input_tcp_ports+=( 25 465 2525 ) # smtp,smtps,alt-smtp
input_tcp_ports+=( 110 143 993 995 ) # pop3,imap,imaps,pop3s
input_tcp_ports+=( 3306 ) # mysql
input_tcp_ports+=( 10050 ) # zabbix
input_udp_ports=()
input_udp_ports+=( 161 ) # snmpd
output_tcp_ports=()
output_tcp_ports+=( 21 22 43 53 80 443 ) # ftp,ssh,whois,dns,http,https,alt-http
output_tcp_ports+=( 110 143 993 995 ) # pop3,imap,imaps,pop3s
output_tcp_ports+=( 389 636 ) # ldap,ldaps
output_tcp_ports+=( 5432 ) # postgres
output_tcp_ports+=( 81 8080 ) # alt-http
output_tcp_ports+=( 9418 ) # git
output_tcp_ports+=( 10050 10051 ) # zabbix
output_udp_ports=()
#################################################
# modules
if [ ! -d "/sys/module/nf_conntrack_ftp" ]; then
$modprobe nf_conntrack_ftp
fi
#################################################
# filter: INPUT
#
# flush chain
$iptables -P INPUT ACCEPT
$iptables -F INPUT
# allow all loopback connections and icmp packets
$iptables -A INPUT -j ACCEPT -i lo
$iptables -A INPUT -j ACCEPT -i $ext -p icmp
$iptables -A INPUT -i $ext -p tcp -m set --match-set ssh src -m tcp --dport 22 -j DROP
# tcp ports 80 and 443 goes from raw table without connection tracking
# accept all traffic to this ports here because 'state' module
# doesn't work without connection tracking
$iptables -A INPUT -j ACCEPT -i $ext -p tcp -m multiport --dports 80,443
# input hook
[ -x /etc/firewall/fw-input ] && /etc/firewall/fw-input
# allow input_tcp_ports
while [ "${#input_tcp_ports[@]}" -gt 0 ]; do
ports=$( printf ',%d' "${input_tcp_ports[@]:0:8}" )
input_tcp_ports=( "${input_tcp_ports[@]:8}" )
$iptables -A INPUT -j ACCEPT -i $ext -p tcp -m multiport --dports "${ports:1}" -m state --state NEW
done
# allow input_udp_ports
while [ "${#input_udp_ports[@]}" -gt 0 ]; do
ports=$( printf ',%d' "${input_udp_ports[@]:0:8}" )
input_udp_ports=( "${input_udp_ports[@]:8}" )
$iptables -A INPUT -j ACCEPT -i $ext -p udp -m multiport --dports "${ports:1}" -m state --state NEW
done
# allow related and established connections
$iptables -A INPUT -j ACCEPT -i $ext -p tcp -m state --state RELATED,ESTABLISHED
$iptables -A INPUT -j ACCEPT -i $ext -p udp -m state --state RELATED,ESTABLISHED
# drop other connections
$iptables -A INPUT -j DROP -i $ext
#################################################
# filter: OUTPUT
#
# flush chain
$iptables -P OUTPUT ACCEPT
$iptables -F OUTPUT
# reject nobody's local connections to smtp server
$iptables -A OUTPUT -j REJECT -o lo -p tcp -m multiport --dports 25,465,2525 \
-m owner --uid-owner nobody --reject-with icmp-port-unreachable
# allow all loopback connections and icmp packets
$iptables -A OUTPUT -j ACCEPT -o lo
$iptables -A OUTPUT -j ACCEPT -o $ext -p icmp
# tcp ports 80 and 443 goes to raw table without connection tracking
# accept all traffic from this ports here because 'state' module
# doesn't work without connection tracking
$iptables -A OUTPUT -j ACCEPT -o $ext -p tcp -m multiport --sports 80,443
# allow dns queries to only configured servers
while read ip; do
$iptables -A OUTPUT -j ACCEPT -o $ext -d $ip -p udp --dport 53 -m state --state NEW
$iptables -A OUTPUT -j ACCEPT -o $ext -d $ip -p tcp --dport 53 -m state --state NEW
done < <( awk '$1 == "nameserver" { print $2 }' /etc/resolv.conf )
# output hook
[ -x /etc/firewall/fw-output ] && /etc/firewall/fw-output
# allow all for root
$iptables -A OUTPUT -j ACCEPT -o $ext -m owner --gid-owner root -m state --state NEW
# allow 25 and 465 port only for "mail" group
$iptables -A OUTPUT -j ACCEPT -o $ext -p tcp -m multiport --dports 25,465,2525 \
-m owner --gid-owner mail -m state --state NEW
# allow output_tcp_ports
while [ "${#output_tcp_ports[@]}" -gt 0 ]; do
ports=$( printf ',%d' "${output_tcp_ports[@]:0:8}" )
output_tcp_ports=( "${output_tcp_ports[@]:8}" )
$iptables -A OUTPUT -j ACCEPT -o $ext -p tcp -m multiport --dports "${ports:1}" -m state --state NEW
done
# allow output_udp_ports
while [ "${#output_udp_ports[@]}" -gt 0 ]; do
ports=$( printf ',%d' "${output_udp_ports[@]:0:8}" )
output_udp_ports=( "${output_udp_ports[@]:8}" )
$iptables -A OUTPUT -j ACCEPT -o $ext -p udp -m multiport --dports "${ports:1}" -m state --state NEW
done
# allow traceroute ports
$iptables -A OUTPUT -j ACCEPT -o $ext -p udp --dport 33434:33690 -m state --state NEW
# allow related and entablished connections
$iptables -A OUTPUT -j ACCEPT -o $ext -p tcp -m state --state RELATED,ESTABLISHED
$iptables -A OUTPUT -j ACCEPT -o $ext -p udp -m state --state RELATED,ESTABLISHED
# drop other connections
$iptables -A OUTPUT -j DROP -o $ext
#################################################
# raw: OUTPUT
#
# flush chain
$iptables -t raw -P OUTPUT ACCEPT
$iptables -t raw -F OUTPUT
# don't track loopback connections
$iptables -t raw -A OUTPUT -o lo -j NOTRACK
# don't track http connections
$iptables -t raw -A OUTPUT -o $ext -p tcp -m multiport --sports 80,443 -j NOTRACK
# don't track mysql connections
$iptables -t raw -A OUTPUT -o $int -p tcp --dport 3306 -j NOTRACK
#################################################
# raw: PREROUTING
#
# flush chain
$iptables -t raw -P PREROUTING ACCEPT
$iptables -t raw -F PREROUTING
# don't track http connections
$iptables -t raw -A PREROUTING -i $ext -p tcp -m multiport --dports 80,443 -j NOTRACK
# don't track mysql connections
$iptables -t raw -A PREROUTING -i $int -p tcp --sport 3306 -j NOTRACK