openship 0.4.4 → 0.4.6

package/dist/server/engine/samples/firewall/iptables/iptables.init.debian

@@ -0,0 +1,363 @@
+#!/usr/bin/env bash
+
+#---------------------------------------------------------------------
+# This file is part of iRedMail, which is an open source mail server
+# solution for Red Hat(R) Enterprise Linux, CentOS, Debian and Ubuntu.
+#
+# iRedMail is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# iRedMail is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with iRedMail.  If not, see <http://www.gnu.org/licenses/>.
+#---------------------------------------------------------------------
+
+#
+### BEGIN INIT INFO
+# Provides:          iptables
+# Required-Start:    $network $syslog
+# Required-Stop:     $network $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Control iptables firewall.
+### END INIT INFO
+#
+# This init.d script is used to control iptables, based on
+# /etc/init.d/iptables on Red Hat Enterprise Linux 5.3, modified
+# by Zhang Huangbin (zhb _at_ iredmail.org), iRedMail project
+# (http://www.iredmail.org/).
+#
+
+#
+# config: /etc/default/iptables
+# config: /etc/default/iptables-config
+
+# Source function library.
+. /lib/lsb/init-functions
+
+IPTABLES='iptables'
+IPTABLES_DATA="/etc/default/$IPTABLES"
+IPTABLES_CONFIG="/etc/default/${IPTABLES}-config"
+IPV="${IPTABLES%tables}" # ip for ipv4 | ip6 for ipv6
+PROC_IPTABLES_NAMES="/proc/net/${IPV}_tables_names"
+VAR_SUBSYS_IPTABLES="/var/lock/subsys/$IPTABLES"
+[ -d $(dirname ${VAR_SUBSYS_IPTABLES}) ] || mkdir -p $(dirname ${VAR_SUBSYS_IPTABLES})
+
+if [ ! -x /sbin/$IPTABLES ]; then
+    log_daemon_msg "/sbin/$IPTABLES does not exist." "iptables"
+    exit 0
+fi
+
+if lsmod 2>/dev/null | grep -q ipchains ; then
+    log_daemon_msg  "ipchains and $IPTABLES can not be used together." "iptables"
+    exit 0
+fi
+
+# Old or new modutils
+/sbin/modprobe --version 2>&1 | grep -q module-init-tools \
+    && NEW_MODUTILS=1 \
+    || NEW_MODUTILS=0
+
+# Default firewall configuration:
+IPTABLES_MODULES=""
+IPTABLES_MODULES_UNLOAD="no"
+IPTABLES_SAVE_ON_STOP="no"
+IPTABLES_SAVE_ON_RESTART="no"
+IPTABLES_SAVE_COUNTER="no"
+IPTABLES_STATUS_NUMERIC="yes"
+
+# Load firewall configuration.
+[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
+
+rmmod_r() {
+    # Unload module with all referring modules.
+    # At first all referring modules will be unloaded, then the module itself.
+    local mod=$1
+    local ret=0
+    local ref=
+
+    # Get referring modules.
+    # New modutils have another output format.
+    [ $NEW_MODUTILS = 1 ] \
+	&& ref=`lsmod | awk "/^${mod}/ { print \\\$4; }" | tr ',' ' '` \
+	|| ref=`lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1`
+
+    # recursive call for all referring modules
+    for i in $ref; do
+	rmmod_r $i
+	let ret+=$?;
+    done
+
+    # Unload module.
+    # The extra test is for 2.6: The module might have autocleaned,
+    # after all referring modules are unloaded.
+    if grep -q "^${mod}" /proc/modules ; then
+	modprobe -r $mod > /dev/null 2>&1
+	let ret+=$?;
+    fi
+
+    return $ret
+}
+
+flush_n_delete() {
+    # Flush firewall rules and delete chains.
+    [ -e "$PROC_IPTABLES_NAMES" ] || return 1
+
+    # Check if firewall is configured (has tables)
+    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
+    [ -z "$tables" ] && return 1
+
+    log_daemon_msg "Flushing firewall rules" "iptables"
+    ret=0
+    # For all tables
+    for i in $tables; do
+        # Flush firewall rules.
+	$IPTABLES -t $i -F;
+	let ret+=$?;
+
+        # Delete firewall chains.
+	$IPTABLES -t $i -X;
+	let ret+=$?;
+
+	# Set counter to zero.
+	$IPTABLES -t $i -Z;
+	let ret+=$?;
+    done
+
+    [ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1
+    return $ret
+}
+
+set_policy() {
+    # Set policy for configured tables.
+    policy=$1
+
+    # Check if iptable module is loaded
+    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1
+
+    # Check if firewall is configured (has tables)
+    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
+    [ -z "$tables" ] && return 1
+
+    log_daemon_msg "Setting chains to policy $policy"
+    ret=0
+    for i in $tables; do
+        echo -n " $i"
+        case "$i" in
+           security)
+               $IPTABLES -t filter -P INPUT $policy \
+                   && $IPTABLES -t filter -P OUTPUT $policy \
+                   && $IPTABLES -t filter -P FORWARD $policy \
+                   || let ret+=1
+               ;;
+            raw)
+                $IPTABLES -t raw -P PREROUTING $policy \
+                && $IPTABLES -t raw -P OUTPUT $policy \
+                || let ret+=1
+            ;;
+            filter)
+                $IPTABLES -t filter -P INPUT $policy \
+                && $IPTABLES -t filter -P OUTPUT $policy \
+                && $IPTABLES -t filter -P FORWARD $policy \
+                || let ret+=1
+            ;;
+            nat)
+            $IPTABLES -t nat -P PREROUTING $policy \
+                && $IPTABLES -t nat -P POSTROUTING $policy \
+                && $IPTABLES -t nat -P OUTPUT $policy \
+                || let ret+=1
+            ;;
+            mangle)
+                $IPTABLES -t mangle -P PREROUTING $policy \
+                && $IPTABLES -t mangle -P POSTROUTING $policy \
+                && $IPTABLES -t mangle -P INPUT $policy \
+                && $IPTABLES -t mangle -P OUTPUT $policy \
+                && $IPTABLES -t mangle -P FORWARD $policy \
+                || let ret+=1
+            ;;
+            *)
+                let ret+=1
+            ;;
+        esac
+    done
+
+    [ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1
+    return $ret
+}
+
+start() {
+    # Do not start if there is no config file.
+    [ -f "$IPTABLES_DATA" ] || return 1
+
+    log_daemon_msg "Applying $IPTABLES firewall rules"
+
+    OPT=
+    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
+
+    $IPTABLES-restore $OPT $IPTABLES_DATA
+    if [ $? -eq 0 ]; then
+        log_end_msg 0
+    else
+        log_end_msg 1; return 1
+    fi
+
+    # Load additional modules (helpers)
+    if [ -n "$IPTABLES_MODULES" ]; then
+	echo -n "Loading additional $IPTABLES modules"
+	ret=0
+	for mod in $IPTABLES_MODULES; do
+	    echo -n "$mod "
+	    modprobe $mod > /dev/null 2>&1
+	    let ret+=$?;
+	done
+	[ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1
+    fi
+
+    touch $VAR_SUBSYS_IPTABLES
+    return $ret
+}
+
+stop() {
+    # Do not stop if iptables module is not loaded.
+    [ -e "$PROC_IPTABLES_NAMES" ] || return 1
+
+    flush_n_delete
+    set_policy ACCEPT
+
+    if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then
+	echo -n "Unloading $IPTABLES modules"
+	ret=0
+	rmmod_r ${IPV}_tables
+	let ret+=$?;
+	rmmod_r ${IPV}_conntrack
+	let ret+=$?;
+	[ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1
+    fi
+
+    rm -f $VAR_SUBSYS_IPTABLES
+    return $ret
+}
+
+save() {
+    # Check if iptable module is loaded
+    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1
+
+    # Check if firewall is configured (has tables)
+    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
+    [ -z "$tables" ] && return 1
+
+    echo -n "Saving firewall rules to $IPTABLES_DATA"
+
+    OPT=
+    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
+
+    ret=0
+    TMP_FILE=`/bin/mktemp -q /tmp/$IPTABLES.XXXXXX` \
+	&& chmod 600 "$TMP_FILE" \
+	&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
+	&& size=`stat -c '%s' $TMP_FILE` && [ $size -gt 0 ] \
+	|| ret=1
+    if [ $ret -eq 0 ]; then
+	if [ -e $IPTABLES_DATA ]; then
+	    cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
+		&& chmod 600 $IPTABLES_DATA.save \
+		|| ret=1
+	fi
+	if [ $ret -eq 0 ]; then
+	    cp -f $TMP_FILE $IPTABLES_DATA \
+		&& chmod 600 $IPTABLES_DATA \
+	        || ret=1
+	fi
+    fi
+    [ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1
+    echo
+    rm -f $TMP_FILE
+    return $ret
+}
+
+status() {
+    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
+
+    # Do not print status if lockfile is missing and iptables modules are not
+    # loaded.
+    # Check if iptable module is loaded
+    if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$tables" ]; then
+	echo "Firewall is stopped."
+	return 1
+    fi
+
+    # Check if firewall is configured (has tables)
+    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+	echo "Firewall is not configured. "
+	return 1
+    fi
+    if [ -z "$tables" ]; then
+	echo "Firewall is not configured. "
+	return 1
+    fi
+
+    NUM=
+    [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
+    VERBOSE=
+    [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
+    COUNT=
+    [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
+
+    for table in $tables; do
+	echo "Table: $table"
+	$IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
+    done
+
+    return 0
+}
+
+restart() {
+    [ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
+    stop
+    start
+}
+
+case "$1" in
+    start)
+	stop
+	start
+	RETVAL=$?
+	;;
+    stop)
+	[ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
+	stop
+	RETVAL=$?
+	;;
+    restart)
+	restart
+	RETVAL=$?
+	;;
+    condrestart)
+	[ -e "$VAR_SUBSYS_IPTABLES" ] && restart
+	;;
+    status)
+	status
+	RETVAL=$?
+	;;
+    panic)
+	flush_n_delete
+	set_policy DROP
+	RETVAL=$?
+        ;;
+    save)
+	save
+	RETVAL=$?
+	;;
+    *)
+	echo "Usage: $0 {start|stop|restart|condrestart|status|panic|save}"
+	exit 1
+	;;
+esac
+
+exit $RETVAL

package/dist/server/engine/samples/firewall/iptables/iptables.rules

@@ -0,0 +1,54 @@
+#---------------------------------------------------------------------
+# This file is part of iRedMail, which is an open source mail server
+# solution for Red Hat(R) Enterprise Linux, CentOS, Debian and Ubuntu.
+#
+# iRedMail is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# iRedMail is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with iRedMail.  If not, see <http://www.gnu.org/licenses/>.
+#---------------------------------------------------------------------
+
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+
+# Keep state.
+-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# Loop device.
+-A INPUT -i lo -j ACCEPT
+
+# Allow PING from remote hosts.
+-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
+
+# ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+
+# http, https
+-A INPUT -p tcp --dport 80 -j ACCEPT
+-A INPUT -p tcp --dport 443 -j ACCEPT
+
+# smtp, submission
+-A INPUT -p tcp --dport 25 -j ACCEPT
+-A INPUT -p tcp --dport 587 -j ACCEPT
+-A INPUT -p tcp --dport 465 -j ACCEPT
+
+# pop3, pop3s
+-A INPUT -p tcp --dport 110 -j ACCEPT
+-A INPUT -p tcp --dport 995 -j ACCEPT
+#-A INPUT -p tcp --dport 10110 -j ACCEPT
+
+# imap, imaps
+-A INPUT -p tcp --dport 143 -j ACCEPT
+-A INPUT -p tcp --dport 993 -j ACCEPT
+
+COMMIT

package/dist/server/engine/samples/firewall/nftables.conf

@@ -0,0 +1,58 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+# `inet` applies to both IPv4 and IPv6.
+table inet filter {
+    chain input {
+        type filter hook input priority 0;
+
+        # accept any localhost traffic
+        iif lo accept
+
+        # no ping floods:
+        ip protocol icmp icmp type echo-request limit rate over 10/second burst 4 packets drop
+        ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate over 10/second burst 4 packets drop
+
+        # accept traffic originated from us
+        ct state established,related accept
+
+        # accept ICMP & IGMP
+        ip6 nexthdr icmpv6 icmpv6 type { echo-request, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, mld-listener-query, mld-listener-report, mld-listener-reduction, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report } accept
+        ip protocol icmp icmp type { echo-request, destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem } accept
+        ip protocol igmp accept
+
+        # ssh
+        tcp dport 22 accept
+
+        # http, https
+        tcp dport 80 accept
+        tcp dport 443 accept
+
+        # smtp, submission, smtps
+        tcp dport 25 accept
+        tcp dport 587 accept
+        tcp dport 465 accept
+
+        # pop3, pop3s
+        tcp dport 110 accept
+        tcp dport 995 accept
+
+        # imap, imaps
+        tcp dport 143 accept
+        tcp dport 993 accept
+
+        # count and drop any other traffic
+        counter drop
+    }
+
+    chain output {
+        type filter hook output priority 0;
+        policy accept;
+    }
+
+    chain forward {
+        type filter hook forward priority 0;
+        policy drop;
+    }
+}

package/dist/server/engine/samples/freebsd/newsyslog.conf.d/dovecot.conf

@@ -0,0 +1,3 @@
+PH_DOVECOT_LOG_FILE    PH_SYS_USER_SYSLOG:PH_SYS_GROUP_SYSLOG   600  7     *    24    Z    PH_DOVECOT_MASTER_PID
+PH_DOVECOT_SIEVE_LOG_FILE    PH_SYS_USER_SYSLOG:PH_SYS_GROUP_SYSLOG   600  7     *    24    Z    PH_DOVECOT_MASTER_PID
+PH_DOVECOT_LMTP_LOG_FILE    PH_SYS_USER_SYSLOG:PH_SYS_GROUP_SYSLOG   600  7     *    24    Z    PH_DOVECOT_MASTER_PID

package/dist/server/engine/samples/freebsd/newsyslog.conf.d/iredapd.conf

@@ -0,0 +1 @@
+PH_IREDAPD_LOG_FILE     PH_SYS_USER_SYSLOG:PH_SYS_GROUP_SYSLOG   600  7     *    24    Z    PH_IREDAPD_PID_FILE

package/dist/server/engine/samples/freebsd/newsyslog.conf.d/mlmmjadmin.conf

@@ -0,0 +1 @@
+PH_MLMMJADMIN_LOG_FILE     PH_SYS_USER_SYSLOG:PH_SYS_GROUP_SYSLOG   600  7     *    24    Z    PH_MLMMJADMIN_PID_FILE

package/dist/server/engine/samples/freebsd/newsyslog.conf.d/php-fpm.conf

@@ -0,0 +1,2 @@
+PH_PHP_FPM_LOG_MAIN    PH_SYS_USER_SYSLOG:PH_SYS_GROUP_SYSLOG   600  7     *    24    Z    PH_PHP_FPM_PID_FILE
+PH_PHP_FPM_LOG_SLOW    PH_SYS_USER_SYSLOG:PH_SYS_GROUP_SYSLOG   600  7     *    24    Z    PH_PHP_FPM_PID_FILE

package/dist/server/engine/samples/freebsd/newsyslog.conf.d/slapd.conf

@@ -0,0 +1 @@
+PH_OPENLDAP_LOG_FILE    PH_SYS_USER_SYSLOG:PH_SYS_GROUP_SYSLOG   640  7     *    24    Z

package/dist/server/engine/samples/freebsd/syslog.d/dovecot.conf

@@ -0,0 +1,2 @@
+!dovecot
+PH_IREDMAIL_SYSLOG_FACILITY.*                       PH_DOVECOT_LOG_FILE

package/dist/server/engine/samples/freebsd/syslog.d/fail2ban.conf

@@ -0,0 +1,2 @@
+!fail2ban
+PH_FAIL2BAN_SYSLOG_FACILITY.*                       PH_FAIL2BAN_LOG_FILE

package/dist/server/engine/samples/freebsd/syslog.d/iredapd.conf

@@ -0,0 +1,2 @@
+!iredapd
+PH_IREDMAIL_SYSLOG_FACILITY.*                       PH_IREDAPD_LOG_FILE

package/dist/server/engine/samples/freebsd/syslog.d/mlmmjadmin.conf

@@ -0,0 +1,2 @@
+!mlmmjadmin
+PH_IREDMAIL_SYSLOG_FACILITY.*                       PH_MLMMJADMIN_LOG_FILE

package/dist/server/engine/samples/freebsd/syslog.d/php-fpm.conf

@@ -0,0 +1,2 @@
+!php-fpm
+local5.*                        PH_PHP_FPM_LOG_MAIN

package/dist/server/engine/samples/freebsd/syslog.d/slapd.conf

@@ -0,0 +1,2 @@
+!slapd
+*.*                     PH_OPENLDAP_LOG_FILE