sshield

#!/bin/bash

#####################################################
###						  ###
### 	         Server Shield v1.1.5 	          ###
###						  ###
#####################################################

# Permission is hereby granted, free of charge, to any person obtaining a
# copy of this software and associated documentation files (the "Software"),
# to deal in the Software without restriction, including without limitation
# the rights to use, copy, modify, merge, publish, distribute, sublicense,
# and/or sell copies of the Software, and to permit persons to whom the
# Software is furnished to do so, subject to the following conditions:

# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
  
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
# DEALINGS IN THE SOFTWARE.

# Copyright (c) 2012. All rights reserved.

### Slowloris Protection
### Firewall Hardening
### ICMP/Ping Flood Resistance
### FTP/SSH Bruteforce Protection
### Automatic Security Updates
### Disables Bash History
### DNS Amplification Protection

# 
# Automatic Updates
# 1: ipconfig, net-tools, sed, gawk, git, yum-security, mod_antiloris
# 2: sshield, ipconfig, net-tools, sed, gawk, git, yum-security, mod_antiloris
update=1

# Public Interfaces
iface=($(ifconfig  | grep 'eth' | awk '{ print $1 }' | cut -d: -f1 | tr '\n' ' '))

# Public IP Addresses
ip=($(ifconfig  | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f2 | awk '{ print $1}'))

# Open Ports
pub_serv=($(ss -ln | tail --lines=+2 | awk '{print $3}' | egrep -v "^(127\.|::1|fe80)" | sed -e 's/:/ /g' | awk '{print $NF}' | tr '\n' , | sort -u | sed '$s/.$//'))

# Don't edit below here unless you know what you're doing

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
DAEMON=/sbin/iptables
NAME=sshield

test -x $DAEMON || exit 0

set -e

iptables=/sbin/iptables

function sshield_start {

	if grep "unset HISTFILE" /etc/profile >/dev/null 2>&1
	then
	    find / -iname '*.bash_history' -type f -exec rm -f {} \;
	else
	    echo "unset HISTFILE" >> /etc/profile
	    find / -iname '*.bash_history' -type f -exec rm -f {} \;
	fi

	# Protect against taking part in an ICMP "Smurf"
	echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

	# Protect against TCP Time-Wait attacks          
	echo 1 > /proc/sys/net/ipv4/tcp_rfc1337

	# Don't bother logging bogus error responses					 
	echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

	# Don't bother logging spoofed IP addresses
	echo 0 > /proc/sys/net/ipv4/conf/all/log_martians

	# Protect against Source Routed Packets                
	echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route         

	# Just DROP, don't send error messages back
	$iptables -P INPUT   DROP
	$iptables -P FORWARD DROP
	$iptables -P OUTPUT  DROP
	
	# Block: Spoofed
	for i in "${!ip[@]}"; do
		$iptables -A INPUT  -i ${iface[$i]} -s ${ip[$i]} -m recent --set -j DROP
	done

	# Accept: Loopback
	$iptables -A INPUT  -i lo -j ACCEPT
	$iptables -A OUTPUT -o lo -j ACCEPT
	
	# Limit: DNS Amplification Attack
	for i in "${!iface[@]}"; do
		$iptables -A INPUT -p udp -m udp -m recent -i ${iface[$i]} --dport 53 -j ACCEPT --set --name DNS --rsource
		$iptables -A INPUT -p udp -m udp -m recent -i ${iface[$i]} --dport 53 --update --seconds 20 --hitcount 20 --name DNS --rsource -j DROP
	done

	# Limit: ICMP Flood
	$iptables -A INPUT  -p icmp -m limit --limit 30/s --limit-burst 200 -j ACCEPT
	$iptables -A INPUT  -p icmp -j DROP

	# Accept: Established Connections
	for i in "${!iface[@]}"; do
		$iptables -A OUTPUT -o ${iface[$i]} -j ACCEPT
		$iptables -A INPUT  -i ${iface[$i]} -m state --state ESTABLISHED,RELATED -j ACCEPT
		$iptables -A INPUT -i ${iface[$i]} -p tcp -d ${ip[$i]} -m multiport --dports $pub_serv -j ACCEPT
		$iptables -A INPUT -i ${iface[$i]} -p udp -d ${ip[$i]} -m multiport --dports $pub_serv -j ACCEPT
	done

	# Limit: SSH Bruteforcing
	$iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 5 --name SSH -j DROP
	$iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT
	
	# Limit: FTP Bruteforcing
	$iptables -A INPUT -p tcp --dport 21 -m recent --update --seconds 60 --hitcount 5 --name FTP -j DROP
	$iptables -A INPUT -p tcp --dport 21 -m state --state NEW -m recent --set --name FTP -j ACCEPT

	# Finish: Log and Reject
	$iptables -A INPUT   -j LOG --log-prefix "IN "
	$iptables -A INPUT   -j REJECT --reject-with icmp-port-unreachable
	$iptables -A OUTPUT  -j LOG --log-prefix "OU "
	$iptables -A OUTPUT  -j REJECT --reject-with icmp-port-unreachable
	$iptables -A FORWARD -j LOG --log-prefix "FW "
	$iptables -A FORWARD -j REJECT --reject-with icmp-port-unreachable
}

function sshield_fallback_start {
	# Flush
	$iptables -F
	$iptables -F -t mangle
	$iptables -X -t mangle
	$iptables -F -t nat
	$iptables -X -t nat
	$iptables -X

	# Defaults
	$iptables -P INPUT   DROP
	$iptables -P FORWARD DROP
	$iptables -P OUTPUT  DROP

	# Accept: Loopback
	$iptables -A INPUT  -i lo -j ACCEPT
	$iptables -A OUTPUT -o lo -j ACCEPT

	# Accept: ICMP
	for i in "${!iface[@]}"; do
		$iptables -A INPUT  -i ${iface[$i]} -d ${ip[$i]} -p icmp -j ACCEPT
	done

	# Accept: Established Connections
	for i in "${!iface[@]}"; do
		$iptables -A OUTPUT -o ${iface[$i]} -j ACCEPT
		$iptables -A INPUT  -i ${iface[$i]} -m state --state ESTABLISHED,RELATED -j ACCEPT
		$iptables -A INPUT -i ${iface[$i]} -p tcp -d ${ip[$i]} -m multiport --dports $pub_serv -j ACCEPT
		$iptables -A INPUT -i ${iface[$i]} -p udp -d ${ip[$i]} -m multiport --dports $pub_serv -j ACCEPT
	done

	# Finish: Log
	$iptables -A INPUT   -j LOG --log-prefix "IN "
	$iptables -A OUTPUT  -j LOG --log-prefix "OU "
	$iptables -A FORWARD -j LOG --log-prefix "FW "
}

function sshield_stop {
	# Flush
	$iptables -F
	$iptables -F -t mangle
	$iptables -X -t mangle
	$iptables -F -t nat
	$iptables -X -t nat
	$iptables -X

	# Default
	$iptables -P INPUT   ACCEPT
	$iptables -P FORWARD ACCEPT
	$iptables -P OUTPUT  ACCEPT
}

case "$1" in
  start)
	if [ "$update" -gt "0" ]; then
	   	echo -n "Updating $NAME: "
	   	yum install -y net-tools iptables sed gawk git yum-security >/dev/null 2>&1
	  	yum --security update -y >/dev/null 2>&1
		rm -rf /tmp/server-shield; cd /tmp
		git clone https://github.com/bluedragonz/server-shield >/dev/null 2>&1
		if test -e /usr/sbin/httpd; then
		    if httpd -M 2>&1 | grep antiloris > /dev/null
			then
				echo "" >/dev/null
			else
				cd /tmp/server-shield
				tar -xvjf /tmp/server-shield/mod_antiloris-0.4.tar.bz2 >/dev/null 2>&1
				if test -e /usr/sbin/apxs; then
					apxs -a -i -c /tmp/server-shield/mod_antiloris-0.4/mod_antiloris.c >/dev/null 2>&1
					service httpd restart >/dev/null 2>&1
				fi
			fi
		fi
	echo "OK"
	fi
	if [ "$update" -gt "1" ]
	then
	   	mv /tmp/server-shield/sshield /etc/init.d/sshield;chmod +x /etc/init.d/sshield
	fi
	sshield_stop
	echo -n "Starting $NAME: "
	sshield_start || sshield_fallback_start
	echo "OK"
	;;
  stop)
	echo -n "Stopping $NAME: "
	sshield_stop
	echo "OK"
	;;
  *)
	N=/etc/init.d/$NAME
	echo "Usage: $N {start|stop}" >&2
	exit 1
	;;
esac

exit 0