first commit
This commit is contained in:
354
templates/firewalld.sh
Normal file
354
templates/firewalld.sh
Normal file
@@ -0,0 +1,354 @@
|
||||
#!/bin/bash
|
||||
|
||||
# ==========================================
|
||||
# INTERACTIVE FIREWALL CONFIGURATOR FOR SAP B1
|
||||
# (With Save/Load State)
|
||||
# ==========================================
|
||||
|
||||
# Configuration File
|
||||
CONFIG_FILE="./firewall_state.conf"
|
||||
|
||||
# Colors for formatting
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
CYAN='\033[0;36m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# ==========================================
|
||||
# SERVICE DEFINITIONS
|
||||
# ==========================================
|
||||
declare -a SVC_NAMES
|
||||
declare -a SVC_PORTS
|
||||
|
||||
SVC_NAMES[0]="SAP Web Client"
|
||||
SVC_PORTS[0]="443"
|
||||
|
||||
SVC_NAMES[1]="SAP HANA Database (System & Company DB)"
|
||||
SVC_PORTS[1]="30013 30015"
|
||||
|
||||
SVC_NAMES[2]="SAP Business One SLD"
|
||||
SVC_PORTS[2]="40000"
|
||||
|
||||
SVC_NAMES[3]="SAP Business One Auth"
|
||||
SVC_PORTS[3]="40020"
|
||||
|
||||
SVC_NAMES[4]="SAP Business One Service Layer, Cockpit"
|
||||
SVC_PORTS[4]="50000 4300"
|
||||
|
||||
SVC_NAMES[5]="SAP Host Agent"
|
||||
SVC_PORTS[5]="1128 1129"
|
||||
|
||||
SVC_NAMES[6]="SSH Remote Access"
|
||||
SVC_PORTS[6]="22"
|
||||
|
||||
SVC_NAMES[7]="SMB / B1_SHR (File Sharing)"
|
||||
SVC_PORTS[7]="139 445"
|
||||
|
||||
# Arrays to store user decisions
|
||||
declare -a CONFIG_DECISION # "ALL", "IP", "SKIP"
|
||||
declare -a CONFIG_IPS # Stores the IP string if "IP" is chosen
|
||||
DO_FLUSH=false
|
||||
|
||||
# ==========================================
|
||||
# HELPER FUNCTIONS
|
||||
# ==========================================
|
||||
|
||||
print_header() {
|
||||
clear
|
||||
echo -e "${CYAN}==========================================${NC}"
|
||||
echo -e "${CYAN} SAP B1 Interactive Firewall Setup ${NC}"
|
||||
echo -e "${CYAN}==========================================${NC}"
|
||||
echo ""
|
||||
}
|
||||
|
||||
save_config() {
|
||||
echo "# SAP B1 Firewall State - Do not edit manually unless you know what you are doing" > "$CONFIG_FILE"
|
||||
for i in "${!SVC_NAMES[@]}"; do
|
||||
# Use simple variable assignment format
|
||||
echo "SAVED_DECISION[$i]=\"${CONFIG_DECISION[$i]}\"" >> "$CONFIG_FILE"
|
||||
echo "SAVED_IPS[$i]=\"${CONFIG_IPS[$i]}\"" >> "$CONFIG_FILE"
|
||||
done
|
||||
echo "Config state saved to $CONFIG_FILE"
|
||||
}
|
||||
|
||||
load_config() {
|
||||
if [ -f "$CONFIG_FILE" ]; then
|
||||
echo -e "${GREEN}Found saved configuration file.${NC}"
|
||||
source "$CONFIG_FILE"
|
||||
# Map SAVED variables to current CONFIG variables
|
||||
for i in "${!SVC_NAMES[@]}"; do
|
||||
CONFIG_DECISION[$i]="${SAVED_DECISION[$i]}"
|
||||
CONFIG_IPS[$i]="${SAVED_IPS[$i]}"
|
||||
done
|
||||
return 0
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# ==========================================
|
||||
# INITIAL SETUP
|
||||
# ==========================================
|
||||
print_header
|
||||
|
||||
# 1. Flush Question (First)
|
||||
echo -e "${YELLOW}Existing Configuration:${NC}"
|
||||
echo "Do you want to FLUSH (remove) all currently active firewall rules before starting?"
|
||||
echo "This ensures a clean slate. (Only affects Runtime, not Permanent config)"
|
||||
read -p "Flush all current rules? [Y/n]: " flush_choice
|
||||
flush_choice=${flush_choice:-Y} # Default to Yes
|
||||
|
||||
if [[ "$flush_choice" =~ ^[Yy]$ ]]; then
|
||||
DO_FLUSH=true
|
||||
echo -e "-> ${RED}Will flush all rules (Clean Slate).${NC}"
|
||||
else
|
||||
echo -e "-> Keeping existing rules (Appending new ones)."
|
||||
fi
|
||||
echo ""
|
||||
sleep 1
|
||||
|
||||
# 2. Load Configuration (Second)
|
||||
HAS_CONFIG=false
|
||||
if load_config; then
|
||||
HAS_CONFIG=true
|
||||
echo "Previous settings loaded. You can press ENTER to accept defaults during selection."
|
||||
else
|
||||
echo "No previous configuration found. Starting fresh."
|
||||
fi
|
||||
echo ""
|
||||
sleep 1
|
||||
|
||||
# ==========================================
|
||||
# CONFIGURATION LOOP
|
||||
# ==========================================
|
||||
|
||||
print_header
|
||||
echo -e "This script will help you configure access rules for each service."
|
||||
echo -e "${YELLOW}Note: Configuration applies to RUNTIME only.${NC}"
|
||||
echo ""
|
||||
|
||||
for i in "${!SVC_NAMES[@]}"; do
|
||||
NAME="${SVC_NAMES[$i]}"
|
||||
PORTS="${SVC_PORTS[$i]}"
|
||||
|
||||
# Get previous setting if available
|
||||
PREV_DECISION="${CONFIG_DECISION[$i]}"
|
||||
PREV_IPS="${CONFIG_IPS[$i]}"
|
||||
|
||||
# Determine default option number for UI
|
||||
DEFAULT_OPT=""
|
||||
DEFAULT_TXT=""
|
||||
if [[ "$PREV_DECISION" == "ALL" ]]; then DEFAULT_OPT="1"; DEFAULT_TXT="[Default: 1 - Public]"; fi
|
||||
if [[ "$PREV_DECISION" == "IP" ]]; then DEFAULT_OPT="2"; DEFAULT_TXT="[Default: 2 - Restricted]"; fi
|
||||
if [[ "$PREV_DECISION" == "SKIP" ]]; then DEFAULT_OPT="3"; DEFAULT_TXT="[Default: 3 - Skip]"; fi
|
||||
|
||||
echo -e "--------------------------------------------------"
|
||||
echo -e "Configuring Service: ${GREEN}$NAME${NC}"
|
||||
echo -e "Ports: ${YELLOW}$PORTS${NC}"
|
||||
echo "--------------------------------------------------"
|
||||
echo "1) Allow from ANYWHERE (Public)"
|
||||
echo "2) Restrict to SPECIFIC IPs"
|
||||
echo "3) Skip / Block (Do not open)"
|
||||
|
||||
while true; do
|
||||
read -p "Select option (1-3) $DEFAULT_TXT: " choice
|
||||
|
||||
# Handle Enter key (Default)
|
||||
if [[ -z "$choice" && -n "$DEFAULT_OPT" ]]; then
|
||||
choice=$DEFAULT_OPT
|
||||
fi
|
||||
|
||||
case $choice in
|
||||
1)
|
||||
CONFIG_DECISION[$i]="ALL"
|
||||
CONFIG_IPS[$i]=""
|
||||
echo -e "-> Selected: ${RED}Public Access${NC}"
|
||||
break
|
||||
;;
|
||||
2)
|
||||
CONFIG_DECISION[$i]="IP"
|
||||
echo ""
|
||||
echo -e "Enter IPs or Subnets separated by spaces or commas."
|
||||
|
||||
# Show previous IPs as default if they exist
|
||||
if [[ -n "$PREV_IPS" ]]; then
|
||||
echo -e "Current Saved IPs: ${CYAN}$PREV_IPS${NC}"
|
||||
read -p "IPs [Press Enter to keep current]: " ip_input
|
||||
if [[ -z "$ip_input" ]]; then
|
||||
ip_input="$PREV_IPS"
|
||||
fi
|
||||
else
|
||||
echo -e "Example: ${CYAN}192.168.1.10, 192.168.1.20${NC}"
|
||||
read -p "IPs: " ip_input
|
||||
fi
|
||||
|
||||
# Replace commas with spaces to sanitize
|
||||
CONFIG_IPS[$i]="${ip_input//,/ }"
|
||||
echo -e "-> Selected: ${GREEN}Restricted to ${CONFIG_IPS[$i]}${NC}"
|
||||
break
|
||||
;;
|
||||
3)
|
||||
CONFIG_DECISION[$i]="SKIP"
|
||||
CONFIG_IPS[$i]=""
|
||||
echo -e "-> Selected: ${YELLOW}Skipping${NC}"
|
||||
break
|
||||
;;
|
||||
*)
|
||||
echo "Invalid option."
|
||||
;;
|
||||
esac
|
||||
done
|
||||
echo ""
|
||||
done
|
||||
|
||||
# ==========================================
|
||||
# SUMMARY & CONFIRMATION
|
||||
# ==========================================
|
||||
|
||||
print_header
|
||||
echo -e "${YELLOW}SUMMARY OF PENDING CHANGES:${NC}"
|
||||
echo ""
|
||||
printf "%-25s | %-15s | %-30s\n" "Service" "Action" "Details"
|
||||
echo "-------------------------------------------------------------------------------"
|
||||
|
||||
for i in "${!SVC_NAMES[@]}"; do
|
||||
NAME="${SVC_NAMES[$i]}"
|
||||
ACTION="${CONFIG_DECISION[$i]}"
|
||||
DETAILS="${CONFIG_IPS[$i]}"
|
||||
|
||||
# Shorten name for table
|
||||
SHORT_NAME=${NAME:0:24}
|
||||
|
||||
if [ "$ACTION" == "ALL" ]; then
|
||||
printf "%-25s | ${RED}%-15s${NC} | %-30s\n" "$SHORT_NAME" "Open Public" "0.0.0.0/0"
|
||||
elif [ "$ACTION" == "IP" ]; then
|
||||
printf "%-25s | ${GREEN}%-15s${NC} | %-30s\n" "$SHORT_NAME" "Restricted" "$DETAILS"
|
||||
else
|
||||
printf "%-25s | ${YELLOW}%-15s${NC} | %-30s\n" "$SHORT_NAME" "Blocked/Skip" "-"
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo -e "${CYAN}Global Actions:${NC}"
|
||||
if [ "$DO_FLUSH" = true ]; then
|
||||
echo "1. FLUSH ALL current rules (Clean Slate)."
|
||||
else
|
||||
echo "1. Remove specific insecure rules (0-65535) and standard SSH service."
|
||||
fi
|
||||
echo ""
|
||||
|
||||
read -p "Do you want to SAVE config and APPLY changes now? [Y/n]: " confirm
|
||||
confirm=${confirm:-Y} # Default to Yes
|
||||
|
||||
if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ==========================================
|
||||
# EXECUTION
|
||||
# ==========================================
|
||||
echo ""
|
||||
echo "Saving configuration to $CONFIG_FILE..."
|
||||
save_config
|
||||
|
||||
echo "Applying configurations (RUNTIME ONLY)..."
|
||||
|
||||
# 1. Flush or Safety Cleanup
|
||||
if [ "$DO_FLUSH" = true ]; then
|
||||
echo "-> Flushing active rules..."
|
||||
# Flush Services
|
||||
for service in $(firewall-cmd --list-services); do
|
||||
firewall-cmd --remove-service="$service" >/dev/null 2>&1
|
||||
done
|
||||
# Flush Ports
|
||||
for port in $(firewall-cmd --list-ports); do
|
||||
firewall-cmd --remove-port="$port" >/dev/null 2>&1
|
||||
done
|
||||
# Flush Rich Rules
|
||||
firewall-cmd --list-rich-rules | while read -r rule; do
|
||||
if [ -n "$rule" ]; then
|
||||
firewall-cmd --remove-rich-rule="$rule" >/dev/null 2>&1
|
||||
fi
|
||||
done
|
||||
else
|
||||
# Only remove specific conflicting rules if not flushing everything
|
||||
echo "-> Cleaning up insecure rules..."
|
||||
firewall-cmd --remove-port=0-65535/tcp >/dev/null 2>&1
|
||||
firewall-cmd --remove-service=ssh >/dev/null 2>&1
|
||||
firewall-cmd --remove-port=22/tcp >/dev/null 2>&1
|
||||
fi
|
||||
|
||||
# 2. Loop and Apply
|
||||
for i in "${!SVC_NAMES[@]}"; do
|
||||
PORTS="${SVC_PORTS[$i]}"
|
||||
DECISION="${CONFIG_DECISION[$i]}"
|
||||
|
||||
# Convert space-separated ports to array for inner loop
|
||||
read -ra PORT_ARR <<< "$PORTS"
|
||||
|
||||
if [ "$DECISION" == "ALL" ]; then
|
||||
# Open ports globally
|
||||
for port in "${PORT_ARR[@]}"; do
|
||||
echo " Opening $port globally..."
|
||||
firewall-cmd --add-port=${port}/tcp >/dev/null
|
||||
done
|
||||
|
||||
elif [ "$DECISION" == "IP" ]; then
|
||||
# Add rich rules for specific IPs
|
||||
read -ra IP_ARR <<< "${CONFIG_IPS[$i]}"
|
||||
|
||||
for ip in "${IP_ARR[@]}"; do
|
||||
if [[ -z "$ip" ]]; then continue; fi
|
||||
for port in "${PORT_ARR[@]}"; do
|
||||
echo " Allowing $ip access to port $port..."
|
||||
firewall-cmd --add-rich-rule="rule family='ipv4' source address='$ip' port port='$port' protocol='tcp' accept" >/dev/null
|
||||
done
|
||||
done
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo -e "${YELLOW}==========================================${NC}"
|
||||
echo -e "${YELLOW} TESTING CONNECTIVITY ${NC}"
|
||||
echo -e "${YELLOW}==========================================${NC}"
|
||||
echo "The new rules are active. If you are locked out, DO NOTHING."
|
||||
echo "The firewall will automatically REVERT in 15 seconds."
|
||||
echo ""
|
||||
echo -e "${GREEN}If you can read this and your connection works:${NC}"
|
||||
echo -e "Press ${CYAN}ENTER${NC} now to CONFIRM and KEEP the changes."
|
||||
echo "OR press Ctrl+C to keep changes without saving (script exits)."
|
||||
echo ""
|
||||
|
||||
if read -t 15 -p "Waiting for confirmation... "; then
|
||||
# User pressed Enter (Connection is good)
|
||||
echo ""
|
||||
echo -e "${GREEN}Connection confirmed!${NC}"
|
||||
echo ""
|
||||
read -p "Do you want to save these rules PERMANENTLY now? [Y/n]: " save_choice
|
||||
save_choice=${save_choice:-Y} # Default to Yes
|
||||
|
||||
if [[ "$save_choice" =~ ^[Yy]$ ]]; then
|
||||
echo "Saving to permanent configuration..."
|
||||
firewall-cmd --runtime-to-permanent
|
||||
echo -e "${GREEN}Configuration Saved.${NC}"
|
||||
else
|
||||
echo "Rules kept in RUNTIME only. They will be lost on reboot."
|
||||
fi
|
||||
else
|
||||
# Timeout occurred (User likely locked out)
|
||||
echo ""
|
||||
echo -e "${RED}Timeout reached! Reverting changes...${NC}"
|
||||
|
||||
# Revert Logic
|
||||
echo "1. Reloading permanent configuration..."
|
||||
firewall-cmd --reload >/dev/null 2>&1
|
||||
|
||||
echo "2. Ensuring SSH is accessible (Failsafe)..."
|
||||
firewall-cmd --add-service=ssh >/dev/null 2>&1
|
||||
|
||||
echo -e "${YELLOW}Firewall reverted to previous state (plus global SSH allow).${NC}"
|
||||
fi
|
||||
|
||||
exit 0
|
||||
Reference in New Issue
Block a user