chore: update

2026-08-08 12:04:57 +02:00
parent 56aef1fa9b
commit 8e36acd812
76 changed files with 12710 additions and 29 deletions
@@ -0,0 +1,106 @@
+#!/bin/bash
+# ═══════════════════════════════════════════════════════════════════
+# Firewall monitoring-uber (185.103.167.138)
+# ─────────────────────────────────────────────────────────────────
+# INBOUND:
+#   • 1514/tcp FROM prod (185.103.166.119) — agents Wazuh
+#   • 1514/tcp FROM pre-prod (185.103.166.112) — agents Wazuh
+#   • 51820/udp — VPN WireGuard
+#   • 10.0.0.0/24 (VPN admins) → 443, 8080, 8090, 9000, 9001
+#   • SSH: BLOCKED from prod/pre-prod/s3 (security hardening)
+# ─────────────────────────────────────────────────────────────────
+# OUTBOUND:
+#   • Tout (0.0.0.0/0) — Internet, updates, DNS
+#   • VPN vers VPS
+# ═══════════════════════════════════════════════════════════════════
+
+set -e
+
+echo "[*] Configurant firewall monitoring-uber..."
+
+# Flush des règles existantes
+iptables -F
+iptables -X
+iptables -t nat -F
+iptables -t nat -X
+iptables -t mangle -F
+iptables -t mangle -X
+
+# Politique par défaut
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT ACCEPT
+
+# ─── INPUT ────────────────────────────────────────────────────────
+# Loopback (services internes)
+iptables -A INPUT -i lo -j ACCEPT
+
+# Established/Related
+iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# SSH (administration locale, bloquer depuis prod/pre-prod/s3)
+iptables -A INPUT -p tcp --dport 22 -s 185.103.166.119 -j DROP  # prod
+iptables -A INPUT -p tcp --dport 22 -s 185.103.166.112 -j DROP  # pre-prod
+iptables -A INPUT -p tcp --dport 22 -s 80.96.58.164 -j DROP     # s3
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT                   # allow from other sources
+
+# ─── Agents Wazuh (prod + pre-prod) ────────────────────────────
+# Prod: 185.103.166.119
+iptables -A INPUT -p tcp --dport 1514 -s 185.103.166.119 -j ACCEPT
+
+# Pre-prod: 185.103.166.112
+iptables -A INPUT -p tcp --dport 1514 -s 185.103.166.112 -j ACCEPT
+
+# ─── VPN (WireGuard) ──────────────────────────────────────────
+iptables -A INPUT -p udp --dport 51820 -j ACCEPT
+
+# ─── Services (accessibles via VPN seulement) ─────────────────
+# Admins via VPN: 10.0.0.0/24
+
+# Wazuh Dashboard (443/https)
+iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
+
+# Dozzle (8080/http)
+iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
+
+# Beszel (8090/http)
+iptables -A INPUT -p tcp --dport 8090 -s 10.0.0.0/24 -j ACCEPT
+
+# S3/RustFS (9000/9001)
+iptables -A INPUT -p tcp --dport 9000 -s 10.0.0.0/24 -j ACCEPT
+iptables -A INPUT -p tcp --dport 9001 -s 10.0.0.0/24 -j ACCEPT
+
+# ─── ICMP ─────────────────────────────────────────────────────
+iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
+iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
+iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
+
+# Reject le reste
+iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
+
+# ─── FORWARD ──────────────────────────────────────────────────
+# Blocker forward par défaut (services locaux, pas de transit)
+iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
+
+# ─── Sauvegarder ──────────────────────────────────────────────
+mkdir -p /etc/iptables
+iptables-save > /etc/iptables/rules.v4
+
+echo "[✓] Firewall monitoring-uber configuré"
+echo ""
+echo "Règles appliquées (ALLOW) :"
+echo "  • SSH 22/tcp — from admin IPs only (BLOCKED from prod/pre-prod/s3)"
+echo "  • Wazuh 1514/tcp FROM prod (185.103.166.119) — agents Wazuh"
+echo "  • Wazuh 1514/tcp FROM pre-prod (185.103.166.112) — agents Wazuh"
+echo "  • VPN 51820/udp — WireGuard"
+echo "  • Wazuh Dashboard 443/tcp FROM 10.0.0.0/24 (VPN)"
+echo "  • Dozzle 8080/tcp FROM 10.0.0.0/24 (VPN)"
+echo "  • Beszel 8090/tcp FROM 10.0.0.0/24 (VPN)"
+echo "  • S3/RustFS 9000-9001/tcp FROM 10.0.0.0/24 (VPN)"
+echo "  • OUTPUT (Internet/DNS)"
+echo ""
+echo "Règles appliquées (DENY) :"
+echo "  • SSH 22/tcp FROM prod (185.103.166.119) — BLOCKED"
+echo "  • SSH 22/tcp FROM pre-prod (185.103.166.112) — BLOCKED"
+echo "  • SSH 22/tcp FROM s3 (80.96.58.164) — BLOCKED"
+echo "  • All other INPUT/FORWARD — default DROP"