##// END OF EJS Templates
Raspi2-3_GenImage
RSS

Cloner depuis https://github.com/drtyhlpr/rpi23-gen-image.git

kernel features + nexmon monitor mode wlan patch(kali-kernel) with RPI3,RPI3B+ firmware patch...
kernel features + nexmon monitor mode wlan patch(kali-kernel) with RPI3,RPI3B+ firmware patch - ENABLE_NEXMON to use raspberry pi kali kernel sources which include patched nl80211 driver. Needed to crosscompile nexmon. Firmware for RPI3 and RPI3B+ is patched in the process to enable moniotor mode and injection. - Support for precompiled kernel. RPI3 64bit kernel from sakaki and a multi kernel (supporting all RPI models) from hyperiotOS. Needs further testing! - start.elf isn't supplied from precompiled kernel so always install them - ENABLE_SYSTEMDSWAP enables swapping service supporting new KERNEL_ZSWAP feature and also manages swap files - KERNEL_SECURITY activates apparmor, keyring,str/mem cpy protection, audit funcionality, integrity checks - KERNEL_ZSWAP enables compressed swap kernel feature. -KERNEL_VIRT enables virtualisation on RPI2,3,3P -KERNEL_BPF enables bpf syscall (supress journald warning message) - KERNEL_NF enable netfilter firewall (iptables-legacy is not default anymore) - KERNEL_DEFAULT_GOV set default cpu governor
Unknown - - Load All Authors

Fichier de la dernière révision:

r502:3d4e292749a1
r502:3d4e292749a1
Show More
21-firewall.sh
53 lines | 1.9 KiB | application/x-sh | BashLexer
/ bootstrap.d / 21-firewall.sh
Historique | Annotation | Brut |Copy content |Copy permalink
#
# Setup Firewall
#
# Load utility functions
. ./functions.sh
if [ "$ENABLE_IPTABLES" = true ] ; then
# Create iptables configuration directory
mkdir -p "${ETC_DIR}/iptables"
if [ "$KERNEL_NF" = false ] ; then
#iptables-save and -restore are slaves of iptables and thus are set accordingly
chroot_exec update-alternatives --verbose --set iptables /usr/sbin/iptables-legacy
fi
# Install iptables systemd service
install_readonly files/iptables/iptables.service "${ETC_DIR}/systemd/system/iptables.service"
# Install flush-table script called by iptables service
install_exec files/iptables/flush-iptables.sh "${ETC_DIR}/iptables/flush-iptables.sh"
# Install iptables rule file
install_readonly files/iptables/iptables.rules "${ETC_DIR}/iptables/iptables.rules"
# Reload systemd configuration and enable iptables service
chroot_exec systemctl daemon-reload
chroot_exec systemctl enable iptables.service
if [ "$ENABLE_IPV6" = true ] ; then
if [ "$KERNEL_NF" = false ] ; then
#iptables-save and -restore are slaves of iptables and thus are set accordingly
chroot_exec update-alternatives --verbose --set ip6tables /usr/sbin/ip6tables-legacy
fi
# Install ip6tables systemd service
install_readonly files/iptables/ip6tables.service "${ETC_DIR}/systemd/system/ip6tables.service"
# Install ip6tables file
install_exec files/iptables/flush-ip6tables.sh "${ETC_DIR}/iptables/flush-ip6tables.sh"
install_readonly files/iptables/ip6tables.rules "${ETC_DIR}/iptables/ip6tables.rules"
# Reload systemd configuration and enable iptables service
chroot_exec systemctl daemon-reload
chroot_exec systemctl enable ip6tables.service
fi
if [ "$ENABLE_SSHD" = false ] ; then
# Remove SSHD related iptables rules
sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/iptables.rules" 2> /dev/null
sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/ip6tables.rules" 2> /dev/null
fi
fi