konsthol/SecDep
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tl;dr

Browse Source
This commit is contained in:
konsthol
2023-09-07 05:35:52 +03:00
parent 6eaa744604
commit d970dda554
1 changed files with 1 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
harden
View File

@@ -512,7 +512,7 @@ function dynamicDockerPortsCronjob {
cat << 'TOHERE' | sudo tee /root/bin/dynamic_docker_ports_cronjob.sh > /dev/null 2>&1 cat << 'TOHERE' | sudo tee /root/bin/dynamic_docker_ports_cronjob.sh > /dev/null 2>&1
#!/usr/bin/env bash #!/usr/bin/env bash
# Get the current ports used by docker # Get the current ports used by docker
CURRENT_DOCKER_PORTS="$(DOCKER_HOST=unix:///run/user/"$(id -u secdep)"/docker.sock /home/secdep/bin/docker ps --format '{{.Ports}}' | rev | cut -d'/' -f2 | sed 's@^[^0-9]*\([0-9]\+\).*@\1@' | rev | sort -u | tr '\n' ' ')" CURRENT_DOCKER_PORTS="$(DOCKER_HOST=unix:///run/user/"$(id -u secdep)"/docker.sock /home/secdep/bin/docker ps --format '{{.Ports}}' | tr ' ' '\n' | rev | cut -d'/' -f2 | sed 's@^[^0-9]*\([0-9]\+\).*@\1@' | rev | sort -u | tr '\n' ' ')"
# Get the current ports allowed by the firewall # Get the current ports allowed by the firewall
CURRENT_FIREWALL_PORTS_FIREWALLD_CMD="$(sudo firewall-cmd --list-ports | tr '\n' ' ')" CURRENT_FIREWALL_PORTS_FIREWALLD_CMD="$(sudo firewall-cmd --list-ports | tr '\n' ' ')"
CURRENT_FIREWALL_PORTS_UFW_CMD="$(sudo ufw status numbered | grep -i allow | awk '{print $3}' | sed '/^[[:space:]]*$/d' | \grep -Eow '[[:digit:]]+' | sort -u | tr '\n' ' ')" CURRENT_FIREWALL_PORTS_UFW_CMD="$(sudo ufw status numbered | grep -i allow | awk '{print $3}' | sed '/^[[:space:]]*$/d' | \grep -Eow '[[:digit:]]+' | sort -u | tr '\n' ' ')"
@@ -601,11 +601,6 @@ if [[ -n "$OLD_PORTS" ]]; then
done done
fi fi
sudo ufw allow 22100/tcp sudo ufw allow 22100/tcp
# Reallow the ports that portainer and watchtower use
# just in case they were removed by the script above
sudo ufw allow 9443/tcp
sudo ufw allow 8000/tcp
sudo ufw allow 8080/tcp
if [[ "$currentFirewall" == "firewalld" ]]; then if [[ "$currentFirewall" == "firewalld" ]]; then
sudo firewall-cmd --reload sudo firewall-cmd --reload
else else