Forum Debian Users Gang

# /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file.
# To really apply changes reload proftpd after modifications.

# Includes DSO modules
Include /etc/proftpd/modules.conf

# Set off to disable IPv6 support which is annoying on IPv4 only boxes.
#UseIPv6                         on
# If set on you can experience a longer connection delay in many cases.
UseReverseDNS                   off
IdentLookups                    off
ServerName                      "+++ Debian +++"
#Ukrycie wersji serwera
ServerIdent                     on "=== FTP ==="
ServerType                      standalone
DeferWelcome                    off

MultilineRFC2228                on
DefaultServer                   on
ShowSymlinks                    on
TimeoutNoTransfer               600
TimeoutStalled                  600
TimeoutIdle                     1200

DisplayLogin                    welcome.msg
DisplayChdir                    .message true
ListOptions                     "-l"

DenyFilter                      \*.*/

# Use this to jail all users in their homes
#DefaultRoot                    ~

# Users require a valid shell listed in /etc/shells to login.
# Use this directive to release that constrain.
RequireValidShell               on
DelayEngine                     off
# Port 21 is the standard FTP port.
Port                            21
#PassivePorts                    49152 65534

# Set the user and group that the server normally runs at.
User                            proftpd
Group                           nogroup
# (second parm) from being group and world writable.
Umask                           022  022
# Normally, we want files to be overwriteable.
AllowOverwrite                  on
TransferLog /var/log/proftpd/xferlog
SystemLog   /var/log/proftpd/proftpd.log

<IfModule mod_facts.c>
FactsAdvertise off
</IfModule>

<IfModule mod_quotatab.c>
QuotaEngine off
<IfModule mod_ratio.c>
Ratios off
</IfModule>


# Delay engine reduces impact of the so-called Timing Attack described in
# http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02
# It is on by default.
<IfModule mod_delay.c>
DelayEngine on
</IfModule>

<IfModule mod_ctrls.c>
ControlsEngine        off
ControlsMaxClients    2
ControlsLog           /var/log/proftpd/controls.log
ControlsInterval      5
ControlsSocket        /var/run/proftpd/proftpd.sock
</IfModule>

<IfModule mod_ctrls_admin.c>
AdminControlsEngine off

</IfModule>

#
# Alternative authentication frameworks
#
#Include /etc/proftpd/ldap.conf
#Include /etc/proftpd/sql.conf

#
# This is used for FTPS connections
#
#Include /etc/proftpd/tls.conf

# A basic anonymous configuration, no upload directories.

# <Anonymous ~ftp>
#   User                                ftp
#   Group                               nogroup
#   # We want clients to be able to login with "anonymous" as well as "ftp"
#   UserAlias                   anonymous ftp
#   # Cosmetic changes, all files belongs to ftp user
#   DirFakeUser on ftp

#   RequireValidShell           off
#
#   # Limit the maximum number of anonymous logins
#   MaxClients                  10
#
#   # We want 'welcome.msg' displayed at login, and '.message' displayed
#   # in each newly chdired directory.
#   DisplayLogin                        welcome.msg
#   DisplayChdir                .message
#
#   # Limit WRITE everywhere in the anonymous chroot
#   <Directory *>
#     <Limit WRITE>
#       DenyAll
#     </Limit>
#   </Directory>
#
#   # Uncomment this if you're brave.
#   # <Directory incoming>
#   #   # Umask 022 is a good standard umask to prevent new files and dirs
#   #   # (second parm) from being group and world writable.
#   #   Umask                           022  022
#   #            <Limit READ WRITE>
#   #            DenyAll
#   #            </Limit>
#   #            <Limit STOR>
#   #            AllowAll
#   #            </Limit>
#   # </Directory>
#
# </Anonymous>

#!/bin/sh

#eth0 - LAN
#eth1 - WAN

#CZYSZCZENIE STARYCH REGUL
iptables -F
iptables -X
iptables -t nat -X
iptables -t nat -F
iptables -t mangle -F
iptables -t mangle -X

# USTAWIENIE DOMYSLNEJ POLITYKI NA DROP
iptables -P INPUT DROP

#WLACZENIE SOURCE NAT (SNAT) ZMIENIC IP 1.2.3.4 - na zewnetrzne IP
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to [b]XX[/b].[b]XX[/b].149.42

# AKCEPTOWANIE WSZYSTKICH PRZYCHODZCYCH POLACZEN OPROCZ eth1 (WAN)
iptables -A INPUT ! -i eth1 -j ACCEPT

# KONTROLA STANU PAKIETU, PRZEPUSZCZENIE PAKIETOW ISTNIEJACYCH POLACZEN
# (KTORE WYSZLY Z eth0)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#WLACZENIE DOSTEPU DO SERWISOW
SERVICES="http 21 5832 80 8080 143"
for x in ${SERVICES}
do
iptables -A INPUT -p tcp --dport ${x} -m state --state NEW -j ACCEPT
done

#UDAWANIE ZE NIE MA URUCHOMIONYCH ZADNYCH SERWISOW i BLOKOWANIE PINGOW z WAN'u
iptables -A INPUT -p tcp -i eth1 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp -i eth1 -j REJECT --reject-with icmp-port-unreachable

#WYLACZENIE ECN
echo "0" > /proc/sys/net/ipv4/tcp_ecn

#ZABEZPIECZENIE PRZED PODSZYWANIEM SIE - SPOOFING
INTERFACES="lo eth0 eth1"
for x in ${INTERFACES}
do
echo "1" > /proc/sys/net/ipv4/conf/${x}/rp_filter
done

#WLACZENIE FORWARDOWANIA
echo "1" > /proc/sys/net/ipv4/ip_forward