51 lines
2.1 KiB
Bash
51 lines
2.1 KiB
Bash
IF=$(ip -4 route show default | awk '{for (i = 1; i < NF; i++) if ($i == "dev") { print $(i + 1); exit }}')
|
|
[ -n "$IF" ] || refuse "no default route; this lab needs a working network"
|
|
pkg_installed firewalld || pkg_install firewalld
|
|
systemctl is-active --quiet firewalld && state_set firewalld-was-active 1
|
|
enabled firewalld && state_set firewalld-was-enabled 1
|
|
tar -C /etc -cf "$LAB_STATE/firewalld.tar" firewalld
|
|
systemctl enable --now --quiet firewalld
|
|
firewall-cmd -q --state
|
|
Z=$(firewall-cmd --get-zone-of-interface="$IF" 2>/dev/null || firewall-cmd --get-default-zone)
|
|
state_set zone "$Z"
|
|
# A fresh start: none of the tasks' services or ports.
|
|
for s in http https ftp; do
|
|
firewall-cmd -q --permanent --zone="$Z" --query-service=$s && firewall-cmd -q --permanent --zone="$Z" --remove-service=$s
|
|
done
|
|
firewall-cmd -q --permanent --zone="$Z" --query-port=8080/tcp && firewall-cmd -q --permanent --zone="$Z" --remove-port=8080/tcp
|
|
firewall-cmd -q --reload
|
|
firewall-cmd --permanent --zone="$Z" --list-services | tr ' ' '\n' | sort >"$LAB_STATE/services-before"
|
|
|
|
# Note the zone's services and ports, runtime (R) and permanent (P).
|
|
mkdir -p /usr/local/lib/le-lab
|
|
cat >/usr/local/lib/le-lab/watch.sh <<'X'
|
|
#!/bin/bash
|
|
# Notes each change of what snap prints.
|
|
log=$1 z=$2 prev=''
|
|
snap() {
|
|
echo "R ports=$(firewall-cmd --zone="$z" --list-ports | tr ' ' ,) services=$(firewall-cmd --zone="$z" --list-services | tr ' ' ,)" \
|
|
"P ports=$(firewall-cmd --permanent --zone="$z" --list-ports | tr ' ' ,) services=$(firewall-cmd --permanent --zone="$z" --list-services | tr ' ' ,)"
|
|
}
|
|
while :; do
|
|
if systemctl is-active --quiet firewalld; then
|
|
cur=$(snap 2>/dev/null)
|
|
[ "$cur" = "$prev" ] || { printf '%s\n' "$cur" >>"$log"; prev=$cur; }
|
|
fi
|
|
sleep 2
|
|
done
|
|
X
|
|
cat >/etc/systemd/system/le-lab-watch.service <<X
|
|
[Unit]
|
|
Description=LINUXexpert practice lab: note firewalld's services and ports
|
|
After=firewalld.service
|
|
|
|
[Service]
|
|
ExecStart=/bin/bash /usr/local/lib/le-lab/watch.sh $LAB_STATE/watch.log $Z
|
|
Restart=always
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
X
|
|
systemctl daemon-reload
|
|
systemctl enable --now --quiet le-lab-watch.service
|