Project

General

Profile

Tâche #25554

Scénario #25287: Les accès FTP ne fonctionne pas - SCRIBE-T06-001 - Vérification accès FTP (2.7.0-b1)

Intégrer le correctif de configuration

Added by Gérald Schwartzmann about 1 year ago. Updated about 1 year ago.

Status:
Fermé
Priority:
Normal
Start date:
10/15/2018
Due date:
% Done:

100%

Estimated time:
0.00 h
Spent time:
Remaining (hours):
0.0

Description

http://debian-facile.org/doc:reseau:iptables-pare-feu-pour-un-client

Depuis debian Stretch, conntrack ne va plus étiqueter les paquets en RELATED, sauf pour le protocole icmp.

https://linuxfr.org/forums/linux-noyau/posts/acceder-a-un-serveur-ftp-depuis-une-passerelle

https://home.regit.org/netfilter-en/secure-use-of-helpers/

FWIW, it seems that there was a change in kernel 4.7, so that you either need to set net.netfilter.nf_conntrack_helper=1 via sysctl (e.g. put it in /etc/sysctl.d/conntrack.conf) or use

iptables -A PREROUTING -t raw -p tcp --dport 21 -j CT --helper ftp
echo "1" > /proc/sys/net/netfilter/nf_conntrack_helper
root@zephir:~# cat /etc/eole/release 
EOLE_MODULE=zephir
EOLE_VERSION=2.6
EOLE_RELEASE=2.6.2
root@zephir:~# uname -a
Linux zephir 4.4.0-138-generic
root@amon:~# cat /etc/eole/release 
EOLE_MODULE=amon
EOLE_VERSION=2.7
EOLE_RELEASE=2.7.0
root@amon:~# uname -a
Linux amon 4.15.0-38-generic

Related issues

Related to ERA - Scénario #25621: ERA : Rendre plus restrictive la recherche de pattern pour remplir $CACHEMOD Nouveau

Associated revisions

Revision 87b9e73b (diff)
Added by Gérald Schwartzmann about 1 year ago

Activate the automatic conntrack helper assignment : ref #25554

  • add lines containing echo in $CACHEMOD

Revision fdbeca17 (diff)
Added by Gérald Schwartzmann about 1 year ago

Activate the automatic conntrack helper assignment : ref #25554

  • add modprobe
  • change the value nf_conntrack_helper to 1

Revision 1083c08c (diff)
Added by Gérald Schwartzmann about 1 year ago

Activate the automatic conntrack helper assignment : ref #25554

  • add modprobe
  • activate nf_conntrack_helper
  • change value netfilter nf_conntrack_helper to 1

Revision ebcd2e6f (diff)
Added by Gérald Schwartzmann about 1 year ago

Add lines containing echo command for bastion-modules file : ref #25554

History

#1 Updated by Scrum Master about 1 year ago

  • Status changed from Nouveau to En cours

#2 Updated by Scrum Master about 1 year ago

  • Description updated (diff)
  • Assigned To set to Gérald Schwartzmann

#3 Updated by Gérald Schwartzmann about 1 year ago

root@amon:~# service systemd-sysctl status
● systemd-sysctl.service - Apply Kernel Variables
   Loaded: loaded (/lib/systemd/system/systemd-sysctl.service; static; vendor preset: enabled)
   Active: active (exited) since Mon 2018-10-15 10:21:00 CEST; 1 day 1h ago
     Docs: man:systemd-sysctl.service(8)
           man:sysctl.d(5)
 Main PID: 289 (code=exited, status=0/SUCCESS)
    Tasks: 0 (limit: 2317)
   CGroup: /system.slice/systemd-sysctl.service

oct. 15 10:21:00 amon systemd-sysctl[289]: Couldn't write '1' to 'net/netfilter/nf_conntrack_helper', ignoring: No such file or directory
oct. 15 10:21:00 amon systemd[1]: Started Apply Kernel Variables.
root@amon:~# service systemd-sysctl restart
root@amon:~# service systemd-sysctl status
● systemd-sysctl.service - Apply Kernel Variables
   Loaded: loaded (/lib/systemd/system/systemd-sysctl.service; static; vendor preset: enabled)
   Active: active (exited) since Tue 2018-10-16 11:44:00 CEST; 1s ago
     Docs: man:systemd-sysctl.service(8)
           man:sysctl.d(5)
  Process: 5546 ExecStart=/lib/systemd/systemd-sysctl (code=exited, status=0/SUCCESS)
 Main PID: 5546 (code=exited, status=0/SUCCESS)

oct. 16 11:44:00 amon systemd[1]: Starting Apply Kernel Variables...
oct. 16 11:44:00 amon systemd[1]: Started Apply Kernel Variables.
root@amon:~#

Édition de /usr/share/era/backend/data/static_rules.sh

ajout de la ligne :

modprobe nf_conntrack nf_conntrack_helper=1

#4 Updated by Gérald Schwartzmann about 1 year ago

  • Estimated time set to 0.00 h
  • Remaining (hours) set to 0.0

#5 Updated by Scrum Master about 1 year ago

  • Status changed from En cours to Résolu

#6 Updated by Gérald Schwartzmann about 1 year ago

  • Related to Scénario #25621: ERA : Rendre plus restrictive la recherche de pattern pour remplir $CACHEMOD added

#8 Updated by Joël Cuissinat about 1 year ago

Paquets présents.

Activation du module testée en 2.7.0 avec vérification dans les tests squash :

#9 Updated by Joël Cuissinat about 1 year ago

  • Status changed from Résolu to Fermé
  • % Done changed from 0 to 100

Also available in: Atom PDF