root/fwknop/tags/fwknop-0.9.7-pre1/access.conf

#
##############################################################################
#
# File: access.conf
#
# Purpose: This file defines how fwknop will modify iptables access controls
#          for specific IPs/networks.  It gets installed by default at
#          /etc/fwknop/access.conf and is consulted by fwknop when run in
#          "access control mode", which is the default (i.e. when fwknop is
#          run from the command line without any command line arguments).
#          The corresponding file ~/.fwknoprc defines how fwknop will
#          send the port knocking sequence for source machines in
#          access.conf.  Multiple access controls can be specified for
#          the same source machine.
#
# See the fwknop man page for a comprehensive treatment of the various
# access control variables.  See below for a few examples of access control
# configurations.
#
# Access examples:
#
# 1) Define parameters for accepting single-packet authorization messages
#    from any source IP address via libpcap.  Fwknop will reconfigure the
#    local Netfilter policy to allow access to the port that is contained
#    within the encrypted authentication packet for 30 seconds from the IP
#    also specified in the packet.  This example probably represents the
#    best configuration for most needs:
#
#   SOURCE: ANY;
#   DATA_COLLECT_MODE: PCAP;
#   KEY: myencryptkey;
#   FW_ACCESS_TIMEOUT: 30;
#
# 2) This example is identical to example 1) above, but now we add GPG keys
#    as an alternate encryption method.  The original symmetric key will
#    still be accepted, but only if an attempted GPG decrypt does not
#    succeed.  The GPG_REMOTE_ID is the key ID that the encrypted packet is
#    signed with by the fwknop client.  Note that using GPG keys requires
#    that the client key has been imported (and signed) into the
#    GPG_HOME_DIR key ring on the server side, and the server key has been
#    imported (and signed) into the GPG key ring on the client side. Because
#    the GPG password for the server key is put within the access.conf, the
#    server key should be specifically generated and used only for fwknop
#    server functions; it should not a valuable GPG key that is used for
#    things like personal email encryption. See the fwknop man page for
#    examples of how to use the GPG encryption method from the fwknop
#    command line on the client side.
#
#   SOURCE: ANY;
#   DATA_COLLECT_MODE: PCAP;
#   KEY: myencryptkey;
#   GPG_HOME_DIR: /root/.gnupg;
#   GPG_DECRYPT_ID: ABCD1234;
#   GPG_DECRYPT_PW: myGpgPassword;
#   GPG_REMOTE_ID: 1234ABCD;
#   FW_ACCESS_TIMEOUT: 30;
#
# 3) This example is identical to example 1) above, but now we allow a
#    remote fwknop client to send a command to the fwknop server (which it
#    will execute as root):
#
#   SOURCE: ANY;
#   DATA_COLLECT_MODE: PCAP;
#   ENABLE_CMD_EXEC;
#   KEY: myencryptkey;
#   FW_ACCESS_TIMEOUT: 30;
#
# 4) This example is identical to example 2) above, but now we specify a
#    regular expression which any remote command must match before being
#    executed:
#
#   SOURCE: ANY;
#   DATA_COLLECT_MODE: PCAP;
#   ENABLE_CMD_EXEC;
#   CMD_REGEX: /sbin/iptables.*ACCEPT;
#   KEY: myencryptkey;
#   FW_ACCESS_TIMEOUT: 30;
#
# 5) This example is similar to example 1) above, but this time instruct
#    fwknop to read packets from a file that is written to by a sniffer
#    process or by something like the ulogd pcap writer (use ULOG_PCAP for
#    this).  The specific file path is defined by the PCAP_FILE keyword in
#    /etc/fwknop/fwknop.conf).  We also require that the username on the
#    system that generates the authorization packet is "mbr":
#
#   SOURCE: ANY;
#   DATA_COLLECT_MODE: FILE_PCAP;
#   KEY: myencryptkey;
#   FW_ACCESS_TIMEOUT: 30;
#   REQUIRE_USERNAME: mbr;
#
# 6) OLD STRATEGY: define parameters for accepting an encrypted knock
#    sequence from any source IP address.  Note that the specific port that
#    will be opened is sent within the encrypted sequence (see the -p and -P
#    options when running fwknop in client mode) since the OPEN_PORTS
#    variable is not defined.
#
#   SOURCE: ANY;
#   DATA_COLLECT_MODE: ENCRYPT_SEQUENCE;
#   KEY myencryptkey;
#
# 7) OLD STRATEGY: Define parameters for an encrypted sequence that requires
#    the operating system from which the encrypted sequence originates be
#    identified as a Linux system (any kernel version).  In addition, define
#    the firewall access timeout to be 10 minutes instead of the default of
#    5 minutes, and restrict access for only those source IP addresses that
#    are within a specific subnet:
#
#   SOURCE: 192.168.10.0/24;
#   DATA_COLLECT_MODE: ENCRYPT_SEQUENCE;
#   KEY myencryptkey;
#   FW_ACCESS_TIMEOUT: 600;
#   REQUIRE_OS_REGEX: linux;
#
# 8) OLD STRATEGY: Define parameters for a shared knock sequence originating
#    from any source IP address, and use the tcp, udp, and icmp protocols in
#    the knock sequence.  The sequence consists of a total of four ports:
#
#   SOURCE: ANY;
#   SHARED_SEQUENCE: tcp/65531, udp/65533, tcp/65532, udp/65530;
#
# 9) OLD STRATEGY: Define parameters for a shared knock sequence identical
#    to 7) above, but require the operating system from which the sequence
#    originates to be exactly "OpenBSD:3.0-3.5::OpenBSD 3.0-3.5" (see the
#    file /etc/fwknop/pf.os):
#
#   SOURCE: ANY;
#   SHARED_SEQUENCE: tcp/65531, udp/65533, tcp/65532, udp/65530;
#   REQUIRE_OS: OpenBSD:3.0-3.5::OpenBSD 3.0-3.5;
#
##############################################################################
#
# $Id$
#

### default Single Packet Authorization (SPA) via libpcap:
SOURCE: ANY;
DATA_COLLECT_MODE: PCAP;
KEY: _CHANGEME_;
FW_ACCESS_TIMEOUT: 30;