fwknop.conf

Revision 1043, 13.7 kB (checked in by mbr, 8 months ago)
minor typo fix
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`

Line
1	#
2	#############################################################################
3	#
4	# [+] fwknop - Firewall Knock Operator [+]
5	#
6	# This is the configuration file for fwknop, the Firewall Knock Operator.
7	# The primary authentication and authorization mechanism offered by fwknop
8	# is known as Single Packet Authorization (SPA). More information about
9	# SPA can be found at: http://www.cipherdyne.org/fwknop/docs/SPA.html
10	#
11	# Note there are no access control directives in this file. All access
12	# control directives are located in the file
13	# /etc/fwknop/access.conf. You will need to edit the access.conf file in
14	# order for fwknop to function correctly.
15	#
16	#############################################################################
17	#
18	# $Id$
19	#
20
21	### Supports multiple email addresses (as a comma separated
22	### list).
23	EMAIL_ADDRESSES root@localhost;
24
25	### Machine hostname
26	HOSTNAME _CHANGEME_;
27
28	### Define the firewall type. The default is "iptables" for Linux systems,
29	### but this can be set to "ipfw" for *BSD systems.
30	FIREWALL_TYPE iptables;
31
32	### This defines the general strategy fwknop uses to authenticate remote
33	### clients. Possible values are "PCAP" (authenticate via regular pcap; this
34	### is the default and puts the interface in promiscuous mode unless
35	### ENABLE_PCAP_PROMISC is turned off) FILE_PCAP (authenticate via a pcap file
36	### that is built by a sniffer), ULOG_PCAP (authenticate via the ulogd pcap
37	### writer).
38	AUTH_MODE PCAP;
39
40	### Define the ethernet interface on which we will sniff packets. Note
41	### that this is only used if the AUTH_MODE keyword above is set to
42	### "PCAP"
43	PCAP_INTF eth0;
44
45	### Define whether put the pcap interface in promiscuous mode.
46	ENABLE_PCAP_PROMISC Y;
47
48	### Define the filters used for PCAP and FILE_PCAP modes; we default
49	### to udp port 62201. Note that either of these variables can be
50	### set to NONE in order to look at all packets.
51	PCAP_FILTER udp port 62201;
52
53	### This instructs fwknopd to not honor SPA packets that have an old time
54	### stamp. The value for "old" is defined by the MAX_SPA_PACKET_AGE variable.
55	### If ENABLE_SPA_PACKET_AGING is set to "N", fwknopd will not use the client
56	### time stamp at all.
57	ENABLE_SPA_PACKET_AGING Y;
58
59	### Defines the maximum age (in seconds) that an SPA packet will be accepted.
60	### This requires that the client system is in relatively close time
61	### synchronization with the fwknopd server system (NTP is good). The default
62	### age is two minutes.
63	MAX_SPA_PACKET_AGE 120;
64
65	### Track digest sums associated with previous fwknop process. This allows
66	### digest sums to remain persistent across executions of fwknop.
67	ENABLE_DIGEST_PERSISTENCE Y;
68
69	### Default to using all three of SHA256, SHA1, and MD5 for SPA replay attack
70	### detection. This is overkill, but performance is not usually a concern.
71	### Further, the variable can also be set to "SHA1" or "MD5".
72	DIGEST_TYPE ALL;
73
74	### This variable controls whether fwknopd includes the source IP of each SPA
75	### packet in the DIGEST store. If a replayed SPA message is detected, then
76	### having this information can provide information about which networks have
77	### people sniffing your SPA packets.
78	ENABLE_DIGEST_INCLUDE_SRC Y;
79
80	### Allow SPA clients to request access to services through an iptables
81	### firewall instead of just to it (i.e. access through the FWKNOP_FORWARD
82	### chain instead of the INPUT chain). This also requires the
83	### ENABLE_FORWARD_ACCESS variable to be set in the access.conf file for the
84	### specific SOURCE stanzas that should be allowed for forwarding access.
85	ENABLE_IPT_FORWARDING N;
86
87	### By default, if forwarding access is enabled (see the ENABLE_IPT_FORWARDING
88	### variable above), then fwknop creates DNAT rules for incoming connections,
89	### but does not also complement these rules with SNAT rules at the same time.
90	### In some situations, internal systems may not have a route back out for the
91	### source address of the incoming connection, so it is necessary to also
92	### apply SNAT rules so that the internal systems see the IP of the internal
93	### interface where fwknopd is running. This functionality is only enabled
94	### when ENABLE_IPT_SNAT is set to "Y", and by default SNAT rules are built
95	### with the MASQUERADE target (since then the internal IP does not have to be
96	### defined here in the fwknop.conf file), but if you want fwknopd to use the
97	### SNAT target then also defined an IP address with the SNAT_TRANSLATE_IP
98	### variable.
99	ENABLE_IPT_SNAT N;
100	SNAT_TRANSLATE_IP _CHANGEME_;
101
102	### If ENABLE_IPT_FORWARDING is enabled, but the /proc/sys/net/ipv4/ip_forward
103	### disables forwarding, then by default enable forwarding
104	ENABLE_PROC_IP_FORWARD Y;
105
106	### Add ACCEPT rules to the FWKNOP_OUTPUT chain. This is usually only useful
107	### if there are no state tracking rules to allow connection responses out and
108	### the OUTPUT chain has a default-drop stance.
109	ENABLE_IPT_OUTPUT N;
110
111	### Force all SPA packets to contain a real IP address within the encrypted
112	### data. This makes it impossible to use the -s command line argument on
113	### the fwknop client command line, so either -R has to be used to
114	### automatically resolve the external address (if the client behind a NAT) or
115	### the client must know the external IP.
116	REQUIRE_SOURCE_ADDRESS N;
117
118	### This pair of variables controls whether fwknopd voluntarily exits and over
119	### what time interval. When fwknopd exits, knopwatchd will restart it.
120	### Because fwknop controls the accessibility of services, this feature can be
121	### used to make sure that the fwknop rules are flushed (see the
122	### FLUSH_IPT_AT_INIT variable), and the effects of any potential logic (or
123	### other) bugs are minimized since fwknopd will start "fresh" when knopwatchd
124	### kicks it off. NOTE: This feature is almost never required since fwknopd is
125	### generally quite stable, and is mostly offered for the the extra paranoid.
126	ENABLE_VOLUNTARY_EXITS N;
127	EXIT_INTERVAL 1440; ### minutes (1 day)
128
129	### Flush all existing rules in the fwknop chains at fwknop start time.
130	FLUSH_IPT_AT_INIT Y;
131
132	### If running on ipfw firewalls, this variable defines the rule number that
133	### fwknopd uses to insert an ipfw pass rule.
134	IPFW_RULE_NUM 1;
135
136	### Define the timeout for running a command
137	PCAP_CMD_TIMEOUT 10;
138
139	### If GPG keys are used instead of a Rijndael symmetric key, this is
140	### the default GPG keys directory. Note that each access block in
141	### /etc/fwknop/access.conf can specify its own GPG directory to override
142	### this default.
143	GPG_DEFAULT_HOME_DIR /root/.gnupg;
144
145	### This gets used if AUTH_MODE is set to "FILE_PCAP". This file must
146	### be created by a sniffer process (or something like the ulogd pcap
147	### writer).
148	PCAP_PKT_FILE /var/log/sniff.pcap;
149
150	### Define a comma-separated set of IP addresses and/or networks that should
151	### be globally blacklisted. That is, any SPA packet that is from a source
152	### IP (or has an internal --allow-ip) within a blacklisted network will be
153	### ignored.
154	BLACKLIST NONE;
155
156	### Defines interval fwknop will use to check for more iptables
157	### messages (this is only used in the legacy port knocking mode).
158	SLEEP_INTERVAL 2; ### seconds
159
160	### TTL values are decremented depending on the number of hops the packet
161	### has taken before it hits the firewall. We will assume packets will not
162	### jump through more than 20 hops on average.
163	MAX_HOPS 20;
164
165	### Note that fwknopd still only gets its data via pcap, so the filter
166	### defined by PCAP_FILTER needs to be updated to include this TCP port.
167	ENABLE_TCP_SERVER N;
168
169	### Set the default port number that the fwknop_serv "dummy" TCP server
170	### listens on. This server is only spawned when ENABLE_TCP_SERVER is set
171	### to "Y".
172	TCPSERV_PORT 62201;
173
174	### Set the type of syslog daemon that is used. The SYSLOG_DAEMON variable
175	### accepts three possible values: syslogd, syslog-ng, or metalog.
176	SYSLOG_DAEMON syslogd;
177
178	### syslog facility and priority (the defaults are usually ok)
179	### The SYSLOG_FACILITY variable can be set to one of LOG_LOCAL{0-7}, and
180	### SYSLOG_PRIORITY can be set to one of LOG_INFO, LOG_DEBUG, LOG_NOTICE,
181	### LOG_WARNING, LOG_ERR, LOG_CRIT, LOG_ALERT, or LOG_EMERG
182	SYSLOG_IDENTITY fwknopd;
183	SYSLOG_FACILITY LOG_LOCAL7;
184	SYSLOG_PRIORITY LOG_INFO;
185
186	### syslog config for knoptm
187	KNOPTM_SYSLOG_IDENTITY fwknop(knoptm);
188	KNOPTM_SYSLOG_FACILITY LOG_LOCAL7;
189	KNOPTM_SYSLOG_PRIORITY LOG_INFO;
190
191	### Allow reporting methods to be enabled/restricted. This keyword can
192	### accept values of "nosyslog" (don't write any messages to syslog),
193	### "noemail" (don't send any email messages), or "ALL" (to generate both
194	### syslog and email messages). "ALL" is the default. Both "nosyslog"
195	### and "noemail" can be combined with a comma to disable all logging
196	### and alerting.
197	ALERTING_METHODS ALL;
198
199	### The following variables can be modified to look for logging messages
200	### that are specific to your firewall configuration (specified by the
201	### "--log-prefix" for iptables firewalls). For example, if your firewall
202	### uses the string "Audit" for packets that have been blocked, then you
203	### could set FW_MSG_SEARCH = "Audit";
204	FW_MSG_SEARCH DROP;
205
206	### For knopwatchd
207	KNOPWATCHD_CHECK_INTERVAL 5; ### seconds
208	KNOPWATCHD_MAX_RETRIES 10;
209
210	### Default minimum message size SPA messages encrypted with GnuPG. The
211	### fwknopd daemon will not attempt to decrypt any packet with gpg that is not
212	### at least as large as this value.
213	MIN_GNUPG_MSG_SIZE 400;
214
215	### fwknop uses the IPTables::ChainMgr module to add allow rules to a
216	### custom iptables chain "FWKNOP_INPUT". This chain is called from
217	### the INPUT chain, and by default no other iptables chains are used.
218	### However, additional chains can be added (say, if access needs to
219	### be allowed through the local system via the FORWARD chain) by
220	### altering the IPT_FORWARD_ACCESS variable below. For a discussion of
221	### the format followed by these keywords, read on:
222	### Specify chain names to which iptables blocking rules will be
223	### added with the IPT_INPUT_ACCESS and IPT_FORWARD_ACCESS keyword.
224	### The format for these variables is:
225	### <Target>,<Direction>,<Table>,<From_chain>,<Jump_rule_position>, \
226	### <To_chain>,<Rule_position>.
227	### "Target": Can be any legitimate iptables target, but should usually
228	### just be "DROP".
229	### "Direction": Can be "src", "dst", or "both", which correspond to the
230	### INPUT, OUTPUT, and FORWARD chains.
231	### "Table": Can be any iptables table, but the default is "filter".
232	### "From_chain": Is the chain from which packets will be jumped.
233	### "Jump_rule_position": Defines the position within the From_chain where
234	### the jump rule is added.
235	### "To_chain": Is the chain to which packets will be jumped. This is the
236	### main chain where fwknop rules are added.
237	### "Rule_position": Defines the position where rule are added within the
238	### To_chain.
239	IPT_INPUT_ACCESS ACCEPT, src, filter, INPUT, 1, FWKNOP_INPUT, 1;
240	### The IPT_OUTPUT_ACCESS variable is only used if ENABLE_IPT_OUTPUT is enabled
241	IPT_OUTPUT_ACCESS ACCEPT, dst, filter, OUTPUT, 1, FWKNOP_OUTPUT, 1;
242	### The IPT_FORWARD_ACCESS variable is only used if ENABLE_IPT_FORWARDING is enabled
243	IPT_FORWARD_ACCESS ACCEPT, src, filter, FORWARD, 1, FWKNOP_FORWARD, 1;
244	IPT_DNAT_ACCESS DNAT, src, nat, PREROUTING, 1, FWKNOP_PREROUTING, 1;
245	### The IPT_SNAT_ACCESS variable is not used unless both ENABLE_IPT_SNAT and
246	### ENABLE_IPT_FORWARDING are enabled. Also, the external static IP must be
247	### set with the SNAT_TRANSLATE_IP variable. The default is to use the
248	### IPT_MASQUERADE_ACCESS variable.
249	IPT_SNAT_ACCESS SNAT, src, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1;
250	IPT_MASQUERADE_ACCESS MASQUERADE, src, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1;
251
252	### Directories
253	FWKNOP_DIR /var/log/fwknop;
254	FWKNOP_RUN_DIR /var/run/fwknop;
255	FWKNOP_LIB_DIR /var/lib/fwknop; # for legacy port knocking mode
256	FWKNOP_MOD_DIR /usr/lib/fwknop;
257	FWKNOP_CONF_DIR /etc/fwknop;
258	FWKNOP_ERR_DIR $FWKNOP_DIR/errs;
259
260	### Files
261	FW_DATA_FILE $FWKNOP_DIR/fwdata; # legacy port knocking mode
262	ACCESS_CONF $FWKNOP_CONF_DIR/access.conf;
263	P0F_FILE $FWKNOP_CONF_DIR/pf.os; ### p0f-based fingerprints
264	DIGEST_FILE $FWKNOP_DIR/digest.cache;
265	FWKNOP_PID_FILE $FWKNOP_RUN_DIR/fwknopd.pid;
266	FWKNOP_CMDLINE_FILE $FWKNOP_RUN_DIR/fwknopd.cmd;
267	TCPSERV_PID_FILE $FWKNOP_RUN_DIR/fwknop_serv.pid;
268	KNOPWATCHD_PID_FILE $FWKNOP_RUN_DIR/knopwatchd.pid;
269	KNOPMD_PID_FILE $FWKNOP_RUN_DIR/knopmd.pid;
270	KNOPTM_PID_FILE $FWKNOP_RUN_DIR/knoptm.pid;
271	KNOPTM_IP_TIMEOUT_SOCK $FWKNOP_RUN_DIR/knoptm_ip_timeout.sock;
272	KNOPMD_FIFO $FWKNOP_LIB_DIR/fwknopfifo;
273	PROC_IP_FORWARD_FILE /proc/sys/net/ipv4/ip_forward;
274
275	### iptables command output and error collection files; these are
276	### used by IPTables::ChainMgr
277	IPT_OUTPUT_FILE $FWKNOP_DIR/fwknopd.iptout;
278	IPT_ERROR_FILE $FWKNOP_DIR/fwknopd.ipterr;
279	KNOPTM_IPT_OUTPUT_FILE $FWKNOP_DIR/knoptm.iptout;
280	KNOPTM_IPT_ERROR_FILE $FWKNOP_DIR/knoptm.ipterr;
281
282	### system binaries
283	mailCmd /bin/mail;
284	shCmd /bin/sh;
285	mknodCmd /bin/mknod;
286	iptablesCmd /sbin/iptables;
287	ipfwCmd /sbin/ipfw; ### BSD and Mac OS X only
288	fwknopdCmd /usr/sbin/fwknopd;
289	fwknop_servCmd /usr/sbin/fwknop_serv;
290	knopmdCmd /usr/sbin/knopmd;
291	knoptmCmd /usr/sbin/knoptm;
292	knopwatchdCmd /usr/sbin/knopwatchd;

Note: See TracBrowser for help on using the browser.

Download in other formats:

Original Format