Changeset 2700 for trunk/server/fedora/config/etc/sysconfig/ip6tables

Timestamp:

May 29, 2015, 1:18:37 AM (9 years ago)

Author:

andersk

Message:

Block outgoing port 25

Exceptions are made for localhost, outgoing.mit.edu, and (temporarily)
the cssa user.

Closes: #403

File:

• trunk/server/fedora/config/etc/sysconfig/ip6tables (modified) (1 diff)

trunk/server/fedora/config/etc/sysconfig/ip6tables

@@ -5 +5 @@
 :log-smtp - [0:0]
 -A log-smtp -o lo -j RETURN
--A OUTPUT -p tcp -m tcp --dport 25 --tcp-flags FIN,SYN,RST,ACK SYN -j log-smtp
+-A OUTPUT -p tcp -m tcp --dport 25 --syn -j log-smtp
 -A log-smtp -m owner --uid-owner postfix -j RETURN
 -A log-smtp -j LOG --log-prefix "SMTP " --log-uid
+# 536957056=cssa (temporary exception)
+-A log-smtp -m owner --uid-owner 536957056 -j RETURN
+-A log-smtp -j REJECT --reject-with icmp6-adm-prohibited
 COMMIT