diff --git a/install.zsh b/install.zsh index e6b9c5d..5f4cc07 100755 --- a/install.zsh +++ b/install.zsh @@ -64,6 +64,13 @@ ask() { } +rm_if_present() { + local object="$1" + if [[ -a "$object" ]]; then + rm -fr "$object" + fi +} + # synapsys: # abort_install "reason" abort_install() { @@ -71,14 +78,20 @@ abort_install() { exit 1 } +#--------[main]--------- + +if [[ ${EUID} != 0 ]]; then + abort_install "Root privilegies are required to run installation" +fi + if [[ ! $(id -g ipban) ]]; then - sudo groupadd --system ipban + groupadd --system ipban else abort_install "Group %Bipban%b already exists" fi if [[ ! $(id -u ipban) ]]; then - sudo useradd \ + useradd \ --system \ --gid ipban \ --no-create-home \ @@ -90,21 +103,46 @@ else abort_install "User %Bipban%b already exists" fi -db_dir="/var/lib/ipban" -if [[ ! -d $db_dir ]]; then - sudo mkdir $db_dir - sudo chmod 775 $db_dir - sudo chown ipban:ipban $db_dir +daemon_dir="/opt/ipban" +if [[ ! -d $daemon_dir ]]; then + #creating directory for daemon + mkdir $daemon_dir + chmod u=rx,g=rx,o=- $daemon_dir + chown ipban:ipban $daemon_dir else - if ask "n" "directory $db_dir already exists. rewrite?"; then - sudo rm -rf $db_dir - - sudo mkdir $db_dir - sudo chmod 775 $db_dir - sudo chown ipban:ipban $db_dir + if ask "n" "directory $daemon_dir already exists. overwrite?"; then + rm -rf $daemon_dir + mkdir $daemon_dir + chmod u=rx,g=rx,o=- $daemon_dir + chown ipban:ipban $daemon_dir else - abort_install "User decided not to overwrite \'$db_dir\'. Which is requred to store banned ip\'s" + abort_install "User decided not to overwrite \'$daemon_dir\'. Which is needed for daemon" + fi + + #copying daemon to it's dir + cp ./py/daemon.py $daemon_dir/daemon.py + chmod u=rx,g=rx,o=- $daemon_dir/daemon.py + chown ipban:ipban $daemon_dir/daemon.py +fi + +bin_client="/bin/ipban" +sbin_client="/sbin/ipban" +if [[ ! -f $bin_client ]]; then + if ! ask "n" "$bin_client already exists. overwrite?"; then + abort_install "Couldn't install ipban client." + fi +fi +if [[ ! -f $sbin_client ]]; then + if ! ask "n" "$sbin_client already exists. overwrite?"; then + abort_install "Couldn't install ipban client." fi fi -#TODO: create systemd service +#client binary +cp ./py/client.py "$bin_client" +cp ./py/client.py "$sbin_client" + +#systemd service +systemd_service="./systemd/ipban.service" +cp "$systemd_service" /etc/systemd/system +systemctl enable --now ipban.service diff --git a/py/client.py b/py/client.py index 22291d9..a0d7f27 100755 --- a/py/client.py +++ b/py/client.py @@ -17,12 +17,10 @@ def conctruct_json(ban_list: Iterable[ipaddress.IPv4Address] | Iterable[ipaddres "remark": "", "reason": "" } - print(json_map) for ip in uban_list: json_map["uban"][str(ip)] = { "reason": "" } - print(json_map) return json.dumps(json_map) @@ -70,7 +68,7 @@ def req_action(sock_path:socket.socket, args): client.sendall(request.encode()) client.shutdown(socket.SHUT_WR) print(client.recv(4096).decode()) - + if __name__ == "__main__": parser = argparse.ArgumentParser() @@ -85,7 +83,7 @@ if __name__ == "__main__": socket_path = "/run/ipban/ipban.sock" client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) client.connect(socket_path) - if args.ban != None and args.uban != None: + if args.ban != None or args.uban != None: req_action(client,args) if args.list: req_list(client) diff --git a/py/daemon.py b/py/daemon.py index efbc80f..d0c79a1 100755 --- a/py/daemon.py +++ b/py/daemon.py @@ -235,6 +235,6 @@ if __name__ == "__main__": #flush_nft([ ipaddress.IPv4Address("123.134.124.1"), ipaddress.IPv4Address("8.8.8.8")]) sock_path = Path("/run/ipban/ipban.sock") - sock_path.parent.mkdir(parents=True,exist_ok=True) + #sock_path.parent.mkdir(parents=True,exist_ok=True) run_server(sock_path, sql_conn) destroy_nft_table() diff --git a/systemd/ipban.service b/systemd/ipban.service new file mode 100644 index 0000000..fca527b --- /dev/null +++ b/systemd/ipban.service @@ -0,0 +1,29 @@ +[Unit] +Description=Service for banning ip adresses +After=nftables.target +#Before= + +[Service] +ExecStart=/bin/python /opt/ipban/daemon.py + +User=ipban +Group=ipban + +StateDirectory=ipban +StateDirectoryMode=775 + +RuntimeDirectory=ipban +RuntimeDirectoryMode=775 + +StandardOutput=journal +StandardError=journal + +Type=simple +Restart=on-failure + +AmbientCapabilities=CAP_NET_ADMIN +CapabilityBoundingSet=CAP_NET_ADMIN +NoNewPrivileges=yes + +[Install] +WantedBy=multi-user.target