Newsgroup: it.comp.os.linux.iniziare
Titolo: lanciare uno script...

ciao,
dovrei lanciare uno script sh :
1) lo rendo eseguibile chmod 755 nomescript.sh
2) entro nella directory che lo contiene e digito; ./ nomescript.sh
mi dice che ./ is a directory ?
dove sbaglio ?

 dove sbaglio ?
Nel mettere lo spazio:
$ ./nomescript.sh
-- 
Francesco Romani -- Ikitt 
'In fact, users don't read /anything/'                         -- Joel Spolsky

 dove sbaglio ?
Niente spazio tra "./" ed il nome.
Davide
-- 
An exotic journey in downtown Newark is in your future.


eh ho provato anche cosi' ma mi dice:
No such file or directorybin/iptables ( tutto attaccato ) ma io nello script
ho assegnato una variabile a sbin/iptables e non bin/iptables ( e' uno
script x il firewall ),
poi errori di :
Command non found 187
Command non found 188
ecc
questo script e' collaudato ( me lo ha passato un amico esperto ) , lo
lancio da una directory che ho creato in /root
dove, ulteriormente, sbaglio?
ciao e grazie

 dove, ulteriormente, sbaglio?
forse funziona(no) solo da root;
r
-- 
A b c d e f
g h i j k l
m n o p q r
s t u v w
x y z
[Louis Aragon: Suicide]
Ramapage: 
http://umpf.net/

 questo script e' collaudato
...si vede...
Davide
-- 
Decision maker, n.:
	The person in your office who was unable to form a task force
before the music stopped.

grenzo alle 11:35, venerdě 20 agosto 2004, ha scarabocchiato:

nello spazio
prova ./nomescript.sh
ciao
-- 
boydon
Non importa quanto lavori, non lavorerai mai abbastanza.

 lancio da una directory che ho creato in /root
collaudato nella sua macchina forse?
puň essere che chiami comandi di pacchetti che tu non hai installato, o
che non hai nel PATH, o che li richiami con un percorso sbagliato, o
che....
ciao
-- 
boydon
Windows ha eseguito una operazione non valida e sara` terminato.
Se il problema persiste, si consiglia di installare Linux.

 dove, ulteriormente, sbaglio?
Difficile dirlo, a questo punto, senza vedere lo script. Almeno per me
intendo.



no, sono root


 questo e' il pezzo dello script dove assegno le variabili:
iptables=/sbin/iptables
modprobe=/sbin/modprobe
# Available interfaces
EXT_DEV=eth1
INT_DEV=eth0
# Configured networks
mi sembra corretto no?
grazie

 intendo.
no sfera di cristallo?
ahiahiahiahi
:)
-- 
boydon
Nonno, se non la smetti ti spezzo le dita e ci gioco a Shangai.
                -- Nico, "Mai Dire Gol"


mah, e' uno script x configurare il firewall con iptables, dovrebbe essere
una cosa 'standard' ( ho l'installazione Fedora1 ... )

  questo e' il pezzo dello script dove assegno le variabili:
Bravo, adesso posta anche il pezzo dove ti da' gli errori.
Davide
-- 
Surprise your boss.  Get to work on time.

 essere una cosa 'standard' ( ho l'installazione Fedora1 ... )
ecco, _dovrebbe_
perchč, tanto per dire la prima cosa che mi viene in mente, lo script
potrebbe chiamare modprobe iptable_mangle e magari sul tuo kernel non
l'hai compilato ne statico ne come modulo
di coseguenza fallirebbe sia il modprobe che i comandi che usano il
mangle
č questa č solo la prima cosa che mi viene in mente, poi potrebbero
eserci PATH sbagliati o altre cose diverse
ciao
-- 
boydon
"Scusa, ma...  e' il tuo fiato, o e' arrivato il circo in citta'?"
                -- Mago Oronzo (Raul Cremona), "Mai Dire Gol"


hem.. e' solo in quel pezzo che assegno sbin/iptables...
volevo ottenere un file di log che contenesse gli esiti del comando
./iptables.sh ed ho digitato ./iptables > logiptables.txt ma il file
generato non contiene nulla. Come faccio a scrivere in un file l'esito di un
comando ?
grazie

 ./iptables.sh ed ho digitato ./iptables > logiptables.txt ma il file
./iptables.sh > log 2>&1
Davide
-- 
Don't steal; thou'lt never thus compete successfully in business.
Cheat.
		-- Ambrose Bierce

inizia cosi':
./iptables.sh: line 26:
: command not found
e, contando le linee dello script ( comprese quelle commentate con # ) alla
26 trovo:
iptables=/sbin/iptables
il percorso /sbin/iptables esiste...

 e, contando le linee dello script ( comprese quelle commentate con # )
*POSTA* sto' cavolo di script... ti spiace???
Davide
-- 
"I like being single.  I'm always there when I need me."
		-- Art Leo

 Davide
ok, pensavo fosse troppo lungo..:-))
#########################################################
# VARIABLES
#
# Here we define all the variables that we are going to
# use later in the ruleset.
#
# Defining executables
iptables=/sbin/iptables
modprobe=/sbin/modprobe
# Available interfaces
EXT_DEV=eth1
INT_DEV=eth0
# Configured networks
INT_NET=
192.168.0.0/16
EXT_NET=x.x.x.x/29
# Firewall external IP address
FW=x.x.x.x
# Here we set the kind of check we use to match new states
# for tcp. Note that with this configuration ESTABLISHED
# connection will starve each time you reload rules.
tcpinit="-m state --state NEW"
# Defining also the kind of check we do for new udp
# connections. This will be mainly unuseful, but
# elegance rules...
udpinit="-m state --state NEW"
#########################################################
# ENVIRONMENT
#
# Here we set global-system preferences which determine
# OS's behaviour.
# Each semaphore is preceded by its meaning and use.
#
# Ping scanning is typically used to determine which
# hosts on a network are up. Typically this is done by
# sending ICMP ECHO request packets to the target host.
# This is seemingly innocent behavior, however often
# network administrators will block such traffic to
# increase their obscurity. The choices involve blocking
# ICMP ECHO requests to broadcast/multicast addresses
# and directly to the host itself.
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
#
# ICMP redirect messages can also be a pain. If your
# box is not acting as a router, you'll probably want
# to disable them:
echo 1 > /proc/sys/net/ipv4/conf/all/accept_redirects
#
# Sometimes you will come across routers that send out
# invalid responses to broadcast frames. This is a
# violation of RFC 1122, "Requirements for Internet Hosts
# -- Communication Layers". As a result, these events are
# logged by the kernel. To avoid filling up your logfile
# with unnecessary clutter, you can tell the kernel not
# to issue these warnings:
echo 0 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
#
# Here determine if we are enabling forwarding between
# network interfaces or not.
echo 1 > /proc/sys/net/ipv4/ip_forward
#
# The rp_filter can reject incoming packets if their
# source address doesn't match the network interface
# that they're arriving on, which helps to prevent IP
# spoofing.It's important to note that even if you do
# not enable the rp_filter, protection against broadcast
# spoofing is always on. Also, the protection it provides
# is only against spoofed internal addresses; external
# addresses can still be spoofed
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
#
#  If you have compiled your kernel with
# CONFIG_SYNCOOKIES, you will be able to optionally turn
# on or off protection against SYN flood attacks. Note
# the emphasis, as compiling the kernel with this value
# does not enable it by default. It works by sending out
# 'syncookies' when the syn backlog queue of a socket
# overflows.
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
#
# Normally, a host has no control over the route any
# particular packet takes beyond its first hop. It is up
# to the other hosts on the network to complete the
# delivery. IP Source Routing (SRR) is a method of
# specifying the exact path that a packet should take
# among the other hosts to get to its destination.
# This is generally a bad idea for the security
# conscious, as someone could direct packets to you
# through a trusted interface and effectively bypass
# your security in some cases.
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
#
# Packets that have source addresses with no known route
# are referred to as "martians".
echo 0 > /proc/sys/net/ipv4/conf/all/log_martians
#########################################################
# KERNEL MODULES LOADING
#
#f Here we tell netfilter which modules to load.
# These could depend on which kind of controls you are
# going to make, and also on how your kernel has been
# compiled.
# We include here only those which are usually needed.
# You may want to take a look at your
# /lib/modules/`uname -r`/kernel/net/ipv4/netfilter
# directory, which is where iptables modules compiled
# with your kernel are stored.
# Just refer to kernel help to understand what each of
# those does.
#
$modprobe ip_conntrack_ftp
$modprobe ip_nat_ftp
$modprobe ipt_REJECT
#########################################################
# PRE-RULES
#
# Here we just flush all chains and define default
# filtering policies, create necessary chains.
#
$iptables -F FORWARD
$iptables -F -t nat
$iptables -P INPUT DROP
$iptables -P FORWARD DROP
$iptables -P OUTPUT DROP
#########################################################
# ENABLE LOOPBACK
#
# Allow loopback, which is required by most local
# services to work correctly.
$iptables -A INPUT -i lo -j ACCEPT
$iptables -A OUTPUT -o lo -j ACCEPT
#########################################################
# DROP SPOOFING
#
# Block IP spoofing attacks from the Evil Internet,
# filtering all packets coming from reserved address
# space (most likely spoofed or misconfigured).
# Obviously, we can't reply to them.
# By default, we don't log them. Anyway, just uncomment
# the LOG rules to log.
# Please note that we do not do any egress filtering on
# any packet which is going to exit with its internal
# address.
# This kind of filtering must be done in the
# POSTROUTING chain. Think we'll include it later on.
#
#$iptables -A INPUT -i $EXT_DEV -s 
192.168.0.0/16
 -j LOG --log-prefix="
Spoofed source? "
#$iptables -A INPUT -i $EXT_DEV -s 
172.16.0.0/12
 -j LOG --log-prefix="
Spoofed source? "
#$iptables -A INPUT -i $EXT_DEV -s 
10.0.0.0/8
 -j LOG --log-prefix=" Spoofed
source? "
$iptables -A INPUT -i $EXT_DEV -s 
192.168.0.0/16
 -j DROP
$iptables -A INPUT -i $EXT_DEV -s 
172.16.0.0/12
 -j DROP
$iptables -A INPUT -i $EXT_DEV -s 
10.0.0.0/8
 -j DROP
#$iptables -A FORWARD -i $EXT_DEV -s 
192.168.0.0/16
 -j LOG --log-prefix="
Spoofed source? "
#$iptables -A FORWARD -i $EXT_DEV -s 
172.16.0.0/12
 -j LOG --log-prefix="
Spoofed source? "
#$iptables -A FORWARD -i $EXT_DEV -s 
10.0.0.0/8
 -j LOG --log-prefix="
Spoofed source? "
$iptables -A FORWARD -i $EXT_DEV -s 
192.168.0.0/16
 -j DROP
$iptables -A FORWARD -i $EXT_DEV -s 
172.16.0.0/12
 -j DROP
$iptables -A FORWARD -i $EXT_DEV -s 
10.0.0.0/8
 -j DROP
#########################################################
# DROP BAD TRAFFIC
#
# Here we block suspicious tcp segments. These present
# uncommon combinations of tcp flags often used by
# network scanners.
# Please note that these will be blocked anyway if
# "tcpinit" variable has been initialized with SYN check.
# We log them before blocking, but with a very low rate,
# because they really could be a lot during massive scans.
#
$iptables -A FORWARD -p tcp --tcp-flags ALL FIN,URG,PSH -m limit --limit
5/minute -j LOG --log-level notice --log-prefix "XMAS Scan: "
$iptables -A FORWARD -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$iptables -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit
5/minute -j LOG --log-level notice --log-prefix "SYN/FIN: "
$iptables -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit
5/minute -j LOG --log-level notice --log-prefix "SYN/RST: "
$iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
#########################################################
# IP MASQUERADING (many-to-one mapping)
#
# Masquerade the hosts in the Internal network, dynamically
# changing packets as they traverse the external interface.
# This allows a single IP address on the translating host
# to support network traffic for a larger range of machines
# on an inside network.
# Please note that the following rule works well only for
# static ip-addresses. If you are using a dynamic-ip
# connection, please use the second rule and comment out
# the first one: this is much more cpu-intensive, but will
# work
$iptables -A POSTROUTING -t nat -o $EXT_DEV -j SNAT --to-source $FW
#########################################################
# RELATED AND ESTABLISHED RULES
#
# Here we accept everything that has been already allowed
# (like return sessions) and all those sessions that are
# related to an allowed one (like data-port for ftp
# sessions or icmp responses from closed udp ports.
# We allow them here so these packets won't traverse all
# the following rules...
#
$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#########################################################
# STATEFUL FILTERING - INBOUND
#
# firewall itself
# We just enable ssh from inside for administration
# purposes...
$iptables -A INPUT -p tcp -i $INT_DEV --dport 22 $tcpinit -j ACCEPT
# ...do enable ping from everywhere...
$iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
# ...and finally accept everything exiting from firewall itself...
$iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#
# Last, we treat all requests directed to auth (ident)
# service. This is often cause of timeouts during
# connection establishing if dropped, so we explicitly
# reject it, bot inbound and outbound...
$iptables -A FORWARD -p tcp --dport 113 $tcpinit -j REJECT
#########################################################
# STATEFUL FILTERING - OUTBOUND
#
# Here we allow internal machines to just reach for the
# services they need.
#
# Let internal network go everywhere...
$iptables -A FORWARD -i $INT_DEV -o $EXT_DEV -m state --state NEW -j ACCEPT
#########################################################
# LOG RULES
#
# Here we log everything is out from allowed connections,
# limiting log rate to 1/sec to avoid syslog flooding
#
$iptables -A INPUT -m limit --limit 1/s -j LOG --log-prefix "out_of_INPUT "
$iptables -A FORWARD -m limit --limit 1/s -j LOG --log-prefix
"out_of_FORWARD "
$iptables -A OUTPUT -m limit --limit 1/s -j LOG --log-prefix "out_of_OUTPUT
"

 ok, pensavo fosse troppo lungo..:-))
Nello script che hai postato la linea 26 non contiene niente,
dalla linea 156 in avanti ci sono una serie di comandi che sono
'spezzati' su due linee, questa roba deve essere riunita su una singola
linea dato che e' commentata o commentare anche la seconda linea.
Il tuo script non ha niente di anormale e funziona perfettamente.
Quindi il problema non e' li' ma da qualche altra parte.
Adesso posta ESATTAMENTE l'errore o gli errori che ottieni e come
lo esegui.
Davide
-- 
Gold, n.:
	A soft malleable metal relatively scarce in distribution.  It
is mined deep in the earth by poor men who then give it to rich men who
immediately bury it back in the earth in great prisons, although gold
hasn't done anything to them.
		-- Mike Harding, "The Armchair Anarchist's Almanac"

ok,
lo eseguo da root: ./iptables.sh
il log che ho ottenuto e' questo:
./iptables.sh: line 26:
: command not found
./iptables.sh: line 42: /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
: No such file or directory
./iptables.sh: line 43: /proc/sys/net/ipv4/icmp_echo_ignore_all
: No such file or directory
./iptables.sh: line 48: /proc/sys/net/ipv4/conf/all/accept_redirects
: No such file or directory
./iptables.sh: line 57: /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
: No such file or directory
./iptables.sh: line 61: /proc/sys/net/ipv4/ip_forward
: No such file or directory
./iptables.sh: line 71: /proc/sys/net/ipv4/conf/all/rp_filter
: No such file or directory
./iptables.sh: line 80: /proc/sys/net/ipv4/tcp_syncookies
: No such file or directory
./iptables.sh: line 92: /proc/sys/net/ipv4/conf/all/accept_source_route
: No such file or directory
./iptables.sh: line 96: /proc/sys/net/ipv4/conf/all/log_martians
: No such file or directory
./iptables.sh: line 97:
: command not found
./iptables.sh: line 98:
: command not found
./iptables.sh: line 114: /sbin/modprobe
: No such file or directory
./iptables.sh: line 115: /sbin/modprobe
: No such file or directory
./iptables.sh: line 116: /sbin/modprobe
: No such file or directory
./iptables.sh: line 117:
: command not found
./iptables.sh: line 118:
: command not found
./iptables.sh: line 125: /sbin/iptables
: No such file or directory
./iptables.sh: line 126: /sbin/iptables
: No such file or directory
./iptables.sh: line 127: /sbin/iptables
: No such file or directory
./iptables.sh: line 128: /sbin/iptables
: No such file or directory
./iptables.sh: line 129: /sbin/iptables
: No such file or directory
./iptables.sh: line 130:
: command not found
./iptables.sh: line 131:
: command not found
./iptables.sh: line 137: /sbin/iptables
: No such file or directory
./iptables.sh: line 138: /sbin/iptables
: No such file or directory
./iptables.sh: line 139:
: command not found
./iptables.sh: line 140:
: command not found
./iptables.sh: line 159: /sbin/iptables
: No such file or directory
./iptables.sh: line 160: /sbin/iptables
: No such file or directory
./iptables.sh: line 161: /sbin/iptables
: No such file or directory
./iptables.sh: line 165: /sbin/iptables
: No such file or directory
./iptables.sh: line 166: /sbin/iptables
: No such file or directory
./iptables.sh: line 167: /sbin/iptables
: No such file or directory
./iptables.sh: line 168:
: command not found
./iptables.sh: line 169:
: command not found
./iptables.sh: line 181: /sbin/iptables
: No such file or directory
./iptables.sh: line 182: /sbin/iptables
: No such file or directory
./iptables.sh: line 183: /sbin/iptables
: No such file or directory
./iptables.sh: line 184: /sbin/iptables
: No such file or directory
./iptables.sh: line 185: /sbin/iptables
: No such file or directory
./iptables.sh: line 186: /sbin/iptables
: No such file or directory
./iptables.sh: line 187:
: command not found
./iptables.sh: line 188:
: command not found
./iptables.sh: line 202: /sbin/iptables
: No such file or directory
./iptables.sh: line 203:
: command not found
./iptables.sh: line 204:
: command not found
./iptables.sh: line 215: /sbin/iptables
: No such file or directory
./iptables.sh: line 216: /sbin/iptables
: No such file or directory
./iptables.sh: line 217: /sbin/iptables
: No such file or directory
./iptables.sh: line 218:
: command not found
./iptables.sh: line 219:
: command not found
./iptables.sh: line 226: /sbin/iptables
: No such file or directory
./iptables.sh: line 228: /sbin/iptables
: No such file or directory
./iptables.sh: line 230: /sbin/iptables
: No such file or directory
./iptables.sh: line 236: /sbin/iptables
: No such file or directory
./iptables.sh: line 237:
: command not found
./iptables.sh: line 238:
: command not found
./iptables.sh: line 239:
: command not found
./iptables.sh: line 240:
: command not found
./iptables.sh: line 248: /sbin/iptables
: No such file or directory
./iptables.sh: line 249:
: command not found
./iptables.sh: line 250:
: command not found
./iptables.sh: line 257: /sbin/iptables
: No such file or directory
./iptables.sh: line 258: /sbin/iptables
: No such file or directory
./iptables.sh: line 259: /sbin/iptables
: No such file or directory

 ./iptables.sh: line 186: /sbin/iptables
Non e' che e' /usr/sbin/iptables invece di /sbin/iptables?
Davide
-- 
Everything should be built top-down, except the first time.

 ok, pensavo fosse troppo lungo..:-))
No, forse e' troppo corto.
Aggiungici
#!/bin/bash
come prima riga e riprova:
-- 
           |Save our planet!
    Ciao   |Save wildlife!
   roberto |For your E-MAIL use ONLY recycled Bytes  !!
           |roberto poggi   
rpo...@softhome.net

e' andato! , grazie x il tuo aiuto...
utlima cosa, come faccio a controllare se ha preso correttamente le regole
di iptables ? c'e' la possibilita' di monitorare qual'e' l'azione del
firewall ?
ciao

 di iptables?
Se non ti ha dato errore le ha prese, prova a collegarti su una
porta 'chiusa' e vedi se funziona o no.
Davide
-- 
"I'm prepared for all emergencies but totally unprepared for everyday
life."