91 lines
3.8 KiB
PHP
Executable File
91 lines
3.8 KiB
PHP
Executable File
#!/usr/bin/env php
|
|
<?php
|
|
declare(strict_types=1);
|
|
|
|
require_once __DIR__ . '/../src/Database.php';
|
|
require_once __DIR__ . '/../src/FirewallManager.php';
|
|
|
|
use App\Database;
|
|
use App\FirewallManager;
|
|
|
|
$cmd = strtolower($argv[1] ?? 'status');
|
|
|
|
switch ($cmd) {
|
|
case 'status':
|
|
$st = FirewallManager::getStatus(true);
|
|
$settings = $st['settings'];
|
|
echo "=== Statut Pare-feu & Sécurité NexusPBX ===\n";
|
|
echo "• Service Fail2ban : " . ($st['is_running'] ? "\033[32mACTIF (En ligne)\033[0m" : "\033[31mARRÊTÉ\033[0m") . "\n";
|
|
echo "• Pare-feu & Filtrage : " . ($settings['firewall_enabled'] ? "\033[32mACTIF\033[0m" : "\033[33mINACTIF\033[0m") . "\n";
|
|
echo "• Mode Strict Certbot 80 : " . ($settings['certbot_strict_port80'] ? "OUI (Port 80 ACME seul)" : "NON (Port 80 ouvert)") . "\n";
|
|
echo "• Port HTTPS Admin : " . ($settings['admin_https_port'] ?? 8443) . "\n";
|
|
$ucpSt = !empty($settings['ucp_enabled']) ? "\033[32mACTIF\033[0m (HTTPS:" . ($settings['ucp_https_port'] ?? 8444) . " / HTTP:" . ($settings['ucp_http_port'] ?? 8084) . ")" : "\033[33mINACTIF\033[0m";
|
|
echo "• Portail Utilisateur UCP: " . $ucpSt . "\n";
|
|
echo "• Total IPs Bannies : " . $st['total_banned'] . "\n";
|
|
if (!empty($st['banned_ips'])) {
|
|
echo "\nListe des IPs bannies :\n";
|
|
foreach ($st['banned_ips'] as $b) {
|
|
echo " - {$b['ip']} (Prison: {$b['jail']} - {$b['jail_label']})\n";
|
|
}
|
|
}
|
|
echo "===========================================\n";
|
|
break;
|
|
|
|
case 'on':
|
|
case 'enable':
|
|
$db = Database::getConnection();
|
|
$db->exec("UPDATE settings SET firewall_enabled = 1, certbot_strict_port80 = 1 WHERE id = 1");
|
|
shell_exec('systemctl start fail2ban 2>&1');
|
|
$settings = FirewallManager::getSettings();
|
|
FirewallManager::applyNginxConfig((int)$settings['admin_https_port'], 1);
|
|
@unlink('/tmp/nexus_fw_status_cache.json');
|
|
echo "\033[32m[OK] Pare-feu NexusPBX activé avec succès (Mode Strict + Fail2ban démarré).\033[0m\n";
|
|
break;
|
|
|
|
case 'off':
|
|
case 'disable':
|
|
$db = Database::getConnection();
|
|
$db->exec("UPDATE settings SET firewall_enabled = 0, certbot_strict_port80 = 0 WHERE id = 1");
|
|
shell_exec('systemctl stop fail2ban 2>&1');
|
|
$settings = FirewallManager::getSettings();
|
|
FirewallManager::applyNginxConfig((int)$settings['admin_https_port'], 0);
|
|
@unlink('/tmp/nexus_fw_status_cache.json');
|
|
echo "\033[33m[OK] Pare-feu NexusPBX désactivé (Mode normal + Fail2ban arrêté).\033[0m\n";
|
|
break;
|
|
|
|
case 'unban':
|
|
$ip = $argv[2] ?? '';
|
|
if (!$ip) {
|
|
echo "Usage: nexus-firewall unban <ip>\n";
|
|
exit(1);
|
|
}
|
|
$res = FirewallManager::unbanIp($ip, 'all');
|
|
echo ($res['success'] ? "\033[32m[OK]\033[0m " : "\033[31m[ERREUR]\033[0m ") . $res['message'] . "\n";
|
|
break;
|
|
|
|
case 'ban':
|
|
$ip = $argv[2] ?? '';
|
|
$jail = $argv[3] ?? 'asterisk';
|
|
if (!$ip) {
|
|
echo "Usage: nexus-firewall ban <ip> [jail]\n";
|
|
exit(1);
|
|
}
|
|
$res = FirewallManager::banIp($ip, $jail);
|
|
echo ($res['success'] ? "\033[32m[OK]\033[0m " : "\033[31m[ERREUR]\033[0m ") . $res['message'] . "\n";
|
|
break;
|
|
|
|
case 'init-ucp':
|
|
case 'sync-ucp':
|
|
case 'apply':
|
|
$settings = FirewallManager::getSettings();
|
|
$res = FirewallManager::saveSettings($settings);
|
|
@unlink('/tmp/nexus_fw_status_cache.json');
|
|
echo ($res['success'] ? "\033[32m[OK]\033[0m " : "\033[31m[ERREUR]\033[0m ") . ($res['message'] ?? '') . "\n";
|
|
break;
|
|
|
|
default:
|
|
echo "Usage: nexus-firewall [status|on|off|init-ucp|ban <ip>|unban <ip>]\n";
|
|
exit(1);
|
|
}
|
|
|