OXIESEC PANEL

Name	Size	Modified	Perms
📁 ..	-	05/10/2024 06:51:59 AM	rwxr-xr-x
📄 :etc:apt:apt.conf.d:20auto-upgrades	80 bytes	04/29/2019 10:13:14 AM	rw-r--r--
📄 :etc:apt:apt.conf.d:50unattended-upgrades	3.71 KB	02/17/2020 11:37:03 AM	rw-r--r--
📄 :etc:default:grub	1.18 KB	10/21/2019 03:50:10 PM	rw-r--r--
📄 :etc:papersize	3 bytes	01/31/2023 12:39:15 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:calendar.ini	74 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:ctype.ini	71 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:curl.ini	68 bytes	05/26/2020 01:09:11 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:dom.ini	66 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:exif.ini	70 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:fileinfo.ini	74 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:ftp.ini	69 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:gettext.ini	73 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:iconv.ini	71 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:json.ini	68 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:mysqli.ini	71 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:mysqlnd.ini	72 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:opcache.ini	79 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:pdo.ini	69 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:pdo_mysql.ini	74 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:phar.ini	70 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:posix.ini	71 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:readline.ini	76 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:shmop.ini	71 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:simplexml.ini	72 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:sockets.ini	73 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:sysvmsg.ini	73 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:sysvsem.ini	73 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:sysvshm.ini	73 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:tokenizer.ini	75 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:wddx.ini	67 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:xml.ini	66 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:xmlreader.ini	72 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:xmlwriter.ini	72 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:php:7.2:mods-available:xsl.ini	66 bytes	01/13/2020 06:39:59 PM	rw-r--r--
📄 :etc:rsyslog.d:50-default.conf	1.1 KB	01/30/2018 04:51:09 PM	rw-r--r--
📄 :etc:ssh:sshd_config	3.17 KB	08/13/2021 06:17:39 AM	rw-r--r--
📄 :etc:ufw:after.rules	1004 bytes	03/25/2019 09:14:25 PM	rw-r--r--
📄 :etc:ufw:after6.rules	915 bytes	03/25/2019 09:14:25 PM	rw-r--r--
📄 :etc:ufw:before.rules	2.48 KB	03/25/2019 09:14:25 PM	rw-r--r--
📄 :etc:ufw:before6.rules	6.54 KB	03/25/2019 09:14:25 PM	rw-r--r--
📄 :run:grub:menu.lst	868 bytes	05/10/2024 06:51:58 AM	rw-------

Editing: :etc:ufw:before6.rules

#
# rules.before
#
# Rules that should be run before the ufw command line added rules. Custom
# rules should be added to one of these chains:
#   ufw6-before-input
#   ufw6-before-output
#   ufw6-before-forward
#

# Don't delete these required lines, otherwise there will be errors
*filter
:ufw6-before-input - [0:0]
:ufw6-before-output - [0:0]
:ufw6-before-forward - [0:0]
# End required lines

# allow all on loopback
-A ufw6-before-input -i lo -j ACCEPT
-A ufw6-before-output -o lo -j ACCEPT

# drop packets with RH0 headers
-A ufw6-before-input -m rt --rt-type 0 -j DROP
-A ufw6-before-forward -m rt --rt-type 0 -j DROP
-A ufw6-before-output -m rt --rt-type 0 -j DROP

# quickly process packets for which we already have a connection
-A ufw6-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw6-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw6-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# multicast ping replies are part of the ok icmp codes for INPUT (rfc4890,
# 4.4.1 and 4.4.2), but don't have an associated connection and are otherwise
# be marked INVALID, so allow here instead.
-A ufw6-before-input -p icmpv6 --icmpv6-type echo-reply -j ACCEPT

# drop INVALID packets (logs these in loglevel medium and higher)
-A ufw6-before-input -m conntrack --ctstate INVALID -j ufw6-logging-deny
-A ufw6-before-input -m conntrack --ctstate INVALID -j DROP

# ok icmp codes for INPUT (rfc4890, 4.4.1 and 4.4.2)
-A ufw6-before-input -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
# codes 0 and 1
-A ufw6-before-input -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
# codes 0-2 (echo-reply needs to be before INVALID, see above)
-A ufw6-before-input -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type echo-request -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
# IND solicitation
-A ufw6-before-input -p icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -j ACCEPT
# IND advertisement
-A ufw6-before-input -p icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -j ACCEPT
# MLD query
-A ufw6-before-input -p icmpv6 --icmpv6-type 130 -s fe80::/10 -j ACCEPT
# MLD report
-A ufw6-before-input -p icmpv6 --icmpv6-type 131 -s fe80::/10 -j ACCEPT
# MLD done
-A ufw6-before-input -p icmpv6 --icmpv6-type 132 -s fe80::/10 -j ACCEPT
# MLD report v2
-A ufw6-before-input -p icmpv6 --icmpv6-type 143 -s fe80::/10 -j ACCEPT
# SEND certificate path solicitation
-A ufw6-before-input -p icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -j ACCEPT
# SEND certificate path advertisement
-A ufw6-before-input -p icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -j ACCEPT
# MR advertisement
-A ufw6-before-input -p icmpv6 --icmpv6-type 151 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
# MR solicitation
-A ufw6-before-input -p icmpv6 --icmpv6-type 152 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
# MR termination
-A ufw6-before-input -p icmpv6 --icmpv6-type 153 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT

# ok icmp codes for OUTPUT (rfc4890, 4.4.1 and 4.4.2)
-A ufw6-before-output -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
# codes 0 and 1
-A ufw6-before-output -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
# codes 0-2
-A ufw6-before-output -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type echo-request -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
# IND solicitation
-A ufw6-before-output -p icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -j ACCEPT
# IND advertisement
-A ufw6-before-output -p icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -j ACCEPT
# MLD query
-A ufw6-before-output -p icmpv6 --icmpv6-type 130 -s fe80::/10 -j ACCEPT
# MLD report
-A ufw6-before-output -p icmpv6 --icmpv6-type 131 -s fe80::/10 -j ACCEPT
# MLD done
-A ufw6-before-output -p icmpv6 --icmpv6-type 132 -s fe80::/10 -j ACCEPT
# MLD report v2
-A ufw6-before-output -p icmpv6 --icmpv6-type 143 -s fe80::/10 -j ACCEPT
# SEND certificate path solicitation
-A ufw6-before-output -p icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -j ACCEPT
# SEND certificate path advertisement
-A ufw6-before-output -p icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -j ACCEPT
# MR advertisement
-A ufw6-before-output -p icmpv6 --icmpv6-type 151 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
# MR solicitation
-A ufw6-before-output -p icmpv6 --icmpv6-type 152 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
# MR termination
-A ufw6-before-output -p icmpv6 --icmpv6-type 153 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT

# ok icmp codes for FORWARD (rfc4890, 4.3.1)
-A ufw6-before-forward -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
-A ufw6-before-forward -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
# codes 0 and 1
-A ufw6-before-forward -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
# codes 0-2
-A ufw6-before-forward -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
-A ufw6-before-forward -p icmpv6 --icmpv6-type echo-request -j ACCEPT
-A ufw6-before-forward -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
# ok icmp codes for FORWARD (rfc4890, 4.3.2)
# Home Agent Address Discovery Reques
-A ufw6-before-input -p icmpv6 --icmpv6-type 144 -j ACCEPT
# Home Agent Address Discovery Reply
-A ufw6-before-input -p icmpv6 --icmpv6-type 145 -j ACCEPT
# Mobile Prefix Solicitation
-A ufw6-before-input -p icmpv6 --icmpv6-type 146 -j ACCEPT
# Mobile Prefix Advertisement
-A ufw6-before-input -p icmpv6 --icmpv6-type 147 -j ACCEPT

# allow dhcp client to work
-A ufw6-before-input -p udp -s fe80::/10 --sport 547 -d fe80::/10 --dport 546 -j ACCEPT

# allow MULTICAST mDNS for service discovery
-A ufw6-before-input -p udp -d ff02::fb --dport 5353 -j ACCEPT

# allow MULTICAST UPnP for service discovery
-A ufw6-before-input -p udp -d ff02::f --dport 1900 -j ACCEPT

# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT