[BugFix:
use a more strict iptables rule to prohibit the access to console agent port, in case a environment
does not have a default reject rule.
@@ -169,7 +169,7 @@ public class ManagementServerConsoleProxyBackend extends AbstractConsoleProxyBac
builder.append(String.format(";sudo iptables -I INPUT -m set --match-set ZS-MN src -p tcp -m comment --comment %s -m tcp --dport %s -j ACCEPT",
ConsoleConstants.VNC_IPTABLES_COMMENTS, dport));
}
- builder.append(String.format(";sudo iptables -I INPUT -m set --match-set ZS-MN src -p tcp -m comment --comment %s -m tcp -s 127.0.0.1 --dport %s -j ACCEPT",
+ builder.append(String.format(";sudo iptables -I INPUT -m set --match-set ZS-MN src -p tcp -m comment --comment %s -m tcp ! -s 127.0.0.1 --dport %s -j REJECT",
ConsoleConstants.VNC_IPTABLES_COMMENTS, agentPort));
} else {
builder.append(String.format("sudo iptables-save | grep '%s' | while read LINE;do drule=${LINE//\\\"/};sudo iptables ${drule/-A/-D};done",
@@ -178,7 +178,7 @@ public class ManagementServerConsoleProxyBackend extends AbstractConsoleProxyBac
builder.append(String.format(";sudo iptables -I INPUT -p tcp -m comment --comment %s -m tcp --dport %s -j ACCEPT",
ConsoleConstants.VNC_IPTABLES_COMMENTS, dport));
}
- builder.append(String.format(";sudo iptables -I INPUT -p tcp -m comment --comment %s -m tcp -s 127.0.0.1 --dport %s -j ACCEPT",
+ builder.append(String.format(";sudo iptables -I INPUT -p tcp -m comment --comment %s -m tcp ! -s 127.0.0.1 --dport %s -j REJECT",
ConsoleConstants.VNC_IPTABLES_COMMENTS, agentPort));
}
ShellUtils.run(builder.toString());
