From: Dinko Korunic <Dinko.Korunic@CARNet.hr>
Date: Thu, 20 Sep 2007 14:10:31 +0000 (+0000)
Subject: r8: - don't import ssh bruteforce rules if there are already some rules
X-Git-Tag: v1.4.8~11
X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=commitdiff_plain;h=75e879985fa0baa9d3287ad71341a7c28b9b9ca5;p=iptables-cn.git

r8: - don't import ssh bruteforce rules if there are already some rules
---

diff --git a/debian/postinst b/debian/postinst
index 9293ede..54c8a67 100755
--- a/debian/postinst
+++ b/debian/postinst
@@ -48,12 +48,12 @@ fi
 # REJECT recent if there is none..
 # also, save current set of rules into active and inactive configuration
 if [ ! -e /var/lib/iptables/active ]; then
-    . /usr/share/doc/iptables-cn/examples/ssh-bruteforce
-    iptables-save > /var/lib/iptables/active
+    if ! iptables-save | grep '^-' >/dev/null; then
+        echo "CN: Netfilter rules empty: importing SSH bruteforce rules"
+        . /usr/share/doc/iptables-cn/examples/ssh-bruteforce
+        iptables-save > /var/lib/iptables/active
+    fi
 fi
-if [ ! -e /var/lib/iptables/inactive ]; then
-   cp /var/lib/iptables/active /var/lib/iptables/inactive 
-fi 
 
 # dh_installdeb will replace this with shell code automatically
 # generated by other debhelper scripts.