Jaya Hardening 💎

JAYAMAC JAYANTA JAYARAW JAYATOR
MAC TOR RAW TOR
UID RAW VPN FORCE
NON NON NETNS NETNS
HISTORY HISTORY SANDBOX SANDBOX

Jayamac 検証:✅️

#!/bin/sh

# PROJECT: Jayamac v2
# UPDATES: 2026-04-30 14:56:28 JST
# LICENSE: The Unlicense (unlicense.org)

PATH='/usr/sbin:/usr/bin:/sbin:/bin'
[ "$(id -u)" -eq 0 ] || exit 1; type ip macchanger || exit 2
rm -rfv /var/db/dhcp/ /var/db/dhcpcd/ /var/lib/dhcp/ /var/lib/dhcpcd/ || exit 3

for f in /sys/class/net/*; do
  i="${f##*/}"
  [ "$i" != "lo" ] || continue
  [ -e "$f/device" ] || continue
  ip link set dev "$i" down || continue

  {
    ip addr flush dev "$i"
    ip neigh flush dev "$i"
  } || echo "fail: ip: $i" >&2

  macchanger -A "$i" || echo "fail: mac: $i" >&2
  ip link set dev "$i" up && echo "good: up: $i"
done

Jayanta 検証:✅️

#!/bin/sh

# PROJECT: Jayanta v3
# UPDATES: 2026-04-30 15:23:55 JST
# LICENSE: The Unlicense (unlicense.org)

PATH='/usr/sbin:/usr/bin:/sbin:/bin'; TOR="${1:-tor}"; RAW="${2:-privoxy}"
[ "$(id -u)" -eq 0 ] || exit 1; type nft tor privoxy conntrack || exit 2
( id "$TOR" && id "$RAW" ) || { echo 'sudo sh jayanta [debian-]tor[anon] privoxy'; exit 3; }
sysctl net.ipv4.ip_forward=0 net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1 || exit 4

nft add table ip nat; nft add table ip filter; nft flush table ip nat; nft flush table ip filter
nft add chain ip nat output '{ type nat hook output priority dstnat; policy accept; }'
for c in input output forward; do nft add chain ip filter $c "{ type filter hook $c priority filter; policy drop; }"; done; conntrack -F expect; conntrack -F
nft add set ip nat reserved '{ type ipv4_addr; flags interval; elements = { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24, 192.0.2.0/24, 192.31.196.0/24, 192.52.193.0/24, 192.88.99.0/24, 192.168.0.0/16, 192.175.48.0/24, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/4, 240.0.0.0/4 }; }'

nft add rule ip nat output udp dport 53 redirect to 9053
nft add rule ip nat output ip daddr 10.192.0.0/10 tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack redirect to 9040
nft add rule ip nat output skuid != "{ $TOR, $RAW }" oifname != "lo" ip daddr != @reserved tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack redirect to 9040

nft add rule ip filter input ct state established accept
nft add rule ip filter input iifname "lo" accept
nft add rule ip filter output ct state vmap '{ invalid : drop, established : accept }'
nft add rule ip filter output ct state new ip daddr 127.0.0.1 meta l4proto . th dport vmap '{ udp . 9053 : accept, tcp . 9040 : accept, tcp . 9050 : accept }'
nft add rule ip filter output ct state new tcp dport 443 tcp flags syn / fin,syn,rst,ack skuid "{ $TOR, $RAW }" accept
nft add rule ip filter output oifname "lo" ip daddr 127.0.0.1 accept; nft list ruleset

{
  echo "SafeSocks 1"
  echo "ReachableAddresses *:443"
  echo "User $TOR"
  echo "DataDirectory /var/lib/tor"
  echo "DNSPort 9053"
  echo "AutomapHostsOnResolve 1"
  echo "AutomapHostsSuffixes .onion"
  echo "VirtualAddrNetworkIPv4 10.192.0.0/10"
  echo "TransPort 9040 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort"
  echo "SocksPort 9050 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort"
} > /etc/tor/torrc; cat /etc/tor/torrc; { sv restart tor || service tor restart || systemctl restart tor || rc-service tor restart; } >/dev/null 2>&1

Jayaraw 検証:✅️

#!/bin/sh

# PROJECT: Jayaraw v1
# UPDATES: 2026-04-29 09:30:12 JST
# LICENSE: The Unlicense (unlicense.org)

PATH='/usr/sbin:/usr/bin:/sbin:/bin'
case "$SUDO_USER" in ''|root) exit 1 ;; esac; type ip nft firejail || exit 2
printf '\033[31m█\033[0m IP Expose [Yes/no]: '; read -r YN; case "$YN" in [Yy]*) ;; *) exit 3 ;; esac
sysctl -q net.ipv4.ip_forward=1 net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1 || exit 4

ip netns list | grep -qw jaraw || ip netns add jaraw

ip link show raw-veth0 >/dev/null 2>&1 || {
  ip link add raw-veth0 type veth peer name raw-veth1
  ip link set raw-veth1 netns jaraw
}

ip addr replace 10.200.0.1/24 dev raw-veth0
ip link set raw-veth0 up

ip -n jaraw addr replace 10.200.0.2/24 dev raw-veth1
ip -n jaraw link set lo up; ip -n jaraw link set raw-veth1 up
ip -n jaraw route replace default via 10.200.0.1 dev raw-veth1

nft add table ip nat
nft add chain ip nat postrouting '{ type nat hook postrouting priority srcnat; policy accept; }'
nft flush chain ip nat postrouting
nft add rule ip nat postrouting ip saddr 10.200.0.0/24 masquerade

nft add table ip filter
nft add chain ip filter forward '{ type filter hook forward priority filter; policy drop; }'
nft flush chain ip filter forward
nft add rule ip filter forward ct state vmap '{ invalid : drop, established : accept }'
nft add rule ip filter forward ct state new iifname "raw-veth0" ip saddr 10.200.0.0/24 ip daddr != 10.100.0.0/24 accept

for i in all default lo raw-veth1; do ip netns exec jaraw sysctl -q net.ipv6.conf.$i.disable_ipv6=1; done
[ ! -f /etc/wireguard/vpn.conf ] || ip -n jaraw link show vpn || ip netns exec jaraw wg-quick up vpn || exit 5; [ -f /run/nojail ] && exec ip netns exec jaraw sudo -u "$SUDO_USER" -i env "XDG_RUNTIME_DIR=/run/user/$(id -u "$SUDO_USER")" "${@:-bash}"
sudo -u "$SUDO_USER" mkdir -p "/home/$SUDO_USER/.firejail/jaraw/" && exec ip netns exec jaraw sudo -u "$SUDO_USER" -i env "XDG_RUNTIME_DIR=/run/user/$(id -u "$SUDO_USER")" firejail --tab --notv --nodvd --nou2f --nodbus --noroot --noinput --nogroups --nonewprivs --noprinters --disable-mnt --caps.drop='all' --blacklist='/timeshift/' --private="/home/$SUDO_USER/.firejail/jaraw/" "${@:-bash}"

Jayator 検証:✅️

#!/bin/sh

# PROJECT: Jayator v1
# UPDATES: 2026-04-29 09:30:16 JST
# LICENSE: The Unlicense (unlicense.org)

PATH='/usr/sbin:/usr/bin:/sbin:/bin'
case "$SUDO_USER" in ''|root) exit 1 ;; esac; type ip nft tor firejail || exit 2
printf '\033[32m█\033[0m IP Hidden [Yes/no]: '; read -r YN; case "$YN" in ''|[Yy]*) ;; *) exit 3 ;; esac
sysctl -q net.ipv4.ip_forward=1 net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1 || exit 4

ip netns list | grep -qw jator || ip netns add jator

ip link show tor-veth0 >/dev/null 2>&1 || {
  ip link add tor-veth0 type veth peer name tor-veth1
  ip link set tor-veth1 netns jator
}

ip addr replace 10.100.0.1/24 dev tor-veth0
ip link set tor-veth0 up

ip -n jator addr replace 10.100.0.2/24 dev tor-veth1
ip -n jator link set lo up; ip -n jator link set tor-veth1 up
ip -n jator route replace default via 10.100.0.1 dev tor-veth1

nft add table ip nat
nft add chain ip nat prerouting '{ type nat hook prerouting priority dstnat; policy accept; }'
nft flush chain ip nat prerouting
nft add rule ip nat prerouting iifname "tor-veth0" udp dport 53 dnat to 10.100.0.1:9053
nft add rule ip nat prerouting iifname "tor-veth0" tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack dnat to 10.100.0.1:9040

nft add table ip filter
for c in input forward; do nft add chain ip filter $c "{ type filter hook $c priority filter; policy drop; }"; done
nft flush chain ip filter input
nft add rule ip filter input ct state vmap '{ invalid : drop, established : accept }'
nft add rule ip filter input ct state new iifname "tor-veth0" udp dport 9053 accept
nft add rule ip filter input ct state new iifname "tor-veth0" tcp dport 9040 tcp flags syn / fin,syn,rst,ack accept
nft add rule ip filter input ct state new iifname "tor-veth0" tcp dport 9050 tcp flags syn / fin,syn,rst,ack accept
nft add rule ip filter input iifname "lo" accept

grep -q '10.100.0.1' /etc/tor/torrc || {
  echo "DNSPort 10.100.0.1:9053"
  echo "TransPort 10.100.0.1:9040 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort"
  echo "SocksPort 10.100.0.1:9050 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort"
} >> /etc/tor/torrc; { sv restart tor || service tor restart || systemctl restart tor || rc-service tor restart; } >/dev/null 2>&1

for i in all default lo tor-veth1; do ip netns exec jator sysctl -q net.ipv6.conf.$i.disable_ipv6=1; done
[ -f /run/nojail ] && exec ip netns exec jator sudo -u "$SUDO_USER" -i env "XDG_RUNTIME_DIR=/run/user/$(id -u "$SUDO_USER")" "${@:-bash}"
sudo -u "$SUDO_USER" mkdir -p "/home/$SUDO_USER/.firejail/jator/" && exec ip netns exec jator sudo -u "$SUDO_USER" -i env "XDG_RUNTIME_DIR=/run/user/$(id -u "$SUDO_USER")" firejail --tab --notv --nodvd --nou2f --nodbus --noroot --noinput --nogroups --nonewprivs --noprinters --disable-mnt --caps.drop='all' --blacklist='/timeshift/' --private="/home/$SUDO_USER/.firejail/jator/" "${@:-bash}"
Edit

Pub: 23 Dec 2025 06:15 UTC

Edit: 30 Apr 2026 06:25 UTC

Views: 2367

Auto Theme: Dark