From 700518a0a2e0cb26cd5f4ea92140942e7a3f4cc2 Mon Sep 17 00:00:00 2001 From: Jamie Curnow Date: Thu, 9 Mar 2023 22:11:28 +1000 Subject: [PATCH] Added fail2ban, though not sure its configured correctly yet --- docker/Dockerfile | 6 + docker/dev/Dockerfile | 8 +- .../rootfs/etc/s6-overlay/s6-rc.d/backend/run | 2 + .../s6-rc.d/fail2ban/dependencies.d/prepare | 0 .../etc/s6-overlay/s6-rc.d/fail2ban/run | 5 + .../etc/s6-overlay/s6-rc.d/fail2ban/type | 1 + .../etc/s6-overlay/s6-rc.d/frontend/run | 2 + .../rootfs/etc/s6-overlay/s6-rc.d/nginx/run | 2 + .../etc/s6-overlay/s6-rc.d/prepare/script.sh | 10 + .../rootfs/etc/s6-overlay/s6-rc.d/prepare/up | 1 + .../s6-rc.d/user/contents.d/fail2ban | 0 .../rootfs/fail2ban/action.d/abuseipdb.conf | 105 +++++++ docker/rootfs/fail2ban/action.d/apf.conf | 26 ++ .../rootfs/fail2ban/action.d/apprise-api.conf | 60 ++++ docker/rootfs/fail2ban/action.d/apprise.conf | 50 ++++ .../fail2ban/action.d/blocklist_de.conf | 85 ++++++ docker/rootfs/fail2ban/action.d/bsd-ipfw.conf | 95 +++++++ .../fail2ban/action.d/cloudflare-token.conf | 93 ++++++ .../rootfs/fail2ban/action.d/cloudflare.conf | 89 ++++++ docker/rootfs/fail2ban/action.d/complain.conf | 122 ++++++++ .../fail2ban/action.d/discord-webhook.conf | 44 +++ docker/rootfs/fail2ban/action.d/dshield.conf | 208 ++++++++++++++ docker/rootfs/fail2ban/action.d/dummy.conf | 64 +++++ .../action.d/firewallcmd-allports.conf | 46 +++ .../fail2ban/action.d/firewallcmd-common.conf | 77 +++++ .../fail2ban/action.d/firewallcmd-ipset.conf | 122 ++++++++ .../action.d/firewallcmd-multiport.conf | 27 ++ .../fail2ban/action.d/firewallcmd-new.conf | 48 ++++ .../action.d/firewallcmd-rich-logging.conf | 30 ++ .../action.d/firewallcmd-rich-rules.conf | 45 +++ docker/rootfs/fail2ban/action.d/gotify.conf | 52 ++++ .../fail2ban/action.d/helpers-common.conf | 18 ++ .../rootfs/fail2ban/action.d/hostsdeny.conf | 63 +++++ docker/rootfs/fail2ban/action.d/ipfilter.conf | 59 ++++ docker/rootfs/fail2ban/action.d/ipfw.conf | 69 +++++ .../fail2ban/action.d/iptables-allports.conf | 16 ++ .../action.d/iptables-ipset-proto4.conf | 67 +++++ .../iptables-ipset-proto6-allports.conf | 28 ++ .../action.d/iptables-ipset-proto6.conf | 28 ++ .../fail2ban/action.d/iptables-ipset.conf | 91 ++++++ .../action.d/iptables-multiport-log.conf | 69 +++++ .../fail2ban/action.d/iptables-multiport.conf | 15 + .../fail2ban/action.d/iptables-new.conf | 16 ++ .../action.d/iptables-xt_recent-echo.conf | 88 ++++++ docker/rootfs/fail2ban/action.d/iptables.conf | 163 +++++++++++ docker/rootfs/fail2ban/action.d/ipthreat.conf | 108 +++++++ .../fail2ban/action.d/mail-buffered.conf | 87 ++++++ .../fail2ban/action.d/mail-whois-common.conf | 29 ++ .../fail2ban/action.d/mail-whois-lines.conf | 93 ++++++ .../rootfs/fail2ban/action.d/mail-whois.conf | 72 +++++ docker/rootfs/fail2ban/action.d/mail.conf | 66 +++++ .../fail2ban/action.d/mynetwatchman.conf | 144 ++++++++++ .../rootfs/fail2ban/action.d/netscaler.conf | 34 +++ .../fail2ban/action.d/nftables-allports.conf | 18 ++ .../fail2ban/action.d/nftables-multiport.conf | 18 ++ docker/rootfs/fail2ban/action.d/nftables.conf | 204 ++++++++++++++ .../fail2ban/action.d/nginx-block-map.conf | 118 ++++++++ docker/rootfs/fail2ban/action.d/npf.conf | 62 ++++ docker/rootfs/fail2ban/action.d/nsupdate.conf | 115 ++++++++ docker/rootfs/fail2ban/action.d/opnsense.conf | 91 ++++++ .../rootfs/fail2ban/action.d/osx-afctl.conf | 17 ++ docker/rootfs/fail2ban/action.d/osx-ipfw.conf | 88 ++++++ docker/rootfs/fail2ban/action.d/pf.conf | 125 +++++++++ docker/rootfs/fail2ban/action.d/pushover.conf | 61 ++++ docker/rootfs/fail2ban/action.d/route.conf | 30 ++ .../fail2ban/action.d/sendmail-buffered.conf | 100 +++++++ .../fail2ban/action.d/sendmail-common.conf | 78 ++++++ .../action.d/sendmail-geoip-lines.conf | 60 ++++ .../sendmail-whois-ipjailmatches.conf | 42 +++ .../action.d/sendmail-whois-ipmatches.conf | 42 +++ .../action.d/sendmail-whois-lines.conf | 53 ++++ .../action.d/sendmail-whois-matches.conf | 42 +++ .../fail2ban/action.d/sendmail-whois.conf | 41 +++ docker/rootfs/fail2ban/action.d/sendmail.conf | 38 +++ .../action.d/shorewall-ipset-proto6.conf | 94 +++++++ .../rootfs/fail2ban/action.d/shorewall.conf | 74 +++++ .../symbiosis-blacklist-allports.conf | 61 ++++ docker/rootfs/fail2ban/action.d/ufw.conf | 76 +++++ .../fail2ban/action.d/xarf-login-attack.conf | 144 ++++++++++ docker/rootfs/fail2ban/fail2ban.conf | 95 +++++++ docker/rootfs/fail2ban/filter.d/3proxy.conf | 21 ++ .../fail2ban/filter.d/airsonic-auth.conf | 17 ++ .../rootfs/fail2ban/filter.d/apache-auth.conf | 72 +++++ .../fail2ban/filter.d/apache-badbots.conf | 25 ++ .../fail2ban/filter.d/apache-botsearch.conf | 40 +++ .../fail2ban/filter.d/apache-common.conf | 45 +++ .../filter.d/apache-fakegooglebot.conf | 17 ++ .../fail2ban/filter.d/apache-modsecurity.conf | 20 ++ .../fail2ban/filter.d/apache-nohome.conf | 21 ++ .../fail2ban/filter.d/apache-noscript.conf | 38 +++ .../fail2ban/filter.d/apache-overflows.conf | 41 +++ .../rootfs/fail2ban/filter.d/apache-pass.conf | 20 ++ .../fail2ban/filter.d/apache-shellshock.conf | 29 ++ docker/rootfs/fail2ban/filter.d/assp.conf | 47 ++++ docker/rootfs/fail2ban/filter.d/asterisk.conf | 56 ++++ .../fail2ban/filter.d/authelia-auth.conf | 21 ++ .../rootfs/fail2ban/filter.d/bitwarden.conf | 14 + .../fail2ban/filter.d/botsearch-common.conf | 20 ++ docker/rootfs/fail2ban/filter.d/centreon.conf | 10 + docker/rootfs/fail2ban/filter.d/common.conf | 90 ++++++ .../fail2ban/filter.d/counter-strike.conf | 16 ++ .../fail2ban/filter.d/courier-auth.conf | 22 ++ .../fail2ban/filter.d/courier-smtp.conf | 23 ++ .../rootfs/fail2ban/filter.d/cyrus-imap.conf | 21 ++ docker/rootfs/fail2ban/filter.d/dante.conf | 17 ++ .../rootfs/fail2ban/filter.d/directadmin.conf | 23 ++ .../rootfs/fail2ban/filter.d/domino-smtp.conf | 51 ++++ docker/rootfs/fail2ban/filter.d/dovecot.conf | 51 ++++ docker/rootfs/fail2ban/filter.d/dropbear.conf | 51 ++++ .../rootfs/fail2ban/filter.d/drupal-auth.conf | 27 ++ .../fail2ban/filter.d/ejabberd-auth.conf | 41 +++ .../rootfs/fail2ban/filter.d/emby-auth.conf | 21 ++ .../rootfs/fail2ban/filter.d/exim-common.conf | 21 ++ .../rootfs/fail2ban/filter.d/exim-spam.conf | 51 ++++ docker/rootfs/fail2ban/filter.d/exim.conf | 55 ++++ .../fail2ban/filter.d/filebrowser-auth.conf | 11 + .../rootfs/fail2ban/filter.d/freeswitch.conf | 59 ++++ .../fail2ban/filter.d/froxlor-auth.conf | 41 +++ .../rootfs/fail2ban/filter.d/gitea-auth.conf | 11 + docker/rootfs/fail2ban/filter.d/gitlab.conf | 7 + docker/rootfs/fail2ban/filter.d/grafana.conf | 10 + .../rootfs/fail2ban/filter.d/groupoffice.conf | 15 + docker/rootfs/fail2ban/filter.d/gssftpd.conf | 19 ++ .../rootfs/fail2ban/filter.d/guacamole.conf | 52 ++++ .../fail2ban/filter.d/haproxy-http-auth.conf | 38 +++ .../fail2ban/filter.d/homeassistant-auth.conf | 14 + docker/rootfs/fail2ban/filter.d/horde.conf | 17 ++ docker/rootfs/fail2ban/filter.d/kerio.conf | 25 ++ .../fail2ban/filter.d/lighttpd-auth.conf | 11 + .../fail2ban/filter.d/mongodb-auth.conf | 50 ++++ docker/rootfs/fail2ban/filter.d/monit.conf | 26 ++ .../rootfs/fail2ban/filter.d/monitorix.conf | 26 ++ .../rootfs/fail2ban/filter.d/mssql-auth.conf | 16 ++ docker/rootfs/fail2ban/filter.d/murmur.conf | 35 +++ .../rootfs/fail2ban/filter.d/mysqld-auth.conf | 33 +++ docker/rootfs/fail2ban/filter.d/nagios.conf | 18 ++ .../fail2ban/filter.d/named-refused.conf | 54 ++++ .../fail2ban/filter.d/nextcloud-auth.conf | 14 + .../rootfs/fail2ban/filter.d/nginx-418.conf | 15 + .../fail2ban/filter.d/nginx-bad-request.conf | 17 ++ .../fail2ban/filter.d/nginx-botsearch.conf | 26 ++ .../rootfs/fail2ban/filter.d/nginx-deny.conf | 18 ++ .../fail2ban/filter.d/nginx-http-auth.conf | 35 +++ .../fail2ban/filter.d/nginx-limit-req.conf | 50 ++++ .../fail2ban/filter.d/nginx-unauthorized.conf | 11 + docker/rootfs/fail2ban/filter.d/nsd.conf | 32 +++ .../rootfs/fail2ban/filter.d/nzbget-auth.conf | 11 + docker/rootfs/fail2ban/filter.d/openhab.conf | 16 ++ .../rootfs/fail2ban/filter.d/openwebmail.conf | 16 ++ .../rootfs/fail2ban/filter.d/oracleims.conf | 64 +++++ .../fail2ban/filter.d/overseerr-auth.conf | 11 + .../rootfs/fail2ban/filter.d/pam-generic.conf | 34 +++ .../rootfs/fail2ban/filter.d/perdition.conf | 19 ++ .../fail2ban/filter.d/php-url-fopen.conf | 24 ++ .../fail2ban/filter.d/phpmyadmin-syslog.conf | 19 ++ .../rootfs/fail2ban/filter.d/portsentry.conf | 16 ++ docker/rootfs/fail2ban/filter.d/postfix.conf | 82 ++++++ docker/rootfs/fail2ban/filter.d/proftpd.conf | 34 +++ .../rootfs/fail2ban/filter.d/pure-ftpd.conf | 41 +++ docker/rootfs/fail2ban/filter.d/qmail.conf | 32 +++ docker/rootfs/fail2ban/filter.d/recidive.conf | 39 +++ .../fail2ban/filter.d/roundcube-auth.conf | 40 +++ .../fail2ban/filter.d/sabnzbd-auth.conf | 20 ++ docker/rootfs/fail2ban/filter.d/scanlogd.conf | 18 ++ .../fail2ban/filter.d/screensharingd.conf | 32 +++ .../fail2ban/filter.d/selinux-common.conf | 24 ++ .../rootfs/fail2ban/filter.d/selinux-ssh.conf | 28 ++ .../fail2ban/filter.d/sendmail-auth.conf | 26 ++ .../fail2ban/filter.d/sendmail-reject.conf | 69 +++++ .../fail2ban/filter.d/servarr-auth.conf | 11 + docker/rootfs/fail2ban/filter.d/sieve.conf | 19 ++ docker/rootfs/fail2ban/filter.d/slapd.conf | 26 ++ .../fail2ban/filter.d/softethervpn.conf | 10 + .../rootfs/fail2ban/filter.d/sogo-auth.conf | 23 ++ .../rootfs/fail2ban/filter.d/solid-pop3d.conf | 33 +++ docker/rootfs/fail2ban/filter.d/squid.conf | 17 ++ .../fail2ban/filter.d/squirrelmail.conf | 13 + docker/rootfs/fail2ban/filter.d/sshd.conf | 139 +++++++++ docker/rootfs/fail2ban/filter.d/stunnel.conf | 14 + docker/rootfs/fail2ban/filter.d/suhosin.conf | 29 ++ docker/rootfs/fail2ban/filter.d/tine20.conf | 25 ++ .../fail2ban/filter.d/traefik-auth.conf | 77 +++++ .../filter.d/unifi-controller-auth.conf | 11 + .../fail2ban/filter.d/unraid-webgui.conf | 11 + .../rootfs/fail2ban/filter.d/uwimap-auth.conf | 18 ++ .../fail2ban/filter.d/vaultwarden-auth.conf | 11 + docker/rootfs/fail2ban/filter.d/vsftpd.conf | 23 ++ .../rootfs/fail2ban/filter.d/webmin-auth.conf | 23 ++ docker/rootfs/fail2ban/filter.d/wuftpd.conf | 23 ++ .../rootfs/fail2ban/filter.d/xinetd-fail.conf | 30 ++ .../fail2ban/filter.d/znc-adminlog.conf | 35 +++ .../rootfs/fail2ban/filter.d/zoneminder.conf | 28 ++ docker/rootfs/fail2ban/jail.conf | 265 ++++++++++++++++++ .../rootfs/fail2ban/jail.d/airsonic-auth.conf | 9 + .../rootfs/fail2ban/jail.d/apache-auth.conf | 8 + .../fail2ban/jail.d/apache-badbots.conf | 13 + .../fail2ban/jail.d/apache-botsearch.conf | 9 + .../fail2ban/jail.d/apache-fakegooglebot.conf | 9 + .../fail2ban/jail.d/apache-modsecurity.conf | 9 + .../rootfs/fail2ban/jail.d/apache-nohome.conf | 9 + .../fail2ban/jail.d/apache-noscript.conf | 8 + .../fail2ban/jail.d/apache-overflows.conf | 9 + .../fail2ban/jail.d/apache-shellshock.conf | 9 + .../rootfs/fail2ban/jail.d/authelia-auth.conf | 9 + docker/rootfs/fail2ban/jail.d/bitwarden.conf | 8 + docker/rootfs/fail2ban/jail.d/dropbear.conf | 9 + docker/rootfs/fail2ban/jail.d/emby-auth.conf | 9 + .../fail2ban/jail.d/filebrowser-auth.conf | 14 + docker/rootfs/fail2ban/jail.d/gitea-auth.conf | 27 ++ docker/rootfs/fail2ban/jail.d/gitlab.conf | 8 + docker/rootfs/fail2ban/jail.d/grafana.conf | 8 + docker/rootfs/fail2ban/jail.d/guacamole.conf | 9 + .../fail2ban/jail.d/haproxy-http-auth.conf | 12 + .../fail2ban/jail.d/homeassistant-auth.conf | 17 ++ .../rootfs/fail2ban/jail.d/lighttpd-auth.conf | 11 + .../fail2ban/jail.d/nextcloud-auth.conf | 15 + docker/rootfs/fail2ban/jail.d/nginx-418.conf | 10 + .../fail2ban/jail.d/nginx-bad-request.conf | 8 + .../rootfs/fail2ban/jail.d/nginx-badbots.conf | 11 + .../fail2ban/jail.d/nginx-botsearch.conf | 8 + docker/rootfs/fail2ban/jail.d/nginx-deny.conf | 9 + .../fail2ban/jail.d/nginx-http-auth.conf | 13 + .../fail2ban/jail.d/nginx-limit-req.conf | 13 + .../fail2ban/jail.d/nginx-unauthorized.conf | 9 + .../rootfs/fail2ban/jail.d/nzbget-auth.conf | 9 + .../rootfs/fail2ban/jail.d/openhab-auth.conf | 9 + .../fail2ban/jail.d/overseerr-auth.conf | 12 + .../rootfs/fail2ban/jail.d/php-url-fopen.conf | 13 + .../fail2ban/jail.d/phpmyadmin-syslog.conf | 9 + .../rootfs/fail2ban/jail.d/prowlarr-auth.conf | 10 + .../rootfs/fail2ban/jail.d/radarr-auth.conf | 10 + .../rootfs/fail2ban/jail.d/sabnzbd-auth.conf | 9 + .../rootfs/fail2ban/jail.d/selinux-ssh.conf | 8 + .../rootfs/fail2ban/jail.d/sonarr-auth.conf | 10 + docker/rootfs/fail2ban/jail.d/sshd.conf | 13 + docker/rootfs/fail2ban/jail.d/suhosin.conf | 8 + .../rootfs/fail2ban/jail.d/traefik-auth.conf | 11 + .../jail.d/unifi-controller-auth.conf | 9 + .../rootfs/fail2ban/jail.d/unraid-sshd.conf | 12 + .../rootfs/fail2ban/jail.d/unraid-webgui.conf | 11 + .../fail2ban/jail.d/vaultwarden-auth.conf | 14 + .../rootfs/fail2ban/jail.d/znc-adminlog.conf | 10 + docker/rootfs/fail2ban/jail.d/zoneminder.conf | 11 + docker/rootfs/fail2ban/paths-common.conf | 113 ++++++++ docker/rootfs/fail2ban/paths-npm.conf | 12 + 245 files changed, 9172 insertions(+), 5 deletions(-) create mode 100644 docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/dependencies.d/prepare create mode 100755 docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/run create mode 100644 docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/type create mode 100644 docker/rootfs/etc/s6-overlay/s6-rc.d/user/contents.d/fail2ban create mode 100644 docker/rootfs/fail2ban/action.d/abuseipdb.conf create mode 100644 docker/rootfs/fail2ban/action.d/apf.conf create mode 100644 docker/rootfs/fail2ban/action.d/apprise-api.conf create mode 100644 docker/rootfs/fail2ban/action.d/apprise.conf create mode 100644 docker/rootfs/fail2ban/action.d/blocklist_de.conf create mode 100644 docker/rootfs/fail2ban/action.d/bsd-ipfw.conf create mode 100644 docker/rootfs/fail2ban/action.d/cloudflare-token.conf create mode 100644 docker/rootfs/fail2ban/action.d/cloudflare.conf create mode 100644 docker/rootfs/fail2ban/action.d/complain.conf create mode 100644 docker/rootfs/fail2ban/action.d/discord-webhook.conf create mode 100644 docker/rootfs/fail2ban/action.d/dshield.conf create mode 100644 docker/rootfs/fail2ban/action.d/dummy.conf create mode 100644 docker/rootfs/fail2ban/action.d/firewallcmd-allports.conf create mode 100644 docker/rootfs/fail2ban/action.d/firewallcmd-common.conf create mode 100644 docker/rootfs/fail2ban/action.d/firewallcmd-ipset.conf create mode 100644 docker/rootfs/fail2ban/action.d/firewallcmd-multiport.conf create mode 100644 docker/rootfs/fail2ban/action.d/firewallcmd-new.conf create mode 100644 docker/rootfs/fail2ban/action.d/firewallcmd-rich-logging.conf create mode 100644 docker/rootfs/fail2ban/action.d/firewallcmd-rich-rules.conf create mode 100644 docker/rootfs/fail2ban/action.d/gotify.conf create mode 100644 docker/rootfs/fail2ban/action.d/helpers-common.conf create mode 100644 docker/rootfs/fail2ban/action.d/hostsdeny.conf create mode 100644 docker/rootfs/fail2ban/action.d/ipfilter.conf create mode 100644 docker/rootfs/fail2ban/action.d/ipfw.conf create mode 100644 docker/rootfs/fail2ban/action.d/iptables-allports.conf create mode 100644 docker/rootfs/fail2ban/action.d/iptables-ipset-proto4.conf create mode 100644 docker/rootfs/fail2ban/action.d/iptables-ipset-proto6-allports.conf create mode 100644 docker/rootfs/fail2ban/action.d/iptables-ipset-proto6.conf create mode 100644 docker/rootfs/fail2ban/action.d/iptables-ipset.conf create mode 100644 docker/rootfs/fail2ban/action.d/iptables-multiport-log.conf create mode 100644 docker/rootfs/fail2ban/action.d/iptables-multiport.conf create mode 100644 docker/rootfs/fail2ban/action.d/iptables-new.conf create mode 100644 docker/rootfs/fail2ban/action.d/iptables-xt_recent-echo.conf create mode 100644 docker/rootfs/fail2ban/action.d/iptables.conf create mode 100644 docker/rootfs/fail2ban/action.d/ipthreat.conf create mode 100644 docker/rootfs/fail2ban/action.d/mail-buffered.conf create mode 100644 docker/rootfs/fail2ban/action.d/mail-whois-common.conf create mode 100644 docker/rootfs/fail2ban/action.d/mail-whois-lines.conf create mode 100644 docker/rootfs/fail2ban/action.d/mail-whois.conf create mode 100644 docker/rootfs/fail2ban/action.d/mail.conf create mode 100644 docker/rootfs/fail2ban/action.d/mynetwatchman.conf create mode 100644 docker/rootfs/fail2ban/action.d/netscaler.conf create mode 100644 docker/rootfs/fail2ban/action.d/nftables-allports.conf create mode 100644 docker/rootfs/fail2ban/action.d/nftables-multiport.conf create mode 100644 docker/rootfs/fail2ban/action.d/nftables.conf create mode 100644 docker/rootfs/fail2ban/action.d/nginx-block-map.conf create mode 100644 docker/rootfs/fail2ban/action.d/npf.conf create mode 100644 docker/rootfs/fail2ban/action.d/nsupdate.conf create mode 100644 docker/rootfs/fail2ban/action.d/opnsense.conf create mode 100644 docker/rootfs/fail2ban/action.d/osx-afctl.conf create mode 100644 docker/rootfs/fail2ban/action.d/osx-ipfw.conf create mode 100644 docker/rootfs/fail2ban/action.d/pf.conf create mode 100644 docker/rootfs/fail2ban/action.d/pushover.conf create mode 100644 docker/rootfs/fail2ban/action.d/route.conf create mode 100644 docker/rootfs/fail2ban/action.d/sendmail-buffered.conf create mode 100644 docker/rootfs/fail2ban/action.d/sendmail-common.conf create mode 100644 docker/rootfs/fail2ban/action.d/sendmail-geoip-lines.conf create mode 100644 docker/rootfs/fail2ban/action.d/sendmail-whois-ipjailmatches.conf create mode 100644 docker/rootfs/fail2ban/action.d/sendmail-whois-ipmatches.conf create mode 100644 docker/rootfs/fail2ban/action.d/sendmail-whois-lines.conf create mode 100644 docker/rootfs/fail2ban/action.d/sendmail-whois-matches.conf create mode 100644 docker/rootfs/fail2ban/action.d/sendmail-whois.conf create mode 100644 docker/rootfs/fail2ban/action.d/sendmail.conf create mode 100644 docker/rootfs/fail2ban/action.d/shorewall-ipset-proto6.conf create mode 100644 docker/rootfs/fail2ban/action.d/shorewall.conf create mode 100644 docker/rootfs/fail2ban/action.d/symbiosis-blacklist-allports.conf create mode 100644 docker/rootfs/fail2ban/action.d/ufw.conf create mode 100644 docker/rootfs/fail2ban/action.d/xarf-login-attack.conf create mode 100644 docker/rootfs/fail2ban/fail2ban.conf create mode 100644 docker/rootfs/fail2ban/filter.d/3proxy.conf create mode 100644 docker/rootfs/fail2ban/filter.d/airsonic-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/apache-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/apache-badbots.conf create mode 100644 docker/rootfs/fail2ban/filter.d/apache-botsearch.conf create mode 100644 docker/rootfs/fail2ban/filter.d/apache-common.conf create mode 100644 docker/rootfs/fail2ban/filter.d/apache-fakegooglebot.conf create mode 100644 docker/rootfs/fail2ban/filter.d/apache-modsecurity.conf create mode 100644 docker/rootfs/fail2ban/filter.d/apache-nohome.conf create mode 100644 docker/rootfs/fail2ban/filter.d/apache-noscript.conf create mode 100644 docker/rootfs/fail2ban/filter.d/apache-overflows.conf create mode 100644 docker/rootfs/fail2ban/filter.d/apache-pass.conf create mode 100644 docker/rootfs/fail2ban/filter.d/apache-shellshock.conf create mode 100644 docker/rootfs/fail2ban/filter.d/assp.conf create mode 100644 docker/rootfs/fail2ban/filter.d/asterisk.conf create mode 100644 docker/rootfs/fail2ban/filter.d/authelia-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/bitwarden.conf create mode 100644 docker/rootfs/fail2ban/filter.d/botsearch-common.conf create mode 100644 docker/rootfs/fail2ban/filter.d/centreon.conf create mode 100644 docker/rootfs/fail2ban/filter.d/common.conf create mode 100644 docker/rootfs/fail2ban/filter.d/counter-strike.conf create mode 100644 docker/rootfs/fail2ban/filter.d/courier-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/courier-smtp.conf create mode 100644 docker/rootfs/fail2ban/filter.d/cyrus-imap.conf create mode 100644 docker/rootfs/fail2ban/filter.d/dante.conf create mode 100644 docker/rootfs/fail2ban/filter.d/directadmin.conf create mode 100644 docker/rootfs/fail2ban/filter.d/domino-smtp.conf create mode 100644 docker/rootfs/fail2ban/filter.d/dovecot.conf create mode 100644 docker/rootfs/fail2ban/filter.d/dropbear.conf create mode 100644 docker/rootfs/fail2ban/filter.d/drupal-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/ejabberd-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/emby-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/exim-common.conf create mode 100644 docker/rootfs/fail2ban/filter.d/exim-spam.conf create mode 100644 docker/rootfs/fail2ban/filter.d/exim.conf create mode 100644 docker/rootfs/fail2ban/filter.d/filebrowser-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/freeswitch.conf create mode 100644 docker/rootfs/fail2ban/filter.d/froxlor-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/gitea-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/gitlab.conf create mode 100644 docker/rootfs/fail2ban/filter.d/grafana.conf create mode 100644 docker/rootfs/fail2ban/filter.d/groupoffice.conf create mode 100644 docker/rootfs/fail2ban/filter.d/gssftpd.conf create mode 100644 docker/rootfs/fail2ban/filter.d/guacamole.conf create mode 100644 docker/rootfs/fail2ban/filter.d/haproxy-http-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/homeassistant-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/horde.conf create mode 100644 docker/rootfs/fail2ban/filter.d/kerio.conf create mode 100644 docker/rootfs/fail2ban/filter.d/lighttpd-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/mongodb-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/monit.conf create mode 100644 docker/rootfs/fail2ban/filter.d/monitorix.conf create mode 100644 docker/rootfs/fail2ban/filter.d/mssql-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/murmur.conf create mode 100644 docker/rootfs/fail2ban/filter.d/mysqld-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/nagios.conf create mode 100644 docker/rootfs/fail2ban/filter.d/named-refused.conf create mode 100644 docker/rootfs/fail2ban/filter.d/nextcloud-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/nginx-418.conf create mode 100644 docker/rootfs/fail2ban/filter.d/nginx-bad-request.conf create mode 100644 docker/rootfs/fail2ban/filter.d/nginx-botsearch.conf create mode 100644 docker/rootfs/fail2ban/filter.d/nginx-deny.conf create mode 100644 docker/rootfs/fail2ban/filter.d/nginx-http-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/nginx-limit-req.conf create mode 100644 docker/rootfs/fail2ban/filter.d/nginx-unauthorized.conf create mode 100644 docker/rootfs/fail2ban/filter.d/nsd.conf create mode 100644 docker/rootfs/fail2ban/filter.d/nzbget-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/openhab.conf create mode 100644 docker/rootfs/fail2ban/filter.d/openwebmail.conf create mode 100644 docker/rootfs/fail2ban/filter.d/oracleims.conf create mode 100644 docker/rootfs/fail2ban/filter.d/overseerr-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/pam-generic.conf create mode 100644 docker/rootfs/fail2ban/filter.d/perdition.conf create mode 100644 docker/rootfs/fail2ban/filter.d/php-url-fopen.conf create mode 100644 docker/rootfs/fail2ban/filter.d/phpmyadmin-syslog.conf create mode 100644 docker/rootfs/fail2ban/filter.d/portsentry.conf create mode 100644 docker/rootfs/fail2ban/filter.d/postfix.conf create mode 100644 docker/rootfs/fail2ban/filter.d/proftpd.conf create mode 100644 docker/rootfs/fail2ban/filter.d/pure-ftpd.conf create mode 100644 docker/rootfs/fail2ban/filter.d/qmail.conf create mode 100644 docker/rootfs/fail2ban/filter.d/recidive.conf create mode 100644 docker/rootfs/fail2ban/filter.d/roundcube-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/sabnzbd-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/scanlogd.conf create mode 100644 docker/rootfs/fail2ban/filter.d/screensharingd.conf create mode 100644 docker/rootfs/fail2ban/filter.d/selinux-common.conf create mode 100644 docker/rootfs/fail2ban/filter.d/selinux-ssh.conf create mode 100644 docker/rootfs/fail2ban/filter.d/sendmail-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/sendmail-reject.conf create mode 100644 docker/rootfs/fail2ban/filter.d/servarr-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/sieve.conf create mode 100644 docker/rootfs/fail2ban/filter.d/slapd.conf create mode 100644 docker/rootfs/fail2ban/filter.d/softethervpn.conf create mode 100644 docker/rootfs/fail2ban/filter.d/sogo-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/solid-pop3d.conf create mode 100644 docker/rootfs/fail2ban/filter.d/squid.conf create mode 100644 docker/rootfs/fail2ban/filter.d/squirrelmail.conf create mode 100644 docker/rootfs/fail2ban/filter.d/sshd.conf create mode 100644 docker/rootfs/fail2ban/filter.d/stunnel.conf create mode 100644 docker/rootfs/fail2ban/filter.d/suhosin.conf create mode 100644 docker/rootfs/fail2ban/filter.d/tine20.conf create mode 100644 docker/rootfs/fail2ban/filter.d/traefik-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/unifi-controller-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/unraid-webgui.conf create mode 100644 docker/rootfs/fail2ban/filter.d/uwimap-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/vaultwarden-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/vsftpd.conf create mode 100644 docker/rootfs/fail2ban/filter.d/webmin-auth.conf create mode 100644 docker/rootfs/fail2ban/filter.d/wuftpd.conf create mode 100644 docker/rootfs/fail2ban/filter.d/xinetd-fail.conf create mode 100644 docker/rootfs/fail2ban/filter.d/znc-adminlog.conf create mode 100644 docker/rootfs/fail2ban/filter.d/zoneminder.conf create mode 100644 docker/rootfs/fail2ban/jail.conf create mode 100644 docker/rootfs/fail2ban/jail.d/airsonic-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/apache-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/apache-badbots.conf create mode 100644 docker/rootfs/fail2ban/jail.d/apache-botsearch.conf create mode 100644 docker/rootfs/fail2ban/jail.d/apache-fakegooglebot.conf create mode 100644 docker/rootfs/fail2ban/jail.d/apache-modsecurity.conf create mode 100644 docker/rootfs/fail2ban/jail.d/apache-nohome.conf create mode 100644 docker/rootfs/fail2ban/jail.d/apache-noscript.conf create mode 100644 docker/rootfs/fail2ban/jail.d/apache-overflows.conf create mode 100644 docker/rootfs/fail2ban/jail.d/apache-shellshock.conf create mode 100644 docker/rootfs/fail2ban/jail.d/authelia-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/bitwarden.conf create mode 100644 docker/rootfs/fail2ban/jail.d/dropbear.conf create mode 100644 docker/rootfs/fail2ban/jail.d/emby-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/filebrowser-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/gitea-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/gitlab.conf create mode 100644 docker/rootfs/fail2ban/jail.d/grafana.conf create mode 100644 docker/rootfs/fail2ban/jail.d/guacamole.conf create mode 100644 docker/rootfs/fail2ban/jail.d/haproxy-http-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/homeassistant-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/lighttpd-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/nextcloud-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/nginx-418.conf create mode 100644 docker/rootfs/fail2ban/jail.d/nginx-bad-request.conf create mode 100644 docker/rootfs/fail2ban/jail.d/nginx-badbots.conf create mode 100644 docker/rootfs/fail2ban/jail.d/nginx-botsearch.conf create mode 100644 docker/rootfs/fail2ban/jail.d/nginx-deny.conf create mode 100644 docker/rootfs/fail2ban/jail.d/nginx-http-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/nginx-limit-req.conf create mode 100644 docker/rootfs/fail2ban/jail.d/nginx-unauthorized.conf create mode 100644 docker/rootfs/fail2ban/jail.d/nzbget-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/openhab-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/overseerr-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/php-url-fopen.conf create mode 100644 docker/rootfs/fail2ban/jail.d/phpmyadmin-syslog.conf create mode 100644 docker/rootfs/fail2ban/jail.d/prowlarr-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/radarr-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/sabnzbd-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/selinux-ssh.conf create mode 100644 docker/rootfs/fail2ban/jail.d/sonarr-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/sshd.conf create mode 100644 docker/rootfs/fail2ban/jail.d/suhosin.conf create mode 100644 docker/rootfs/fail2ban/jail.d/traefik-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/unifi-controller-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/unraid-sshd.conf create mode 100644 docker/rootfs/fail2ban/jail.d/unraid-webgui.conf create mode 100644 docker/rootfs/fail2ban/jail.d/vaultwarden-auth.conf create mode 100644 docker/rootfs/fail2ban/jail.d/znc-adminlog.conf create mode 100644 docker/rootfs/fail2ban/jail.d/zoneminder.conf create mode 100644 docker/rootfs/fail2ban/paths-common.conf create mode 100644 docker/rootfs/fail2ban/paths-npm.conf diff --git a/docker/Dockerfile b/docker/Dockerfile index 5e21a9f..a8a08f7 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -53,6 +53,12 @@ ENV SUPPRESS_NO_CONFIG_WARNING=1 \ RUN echo "fs.file-max = 65535" > /etc/sysctl.conf +# fail2ban +RUN apt-get update \ + && apt-get install -y --no-install-recommends fail2ban \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* /etc/fail2ban + # s6 overlay COPY scripts/install-s6 /tmp/install-s6 RUN /tmp/install-s6 "${TARGETPLATFORM}" && rm -rf /tmp/* diff --git a/docker/dev/Dockerfile b/docker/dev/Dockerfile index a823e63..8065e06 100644 --- a/docker/dev/Dockerfile +++ b/docker/dev/Dockerfile @@ -22,13 +22,13 @@ ENV GOPROXY=$GOPROXY \ RUN echo "fs.file-max = 65535" > /etc/sysctl.conf -# usql and node +# usql, node, fail2ban RUN curl -fsSL https://deb.nodesource.com/setup_16.x | bash - \ && apt-get update \ - && apt-get install -y --no-install-recommends nodejs vim dnsutils \ + && apt-get install -y --no-install-recommends nodejs vim dnsutils fail2ban \ && npm install --location=global yarn \ && apt-get clean \ - && rm -rf /var/lib/apt/lists/* \ + && rm -rf /var/lib/apt/lists/* /etc/fail2ban \ && go install github.com/xo/usql@master # Task @@ -42,8 +42,6 @@ RUN rm -f /etc/nginx/conf.d/production.conf # s6 overlay COPY scripts/install-s6 /tmp/install-s6 RUN /tmp/install-s6 && rm -rf /tmp/* -#RUN curl -L -o /tmp/s6-overlay-amd64.tar.gz "https://github.com/just-containers/s6-overlay/releases/download/v1.22.1.0/s6-overlay-amd64.tar.gz" \ -# && tar -xzf /tmp/s6-overlay-amd64.tar.gz -C / # Fix for golang dev: RUN chown -R 1000:1000 /opt/go diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/backend/run b/docker/rootfs/etc/s6-overlay/s6-rc.d/backend/run index b17534f..ceebed5 100755 --- a/docker/rootfs/etc/s6-overlay/s6-rc.d/backend/run +++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/backend/run @@ -1,4 +1,6 @@ #!/command/with-contenv bash +# shellcheck shell=bash + set -e echo "❯ Starting backend ..." diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/dependencies.d/prepare b/docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/dependencies.d/prepare new file mode 100644 index 0000000..e69de29 diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/run b/docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/run new file mode 100755 index 0000000..261fea1 --- /dev/null +++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/run @@ -0,0 +1,5 @@ +#!/command/with-contenv bash +# shellcheck shell=bash + +echo "❯ Starting fail2ban ..." +exec /usr/bin/fail2ban-client -c /fail2ban -x -vv -f start diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/type b/docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/type new file mode 100644 index 0000000..5883cff --- /dev/null +++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/type @@ -0,0 +1 @@ +longrun diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/frontend/run b/docker/rootfs/etc/s6-overlay/s6-rc.d/frontend/run index 077bd4d..d2d9bb2 100755 --- a/docker/rootfs/etc/s6-overlay/s6-rc.d/frontend/run +++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/frontend/run @@ -1,4 +1,6 @@ #!/command/with-contenv bash +# shellcheck shell=bash + set -e # This service is DEVELOPMENT only. diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/nginx/run b/docker/rootfs/etc/s6-overlay/s6-rc.d/nginx/run index b49ee14..13b4839 100755 --- a/docker/rootfs/etc/s6-overlay/s6-rc.d/nginx/run +++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/nginx/run @@ -1,4 +1,6 @@ #!/command/with-contenv bash +# shellcheck shell=bash + set -e echo "❯ Starting nginx ..." diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/script.sh b/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/script.sh index be03d28..23a37d1 100755 --- a/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/script.sh +++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/script.sh @@ -1,4 +1,6 @@ #!/command/with-contenv bash +# shellcheck shell=bash + set -e DATA_PATH=/data @@ -47,6 +49,14 @@ chown -R npmuser:npmuser /var/log/nginx mkdir -p /tmp/npmuserhome chown -R npmuser:npmuser /tmp/npmuserhome +# fail2ban configuration +mkdir -p /fail2ban/{action.d,filter.d,jail.d,log} +chown -R npmuser:npmuser /fail2ban +mkdir -p /var/run/fail2ban +mkdir -p /data/logs/fail2ban +chown nobody:nogroup /data/logs/fail2ban +chmod 02755 /data/logs/fail2ban + echo echo "------------------------------------- _ _ ____ __ __ diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/up b/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/up index fd2fc5d..b58eed6 100644 --- a/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/up +++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/up @@ -1 +1,2 @@ +# shellcheck shell=bash /etc/s6-overlay/s6-rc.d/prepare/script.sh diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/user/contents.d/fail2ban b/docker/rootfs/etc/s6-overlay/s6-rc.d/user/contents.d/fail2ban new file mode 100644 index 0000000..e69de29 diff --git a/docker/rootfs/fail2ban/action.d/abuseipdb.conf b/docker/rootfs/fail2ban/action.d/abuseipdb.conf new file mode 100644 index 0000000..1702884 --- /dev/null +++ b/docker/rootfs/fail2ban/action.d/abuseipdb.conf @@ -0,0 +1,105 @@ +## Version 2022/08/06 +# Fail2ban configuration file +# +# Action to report IP address to abuseipdb.com +# You must sign up to obtain an API key from abuseipdb.com. +# +# NOTE: These reports may include sensitive Info. +# If you want cleaner reports that ensure no user data see the helper script at the below website. +# +# IMPORTANT: +# +# Reporting an IP of abuse is a serious complaint. Make sure that it is +# serious. Fail2ban developers and network owners recommend you only use this +# action for: +# * The recidive where the IP has been banned multiple times +# * Where maxretry has been set quite high, beyond the normal user typing +# password incorrectly. +# * For filters that have a low likelihood of receiving human errors +# +# This action relies on a api_key being added to the above action conf, +# and the appropriate categories set. +# +# Example, for ssh bruteforce (in section [sshd] of `jail.local`): +# action = %(known/action)s +# abuseipdb[abuseipdb_apikey="my-api-key", abuseipdb_category="18,22"] +# +# See below for categories. +# +# Added to fail2ban by Andrew James Collett (ajcollett) + +## abuseIPDB Categories, `the abuseipdb_category` MUST be set in the jail.conf action call. +# Example, for ssh bruteforce: action = %(action_abuseipdb)s[abuseipdb_category="18,22"] +# ID Title Description +# 3 Fraud Orders +# 4 DDoS Attack +# 9 Open Proxy +# 10 Web Spam +# 11 Email Spam +# 14 Port Scan +# 18 Brute-Force +# 19 Bad Web Bot +# 20 Exploited Host +# 21 Web App Attack +# 22 SSH Secure Shell (SSH) abuse. Use this category in combination with more specific categories. +# 23 IoT Targeted +# See https://abuseipdb.com/categories for more descriptions + +[Definition] + +# bypass action for restored tickets +norestored = 1 + +# Option: actionstart +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# +# ** IMPORTANT! ** +# +# By default, this posts directly to AbuseIPDB's API, unfortunately +# this results in a lot of backslashes/escapes appearing in the +# reports. This also may include info like your hostname. +# If you have your own web server with PHP available, you can +# use my (Shaun's) helper PHP script by commenting out the first #actionban +# line below, uncommenting the second one, and pointing the URL at +# wherever you install the helper script. For the PHP helper script, see +# +# +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = lgm=$(printf '%%.1000s\n...' ""); curl -sSf "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: " --data-urlencode "comment=$lgm" --data-urlencode "ip=" --data "categories=" + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = + +[Init] +# Option: abuseipdb_apikey +# Notes Your API key from abuseipdb.com +# Values: STRING Default: None +# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below. +# You will need to set the category in the action call. +abuseipdb_apikey = diff --git a/docker/rootfs/fail2ban/action.d/apf.conf b/docker/rootfs/fail2ban/action.d/apf.conf new file mode 100644 index 0000000..5ce0262 --- /dev/null +++ b/docker/rootfs/fail2ban/action.d/apf.conf @@ -0,0 +1,26 @@ +## Version 2022/08/06 +# Fail2Ban configuration file +# https://www.rfxn.com/projects/advanced-policy-firewall/ +# +# Note: APF doesn't play nicely with other actions. It has been observed to +# remove bans created by other iptables based actions. If you are going to use +# this action, use it for all of your jails. +# +# DON'T MIX APF and other IPTABLES based actions +[Definition] + +actionstart = +actionstop = +actioncheck = +actionban = apf --deny "banned by Fail2Ban " +actionunban = apf --remove + +[Init] + +# Name used in APF configuration +# +name = default + +# DEV NOTES: +# +# Author: Mark McKinstry diff --git a/docker/rootfs/fail2ban/action.d/apprise-api.conf b/docker/rootfs/fail2ban/action.d/apprise-api.conf new file mode 100644 index 0000000..767aafc --- /dev/null +++ b/docker/rootfs/fail2ban/action.d/apprise-api.conf @@ -0,0 +1,60 @@ +## Version 2022/08/06 +# Fail2Ban action configuration for apprise-api +# Author: Roxedus https://github.com/Roxedus +# Modified by: nemchik https://github.com/nemchik + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = curl -X POST -d '{"tag": "", "type": "info", "body": "The jail as been started successfully."}' \ + -H "Content-Type: application/json" \ + + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = curl -X POST -d '{"tag": "", "type": "info", "body": "The jail has been stopped."}' \ + -H "Content-Type: application/json" \ + + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# + +actionban = curl -X POST -d '{"tag": "", "type": "warning", "body": "The IP has just been banned from after attempts."}' \ + -H "Content-Type: application/json" \ + + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# + +actionunban = curl -X POST -d '{"tag": "", "type": "success", "body": "The IP has just been unbanned from ."}' \ + -H "Content-Type: application/json" \ + + +[Init] + +proto = http +host = apprise +port = 8000 +key = apprise +url = ://:/notify/ +#tag = fail2ban +tag = all diff --git a/docker/rootfs/fail2ban/action.d/apprise.conf b/docker/rootfs/fail2ban/action.d/apprise.conf new file mode 100644 index 0000000..3a6bdeb --- /dev/null +++ b/docker/rootfs/fail2ban/action.d/apprise.conf @@ -0,0 +1,50 @@ +## Version 2022/08/06 +# Fail2Ban configuration file +# +# Author: Chris Caron +# +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = printf %%b "The jail as been started successfully." | -t "[Fail2Ban] : started on `uname -n`" + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = printf %%b "The jail has been stopped." | -t "[Fail2Ban] : stopped on `uname -n`" + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = printf %%b "The IP has just been banned by Fail2Ban after attempts against " | -n "warning" -t "[Fail2Ban] : banned from `uname -n`" + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = + +[Init] + +# Define location of the default apprise configuration file to use +# +config = /etc/fail2ban/apprise.conf +# +apprise = apprise -c "" diff --git a/docker/rootfs/fail2ban/action.d/blocklist_de.conf b/docker/rootfs/fail2ban/action.d/blocklist_de.conf new file mode 100644 index 0000000..d2b0b68 --- /dev/null +++ b/docker/rootfs/fail2ban/action.d/blocklist_de.conf @@ -0,0 +1,85 @@ +## Version 2022/08/06 +# Fail2Ban configuration file +# +# Author: Steven Hiscocks +# +# + +# Action to report IP address to blocklist.de +# Blocklist.de must be signed up to at www.blocklist.de +# Once registered, one or more servers can be added. +# This action requires the server 'email address' and the associated apikey. +# +# From blocklist.de: +# www.blocklist.de is a free and voluntary service provided by a +# Fraud/Abuse-specialist, whose servers are often attacked on SSH-, +# Mail-Login-, FTP-, Webserver- and other services. +# The mission is to report all attacks to the abuse departments of the +# infected PCs/servers to ensure that the responsible provider can inform +# the customer about the infection and disable them +# +# IMPORTANT: +# +# Reporting an IP of abuse is a serious complaint. Make sure that it is +# serious. Fail2ban developers and network owners recommend you only use this +# action for: +# * The recidive where the IP has been banned multiple times +# * Where maxretry has been set quite high, beyond the normal user typing +# password incorrectly. +# * For filters that have a low likelihood of receiving human errors +# + +[Definition] + +# Option: actionstart +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = curl --fail --data-urlencode "server=" --data "apikey=" --data "service=" --data "ip=" --data-urlencode "logs=
" --data 'format=text' --user-agent "" "https://www.blocklist.de/en/httpreports.html" + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = + +# Option: email +# Notes server email address, as per blocklist.de account +# Values: STRING Default: None +# +#email = + +# Option: apikey +# Notes your user blocklist.de user account apikey +# Values: STRING Default: None +# +#apikey = + +# Option: service +# Notes service name you are reporting on, typically aligns with filter name +# see http://www.blocklist.de/en/httpreports.html for full list +# Values: STRING Default: None +# +#service = diff --git a/docker/rootfs/fail2ban/action.d/bsd-ipfw.conf b/docker/rootfs/fail2ban/action.d/bsd-ipfw.conf new file mode 100644 index 0000000..9097ed4 --- /dev/null +++ b/docker/rootfs/fail2ban/action.d/bsd-ipfw.conf @@ -0,0 +1,95 @@ +## Version 2022/08/06 +# Fail2Ban configuration file +# +# Author: Nick Munger +# Modified by: Ken Menzel +# Daniel Black (start/stop) +# Fabian Wenk (many ideas as per fail2ban users list) +# +# Ensure firewall_enable="YES" in the top of /etc/rc.conf +# + +[Definition] + +# Option: actionstart +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). +# Values: CMD +# +actionstart = ipfw show | fgrep -c -m 1 -s 'table()' > /dev/null 2>&1 || ( + num=$(ipfw show | awk 'BEGIN { b = } { if ($1 == b) { b = $1 + 1 } } END { print b }'); + ipfw -q add "$num" from table\(
\) to me ; echo "$num" > "" + ) + + +# Option: actionstop +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +# Values: CMD +# +actionstop = [ ! -f ] || ( read num < ""
ipfw -q delete $num
rm "" ) + + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +# requires an ipfw rule like "deny ip from table(1) to me" +actionban = e=`ipfw table
add 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || echo "$e" | grep -q "record already exists" || { echo "$e" 1>&2; exit $x; } + + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = e=`ipfw table
delete 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || echo "$e" | grep -q "record not found" || { echo "$e" 1>&2; exit $x; } + +[Init] +# Option: table +# Notes: The ipfw table to use. If a ipfw rule using this table already exists, +# this action will not create a ipfw rule to block it and the following +# options will have no effect. +# Values: NUM +table = 1 + +# Option: port +# Notes.: Specifies port to monitor. Blank indicate block all ports. +# Values: [ NUM | STRING ] +# +port = + +# Option: startstatefile +# Notes: A file to indicate that the table rule that was added. Ensure it is unique per table. +# Values: STRING +startstatefile = /var/run/fail2ban/ipfw-started-table_
+ +# Option: block +# Notes: This is how much to block. +# Can be "ip", "tcp", "udp" or various other options. +# Values: STRING +block = ip + +# Option: blocktype +# Notes.: How to block the traffic. Use a action from man 5 ipfw +# Common values: deny, unreach port, reset +# ACTION defination at the top of man ipfw for allowed values. +# Values: STRING +# +blocktype = unreach port + +# Option: lowest_rule_num +# Notes: When fail2ban starts with action and there is no rule for the given table yet +# then fail2ban will start looking for an empty slot starting with this rule number. +# Values: NUM +lowest_rule_num = 111 + + diff --git a/docker/rootfs/fail2ban/action.d/cloudflare-token.conf b/docker/rootfs/fail2ban/action.d/cloudflare-token.conf new file mode 100644 index 0000000..8b83abf --- /dev/null +++ b/docker/rootfs/fail2ban/action.d/cloudflare-token.conf @@ -0,0 +1,93 @@ +## Version 2022/12/15 +# +# Author: Logic-32 +# +# IMPORTANT +# +# Please set jail.local's permission to 640 because it contains your CF API token. +# +# This action depends on curl. +# +# To get your Cloudflare API token: https://developers.cloudflare.com/api/tokens/create/ +# +# Cloudflare Firewall API: https://developers.cloudflare.com/firewall/api/cf-firewall-rules/endpoints/ + +[Definition] + +# Option: actionstart +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: IP address +# number of failures +#
+_nft_get_handle_id = grep -oP '@\s+.*\s+\Khandle\s+(\d+)$' + +_nft_add_set = add set
\{ type \; \} + <_nft_for_proto--iter> + add rule
%(rule_stat)s + <_nft_for_proto--done> +_nft_del_set = { %(_nft_list)s | %(_nft_get_handle_id)s; } | while read -r hdl; do + delete rule
$hdl; done + delete set
+ +# Option: _nft_shutdown_table +# Notes.: command executed after the stop in order to delete table (it checks that no sets are available): +# Values: CMD +# +_nft_shutdown_table = { list table
| grep -qP '^\s+set\s+'; } || { + delete table
+ } + +# Option: actionstart +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). +# Values: CMD +# +actionstart = add table
+ -- add chain
\{ type hook priority \; \} + %(_nft_add_set)s + +# Option: actionflush +# Notes.: command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action); +# uses `nft flush set ...` and as fallback (e. g. unsupported) recreates the set (with references) +# Values: CMD +# +actionflush = { flush set
2> /dev/null; } || { + %(_nft_del_set)s + %(_nft_add_set)s + } + +# Option: actionstop +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +# Values: CMD +# +actionstop = %(_nft_del_set)s + <_nft_shutdown_table> + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = list chain
| grep -q '@[ \t]' + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = add element
\{ \} + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = delete element
\{ \} + +[Init] + +# Option: table +# Notes.: main table to store chain and sets (automatically created on demand) +# Values: STRING Default: f2b-table +table = f2b-table + +# Option: table_family +# Notes.: address family to work in +# Values: [ip | ip6 | inet] Default: inet +table_family = inet + +# Option: chain +# Notes.: main chain to store rules +# Values: STRING Default: f2b-chain +chain = f2b-chain + +# Option: chain_type +# Notes.: refers to the kind of chain to be created +# Values: [filter | route | nat] Default: filter +# +chain_type = filter + +# Option: chain_hook +# Notes.: refers to the kind of chain to be created +# Values: [ prerouting | input | forward | output | postrouting ] Default: input +# +chain_hook = input + +# Option: chain_priority +# Notes.: priority in the chain. +# Values: NUMBER Default: -1 +# +chain_priority = -1 + +# Option: addr_type +# Notes.: address type to work with +# Values: [ipv4_addr | ipv6_addr] Default: ipv4_addr +# +addr_type = ipv4_addr + +# Default name of the filtering set +# +name = default + +# Option: port +# Notes.: specifies port to monitor +# Values: [ NUM | STRING ] Default: +# +port = ssh + +# Option: protocol +# Notes.: internally used by config reader for interpolations. +# Values: [ tcp | udp ] Default: tcp +# +protocol = tcp + +# Option: blocktype +# Note: This is what the action does with rules. This can be any jump target +# as per the nftables man page (section 8). Common values are drop, +# reject, reject with icmpx type host-unreachable, redirect to 2222 +# Values: STRING +blocktype = reject + +# Option: nftables +# Notes.: Actual command to be executed, including common to all calls options +# Values: STRING +nftables = nft + +# Option: addr_set +# Notes.: The name of the nft set used to store banned addresses +# Values: STRING +addr_set = addr-set- + +# Option: addr_family +# Notes.: The family of the banned addresses +# Values: [ ip | ip6 ] +addr_family = ip + +[Init?family=inet6] +addr_family = ip6 +addr_type = ipv6_addr +addr_set = addr6-set- diff --git a/docker/rootfs/fail2ban/action.d/nginx-block-map.conf b/docker/rootfs/fail2ban/action.d/nginx-block-map.conf new file mode 100644 index 0000000..05e9b03 --- /dev/null +++ b/docker/rootfs/fail2ban/action.d/nginx-block-map.conf @@ -0,0 +1,118 @@ +## Version 2022/08/06 +# Fail2Ban configuration file for black-listing via nginx +# +# Author: Serg G. Brester (aka sebres) +# +# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration, +# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban). +# +# Example (argument "token_id" resp. cookie "session_id" used here as unique identifier for user): +# +# http { +# ... +# # maps to check user is blacklisted (banned in f2b): +# #map $arg_token_id $blck_lst_tok { include blacklisted-tokens.map; } +# map $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; } +# ... +# # special log-format to notify fail2ban about failures: +# log_format f2b_session_errors '$msec failure "$cookie_session_id" - $remote_addr - $remote_user ' +# ;# '"$request" $status $bytes_sent ' +# # '"$http_referer" "$http_user_agent"'; +# +# # location checking blacklisted values: +# location ... { +# # check banned sessionid: +# if ($blck_lst_ses != "") { +# try_files "" @f2b-banned; +# } +# ... +# # notify fail2ban about a failure inside nginx: +# error_page 401 = @notify-f2b; +# ... +# } +# ... +# # location for return with "403 Forbidden" if banned: +# location @f2b-banned { +# default_type text/html; +# return 403 "
+# +# You are banned!
"; +# } +# ... +# # location to notify fail2ban about a failure inside nginx: +# location @notify-f2b { +# access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors; +# } +# } +# ... +# +# Note that quote-character (and possibly other special characters) are not allowed currently as session-id. +# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service), +# like in example below: +# +# location ... { +# if ($cookie_session_id !~ "^[\w\-]+$") { +# return 403 "Wrong session-id" +# } +# ... +# } +# +# The parameters for jail corresponding log-format (f2b_session_errors): +# +# [nginx-blck-lst] +# filter = +# datepattern = ^Epoch +# failregex = ^ failure "[^"]+" - +# usedns = no +# +# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs): +# +# [nginx-blck-ip] +# maxretry = 100 +# filter = +# datepattern = ^Epoch +# failregex = ^ failure "[^"]+" - +# usedns = no +# + +[Definition] + +# path to configuration of nginx (used to target nginx-instance in multi-instance system, +# and as path for the blacklisted map): +srv_cfg_path = /etc/nginx/ + +# cmd-line arguments to supply to test/reload nginx: +#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf +srv_cmd = nginx + +# pid file (used to check nginx is running): +srv_pid = /run/nginx.pid + +# command used to check whether nginx is running and configuration is valid: +srv_is_running = [ -f "%(srv_pid)s" ] +srv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt + +# first test nginx is running and configuration is correct, hereafter send reload signal: +blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then + %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi; + fi; + +# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file="/path/file.map"]`: +blck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.map + +# Action definition: + +actionstart_on_demand = false +actionstart = touch '%(blck_lst_file)s' + +actionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s + +actionstop = %(actionflush)s + +actioncheck = + +_echo_blck_row = printf '\%%s 1;\n' "" + +actionban = %(_echo_blck_row)s >> '%(blck_lst_file)s'; %(blck_lst_reload)s + +actionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^$id$/d" %(blck_lst_file)s; %(blck_lst_reload)s diff --git a/docker/rootfs/fail2ban/action.d/npf.conf b/docker/rootfs/fail2ban/action.d/npf.conf new file mode 100644 index 0000000..fcedc12 --- /dev/null +++ b/docker/rootfs/fail2ban/action.d/npf.conf @@ -0,0 +1,62 @@ +## Version 2022/08/06 +# Fail2Ban configuration file +# +# NetBSD npf ban/unban +# +# Author: Nils Ratusznik +# Based on pf.conf action file +# + +[Definition] + +# Option: actionstart +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). +# Values: CMD +# +# we don't enable NPF automatically, as it will be enabled elsewhere +actionstart = + + +# Option: actionstop +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +# Values: CMD +# +# we don't disable NPF automatically either +actionstop = + + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: IP address +# number of failures +#